Cover Image

PAPERBACK
$28.00



View/Hide Left Panel

1
Introduction

The President’s Cancer Panel’s (the Panel) 2003 Annual Report, Living Beyond Cancer: Finding a New Balance made a number of recommendations on issues affecting cancer survivors across the life span. Among them, under the heading of HIPAA Privacy and Insurance Portability Provisions (see Box 1), were recommendation 3a, “The Institute of Medicine should be commissioned to evaluate the impact of HIPAA provisions and provide guidance to legislators on amendments needed to make this law serve the interests of cancer survivors and others” and 3b, “HIPAA privacy provisions (called the Privacy Rule) inhibiting the ability to track and collect data for research on cancer survivors should be re-evaluated” (Reuben, SH, Ed., 2004). The Panel’s 2005–2006 report, Assessing Progress, Advancing Change, called again for an evaluation of HIPAA-related barriers (Reuben, SH, Ed., 2006).

Panel member Margaret L. Kripke, PhD, Executive Vice President and Chief Academic Officer, the University of Texas M.D. Anderson Cancer Center, requested time to address the Institute of Medicine’s (IOM) National Cancer Policy Forum (the Forum) at its February 22, 2006 meeting. At that meeting, Dr. Kripke presented herself as a messenger from the President’s Cancer Panel regarding the Panel’s findings and recommendations on the impact of HIPAA on research. She referred to the Panel’s 2003 report in which the Panel found that the HIPAA Privacy Rule slowed research on cancer survivors. She also mentioned increased bureaucracy, informed consent problems, and complications for clinical trials as ways in which the



The National Academies | 500 Fifth St. N.W. | Washington, D.C. 20001
Copyright © National Academy of Sciences. All rights reserved.
Terms of Use and Privacy Statement



Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.

OCR for page 1
Effect of the Hipaa Privacy Rule on Health Research: Proceedings of a Workshop Presented to the National Cancer Policy Forum 1 Introduction The President’s Cancer Panel’s (the Panel) 2003 Annual Report, Living Beyond Cancer: Finding a New Balance made a number of recommendations on issues affecting cancer survivors across the life span. Among them, under the heading of HIPAA Privacy and Insurance Portability Provisions (see Box 1), were recommendation 3a, “The Institute of Medicine should be commissioned to evaluate the impact of HIPAA provisions and provide guidance to legislators on amendments needed to make this law serve the interests of cancer survivors and others” and 3b, “HIPAA privacy provisions (called the Privacy Rule) inhibiting the ability to track and collect data for research on cancer survivors should be re-evaluated” (Reuben, SH, Ed., 2004). The Panel’s 2005–2006 report, Assessing Progress, Advancing Change, called again for an evaluation of HIPAA-related barriers (Reuben, SH, Ed., 2006). Panel member Margaret L. Kripke, PhD, Executive Vice President and Chief Academic Officer, the University of Texas M.D. Anderson Cancer Center, requested time to address the Institute of Medicine’s (IOM) National Cancer Policy Forum (the Forum) at its February 22, 2006 meeting. At that meeting, Dr. Kripke presented herself as a messenger from the President’s Cancer Panel regarding the Panel’s findings and recommendations on the impact of HIPAA on research. She referred to the Panel’s 2003 report in which the Panel found that the HIPAA Privacy Rule slowed research on cancer survivors. She also mentioned increased bureaucracy, informed consent problems, and complications for clinical trials as ways in which the

OCR for page 1
Effect of the Hipaa Privacy Rule on Health Research: Proceedings of a Workshop Presented to the National Cancer Policy Forum Box 1 History of the Privacy Rule: The Health Insurance Portability and Accountability Act (HIPAA) of 1996 (Public Law 104-191) was enacted to improve the portability and continuity of health insurance; combat waste, fraud, and abuse in health insurance and health care delivery; promote medical savings accounts; improve access to long-term care services and coverage; and simplify the administration of health insurance. The Administrative Simplification “Standards for Privacy of Individually Identifiable Health Information” (the Privacy Rule) arise from this last objective. HIPAA’s Administrative Simplification provisions focus on facilitating the electronic exchange of information for financial and administrative functions related to patient care. However, the very advances that make it easier to transmit information also present challenges to preserving the confidentiality of potentially sensitive personal information contained in medical records. Absent further congressional action, the Secretary of Health and Human Services (HHS) was required by the law to develop standards for protecting such information. Within HHS, the Office for Civil Rights (OCR) is responsible for implementing and enforcing the Privacy Rule. The compliance date for most of those affected by the Rule was April 14, 2003. Provisions of the Privacy Rule: The Privacy Rule addresses the use and disclosure of health information contained in individual Privacy Rule affected research. The Panel continues to be concerned about these HIPAA-related barriers, she said. On behalf of the Panel, she asked that IOM conduct a study and recommend changes in HIPAA that would resolve some of these issues. She asked, “How can HIPAA be modified to address the problems for research yet retain the protections for privacy?” After a brisk discussion among the Forum members, it was decided that this was an important subject that deserved a comprehensive initial exploration with a series of invited speakers at the next meeting of the Forum on June 16, 2006. Several Forum members emphasized that such an exploration, while it should include cancer research, should not be focused exclusively on research of one particular type or involving one particular

OCR for page 1
Effect of the Hipaa Privacy Rule on Health Research: Proceedings of a Workshop Presented to the National Cancer Policy Forum health records—“protected health information” (PHI)—by organizations subject to the Privacy Rule—“covered entities.” Covered entities include health plans, health care clearinghouses, and health care providers that transmit health information electronically. All “individually identifiable health information” held or transmitted by a covered entity is protected under the Privacy Rule and considered PHI. This includes data relating to: the individual’s past, present, or future physical or mental health or condition; the provision of health care to the individual; or the past, present, or future payment for the provision of health care to the individual. Common items like name, address, birth date, and Social Security Number are included in PHI. “De-identified” health information–information that does not identify an individual or provide the means to do so—is under no disclosure restrictions. The Privacy Rule defines the circumstances under which PHI may be used or disclosed by covered entities. PHI can be used by them in the normal course of providing medical care and the necessary administrative and financial transactions. Most other uses of PHI, including under most circumstances health research, require explicit written authorization by the individual (or personal representative). SOURCE: Adapted from NIH and OCR guidances accessed August 24, 2003 at http://privacyruleandresearch.nih.gov/pr_02.asp and http://www.hhs.gov/ocr/hipaa. Also see Glossary at the end of this Proceedings. disease or condition. Forum members also agreed that any examination of the Privacy Rule should include concern for continuing and reliable privacy of protected health information as well as concern for the effective and efficient performance of health research. The Forum should hear presentations on the effect of the HIPAA Privacy Rule on health research of various kinds and on the protection of privacy of health information in various situations, although, clearly, given the request from the President’s Cancer Panel, the emphasis would be on effects on health research. These proceedings of a workshop presented to the National Cancer Policy Forum are the result of the Forum decision to examine the HIPAA Privacy Rule and its effects on health research and privacy. In preparation

OCR for page 1
Effect of the Hipaa Privacy Rule on Health Research: Proceedings of a Workshop Presented to the National Cancer Policy Forum for the June meeting, the Forum invited a group of speakers balanced among those from all sectors, private academic, advocacy, industry, and public, including those who were focused on protecting the privacy of health information, those who had participated in preparation of the Privacy Rule, those who were responsible for both funding and carrying out health research, and those who had studied the Privacy Rule and recommended changes. Also, the North American Association of Central Cancer Registries carried out a short, two-question survey of its members enquiring about HIPAA Privacy Rule generated problems in cancer registry research, and the results of this brief preliminary survey were presented to the workshop. The agenda for the workshop as it actually took place is reproduced in the appendix to these proceedings. Chapter 2 includes the presentations of the invited speakers and the comments of speakers, Forum members, and others in attendance as transcribed and edited to eliminate redundancies, grammatical errors, and otherwise make them more readable. Material from PowerPoints used by speakers to support their presentations has occasionally been added to the text to clarify the speakers’ messages as needed. This workshop consumed the major part of a regularly scheduled meeting of the National Cancer Policy Forum. The Forum was established as a unit of the IOM on May 1, 2005 with support from the federal DHHS agencies, the National Cancer Institute (NCI), the Centers for Disease Control and Prevention (CDC), the Agency for Healthcare Research and Quality (AHRQ), the Food and Drug Administration (FDA), the Centers for Medicare and Medicaid Services (CMS), and the Health Resources and Services Administration (HRSA), and the private sector organizations, the American Cancer Society (ACS), the American Society of Clinical Oncology (ASCO), C-Change, and UnitedHealth Group. The Forum was a successor to the National Cancer Policy Board (1997–2005) and was designed to provide its 22 governmental, industry, academic, and other members a venue for exchanging information and presenting individual views on emerging policy issues in the nation’s effort to combat cancer. Publication of these proceedings informs the Forum and, in addition, provides an opportunity to make the information and views presented and discussed at the workshop available to a wider public audience. Only what was actually communicated at the workshop is reported here without additional comment, interpretation, or analysis, although as a response to Dr. Kripke’s request these proceedings might serve as an opening to additional IOM study.

OCR for page 1
Effect of the Hipaa Privacy Rule on Health Research: Proceedings of a Workshop Presented to the National Cancer Policy Forum REFERENCES Reuben, SH, (Ed.) Living Beyond Cancer: Finding a New Balance, President’s Cancer Panel, 2003 Annual Report, National Cancer Institute, National Institutes of Health, May 2004. Reuben, SH, (Ed.) Assessing Progress, Advancing Change, President’s Cancer Panel, 2005–2006 Annual Report, National Cancer Institute, National Institutes of Health, June 2006.