I am James Roberts, the Director of the Magee-Womens Research Institute, in Pittsburgh, Pennsylvania. Magee-Womens Research Institute is the largest research center in the country whose research efforts are directed solely to improving the health of women and their infants. We have a very large clinical research program with over 450 approved clinical research protocols. The clinical research program includes membership in several NIH networks for clinical trials. These include the Maternal-Fetal Medicine Network of the NICHD, the gynecological urological network, and the pelvic surgery network. All of these were designed by the NIH to use a large multicenter strategy to rapidly answer questions that will improve the health of women and their babies. They demand adequate enrollment for continued participation. These programs and the other clinical research projects at Magee have been devastated by the new HIPAA regulations. I thank the Society for Women's Health Research for the opportunity to address the problems associated with these regulations and their specific impact at our institution. The mission of the Society is to advocate for research to improve the health of all women.
I am certain that the authors of the HIPAA regulations had no idea of the adverse effect of these regulations could have on clinical research. In fact, I read a quote stating the authors felt the regulations would help research recruiting because subjects would be more confident that their privacy would be protected. Improved recruitment has certainly not been the result of the first six months of the HIPAA regulations. The reasons for this are fairly obvious and many were pointed out before the regulations went into effect.
One problem is the mandate that women cannot be approached about a research project without first giving written permission to a member of the clinical team providing care. This puts an additional burden on the already overtaxed care providing team whose first interest and responsibility is not research but getting there patients seen and cared for in a safe, efficient and economical manner. One solution is to hire more staff and this has been done in several centers.
Another major problem is the impact of the HIPAA regulations on retrospective chart reviews. In years past an important and economical source of information were the medical records of patients previously cared for at the institution. To acquire preliminary data, for example, about preventable risk factors for a disease, records of patients with the disease for several years would be examined and the disease and its relationship to some behavior, or metabolic or genetic factor would be examined. It was this type of information that suggested the relationship of smoking to lung cancer, estrogens to breast cancer and lipids and obesity to heart disease. If there were strong relationships, larger studies including clinical trials, would be performed to determine if modifying the risk factor prevented the disease. These chart review studies can no longer be performed without permission to review charts from all of the involved patients, even those cared for years previously, and in my state even if deceased, we must obtain permission from families. This is difficult to impossible.
The regulations are also subject to different interpretations. For example, one regulation states that “Preparatory to research… The covered entity may give a researcher access if the researcher provides assurance that: 1) Use or disclosure is solely to prepare for research 2) PHI [protected health information] may not be recorded or removed and 3) Such access must be necessary for research purposes”. This has been interpreted by some organizations as allowing prescreening to identify subjects eligible for research. Conversely, others have concluded that the prescreening can be only used for such things as to determine frequency of a disease in the hospital population. The regulations if very strictly interpreted also suggest that to acquire more complex information preparatory to research, for example, how many African Americans vs. Caucasians have the disease or how often the disease occurs at different ages, it will be necessary to have the review carried our by someone with a very good memory since, “PHI may not be recorded or removed.” Since the penalties for not complying with the HIPAA regulations are severe, fines and imprisonment, the interpretation is quite important and tends toward the conservative.
A particularly disturbing feature is the” TPO” provision that charts can be reviewed for Treatment purposes, Payment (billing) purposes and Organizational purposes without prior approval. Missing from the list is research, which has for many years had many regulations in place to protect patient privacy, and that I would contend is at least as important to the health care of our patients as billing.
What are the current approaches to work through these problems to maintain clinical research? A general approach that has the potential to solve all of these problems is a “Research Registry”. Patients are asked to be part of this registry in which they will give permission to be approached for research and to have current and prior records available for review. However, as attractive as this sounds, it has not worked well in many settings. First, the registry must be disease specific and the patient must therefore give permission for many registries. This also prevents a simple research clause in the general HIPAA information forms. Furthermore, the person approaching the potential research registrant cannot be an investigator but must be a member of the care providing team. As I pointed out, this taxes an already busy group of individuals whose primary orientation is not research. The use of care providers to get this permission only works in slow offices, especially if care providers are interested in research, or in busy setting where patients sign without reading the document. This is not an ideal solution.
Chart reviews can be carried out without permission if they are deidentified. This requires the removal of 18 items ranging from the patient’s name to dates that they were seen or born from every page of the chart. It is estimated that this will take an abstracter two and one half hours per inch of thickness of the chart. Charts, especially of patients with a long history of care or with complex diseases, can be many inches thick. Electronic records will make this deidentification faster and thus more economical. However, in our own experience, removal of dates can sometime dramatically reduce the value of the information. It is at least mandatory to put in “pseudo dates” that are separated by the appropriate durations to judge disease progression rate or recurrence rate.
An approach that is widely used around the country takes advantage of the Waiver of Authorization that can be given by the IRB. The requirements for the waiver include that “1.) research cannot be done without the waiver, and 2) risk to patient privacy is slight”. Again this is subject to interpretation. Some IRBs conclude that all IRB approved protocols meet these requirements. Others, undoubtedly influenced by the possibility of fines and imprisonment, conclude the wording is too vague to allow them to give any waivers.
How are we doing at Magee? We instituted a research registry with enrollment by the clinical care providers. In the first six months after institution of the HIPAA regulations, this did well in settings with slow practices but in our busy clinics enrollment was less than 10%. We also do not have electronic records before 1997 and records are incomplete even after 1997, thus chart review studies have almost stopped. We have been warned by the NIH that we must increase our recruiting, and our funding for our ongoing clinical research is in jeopardy.
We continue to commit an enormous amount of time and energy to “get around” the regulations legally. Our most recent strategy has been to institute IRB waivers to allow the investigative team to prescreen charts for eligibility for specific studies. If the patient is eligible a permit to be approached for the study is placed on the chart. Care providers must still get the patient to sign the waiver to be approached. However, since it will be less complex (time consuming) to obtain permission for the patient to be approached by an investigator than presenting details of the registry, we believe that we will get better participation. Once the waiver is signed the appropriate investigative team approaches the woman for entry to their study and more importantly to participate in the Research Registry. It remains to be seen if this will solve our problem. It is important to point our that we currently have our own IRB at Magee but that our IRB will likely merge with the general University of Pittsburgh IRB in the near future, The University of Pittsburgh IRB has been very reluctant to grant waivers.
In summary, if we remember the purpose of the HIPAA regulations, to protect patient privacy; and the purpose of medical research, to improve the health of our patients, it seems clear that something must be done to make the letter of the law consistent with the spirit. HIPAA was never intended to eliminate or hinder clinical research such as is performed at Magee to improve the health of women and their children. There are some obvious solutions. Most appropriate, I believe, would be the inclusion of research as part of the Treatment, Payment, Operations (TPO) exclusion, allowing research to be a designated use of medical records without prior approval. Unlike all of these other uses of patient data, research approved by IRB’s has extensive privacy regulations already in place. Failing this then perhaps the generalization of the approval for research use of medical information by patients from disease specific to all research would permit the inclusion of research in the general HIPAA approval. We must modify the HIPAA regulations to preserve clinical research for the good of our patients and improvements of their future care.