Testimony by Martha Linet for the November 20th, 2003 NCVHS Subcommittee on Privacy and Confidentiality Hearings

American College of Epidemiology (ACE) Testimony on Impact of HIPAA on Research

November 20, 2003

Martha Linet, M.D., M.P.H., ACE President-Elect

Overview

Epidemiologic research evaluates postulated risk factors for a disease to ascertain etiology and identify preventable causes. Among the enormous contributions to public health, epidemiologic research elucidated consumption of contaminated water as the cause of cholera centuries before the discovery of the causal infectious organism, identified cigarette smoking as the major cause of lung cancer, delineated the risk factors accounting for the majority of cardiovascular diseases, and clarified the role of folic acid in the etiology of neural tube defects. Public opinion polls repeatedly showed that two-thirds of Americans favored doubling the total national spending on government-sponsored scientific research over 5 years, more than half were willing to pay $1 per week more in taxes and $1 more for each prescription drug to fund additional medical research, close to half supported increasing the percent of each health care dollar spent on medical and health research, and two-thirds indicated that preventable diseases are a major health problem on which too little is spent (http://www.researchamerica.org/).

Only six months have passed since implementation of HIPAA legislation, but the impact is already apparent in some newly launched and other ongoing epidemiological studies. Epidemiologists report mixed experiences, apparently due to highly variable interpretation of HIPAA requirements by Institutional Review Boards (IRBs) and hospitals. This document highlights several areas of epidemiologic research that have been affected, with examples provided from ongoing field research. Problems described include: 1) new restrictions on database access; 2) variable access to individual medical records; 3) increasing length and complexity of consent forms; and 4) expanded disclosure of confidential data to more entities. Senior epidemiologists from different settings provided the examples.

Problems

1. Database Access Restricted

Case-control studies provide a crucial way to find clues to disease causation. These types of studies depend on the ability to identify appropriate controls, often utilizing population-based listings. Prior to HIPAA, Medicare and Medicaid files were available (with submission of proper documentation to the Centers for Medicare and Medicaid Services (CMS, formerly HCFA)) and widely used for selection of controls. Investigators cited new restriction of access to these databases to select controls for studies initiated after HIPAA. While ongoing studies have been ‘grandfathered’ to allow access to CMS beneficiary data for selecting population controls, CMS staff cited HIPAA as the reason for withholding access to beneficiary data in some instances. As an example, two investigators submitted letters to CMS recently, both citing the ‘grandfather’ exemption for their ongoing studies; in one case the CMS representative authorized access to the beneficiary data, while in the other case a different CMS representative continues to withhold access.

2. Variable Access to Medical Records of Individual Subjects

Prior to HIPAA, investigators could generally use a simple universally accepted release form signed by subjects or proxies to request their/next of kin medical records. In recent years, epidemiologists began to experience some difficulties including problems in obtaining medical records from some smaller facilities, shorter expiration times for consent forms, and rapidly rising administrative costs for obtaining medical records to abstract. Since implementation of HIPAA, epidemiologists have described notably greater variability in access to medical records, with a substantially higher proportion of hospitals (not only smaller but also larger facilities) refusing to release records for research purposes. In addition, researchers have described increased requirements for subjects including specific designation of a long list of components of the medical record for release; absolving hospitals from liabilities, responsibilities, damages, and claims arising from release of medical record information; and recognition of a hospital’s right to deny or revoke a request for release of records for research. An investigator studying birth defects used a simple, universal medical release form that was widely accepted by all hospitals in his multi-center study prior to HIPAA. Since HIPAA, he has been required to use substantially more complicated release forms prepared by the hospital (see attachment A, before and after). The researcher notes that mothers are intimidated by the complex and legalistic language and are refusing to participate. Deviation from a universal, simple release form necessitates substantial time and effort by the research team to contact each hospital, to obtain the unique and widely differing consent forms, and to request the subject to sign the form. In the frequent instances in which subjects have been hospitalized at more than one facility, researchers need to spend substantial time explaining the difficult content of multiple varying consent forms to a subject.

3. Increasing Length and Complexity of Consent Forms

Individuals were required to sign consent forms to participate in a research study prior to HIPAA, but since implementation of HIPAA, consent forms have increased in length and complexity. Researchers are concerned that the more complex forms confuse potential participants, and that the added language may detract from the important information such as the purpose, procedures, risks and benefits of the study. An investigator has noted that providers are requesting informed consents with much more information than before including: 1) the facility's own name on the consent form; 2) a date when the authorization expires and acknowledgement of the participant's right to revoke consent; 3) witnessed consent or notarized consent forms; 4) proof of kinship or proof of power of attorney for consent forms signed by the next of kin of deceased participants; 5) date of treatment and purpose of the request; 6) a copy of the study protocol; and 7) the investigator's signature. An example of the substantially greater length and complexity of a consent form after HIPAA is shown in attachment B (see highlighted required additions).

4. Expanded Disclosure of Confidential Data to More Entities

Prior to HIPAA, access to data was restricted to researchers directly involved in the project. Since HIPAA, some IRBs have required researchers to list an expanded number of entities to which confidential data from subjects can be disclosed on the study consent form. Epidemiologists raised concern that such expanded disclosure makes potential subjects feel that their privacy is less, rather than more, protected. Additionally, this language has added to the length and complexity of consent forms. An experienced cancer epidemiologist is now required to include statements in consent forms indicating that confidential data will be/can be disclosed to the funding agency and to the Institutional Review Board of the investigator’s institution. The investigator, who is establishing a cohort of American Indian and Alaska Natives to follow up for serious disease outcomes, was previously able to reassure Native American participants that identifiable information would not be taken off the reservation. Subsequent to HIPAA, the investigator’s IRB requires a statement in the consent form indicating that subject-specific information may be required to be turned over to the agency funding the investigation.

Cross-Cutting Issues

1. Decline in Participation

Epidemiologists are extremely concerned about the effect of HIPAA on subject participation. Factors that have been identified as affecting participation or recruitment rates include: restricted access to medical records (for identification of potentially eligible study subjects, for validating medical diagnoses, or for ascertaining postulated risk factor information such as family history of specific diseases or use of particular medical treatments), increasingly complex consent forms, and concern of subjects about confidential data being disclosed to more entities. Epidemiologists have described profound adverse effects on participation rates emanating from an IRB’s or hospital’s interpretation of HIPAA requirements in each of these areas. In one example, a senior epidemiologist was conducting a study of pregnancy in which medical discharge diagnoses were first reviewed to identify potentially eligible subjects. Prior to HIPAA, the study was accruing approximately 10 subjects a week. After HIPAA, the study recruitment dropped to zero for six months. The investigator was ultimately granted a waiver by the institutional IRB and recruitment increased to pre-HIPAA levels. In a second example, a researcher examining medical expenditures has noted a decline in participation since the implementation of HIPAA. The study, which collects data from both household members and medical providers, has experienced a decline in participation by providers (who are refusing to release medical records). As a third example, an investigator conducting research on vaccine safety compared the success rate for abstracting medical record data before HIPAA (Phase 1) and after the passage of HIPAA (Phase 2). In this study, the investigator identified possible cases of a serious gastrointestinal (GI) problem using administrative claims, followed by medical record validation of occurrence of the GI disorder and vaccination status. Before HIPAA, the investigator was able to obtain 100% of medical records, whereas after the passage of HIPAA the investigator obtained 73% of records. Reasons for the decline were that the institution or provider “refused to release the chart or did not respond” (11%) or “required a site-specific IRB approval” (5 %) and informed consent (even though the study had IRB approval with a waiver of informed consent). The investigator also noted an increase in the length of time needed for abstracting medical records, in part due to a greater reluctance of providers to release medical records during Phase 2.

2. Financial and Legal Impact

Many researchers commented on the increased time and additional costs for conducting research subsequent to implementation of HIPAA. Much of this increased cost came from answering queries from institutions, collaborators, and subjects, interacting with legal staff over language in forms, designing HIPAA compliant materials, and training staff in HIPAA requirements. Epidemiologists also noted that many hospitals now view research studies not only as a financial burden, but also as activities which put the institution at a legal or regulatory risk. In fact, one investigator, who had been requesting a waiver to conduct his research, was told by several facilities that they were concerned that granting a waiver may put the hospital at increased risk of a federal audit.

Conclusion

The American College of Epidemiology will continue to request feedback from epidemiologists about their research experiences subsequent to HIPAA as compared with pre-HIPAA. As patterns emerge, the College will characterize and classify issues and problems with the goal of preparing and administering a standardized survey instrument and conducting a wide-scale survey. The College will also continue to provide feedback to the epidemiologist community, IRBs, hospitals, DHHS and others. We hope to continue to provide feedback about problems encountered, while not losing focus of subjects’ and investigators’ deep awareness of the importance of confidentiality. The College will also try to work closely with other medical research organizations to provide constructive suggestions to DHHS about possible remediation measures as we move forward in the post-HIPAA era. The key role of epidemiologic research in understanding disease causation is important ultimately because identification of etiology can lead to prevention and thus to improved health. Because epidemiologic research relies completely on in-depth study of individuals and populations, access to personal health data remains crucial.