National Academies Press: OpenBook

Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research (2009)

Chapter: 3 The Value, Importance, and Oversight of Health Research

« Previous: 2 The Value and Importance of Health Information Privacy
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 111
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 112
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 113
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 114
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 115
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 116
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 117
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 118
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 119
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 120
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 121
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 122
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 123
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 124
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 125
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 126
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 127
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 128
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 129
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 130
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 131
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 132
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 133
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 134
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 135
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 136
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 137
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 138
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 139
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 140
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 141
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 142
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 143
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 144
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 145
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 146
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 147
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 148
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 149
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 150
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 151
Suggested Citation:"3 The Value, Importance, and Oversight of Health Research." Institute of Medicine. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press. doi: 10.17226/12458.
×
Page 152

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

3 The Value, Importance, and Oversight of Health Research The previous chapter reviewed the value of privacy, while this chapter examines the value and importance of health research. As noted in the introduction to Chapter 2, the committee views privacy and health research as complementary values. Ideally, society should strive to facilitate both for the benefit of individuals as well as the public. In addition to defining health research and delineating its value to individuals and society, this chapter provides an overview and historical perspective of federal research regulations that were in place long before the Privacy Rule was implemented. Because a great deal of medical research falls under the purview of multiple federal regulations, it is important to understand how the various rules overlap or diverge. The chapter also explains how the definition of research has become quite complex under the various federal regulations, which make a distinction between research and some closely related health practice activities that also use health data, such as quality improvement initiatives. The chapter also reviews the available survey data regarding public perceptions of health research and describes the importance of effective communication about health research with patients and the public. CONCEPTS AND VALUE OF HEALTH RESEARCH Definitions Under both the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the Common Rule, “research” is defined as “a 

 BEYOND THE HIPAA PRIVACY RULE systematic investigation, including research development, testing and evalu- ation, designed to develop or contribute to generalizable knowledge.” This is a broad definition that may include biomedical research, epidemiologi- cal studies,1 and health services research,2 as well as studies of behavioral, social, and economic factors that affect health. Perhaps the most familiar form of health research is the clinical trial, in which patients volunteer to participate in studies to test the efficacy and safety of new medical interventions. But an increasingly large portion of health research is now information based. A great deal of research entails the analysis of data and biological samples that were initially collected for diagnostic, treatment, or billing purposes, or that were collected as part of other research projects, and are now being used for new research purposes. This secondary3 use of data is a common research approach in fields such as epidemiology, health services research, and public health research, and includes analysis of patterns of occurrences, determinants, and natural his- tory of disease; evaluation of health care interventions and services; drug safety surveillance; and some genetic and social studies (Lowrance, 2002; Lowrance and Collins, 2007). The Importance of Health Research Like privacy, health research has high value to society. It can provide important information about disease trends and risk factors, outcomes of treatment or public health interventions, functional abilities, patterns of care, and health care costs and use. The different approaches to research provide complementary insights. Clinical trials can provide important infor- mation about the efficacy and adverse effects of medical interventions by controlling the variables that could impact the results of the study, but feedback from real-world clinical experience is also crucial for comparing and improving the use of drugs, vaccines, medical devices, and diagnostics. For example, Food and Drug Administration (FDA) approval of a drug for a particular indication is based on a series of controlled clinical trials, often 1 Epidemiology is the study of the occurrence, distribution, and control of diseases in populations. 2 Health services research has been defined as a multidisciplinary field of inquiry, both basic and applied, that examines the use, costs, quality, accessibility, delivery, organization, financing, and outcomes of health care services to increase knowledge and understanding of the structure, processes, and effects of health services for individuals and populations (IOM, 1995). 3 The National Committee on Vital and Health Statistics has noted that “secondary uses” of health data is an ill-defined term, and urges abandoning it in favor of precise description of each use (NCVHS, 2007a). Thus, the committee chose to minimize use of the term in this report.

 HEALTH RESEARCH with a few hundred to a few thousand patients, but after approval it may be used by millions of people in many different contexts. Therefore, tracking clinical experience with the drug is important for identifying relatively rare adverse effects and for determining the effectiveness in different populations or in various circumstances. It is also vital to record and assess experience in clinical practice in order to develop guidelines for best practices and to ensure high-quality patient care. Collectively, these forms of health research have led to significant discoveries, the development of new therapies, and a remarkable improve- ment in health care and public health.4 Economists have found that medi- cal research can have an enormous impact on human health and longevity, and that the resulting increased productivity of the population contributes greatly to the national economy (Hatfield et al., 2001; Murphy and Topel, 1999) in addition to the individual benefits of improved health. If the research enterprise is impeded, or if it is less robust, important societal interests are affected. The development of Herceptin as a treatment for breast cancer is a prime example of the benefits of research using biological samples and patient records (Box 3-1) (Slamon et al., 1987). Many other examples of findings from medical records research have changed the practice of medi- cine as well. Such research underlies the estimate that tens of thousands of Americans die each year from medical errors in the hospital, and research has provided valuable information for reducing these medical errors by implementing health information technology, such as e-prescribing (Bates et al., 1998; IOM, 2000b). This type of research also has documented that disparities in health care and lack of access to care in inner cities and rural areas result in poorer health outcomes (Mick et al., 1994). Furthermore, medical records research has demonstrated that preventive services (e.g., mammography) substantially reduce mortality and morbidity at reasonable costs (Mandelblatt et al., 2003), and has established a causal link between the nursing shortage and patient health outcomes by documenting that patients in hospitals with fewer registered nurses are hospitalized longer and are more likely to suffer complications, such as urinary tract infections and upper gastrointestinal bleeding (Needleman et al., 2002). These find- ings have all informed and influenced policy decisions at the national level. As the use of electronic medical records increases, the pace of this form of research is accelerating, and the opportunities to generate new knowledge about what works in health care are expanding (CHSR, 2008). 4 See Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 59918, 59967 (preamble to rule proposed November 3, 1999) for a discussion on the benefits of health records research.

 BEYOND THE HIPAA PRIVACY RULE BOX 3-1 Examples of Important Findings from Medical Database Research Herceptin and breast cancer: Data were collected from a cohort of more than 9,000 breast cancer patients whose tumor specimens were consecutively received at the University of San Antonio (1974–1992, from across the United States). Data were collected prospectively with audits for verification, and recurrences were recorded through systematic patient follow-up. This database was analyzed to identify prognostic factors, and the results showed that amplification of the HER-2 oncogene was a significant predictor of both overall survival and time to relapse in patients with breast cancer. This information subsequently led to the development of Herceptin (trastuzumab), a targeted therapy that is effective for many women with HER-2–positive breast cancer. Folic acid and birth defects: Medical records research led to the discovery that supplementing folic acid during pregnancy can prevent neural tube birth defects (NTDs). Studies in the 1970s found that vitamin (folate) deficiency and use of anticonvulsive drugs that deplete folate were associated with higher rates of NTDs, and studies in the 1980s found that use of folate supplements was associ- ated with decreased rates. Population-based surveillance systems showed that the number of NTDs decreased 31 percent after mandatory fortification of cereal grain products. Effects of intrauterine DES exposure: Starting in the 1940s, diethylstilbestrol (DES) was used by millions of pregnant women to prevent miscarriages and other disorders in pregnancy. In the 1970s, retrospective studies of medical records began to show that infants exposed to DES during the first trimester of pregnancy had an increased risk as adults of breast, vaginal, and cervical cancer as well as reproductive anomalies. In November 1971, the FDA sent a FDA Drug Bulletin to all U.S. physicians advising them to stop prescribing DES to pregnant women and ordered that prevention of miscarriage be removed from Indications and pregnancy be added to Contraindications in the physician-prescribing information for DES. Patient safety: Health services research estimated that tens of thousands of Americans die each year from medical errors in the hospital. A 1998 study led by David Bates (Brigham & Women’s Hospital) found that computerized order entry of prescriptions at Brigham & Women’s Hospital reduced medical error rates by 55 percent; rates of serious errors fell by 86 percent. In response to this ground- breaking work, hospitals around the country are installing their own computer- ized physician order entry systems. For example, The Leapfrog Group—a large national coalition of more than 100 public and private organizations that provide health care benefits—includes computerized physician order entry as one of the safety standards it encourages hospitals to adopt.

 HEALTH RESEARCH Mortality risks of antipsychotic drugs in the elderly: In 2005, the FDA issued a public health advisory stating that the atypical (second generation) antipsychotic medications increase mortality among elderly patients. This decision was based on the results of 17 placebo-controlled trials with such drugs that enrolled a total of 5,106 elderly patients with dementia who had behavioral disorders. Fifteen of the studies showed numerical increases in mortality in the drug-treated group compared to the placebo-treated patients (approximately 1.6-1.7–fold increase in mortality), most often due to heart-related events (e.g., heart failure, sudden death) or infections (mostly pneumonia). However, the risk of death with older, conventional agents was not known. Results from two subsequent retrospective reviews of 27,000 and 37,000 medical records of elderly patients who had been treated with either conventional or atypical antipsychotic drugs indicated that conventional antipsychotic medications are at least as likely as atypical agents to increase the risk of death among those patients. As a result, the FDA now requires that the prescribing information for all antipsychotic drugs includes the same infor- mation about this risk in a boxed warning and a warnings section. Child safety: Using the Partners for Child Passenger Safety (PCPS)—an ongoing child-focused, real-time, crash surveillance system established with the State Farm Insurance Companies in 1997—Flaura Winston (Children’s Hospital of Pennsylvania) found that only 25 percent of children between 3 and 7 years of age were appropri- ately restrained in crashes; children in seat belts alone were at a 3.5-fold increased risk of serious injury. Winston’s analysis of PCPS data led to the rapid adoption of belt-positioning boosters as the appropriate form of restraint for children once they have outgrown car seats. Appropriate restraint by children in this age group has doubled, and child fatality from crashes is at its lowest level ever. Obesity: Eric Finkelstein (RTI International) used data from the late 1990s to find that obesity is responsible for up to $92.6 billion in medical expenditures each year; approximately half of obesity-related health care costs are borne by Medi- care and Medicaid. A 2002 study by Roland Sturm (RAND) found that the effects of obesity on a number of chronic conditions were larger than those of smoking or problem drinking. Since then, obesity has been escalated to the top of the list of health care priorities, and policy makers have appropriated funds for federal agencies to fund health services research that encourages people to understand the effects of diet and exercise on their health. Rural health: Stephen Mick (Virginia Commonwealth University) and colleagues examined rural hospital performance in the late 1980s and early 1990s and found that activity typical of urban hospitals is beyond the capacity of most rural facilities and recommended that a new federal approach would be required to preserve rural acute-care services. This work helped form the intellectual basis for Medi- care’s highly successful Critical Access Hospital program, which was designed to improve rural health care access and reduce closures of hospitals that provide essential community services. continued

 BEYOND THE HIPAA PRIVACY RULE BOX 3-1 Continued Workforce and health outcomes: In 1997, Jack Needleman (University of California–Los Angeles) and Peter Buerhaus (Vanderbilt University) analyzed more than 6 million patient discharge records from 799 hospitals in 11 states. They found that patients in hospitals with fewer registered nurses stay hospitalized lon- ger and are more likely to suffer complications, such as urinary tract infections and upper gastrointestinal bleeding. This research established a causal link between the nursing shortage and outcomes, and helped move the nursing shortage into the public’s eye and onto policy makers’ radar. In 2002, Congress passed the Nurse Reinvestment Act to increase the domestic supply of nurses. SOURCES: Bates et al. (1998); FDA (1971, 2005, 2008); Finkelstein et al. (2003); Gill et al. (2007); Herbst et al. (1971); IOM (2000b); Mick et al. (1994); Needleman et al. (2002); Pitkin (2007); Schneeweiss et al. (2007); Slamon et al. (1987); Thorpe et al. (2004); Veurink et al. (2005); Winston et al. (2000). Advances in health information technology are enabling a transforma- tion in health research that could facilitate studies that were not feasible in the past, and thus lead to new insights regarding health and disease. As noted by the National Committee on Vital and Health Statistics, “Clinically rich information is now more readily available, in a more structured format, and able to be electronically exchanged throughout the health and health care continuum. As a result, the information can be better used for quality improvement, public health, and research, and can significantly contribute to improvements in health and health care for individuals and populations” (NCVHS, 2007a). The informatics grid recently developed with support from the National Cancer Institute (Cancer Biomedical Informatics Grid, or caBIG) is an example of a how information technologies can facilitate health research by enabling broader sharing of health data while still ensur- ing regulatory compliance and protecting patient privacy (Box 3-2). Science today is also changing rapidly and becoming more complex, so no single researcher or single site can bring all the expertise to develop and validate medical innovations or to ensure their safety. Thus, efficient shar- ing of information between institutions has become even more important than in previous eras, when there were fewer new therapies introduced. The expansion of treatment options, as well as the escalating expense of new therapies, mandates greater scrutiny of true effectiveness,5 once efficacy 5 Effectiveness can be defined as the extent to which a specific test or intervention, when used under ordinary circumstances, does what it is intended to do. Efficacy refers to the extent to which a specific test or intervention produces a beneficial result under ideal conditions (e.g., in a clinical trial).

 HEALTH RESEARCH BOX 3-2 caBIG (Cancer Biomedical Informatics Grid) The National Cancer Institute’s caBIG Data Sharing and Intellectual Capital Workspace’s mission is to enable all constituencies in the cancer community— including researchers, physicians, and patients—to share data and knowledge through an informatics grid “by addressing the legal, regulatory, ethical, policy, academic, proprietary, and contractual barriers.” The caBIG strives to achieve this objective through a number of different initiatives. First, caBIG provides decision support tools for institutions that share data through the informatics grid. This analytic framework is intended to encour- age institutions to make consistent analysis of legal, regulatory, and ethical con- straints on data sharing. The program has identified four sets of considerations for institutions to analyze: (1) intellectual property considerations, (2) privacy and confidentiality considerations, (3) IRB and ethical considerations, and (4) sponsor considerations. Second, caBIG has identified a number of best practices and processes for facilitating the approval of data sharing agreements via the caBIG infrastructure. Currently identified best practices include suggestions for conducting the patient informed consent process in a manner that permits data to be shared via caBIG, standardizing expectations for sharing unpublished data, creating recommenda- tions for developing contract clauses for sponsored research projects that permit broad data sharing, and providing information documents for IRBs and Privacy Boards to use in reviewing proposals for data sharing via caBIG. Third, caBIG has created model documents intended to facilitate and expe- dite the arrangements between institutions to share data. These include model informed consent provisions, model researcher questionnaires and data shar- ing checklists, and security-related agreements. Finally, caBIG has developed security policies and requirements for systems that are attached to or access the caBIG infrastructure. Under caBIG, each institution retains legal responsibility for the research data it generates; this includes responsibility for complying with the HIPAA Privacy Rule, the Common Rule, as well as any applicable state laws. The institutions also retain the right to determine who they will share their data with, what type of data (deidentified versus identifiable) they will share and under what terms and conditions. The advantage to conducting research within the caBIG technical infrastructure is that the program has identified the common legal and ethical considerations that apply to all researchers across the country, and has simplified the process for sharing data. In addition, the caBIG infrastructure has increased institutions’ trust in one another because “everyone is playing by the same rules” and a common set of expectations exist. Recently, the BIG Health Consortium was developed to extend the concept of caBIG beyond cancer research, and to link all stakeholders in biomedicine through a new biomedical configuration. SOURCES: Big Health (2008); NCI (2008); NCVHS (2007b).

 BEYOND THE HIPAA PRIVACY RULE has been demonstrated. This requires registries of patient characteristics, outcomes, and adverse events. Large populations are required to facili- tate comparison of patient populations and to calculate risk/benefit esti- mates. For example, INTERMACS6 (Interagency Registry for Mechanically Assisted Circulatory Support) is a national registry for patients who are receiving mechanical circulatory support device therapy to treat advanced heart failure. This registry was devised as a joint effort of the National Heart, Lung and Blood Institute, Centers for Medicare & Medicaid Ser- vices, FDA, clinicians, scientists and industry representatives. Analysis of the data collected is expected to facilitate improved patient evaluation and management while aiding in better device development. Registry results are also expected to influence future research and facilitate appropriate regula- tion and reimbursement of such devices. Similarly, the Extracorporeal Life Support Organization (ELSO),7 an international consortium of health care professionals and scientists who focus on the development and evaluation of novel therapies for support of failing organ systems, maintains a registry of extracorporeal membrane oxygenation and other novel forms of organ system support. Registry data are used to support clinical practice and research, as well as regulatory agencies. Another example is the database developed by the United Network for Organ Sharing (UNOS) for the col- lection, storage, analysis and publication of data pertaining to the patient waiting list, organ matching, and transplants.8 Launched in 1999, this secure Internet-based system contains data regarding every organ donation and transplant event occurring in the United States since 1986. Information-based research, such as research using health information databases has many advantages (reviewed by Lowrance, 2002). It is often faster and less expensive than experimental studies; it can analyze very large sets of data and may detect unexpected phenomena or differences among subpopulations that might not be included in a controlled experimental study; it can often be undertaken when controlled trials are simply not possible for ethical, technical, or other reasons, and it can be used to study effectiveness of a specific test or intervention in clinical practice, rather than just the efficacy as determined by a controlled experimental study. It can also reexamine data accrued in other research studies, such as clinical trials, to answer new questions quickly and inexpensively. However, information- based research does have limitations. Often it has less statistical rigor than controlled clinical studies because it lacks scientific control over the original data collection, quality, and format that prospective experimental research can dictate from the start. In addition to these scientific limitations, because 6 See http://www.intermacs.org. 7 See http://www.elso.med.umich.edu. 8 See http://www.unos.org/Data.

 HEALTH RESEARCH of its relational and often distant physical separation from the data subjects, and the sheer volume of the records involved, obtaining individual consent for the research can be difficult or impossible. Advances in information-based medical research could also facilitate the movement toward personalized medicine, which will make health research more meaningful to individuals. The goal of personalized medicine is to tailor prevention strategies and treatments to each individual based on his/her genetic composition and health history. In spite of the strides made in improving health through new treatments, it is widely known that most drugs are effective in only a fraction of patients who have the condition for which the drug is indicated. Moreover, a small percentage of patients are likely to have adverse reactions to drugs that are found to be safe for the majority of the population at the recommended dose. Both of these phenomena are due to variability in the patient population. Revolutionary advances in the study of genetics and other markers of health and disease are now making it possible to identify and study these variations, and are leading to more personalized approaches to health care—that is, the ability to give “the appropriate drug, at the appropriate dose, to the appropri- ate patient, at the appropriate time.” Achieving the goals of personalized medicine will lead to improvements in both the effectiveness and the safety of medical therapies. Public Perceptions of Health Research A number of studies have been undertaken to gauge the public’s atti- tude toward research and the factors that influence individuals’ willingness to participate in research. The surveys reviewed in this chapter focus on interventional clinical trials. A review of survey questions to gauge the public willingness to allow their medical records to be used in research can be found in Chapter 2. The Public Values Health Research A number of studies suggest that most Americans have a positive view of medical research and believe that research is beneficial to society. A recent Harris poll found that nearly 80 percent of respondents were inter- ested in health research findings, consistent with previous survey results (Westin, 2007). A study in 2005 compiled data from 70 state surveys and 18 national surveys and found that the majority of Americans believe main- taining world leadership in health-related research is important. Seventy- eight percent of respondents said that it is very important, and 17 percent said that it is somewhat important. Only 4 percent of Americans reported that maintaining world leadership in health-related research is not impor-

0 BEYOND THE HIPAA PRIVACY RULE tant (Woolley and Propst, 2005). Similar results were found in a 2007 survey—76 percent of respondents reported that science plays a very impor- tant role in our health, and 78 percent reported that science plays a very important role in our competitiveness (Research!America, 2007). The Virginia Commonwealth University 2004 Life Sciences Survey also found that most Americans have a positive view of research. In this study, 90 percent of respondents agreed that developments in science have made society better; 92 percent reported that “scientific research is essential for improving the quality of human lives”; and 84 percent agreed that “the benefits of scientific research outweigh the harmful results” (NSF, 2006). Overall Experience When Participating in Research Little is known about the attitudes of individuals who have actually participated in medical research. However, the available evidence suggests that most research participants have positive experiences. A recent Harris Poll found that 13 percent of respondents had participated in some form of health research, and 87 percent of those felt comfortable about their experience (Westin, 2007). In a study focused on cancer, 93 percent of respondents who participated in research reported it as a very positive expe- rience; 76 percent said they would recommend participation in a clinical trial to someone with cancer. Most physicians surveyed in this study stated that they believe clinical trial participants receive the best possible care, and have outcomes at least as good as patients receiving standard cancer treatment (Comis et al., 2000). Another study found that 55 percent of indi- viduals who participated in a research study would be willing to participate again in a future research study (Trauth et al., 2000). Willingness to Participate in Research Public opinion surveys indicate that a majority of Americans are willing to participate in clinical research studies. In 2001, a compilation of studies commissioned by Research!America found that 63 percent of Americans would be willing to participate in a clinical research study (Woolley and Propst, 2005). This percentage has remained stable over time. A 2007 Research!America survey also found that 63 percent of Americans would be very likely to participate in a clinical research study if asked (Research!America, 2007); 68 percent of respondents reported that their desire to improve their own health or the health of others was a major factor in deciding whether to participate in a clinical research project (Research!America, 2007). Other surveys also suggest that willingness to participate in research focused on specific diseases is quite high. In one survey, the percentage of

 HEALTH RESEARCH respondents indicating a willingness to participate in a medical research study was 88 percent for cancer, 86 percent for heart disease, 83 percent for a noncurable fatal disease, 79 percent for addiction, 78 percent for depres- sion, and 76 percent for schizophrenia (Trauth et al., 2000). Respondents with greater knowledge of how research is conducted were more willing to participate (Trauth et al., 2000). Another study found that 8 of 10 Ameri- cans would consider participating in a clinical trial if faced with cancer. More than two-thirds of respondents said they would be willing to partici- pate in a clinical trial designed to prevent cancer (Comis et al., 2000). Americans also seem to be very supportive of medical research that relies on genetic data. A 2007 survey found that 93 percent of Americans supported the use of genetic testing if the information collected is used by researchers to find new ways to diagnose, prevent, or treat disease (Genetics & Public Policy Center, 2007). Two separate surveys found that 66 percent of Americans would be willing to donate their genetic material for medical research (Genetics & Public Policy Center, 2007; Research!America, 2007). However, despite this apparent positive view of genetic research, 92 percent of Americans reported they were concerned about their genetic information being used in a “harmful way” (Genetics & Public Policy Center, 2007). Many factors, in addition to concerns about privacy and confidential- ity (Genetics & Public Policy Center, 2007; Research!America, 2007), may influence an individual’s willingness to participate in a medical research study. The Trauth survey found that individuals with higher income levels, with a college or graduate degree, or with children were more likely to participate in research. Age affected willingness to participate: 57 percent of respondents ages 18–34 were willing to participate in research, but only 31 percent of respondents ages 65 or older were willing (Trauth et al., 2000). Other factors that potentially influence an individual’s willingness to participate in research are race and ethnicity. It is well documented that minorities participate in health research at a much lower percentage than white Americans. Many cultural, linguistic, and socioeconomic barriers could be responsible for this difference (Giuliano et al., 2000), and study results have been variable on this issue. Several studies suggest that the low participation rates by racial and ethnic minority groups are due to their strong distrust of the medical research community compared to the general population (Braunstein et al., 2008; Corbie-Smith et al., 1999; Farmer et al., 2007; Grady et al., 2006; Shavers et al., 2002). However, other evidence suggests that the low percentage of minorities participating in research is related to minority groups’ lack of access to the research community (Brown et al., 2000; Wendler et al., 2006; Williams and Corbie-Smith, 2006). Thus, it is likely that the low number of minority individuals participating in medical research is at least partly due to recruit- ment techniques that are ineffective for minority populations.

 BEYOND THE HIPAA PRIVACY RULE The survey that focused on cancer research suggests that one of the main reasons why individuals do not participate in research is lack of knowledge about the availability of clinical trials. In a survey of nearly 6,000 cancer patients, 85 percent said they were unaware of the opportu- nity to participate in a clinical trial. Respondents who did participate said they did so because of one of the following beliefs: (1) trials provide access to the best quality of care (76 percent), (2) their participation would benefit future cancer patients (72 percent), (3) they would receive newer and better treatment (63 percent), and (4) participation would get them more care and attention (40 percent) (Comis et al., 2000). A recommendation from a physician can also impact participation. In the United States, 48 percent of respondents to one survey reported that a physicians’ recommendation would be a major factor in deciding whether to take part in a research study. Nearly three-fourths of respondents also cited an institution’s reputation as a key factor to consider when deciding whether to participate in a study (Research!America, 2007). Twenty percent of respondents in an Italian public survey indicated that the presence of a physician as a reference during a research study influenced their willingness to participate (Mosconi et al., 2005). In sum, surveys indicate that the vast majority of Americans have a positive view of medical research, believe that research is beneficial to soci- ety, and are interested in health research findings. Although little is known about the attitudes of individuals who have actually participated in medical research, the available evidence suggests that most research participants have positive experiences. Surveys also suggest that a majority of Americans are willing to participate in clinical research studies. Similar to the findings in Chapter 2, surveys indicate that many factors, in addition to concerns about privacy and confidentiality, can potentially influence an individual’s willingness to participate in medical research, including the type of research and personal characteristics such as health status, age, education, and race. Notably, respondents with greater knowledge of how research is conducted were more willing to participate in research. OVERSIGHT OF HEALTH RESEARCH Historical Development of Federal Protections of Health Information in Research The development of international codes, federal legislation, and federal regulation of human subjects often occurred in response to past abuses in biomedical experiments (reviewed by Pritts, 2008) (Box 3-3). The most well-known examples included (1) reported abuses of concentration camp prisoners in Nazi experiments during World War II, and (2) the Tuskegee

 HEALTH RESEARCH syphilis study begun in 1932, in which researchers withheld effective treat- ment from affected African American men long after a cure for syphilis was found. Most of the current principles and standards for conducting human subjects research were developed primarily to protect against the physical and mental harms that can result from these types of biomedical experi- ments. Therefore, they focus on the principles of autonomy and consent. Although the standards apply to research that uses identifiable health infor- mation, research based solely on information is not their primary focus. In the United States, perhaps the most influential inquiry into the pro- tection of human subjects in research was the Belmont Report. The Belmont principles have been elaborated on in many settings, and served as the basis for formal regulation of human subjects research in the United States. In general, states do not directly regulate the activity of most researchers (Burris et al., 2003). However, the Belmont Commission’s recommendations were reflected in the Department of Health and Human Services’ (HHS’s) Policy for Protection of Human Subjects Research, Subpart A of 45 C.F.R. 46 (“Subpart A”) in 1979.9 These protections were considered a bench- mark policy for federal agencies, and in December 1981, the President’s Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research recommended10 that all federal departments and agencies adopt the HHS regulations.11 In 1982, the President’s Office of Science and Technology Policy appointed a Committee for the Protection of Human Research Subjects to respond to the recommendations of the President’s commission. The committee agreed that uniformity of federal regulations on human subjects protection is desirable to eliminate unnecessary regulations and to promote increased understanding by institutions that conduct federally supported or regulated research. As a result, in 1991, other federal departments and agencies joined HHS in adopting a uniform set of rules for the protection of human subjects of research, identical to Subpart A of 45 C.F.R. 46, which is now informally known as the “Common Rule.” Eighteen federal agencies have now adopted the Common Rule as their own respective regulations. Overview of the Common Rule The Common Rule governs most federally funded research conducted on human beings and aims to ensure that the rights of human subjects 9 The Department of Health, Education and Welfare (now HHS) had previously issued policy and guidance on the protection of human subjects. See Williams (2005). 10 In its report “First Biennial Report on the Adequacy and Uniformity of Federal Rules and Policies, and their Implementation, for the Protection of Human Subjects in Biomedical and Behavioral Research, Protecting Human Subjects.” 11 45 C.F.R. part 46 (2005).

 BEYOND THE HIPAA PRIVACY RULE BOX 3-3 The Basis for Human Subjects Protections in Biomedical Research Nuremberg Code The Nuremberg Code, created by the international community after the Nazi War Crimes Trials, is generally seen as the first codification of ethical norms governing experimentation on humans. Although it did not carry the force of law, the Nuremberg Code was the first international document to advocate voluntary participation and informed consent, which is partially based on autonomy. The Code established a set of ethical standards for physical experiments on humans emphasizing the following principles: • The need to obtain the informed consent of the research subject; • The duty to avoid all unnecessary physical and mental suffering and injury; and • The requirement that any and all risks associated with the research must be outweighed by associated benefits. Declaration of Helsinki In 1964, The World Medical Association adopted the “Ethical Principles for Medical Research Involving Human Subjects,” also known as the “Declaration of Helsinki,” noting that all “[m]edical research is subject to ethical standards that promote respect for all human beings and protect their health and rights.” The Declaration, which sets forth ethical principles to provide guidance to investiga- tors and participants in human subjects research, made expressly clear that ethical standards on medical research encompass the protection of research on identifiable human material or identifiable data. The Declaration reiterated the principles of informed consent found in the Nuremberg Code and amplified them by, among other things, requiring that all experimental research be reviewed by an independent body. The principles are based on the general concept that it is the duty of medical researchers “to protect the life, health, privacy, and dignity of the human subject.” The principles also require that “[e]very precaution [is made] . . . to respect the privacy of the subject, the confidentiality of the patient’s information and to minimize the impact of the study on the subject’s physical and mental integrity and on the personality of the subject.” Thus, the Helsinki Declara- tion promotes the concepts of respect, autonomy, privacy, and confidentiality. are protected during the course of a research project. The Common Rule stresses the importance of individual autonomy and consent; requires inde- pendent review of research by an Institutional Review Board (IRB); and seeks to minimize physical and mental harm. Privacy and confidentiality

 HEALTH RESEARCH Belmont Report In 1979, the National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research, created largely in response to the ethical breaches of the Tuskegee Syphilis Study, issued the “Belmont Report” to guide the resolution of ethical problems arising from research involving human subjects. The report first distinguished between practice (interventions designed solely to enhance the well-being of a patient) and research (activities intended to test a hypothesis and gain generalizable knowledge) and concluded that when elements of research are present in an activity, that activity should undergo review for the protection of human subjects. The Commission then identified and defined three overarching principles applicable to research involving human subjects: respect for persons, beneficence, and justice. Two of these principles, respect for persons and beneficence, are particularly relevant to privacy. The principle of respect for persons encompasses the requirement to treat competent adults as autonomous individuals capable of making their own choices. In application, this requires that subjects, to the degree that they are capable, be given the opportunity to choose what will or will not happen to them. Informed consent is closely tied to the princi- ple of respect for persons because it provides information about potential benefits and risks, including how personal data will be protected, and requires comprehen- sion of those risks and voluntariness to participate. The principle of respect for persons also seeks to protect persons with diminished autonomy, such as children and persons with serious mental disabilities. The principle of beneficence consists of the obligations to not harm the subject and to maximize possible benefits and minimize possible harms. Such an assessment should consider not only physical and psychological harms, but also social and economic harms, including breach of privacy. These harms are to be weighed against the anticipated benefit to the subject (if any) and the anticipated benefit to society. Although not as salient to questions of privacy and research, the third Belmont principle of justice is also worth emphasizing. Justice requires that the benefits and burdens of human subjects research be fairly allocated. It therefore protects the least advantaged in society. SOURCES: Furrow et al. (2004); HEW (1979); Pritts (2008); Williams (2005); WMA (1964). protections, although not defined in a detailed and prescriptive manner, are included as important components of risk in research. The framework for achieving the goal of protecting human subjects is based on two foundational requirements: the informed consent of the

 BEYOND THE HIPAA PRIVACY RULE research participant and the review of proposed research by an IRB. This section describes some of the basic parameters of the Common Rule (reviewed by Pritts, 2008). Particular provisions that interact with the HIPAA Privacy Rule are described in more detail in Chapter 4. Scope of the Common Rule In general, the Common Rule applies only to research on human subjects that is supported by the federal government.12 As noted previ- ously, research is defined as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.”13 Under the Common Rule, a “human subject” is defined as “a living individual about whom an investigator . . . conducting research obtains (1) Data through intervention or interaction with the individual, or (2) Identifi- able private information.” Private information is considered to be personally identifiable if the identity of the subject is or may readily be ascertained by the investigator or associated with the information. The Common Rule applies to most human subjects research conducted using federal funds, but its influence is broader because most institutions that accept federal funds sign an agreement (a Federalwide Assurance or FWA) with HHS to abide by the Common Rule requirements in all research, regardless of funding source. Nonetheless, some privately funded human subjects research is conducted outside the purview of federal regu- lation (Goldman and Choy, 2001; Williams, 2005). Companies and other organizations may voluntarily choose to apply the Common Rule to their research projects, and many do. However, research projects in which com- pliance is voluntary are not subject to oversight or disciplinary action by HHS (Goldman and Choy, 2001; Williams, 2005). Informed Consent14 The Common Rule requires that a researcher obtain informed consent (usually in writing) from a person before he/she can be admitted to a study (Williams, 2005). Informed consent is sought through a process in which a person learns key facts about a research study, including the potential risks and benefits, so that he/she can then agree voluntarily to take part or decide against it. 12 See 45 C.F.R. § 46.101 (2005). 13 See 45 C.F.R. § 46.102(d) (2005). 14 This section on informed consent is based largely on a Congressional Research Service report (Williams, 2005), as adapted by Pritts (2008).

 HEALTH RESEARCH The Common Rule informed consent regulations focus primarily on the elements and documentation of informed consent rather than on the process used to obtain it. As to the process, the regulations require that informed consent be sought only under circumstances that provide the prospective subject with adequate opportunity to consider whether to participate. The Common Rule requires that information pertaining to informed consent be given in language understandable to the subject, and that the consent does not imply that the subject is giving up his/her legal rights or that the investigator is released from liability for negligence during the conduct of the study.15 The Common Rule also specifies a number of elements that must be provided when informed consent is sought. These elements include: • an explanation of the purposes of the research, • the expected duration of the subject’s participation, • the potential risks and benefits of the research, • how confidentiality will be maintained, • the fact that participation is strictly voluntary, and • who the subject can contact to answer questions about the study or about his/her rights as a research participant. In certain limited circumstances, the Common Rule allows an informed consent to be for unspecified future research. For example, under the Com- mon Rule an informed consent can be used to obtain a person’s permission to study personally identifiable information maintained in a repository for future, unspecified research purposes (HHS, 2003). For the most part, the required elements of an informed consent address all types of research, although some are more relevant to bio- medical research (e.g., the consent must include a disclosure of appropri- ate alternative procedures or courses of treatment, if any, that might be advantageous to the subject). One required element of informed consent is particularly relevant to research involving personally identifiable health information. The Common Rule requires an informed consent to include a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.16 Institutional Review Boards Adopting the principles of the Belmont Report, the Common Rule requires that protocols for human subjects research be reviewed by an IRB 15 See 45 C.F.R. § 46.116 (2005). 16 See 45 C.F.R. § 46.116(b) (2005).

 BEYOND THE HIPAA PRIVACY RULE (Box 3-4) before research may begin.17 The IRB must meet certain member- ship requirements, including having members with different expertise and at least one member who is not affiliated with the investigator’s institution. The Common Rule specifies which level of IRB review is needed for vari- ous types of research and provides criteria for the IRB to consider during the review. Although the Common Rule does not specify the procedures an IRB must follow in its review of protocols, it does require the IRB to have written procedures for how it will review protocols and document IRB decisions. The Common Rule requires that an IRB determine the following factors are satisfied to approve proposed research: • Risks to subjects are minimized; • Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result; • The selection of subjects is equitable; • Informed consent will be sought in accordance with the rules and will be documented; • When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects; and • When appropriate, adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data.18 An IRB may waive the requirement to obtain informed consent or approve an alteration of the consent form for some minimal risk research. The IRB may also waive the requirement for signed consent in certain circumstances.19 Anonymized Data As noted above, the Common Rule considers use of “private identifi- able information” to be human subjects research. Data are considered personally identifiable if the identity of the subject is or may be readily ascertained by the investigator or associated with the information accessed by the researcher.20 However, the Common Rule exempts from its require- ments research that involves: 17 See45 C.F.R. § 46.103 (2005). 18 See45 C.F.R. § 46.111 (2005). There are additional factors if the study includes subjects who are likely to be vulnerable to coercion or undue influence. 19 See 45 C.F.R. § 46.116(d); 46.117(c) (2005). 20 See 45 C.F.R. § 46.102(f) (2005).

 HEALTH RESEARCH BOX 3-4 Institutional Review Boards According to the Department of Health and Human Services (HHS) Institutional Review Board (IRB) guidebook, “the IRB is an administrative body established to protect the rights and welfare of human research subjects recruited to participate in research activities conducted under the auspices of the institution with which it is affiliated. The IRB has the authority to approve, require modifications in, or disapprove all research activities that fall within its jurisdiction as specified by both the federal regulations and local institutional policy.” Therefore, IRBs have enormous responsibility in determining whether health research projects are planned and orchestrated in a way that minimizes or elimi- nates the potential risk to human research participants, including direct physical harms as well as nonphysical harms such as breach of privacy. An IRB must be made up of at least five members with varying backgrounds who are sufficiently qualified through experience and expertise, and the diversity of the members must be sufficient to analyze the proposed research project. The IRB cannot consist entirely of members from one profession. At least one member must be unaffiliated with the institution conducting the research, and must not be part of the immediate family of someone affiliated with the institution. Members cannot have conflicts of interest with regard to the proposed research project. Also, there must be one member whose primary concerns are scientific, and one member whose primary concerns are nonscientific on each IRB. SOURCE: OHRP (2008a). [T]he collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.21 Otherwise identifiable data may be deidentified or “anonymized” for purposes of the Common Rule if it is coded and certain other conditions are met (HHS, 2004). Under Guidance issued by the Office for Human Research Protection, information is “coded” if identifying information (such as name or Social Security number) that would enable the investiga- tor to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (the code), and a key to decipher the code 21 See 45 C.F.R. § 46.101(b)(4) (2005).

0 BEYOND THE HIPAA PRIVACY RULE exists, enabling linkage of the identifying information to the private infor- mation or specimen. Research involving only coded private information or specimens is not considered to involve human subjects under the Common Rule if the follow- ing conditions are met: • The private information or specimens were not collected specifi- cally for the currently proposed research project through an inter- action or intervention with living individuals; and • The investigator(s) cannot readily ascertain the identify of the individual(s) to whom the coded private information or specimens pertain because, for example: — The key to decipher the code is destroyed before the research begins; — The investigators and the holder of the key enter into an agree- ment prohibiting the release of the key to the investigators under any circumstances, until the individuals are deceased; — IRB-approved written policies and operating procedures for a repository or data management center prohibit the release of the key to investigators under any circumstances, until the individuals are deceased; or — Other legal requirements prohibit the release of the key to the investigators, until the individuals are deceased. Under this standard, when a researcher accesses or receives data that have been coded and does not have access to the identifying key, the research is not considered human subjects research and is not subject to the Common Rule’s requirements of informed consent or IRB review and approval of protocol. Enforcement of the Common Rule The Common Rule requirements for informed consent do not preempt any applicable federal, state, or local laws that require additional informa- tion to be disclosed to a subject in order for informed consent to be legally effective.22 Federal funding can be suspended or withdrawn from an institution when it is found to be in material violation of the Common Rule.23 There is no authority to impose penalties directly on individual researchers for violations. Neither does the Common Rule expressly provide a research 22 See 45 C.F.R. § 46.116(e) (2005). 23 See 45 C.F.R. § 46.123 (2005).

 HEALTH RESEARCH participant with a private right of action. It should be noted, however, that recent cases indicate that courts may be willing to hold an institu- tion liable under common law negligence theories where the approved informed consent form is determined to be less than adequate (Shaul et al., 2005).24 FDA Protection of Human Research Subjects Some health research is also subject to FDA regulations. The FDA is charged by statute with ensuring the protection of the rights, safety, and welfare of human subjects who participate in clinical investigations25 involving articles subject to the Federal Food, Drug, and Cosmetic Act26 (the Act), as well as clinical investigations that support applications for research or marketing permits for products regulated by the FDA, including drugs, medical devices, and biological products for human use (Box 3-5). In January 1981, the FDA adopted regulations governing informed consent of human subjects27 and regulations establishing standards for the composition, operation, and responsibilities of IRBs that review clinical investigations involving human subjects.28 At the same time, HHS adopted the Common Rule regulations on the protection of human research sub- jects.29 The FDA’s regulations were harmonized with the Common Rule in 1991 to the extent permitted by statute. Key differences between FDA and HHS regulations include that the FDA does not allow for waiver or alteration of informed consent and requires that subjects be informed that the FDA may inspect their medical records. In addition, studies of efficacy based solely on medical records research are not permitted to support reg- istration. Remaining differences in the rules are due to differences in the statutory scope or requirements (Lee, 2000). DISTINGUISHING HEALTH RESEARCH FROM PRACTICE The Common Rule and Privacy Rule make a somewhat artificial distinc- tion between health research and some closely related health care practices, such as public health practice, quality improvement activities, program 24 See also Grimes v. Kennedy Krieger Institute, 782 A. 2d 807 (Md. Ct. App. 2001); Gelsinger v. University of Pennsylvania (Philadelphia County Court of Common Pleas filed September 18, 2000), available at http://www.sskrplaw.com/links/healthcare2.html. 25 The FDA has defined “clinical investigation” to be synonymous with “research.” 26 The Food, Drug, and Cosmetic Act Section 505(i), 507(d), or 520(g) of 21 U.S.C. 355(i), 357(d), or 360j(g) (1972). 27 See 21 C.F.R. part 50 (2008); 46 Fed. Reg. 8942 (1981). 28 See 21 C.F.R. part 56 (2008); 46 Fed. Reg. 8958 (1981). 29 See 45 C.F.R. part 46 (2005); 46 Fed. Reg. 8366 (1981).

 BEYOND THE HIPAA PRIVACY RULE BOX 3-5 FDA Protection of Human Subjects Regulations The Food and Drug Administration (FDA) Protection of Human Subjects Regu- lations aim to protect the rights of human subjects enrolled in research involv- ing products that the FDA regulates (i.e., drugs, medical devices, biologicals, foods, and cosmetics). For example, the regulations set out a number of steps researchers must go through before conducting drug research on human subjects. Researchers must submit a brief statement to the FDA promising that they will uphold ethical research standards, and identifying the Institutional Review Board (IRB) that will review the study prior to its start date. Sponsors of the study are required to submit to the FDA the results of any chemical and animal studies conducted on the new drug, provide the proposed study procedures for using human subjects, and ensure that the researchers’ designated IRB will review the proposed study. The FDA will then review this information to ensure that there are no unacceptable risks to human subjects, that the project is ethically sound, and that the research is likely to achieve the study’s objectives. The regulations give the FDA the right to request modifications to the proposed study, or the right to reject the proposal as presenting an unacceptable risk to human subjects. Additionally, the FDA Protection of Human Subjects Regulations allow the FDA to conduct onsite inspections of IRBs to determine whether they are adhering to the requirements of the regulation. This portion of the regulation provides the FDA with the ability to examine IRB minutes, IRB written operating procedures, and other documents that substantiate the IRB’s review of the research project. The FDA can also ensure that the IRB reviewing the study meets the membership requirements stipulated in the regulations, and that the consent forms contain all the required elements and are signed by all the subjects. SOURCE: GAO (1996). evaluations,30 and utilization reviews,31 all of which may involve collec- tion and analysis of personally identifiable health information. However, determining which activities meet the definition of “research” is a major 30 The Centers for Disease Control and Prevention defines program evaluation as the “sys- tematic investigation of the merit, worth, or significance of organized public health action,” noting that such evaluations are “systematic ways to improve and account for public health actions by involving procedures that are useful, feasible, ethical, and accurate.” They can be based on goals, processes, outcomes, or value (http://www.cdc.gov/mmwr/preview/mmwrhtml/ rr4811a1.htm). 31 The Utilization Review Accreditation Commission defines utilization review as “the evaluation of the medical necessity, appropriateness, and efficiency of the use of health care services, procedures, and facilities under the provisions of the applicable health benefits plans” (http://www.urac.org/about/).

 HEALTH RESEARCH challenge for IRBs, Privacy Boards,32 investigators, and health care prac- titioners because neither the regulations nor their interpretations by HHS provide clear guidance on how to distinguish research from activities that use similar techniques to analyze health information (IOM, 2000a). It is important for IRBs and Privacy Boards to correctly distinguish among activities that are or are not subject to the various provisions of the Privacy Rule and the Common Rule. Only research requires formal IRB or Privacy Board review and informed consent.33 Inappropriate classification of an activity as research can make it difficult or impossible for important health care activities, such as public health practice and quality improve- ment, to be undertaken. On the other hand, failure to correctly identify an activity as research could potentially allow improper disclosure of person- ally identifiable health information without sufficient oversight. Thus, standard criteria are urgently needed for IRBs and Privacy Boards to use when making distinctions between health research and related activi- ties, and the committee recommends that HHS consult with relevant stake- holders to develop such standard criteria. HHS is aware of this need, and created a working document titled “What Is Research?” However, the work on this project apparently has been delayed for unknown reasons (NCURA, 2007).34 As described below, a number of other models have already been proposed to help determine whether activities should be clas- sified as research in the fields of public health and quality improvement, and these could be instructive for developing HHS guidance. Any criteria adopted by HHS should be regularly evaluated to ensure that they are help- ful and producing the desired outcomes. The following sections describe some ongoing efforts to develop such criteria in the fields of public health and quality improvement. The intent of the committee is not to endorse these particular models, but rather to illustrate the challenges associated with making these distinctions and establishing standard criteria. Public Health Practice Versus Public Health Research The Belmont Report defined health practice as “interventions designed solely to enhance the well-being of the person, patient or client, and which have reasonable expectation of success” (CDC, 1999). To apply this defini- tion to “public” health practice, the targeted beneficiary of the intervention must be expanded to include benefit to the community, rather than just a particular person. Neither the Common Rule nor the Privacy Rule provides 32 Another type of oversight board defined by the Privacy Rule. See Chapter 4. 33 Under the Privacy Rule, consent is referred to as authorization. See Chapter 4. 34 Personal communication, C. Heide, Office for Civil Rights, HHS, May 29, 2008.

 BEYOND THE HIPAA PRIVACY RULE a specific definition for public health research; rather public health research is included in the general definition of research. However, the Privacy Rule regulates public health practice differently from public health research (see Chapter 4). An early model for distinguishing public health research from public health practice focused on the intent for which the activity was designed, noting that the intent of public health research is to “contribute to or gener- ate generalizable knowledge,” while the intent of public health practice is to “conduct programs to prevent disease and injury and improve the health of communities” (Snider and Stroup, 1997). The Centers for Disease Control and Prevention developed a similar method with an expanded assessment of intent. For example, the model posits that in public health research, the intended benefits of the project extend beyond the study participants, and the data collected exceed the requirements for the care of the study partici- pants. But for public health practice, the intended benefits of the project are primarily for the participants in the activity, or for the participants’ com- munity, and the only data collected are those needed to assess or improve a public health program or service, or the health of the participants and their community. The model also assumes that public health practice is based on well-established medical interventions and is nonexperimental (CDC, 1999). However, these models both have been criticized as too subjective and too dependent on the opinion of the person conducting the activity (Gostin, 2008; Hodge, 2005). A new, more comprehensive model incorporating much of the previous two was recently proposed as a more objective checklist to be used by IRBs, Privacy Boards, and interested parties (Hodge, 2005; Hodge and Gostin, 2004). The foundations for this model are specific definitions of public health research: “the collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will benefit those beyond the participating community who bear the risks of participation,” and public health practice: “the collection and analysis of identifiable health data by a public health authority for the purpose of pro- tecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community.” The model is based on two primary assumptions. First, the actor per- forming the activity in question is a governmental public health official, agent, agency, or entity at the federal, tribal, state, or local level. Second, the activity in question involves the acquisition, use, or disclosure of per- sonally identifiable health data. The model is then divided into two stages. Stage 1 is applied to all activities, and can be used to distinguish practice from research in the easiest cases. Stage 2 is only applied to those cases that are hard to distinguish, and where Stage 1 failed to lead to a definitive IRB/Privacy Board decision (Box 3-6).

 HEALTH RESEARCH BOX 3-6 A Model for Distinguishing Public Health Practice from Research Stage 1 Public health practice: • “Involves specific legal authorization for conducting the activity as public health practice at the federal, state, or local levels; • Includes a corresponding governmental duty to perform the activity to protect the public’s health; • Involves direct performance or oversight by a governmental public health authority (or its authorized partner) and accountability to the public for its performance; • May legitimately involve persons who did not specifically volunteer to partici- pate (i.e., they did not provide informed consent); • Supported by principles of public health ethics that focus on populations while respecting the dignity and rights of individuals.” Public health research: • “Involves living individuals; • Involves, in part, identifiable private health information; • Involves research subjects who voluntarily participate (or participate with the consent of their guardian) absent a waiver of informed consent; • Supported by principles of research ethics that focus on the interests of indi- viduals while balancing the communal value of research.” Stage 2 Legal authority: If authorized by a specific legal authority, the activity is health care practice. If authorized by general legal authority, analysis depends on whether the scope and limits of the authorization include research. Specific intent: The intent of research is to “test a hypothesis and seek to gen- eralize the findings or acquired knowledge beyond the activity’s participants.” The intent of public health practice is “to assure the conditions in which people can be healthy through public health efforts that are primarily aimed at prevention of known or suspected injuries, diseases, or other conditions, or promoting the health of a particular community.” If the intent of an activity meets both definitions, the activity should follow research provisions. Responsibility: In research, the principal investigator is responsible for the “health, safety, and well-being” of the research participants. In public health prac- tice, a government entity often takes that responsibility. continued

 BEYOND THE HIPAA PRIVACY RULE BOX 3-6 Continued Participant benefits: In research, participants usually do not receive or expect any direct benefit from the activity. Public health practice is premised on providing some benefit to the participants or the population involved in the activity. Experimentation: Research is experimental, and usually involves a nonstandard intervention or data analysis. Public health practice uses “standard, accepted, and proven interventions to address known or suspected public health problems.” Subject selection: In research, subjects are often selected randomly to ensure the generalizability of the results and reduce the potential for selection bias. Par- ticipants are selected for public health practice because they have or are at risk of having a particular disease or condition, and can likely benefit from the activity. SOURCES: Hodge (2005); Hodge and Gostin (2004). Quality Improvement Versus Health Research Quality improvement has been defined as “systematic, data-guided activities designed to bring about immediate, positive change in the delivery of health care in a particular setting” (Baily, 2008). Quality improvement activities do not require IRB or Privacy Board approval under the Common Rule or the Privacy Rule, which classify quality improvement as a compo- nent of health care operations.35 However, in many cases, it is difficult for health care providers, IRBs, and Privacy Boards to determine whether a particular activity is purely for quality improvement, or whether it also entails research. One survey36 exploring opinions in the health care community about the need for IRBs to review various quality-related activities found that physicians conducting quality improvement were less likely than IRB chairs to believe that IRB 35 The Privacy Rule defines the term “health care operations” by listing a number of specific activities that qualify as health care operations. These include “conducting quality assessment and improvement activities, population-based activities relating to improving or reducing health care costs, and case management and care coordination.” See 45 C.F.R. § 164.501 (2006). 36 A total of 444 surveys were mailed to the medical directors of quality improvement and IRB chairs at hospitals with 400 or more beds that belong to the Council of Teaching Hos- pitals of the Association of American Medical Colleges, and to the editors of all U.S.-based medical journals that publish original research and appear in the Abridged Index Medicus. 236 surveys were returned, for a 53 percent response rate. The survey consisted of six brief scenarios that asked respondents to determine whether the described project needed IRB review and informed consent.

 HEALTH RESEARCH review was required for a given hypothetical activity, or that informed con- sent was necessary (Lindenauer et al., 2002). Recently, a highly publicized case has again brought the issue to the forefront for all the stakeholders (Box 3-7). Some members of the health care community have proposed requir- ing that all prospective quality improvement activities go through external review (Bellin and Dubler, 2001), while others have outlined specific criteria to differentiate quality improvement activities from research. For example, Casarett and colleagues developed a two-part test to iden- tify quality improvement activities. The first test is whether the majority of BOX 3-7 A Case Study of Quality Improvement and Research Peter Pronovost of Johns Hopkins University (JHU) led a quality improve- ment effort at 103 intensive care units (ICUs) in Michigan hospitals to reduce the number of catheter-related bloodstream infections. This effort relied on promoting five medical procedures recommended by the Centers for Disease Control and Prevention (CDC) to reduce infection. The investigators recorded the number of infections that occurred at the ICU level; no data were recorded at the individual level. Prior to starting the quality improvement effort, the investigators submitted an application to the Johns Hopkins Institutional Review Board (IRB), and clas- sified the project as exempt from the requirements of the Common Rule. The IRB approved the project as exempt, and did not review the proposal further. After a description of the quality improvement effort was published in the New England Journal of Medicine, the Office for Human Research Protections (OHRP) received a letter of complaint that this was research without IRB approval and without informed consent. OHRP opened a compliance oversight evaluation, and initially determined that the project was research and needed to go through the IRB review process. OHRP stated that “quality improvement activities can also be research activities” and that “JHU failed to ensure the requirements for obtaining and documenting the legally effective informed consent of the subjects.” On February 15, 2008, OHRP reversed its initial decision, and concluded that this activity was a quality improvement effort and was not required to comply with the regulations governing human subjects research. The Michigan hospitals have been allowed to continue implementing and studying the effectiveness of the CDC-recommended procedures in ICUs, and have not been required to get IRB approval or informed consent. Also at this time, OHRP announced that it was going to review its policies on quality improvement. SOURCE: OHRP (2008b).

 BEYOND THE HIPAA PRIVACY RULE patients are expected to benefit directly from “the knowledge to be gained” from the initiative. This means that the patients must actually benefit from the knowledge learned during the evaluation, not just from being a recipi- ent of the protocol itself. If the patients are generally expected to directly benefit from the knowledge gained during the activity, then the activity is quality improvement. If not, the activity is research. The second test is whether the participants would be subjected to additional risks or burdens, including the risk of privacy breach, beyond the usual clinical practice in order to make the results of the initiative generalizable. If yes, then the initiative should be reviewed as research (Casarett et al., 2000). More recently, the Hastings Center published a report exploring the similarities and differences between research and quality improvement. The report emphasized three fundamental characteristics of quality improve- ment and three fundamental characteristics of research. The authors argue that individuals have a responsibility to participate in the quality improve- ment activities because all patients have an interest in receiving high- quality medical care, and the success of a quality improvement activity depends on the cooperation of all patients. In addition, the report notes that quality improvement activities are a low risk to the patient, so there is little justification for not participating. The report also assumes that quality improvement activities are based on existing knowledge about human health and should lead to immediate local improvements in the provision of medical care. In contrast, the report notes that participation in research should be voluntary, and decisions to participate should be based on researchers’ full disclosure of all the potential risks and benefits. In addition, the authors assert that research is designed to create new knowledge about human health, rather than relying solely on existing knowledge, and that most research does not result in any direct benefit to the institution where the research is being conducted. The authors concluded that IRBs are not the appropriate body for the ethical oversight of quality improvement activities. They argue that IRBs unnecessarily impose high transaction costs on these activities because of the difference in the way they are conducted compared to research. For example, in research, any changes in methodology require further IRB approval. In contrast, quality improvement activities involve frequent adjustments in the intervention, measurement, and goals of the activity based on the experience of the investigators. Requiring the investigator to revisit an IRB every time a small adjustment is needed in such an activity significantly increases the amount of time and effort required to conduct the initiative and to produce meaningful data. Also, the investigators involved in quality improvement activities ordinarily are already involved in the clinical care of participants and bear responsibility for the quality and

 HEALTH RESEARCH safety of an intervention. Thus, the authors argue that there is no need for the additional oversight by an IRB to protect participant safety. Rather, the report recommended integrating the ethical oversight of quality improvement activities into the ongoing management of an insti- tution’s health care delivery system, suggesting that oversight of quality improvement could be left with the managers of clinical care organizations, and that consent to receive treatment should include consent to participate in any quality improvement project that is minimal risk. However, the report stated that if a project has the characteristics of both quality improve- ment and research, the project should be reviewed as both human subjects research and quality improvement (Baily et al., 2006; Lynn et al., 2007). In response to the ongoing confusion over when quality improvement rises to the level of research and requires IRB review, the IOM jointly hosted a meeting with the American Board of Internal Medicine in May 2008 to discuss this issue. Key members of the quality improvement com- munity attended, and short- and long-term solutions to this problem were proposed. However, no written report from this meeting was produced and no general consensus was reached. THE IMPORTANCE OF EFFECTIVE COMMUNICATION WITH THE PUBLIC As noted previously in this chapter, surveys indicate that the vast major- ity of Americans believe that health research is important and are interested in the findings of research studies. The majority of patients also appear to be willing to participate in health research, either by volunteering for a study to test a medical intervention or by allowing access to their medical records or stored biospecimens, under certain conditions. Their willingness to participate depends on trust in researchers to safeguard the rights and well-being of patients, including assurance of privacy and confidentiality, and the belief that it is a worthwhile endeavor that warrants their involve- ment. Yet patients often lack information about how research is conducted, and are rarely informed about research results that may have a direct impact on their health. The committee’s recommendations in this section are intended to address both the public’s desire for more information about health research and to help fulfill two of the committees overarching goals of the report: (1) improving the privacy and security of health information, and (2) improving the effectiveness of health research. Disseminating Health Research Results Ethicists have long suggested greater community involvement in health research studies, including more communication about research results

0 BEYOND THE HIPAA PRIVACY RULE (reviewed by Shalowitz and Miller, 2008a,b). In addition, the IOM commit- tee identified transparency—the responsibility to disclose clearly how and why personally identifiable information is being collected—as an important component of comprehensive privacy protections. A previous IOM report also recommended improved communication with the public and research participants to ensure that the protection process is open and accessible to all interested parties (IOM, 2002). Effective communication would build the public’s trust of the research community and is consistent with the principles of fair information practices. When patients consent to the use of their medical records in a particu- lar study, health researchers should make greater efforts at the conclusion of the study to inform study participants about the results, and the relevance and importance of those results. Learning about clinically relevant findings from a study in which a patient has participated could make patients feel more integrated into the process and could encourage more to participate in future studies. A recent United Kingdom report on the use of personal data in health research concluded that public involvement in research is necessary for the success of information-based research, and that a public informed about the value of research is likely to have greater enthusiasm and confidence in research and the research community (AMS, 2006). Moreover, direct feedback with study participants could lead to improved health care for the individuals if the results indicate that an altered course of care is warranted. Nonetheless, there are multiple impediments, beyond cost, to providing meaningful feedback to participants. A summary of the results alone, while necessary and reasonable, can be seen as a token, and also raises questions about issues such as how best to write summaries, the stage at which results should be disseminated, and how to present research with uninformative outcomes. For example, one recent study found that sharing results directly with study participants was met with overwhelmingly favorable reactions from patients, but the study also revealed some obstacles (Partridge et al., 2008). In a survey of women who had participated in a randomized trial of breast cancer therapy and had received a summary of the study results by mail, 95 percent reported that they were glad they received the results. Most respondents interpreted the results correctly, although incorrect inter- pretation of the results was associated with increased anxiety, as was dis- satisfaction with treatment. Although some guidelines for providing and explaining study results to research participants have been proposed, they differ in details because limited data are available on this subject, and thus standards are lacking (Partridge and Winer, 2002; Partridge et al., 2008; Shalowitz and Miller, 2008b; Zarin and Tse, 2008). Because transparency is best achieved by providing graded levels of information and guidance to interested parties

 HEALTH RESEARCH (IOM, 2002), it will be important to develop effective and efficient ways to communicate with various sectors of the population. A commitment to the principles of “plain language”37 will be important. Broader adoption of electronic medical records may also be helpful in accomplishing this goal. Research Registries One way to make information about research studies more broadly available to the public is through registration of trials and other studies in public databases. HHS should encourage such registration of trials and other studies, particularly when research is conducted with an IRB/Privacy Board approved waiver of consent or authorization (see Chapter 4). Numer- ous clinical trial registries already exist, and registration has increased in recent years (reviewed by Zarin and Tse, 2008). In 2000, the National Library of Medicine established a clinical trials registry (ClinicalTrials.gov), which has expanded to include information from several other trial regis- tries and to serve as the FDA-required site for submissions about clinical trials subject to the FDA databank requirement. The FDA Amendments Act of 200738 expanded the scope of required registrations at ClinicalTrials.gov and provided the first federally funded trials results database. It mandates registrations of controlled clinical investigations, except for Phase I trials, of drugs, biologics, and devices subject to FDA regulation. A policy of the International Committee of Medical Journal Editors (ICMJE), adopted in fall 2005, also requires prospective trial registration as a precondition for publication (DeAngelis et al., 2004). This policy led to a 73 percent increase in trial registrations of all intervention types from around the world (Zarin et al., 2005). Nearly 45,000 trials had been reg- istered by fall 2007. However, although the development of such registries is an important first step toward providing high-quality clinical trial information to the public, no centralized system currently exists to disseminate information about clinical trials of drugs or other interventions, making it difficult for consumers and their health care providers to identify ongoing studies. The current statutory requirements for registration and data reporting in the United States are not as broad as the transnational policies of the ICMJE or the World Health Organization, which call for the registration of all interventional studies in human beings regardless of intervention type (Laine et al., 2007; Sim et al., 2006). Moreover, noninterventional stud- ies, such as observational studies that play an increasingly critical role in biomedical research, are not generally included in these databases. Because 37 See http://plainlanguage.gov/index.cfm. 38 FDA, Public Law 110–85 § 801 (2007).

 BEYOND THE HIPAA PRIVACY RULE many noninterventional studies are conducted with an IRB/Privacy Board approved waiver of consent or authorization, including those studies in a registry could be an important method for increasing public knowledge of such studies. Informing the Public About the Methods and Value of Research As noted previously, clinical trials are the most visible of the various types of health research, but a great deal of information-based health research entails analysis of thousands of patient records to better under- stand human diseases, to determine treatment effectiveness, and to identify adverse side effects of therapies. This form of research is likely to increase in frequency as the availability of electronic records continues to expand. As we move toward the goal of personalized medicine, research results will be even more likely to be directly relevant to patients, but more study subjects will be necessary to derive meaningful results. However, many patients probably are not aware that their medical records are being used in information-based research. For example, the recent study that used focus groups to examine the views of veterans toward the use of medical records in research found that the majority of participants (75 percent) were not aware that “under some circumstances, [their] medical records could be used in some research studies without [their] permission,” despite the fact that a notice of privacy practices, which included a statement that such research could occur, had been mailed to all participants less than a year prior to the study (Damschroder et al., 2007). Moreover, surveys show that many patients desire not only notice, but also the opportunity to decide whether to consent to such research with medical records. Those surveys further indicate that patients who wish to be asked for consent for each study are most concerned about the potentially detrimental affects of inappropriate disclosure of their personally identifi- able health information, including discrimination in obtaining health or life insurance or employment. As noted in Chapter 2, strengthening security protections of health data should reduce the risk of security breaches and their potential negative con- sequences, and thus should help to alleviate patient concerns in this regard. But educating patients about how health research is conducted, monitored, and reported on could also help to ease patient concerns about privacy and increase patients’ trust in the research community, which as noted above is important for the public’s continued participation in health research. For example, datasets are most often provided to researchers without direct identifiers such as name and Social Security number. Furthermore, identi- fiers are not included in publications about research results. Also, under

 HEALTH RESEARCH both the Privacy Rule and the Common Rule, a waiver of consent and authorization is possible only under the supervision of an IRB or Privacy Board, and a waiver is granted only when the research entails minimal risk and when obtaining individual consent and authorization is impracticable (see the previous section and also Chapter 4). Finally, professional ethics dictate that researchers safeguard data and respect privacy. Conveying the value of medical records research to patients will be important. Surveys show that people are more supportive of research that is relevant to them and their loved ones. At the same time, educational efforts should stress the negative impact of incomplete datasets on research findings. Representative samples are essential to ensure the validity and generalizability of health research (Box 3-8), but datasets will not repre- sent the entire population if some people withhold access to their health information. In addition, an educated public could also decrease the potential for biased research samples. A universal requirement for consent or authoriza- tion in medical records research leads to incomplete datasets, and thus to biased results and inaccurate conclusions. Some large medical institutions with a strong research history and reputation (e.g., Mayo Clinic) can obtain authorization and consent rates as high as 80 percent, but the 20 percent BOX 3-8 Selection Bias in Health Research When researchers are required to obtain consent or authorization to access each individual’s medical record for a research study, it is likely that individuals’ willingness to grant access will not be random, and will vary in a way that may bias the study results—a phenomenon known as selection bias. A study sample is biased if certain members are underrepresented or overrepresented relative to others in the population. A biased sample causes problems because any statistic computed from that sample has the potential to be consistently erroneous. The bias can lead to an over- or underrepresentation of the corresponding parameter being studied in the population. Typically this causes measures of statistical sig- nificance to appear much stronger than they are, but it is also possible to cause completely illusory artifacts. In either case, conclusions drawn from a biased sample are likely to be invalid. The requirement to obtain consent or authoriza- tion may lead to a biased study sample because those who decline to participate may be more or less likely than average to have a particular health problem. This may be especially problematic if the research topic entails sensitive or potentially embarrassing information, such as HIV infection. SOURCES: Casarett et al. (2005); Jacobsen et al. (1999).

 BEYOND THE HIPAA PRIVACY RULE who refuse have distinct demographic and health characteristics. In fact, even a refusal rate of less than 5 percent can create selection bias in the data (Jacobsen et al., 1999; see Chapter 5 for more detail). Conveying to the public the importance of health care improvements derived from medical records research and stressing the negative impact of incomplete datasets on research findings may increase the public’s participation in research and their willingness to support information-based research that is conducted with IRB or Privacy Board oversight, under a waiver of patient consent or authorization. Numerous examples of important research findings from medical records research would not have been possible if direct patient consent and authorization were always required (Box 3-1). For example, analysis of medical records showed that infants exposed to diethylstilbesterol (DES) during the first trimester of pregnancy had an increased risk of breast, vaginal, and cervical cancer as well as reproductive anomalies as adults. Similarly, studies of medical records led to the discovery that folic acid supplementation during pregnancy can prevent neural tube defects. Thus, HHS and the health research community should work to edu- cate the public about how research is done and the value it provides. All stakeholders, including professional organizations, nonprofit funders, and patient organizations, have different interests and responsibilities to make sure that their constituencies are well informed. For example, the American Society of Clinical Oncology and the American Heart Association already have some online resources to help patients gather information about research that may be relevant to their conditions. But coordination and identification of best practices by HHS would be helpful, and research is needed to identify which segments of the population would be receptive to and benefit from various types of information about how research is done and its value in order to create and implement an effective plan. Greater use of community-based participatory research, in which community-based organizations or groups bring community members into the research process as partners to help design studies and disseminate the knowledge gained,39 could help achieve this goal. These groups help researchers to recruit research participants by using the knowledge of the community to understand health problems and to design activities that the community is likely to value. They also inform community members about how the research is done and what comes out of it, with the goal of providing immediate community benefits from the results when possible. 39 See http://www.ahrq.gov/research/cbprrole.htm.

 HEALTH RESEARCH CONCLUSIONS AND RECOMMENDATIONS Based on its review of the information described in this chapter, the committee agreed on a second overarching principle to guide the formation of recommendations. The committee affirms the importance of maintaining and improving health research effectiveness. Research discoveries are central to achieving the goal of extending the quality of healthy lives. Research into causes of disease, methods for prevention, techniques for diagnosis, and new approaches to treatment has increased life expectancy, reduced infant mortality, limited the toll of infectious diseases, and improved outcomes for patients with heart disease, cancer, diabetes, and other chronic diseases. Patient-oriented clinical research that tests new ideas makes rapid medical progress possible. Today, the rate of discovery is accelerating, and we are at the precipice of a remarkable period of investigative promise made possible by new knowledge about the genetic underpinnings of disease. Genomic research is opening new possibilities for preventing illness and for develop- ing safer, more effective medical care that may eventually be tailored for specific individuals. Further advances in relating genetic information to predispositions to disease and responses to treatments will require the use of large amounts of existing health-related information and stored tissue specimens. The increasing use of electronic medical records will further facilitate the generation of new knowledge through research and acceler- ate the pace of discovery. These efforts will require broad participation of patients in research and broad data sharing to ensure that the results are valid and applicable to different segments of the population. Collaborative partnerships among communities of patients, their physicians, and teams of researchers to gain new scientific knowledge will bring tangible benefits for people in this country and around the world. Surveys indicate that the majority of Americans believe that health research is important, are interested in the findings of research studies, and are willing to participate in health research. But patients often lack infor- mation about how research is conducted and are rarely informed about research results that may have a direct impact on their health. Effective communication could build the public’s trust of the research community, which is important because trust is necessary for the public’s continued participation in research. Moreover, direct feedback could lead to improved health care for study participants if the results indicate that an altered course of care is warranted. Thus, the committee recommends that when patients consent to the use of their medical records in a particular study, health researchers should make greater efforts when the study ends to inform study participants about the results, and the relevance and importance of those results. Broader adop- tion of electronic health records may be helpful in accomplishing this goal,

 BEYOND THE HIPAA PRIVACY RULE but standards and guidelines for providing and explaining study results to research participants or various sectors of the public are needed. HHS should also encourage registration of trials and other studies in public databases, particularly when research is conducted with an IRB/ Privacy Board approved waiver of consent or authorization, as a way to make information about research studies more broadly available to the public. Numerous clinical trial registries already exist, and registration has increased in recent years, but no centralized system currently exists for dis- seminating information about clinical trials of drugs or other interventions, making it difficult for consumers and their health care providers to identify ongoing studies. Moreover, noninterventional studies, such as observational studies that play an increasingly critical role in biomedical research, are not generally included in these databases. Because many noninterventional stud- ies are conducted with an IRB/Privacy Board approved waiver of consent or authorization, including such studies in a registry could be an important method for increasing public knowledge of those studies. Interventional clinical trials are the most visible of the various types of health research, but a great deal of information-based health research entails analysis of thousands of patient records to better understand human diseases, to determine treatment effectiveness, and to identify adverse side effects of therapies. This form of research is likely to increase in frequency as the availability of electronic health records continues to expand. As we move toward the goal of personalized medicine, research results will be even more likely to be directly relevant to patients, but more study partici- pants will be necessary to derive meaningful results. However, many patients are likely not aware that their medical records are being used in information-based research, and surveys show that many patients desire not only notice, but also the opportunity to decide about whether to consent to such research with medical records. As noted in Chapter 2, strengthening security protections of health data should reduce the risk of security breaches and their potential negative consequences, and thus should help to alleviate patient concerns in this regard. But educating patients about how health research is conducted, monitored, and reported could also increase patients’ trust in the research community. Thus, HHS and the health research community should work to educate the public about how research is done. It will also be important for HHS and researchers to convey the value of health care improvements derived from medical records research, and to stress the negative impact of incomplete datasets on research findings. Representative samples are essential to ensure the validity and generalizabil- ity of health research, but datasets will not be representative of the entire population if some people withhold access to their health information. A universal requirement for consent or authorization in information-based

 HEALTH RESEARCH research may lead to incomplete datasets, and thus to biased results and inaccurate conclusions. Numerous examples of important research findings from medical records research would not have been possible if direct patient consent and authorization were always required. To ensure that beneficial health research and related activities continue to be undertaken with appropriate oversight under federal regulations, it will be important for HHS to also provide more guidance on how to distin- guish the various activities. The Privacy Rule makes a distinction between health research and some closely related endeavors, such as public health and quality improvement activities, which also may involve collection and analysis of personally identifiable health information. Under the Privacy Rule (as well as the Common Rule), these activities, which aim to protect the public’s health and improve the quality of patient care, are considered and health care “practice” rather than health research. Therefore, they can be undertaken without consent or authorization, or an IRB/Privacy Board waiver of consent or authorization. However, it can be a challenge for IRBs and Privacy Boards to distinguish among activities that are or are not sub- ject to the various provisions of the Privacy Rule and the Common Rule, and inappropriate decisions may prevent important activities from being undertaken or could potentially allow improper disclosure of personally identifiable health information. To address these difficulties, a number of models have been proposed that outline the criteria IRBs and Privacy Boards should use to distinguish practice and research. For example, one recent model provides a detailed checklist for IRBs and Privacy Boards to use in determining whether an activity is public health research and required to comply with the research provisions of the Privacy Rule, or public health practice that does not need IRB/Privacy Board review. The committee believes that standardizing the criteria is essential to support the conduct of these important health care activities. Thus, HHS should convene the relevant stakeholders to develop standard criteria for IRBs and Privacy Boards to use when making deci- sions about whether protocols entail research or practice. There should be flexibility in the regulation to allow important activities to go forward with appropriate levels of oversight. Also, it will be important to evaluate whether these criteria are effective in aiding IRB/Privacy Board reviews of proposed protocols, and whether they lead to appropriate IRB/Privacy Board decisions. These changes suggested above could be accomplished without any changes to HIPAA by making them a condition of funding from HHS and other research sponsors and by providing some additional funds to cover the cost.

 BEYOND THE HIPAA PRIVACY RULE REFERENCES AMS (Academy of Medical Sciences). 2006. Personal data for public good: Using health information in medical research. http://www.acmedsci.ac.uk/images/project/Personal.pdf (accessed August 28, 2008). Baily, M. A. 2008. Harming through protection? New England Journal of Medicine 258(8):768–769. Baily, M. A., M. Bottrell, J. Lynn, and B. Jennings. 2006. The ethics of using QI methods to improve health care quality and safety. A Hastings Center Special Report 36(4): S1–S40. Bates, D. W., L. L. Leape, D. J. Cullen, N. Laird, L. A. Petersen, J. M. Teich, E. Burdick, M. Hickey, S. Kleefield, B. Shea, V. M. Vander, and D. L. Seger. 1998. Effect of computer- ized physician order entry and a team intervention on prevention of serious medication errors. JAMA 280(15):1311–1316. Bellin, E., and N. N. Dubler. 2001. The quality improvement-research divide and the need for external oversight. American Journal of Public Health 91(9):1512–1517. Big Health. 2008. Big health consortium. http://www.bighealthconsortium.org/about/ (accessed October 29, 2008). Braunstein, J. B., N. S. Sherber, S. P. Schulman, E. L. Ding, and N. R. Powe. 2008. Race, medi - cal researcher distrust, perceived harm, and willingness to participate in cardiovascular prevention trials. Medicine 87(1):1–9. Brown, D. R., M. N. Fouad, K. Basen-Engquist, and G. Tortolero-Luna. 2000. Recruitment and retention of minority women in cancer screening, prevention and treatment trials. Annals of Epidemiology 10:S13–S21. Burris, S., L. Gable, L. Stone, and Z. Lazzarini. 2003. The role of state law in protecting hu- man subjects of public health research and practice. Journal of Law, Medicine & Ethics 31:654. Casarett, D., J. Karlawish, and J. Sugarman. 2000. Determining when quality improvement initiatives should be considered research: Proposed criteria and potential implications. JAMA 284(7):2275–2280. Casarett, D., J. Karlawish, E. Andrews, and A. Caplan. 2005. Bioethical issues in pharmaco- epidemiological research. In Pharmacoepidemiology, 4th ed., edited by B. L. Strom. West Sussex, England: John Wiley & Sons, Ltd. Pp. 417–432. CDC (Centers for Disease Control and Prevention). 1999. Guidelines for defining public health research and public health non-research. http://www.cdc.gov/od/science/regs/hrpp/ researchdefinition.htm (accessed March 4, 2008). CHSR (Coalition for Health Services Research). 2008. Framework for health services research policy for 00. http://www.chsr.org/Policy_Priorities.pdf (accessed August 21, 2008). Comis, R. L., C. R. Aldige, E. L. Stovall, L. U. Krebs, P. J. Risher, and H. J. Taylor. 2000. A quantitative survey of public attitudes towards cancer clinical trials. Philadelphia, PA: Coalition of National Cancer Cooperative Groups, Cancer Research Foundation of America, Cancer Leadership Council, and Oncology Nursing Society. Corbie-Smith, G., S. B. Thomas, M. V. Williams, and S. Moody-Ayers. 1999. Attitudes and beliefs of African Americans towards participation in medical research. Journal of General Internal Medicine 14:537–546. Damschroder, L. J., J. L. Pritts, M. A. Neblo, R. J. Kalarickal, J. W. Creswell, and R. A. Hayward. 2007. Patients, privacy and trust: Patients’ willingness to allow researchers to access their medical records. Social Science & Medicine 64(1):223–235. DeAngelis, C. D., J. M. Drazen, F. A. Frizelle, C. Haug, J. Hoey, R. Horton, S. Kotzin, C. Laine, A. Marusic, A. J. P. M. Overbeke, T. V. Schroeder, H. C. Sox, and M. B. Van Der Weyden. 2004. Clinical trial registration: A statement from the International Committee of Medical Journal Editors. JAMA 292(11):1363–1364.

 HEALTH RESEARCH Farmer, D., S. A. Jackson, F. Camacho, and M. A. Hall. 2007. Attitudes of African American and low socioeconomic status white women toward medical research. Journal of Health Care for the Poor and Underserved 18:85–99. FDA (Food and Drug Administration). 1971. Certain estrogens for oral or parenteral use. Drugs for human use; drug efficacy study implementation. Federal Register 36(217):21537–21538. FDA. 2005. FDA public health advisory, deaths with antipsychotics in elderly patients with behavioral disturbances. http://www.fda.gov/cder/drug/advisory/antipsychotics. htm (accessed August 18, 2008). FDA. 2008. FDA alert [6/16/2008]: Information for healthcare professionals. Antipsychotics. http://www.fda.gov/cder/drug/infosheets/hcp/antipsychotics_conventional.htm (accessed August 18, 2008). Finkelstein, E. A., I. C. Fiebelkorn, and G. Wang. 2003. National medical spending attributable to overweight and obesity: How much, and who’s paying? Health Affairs Web Exclusive. http://content.healthaffairs.org/cgi/content/abstract/hlthaff.w3.219v1 (accessed August 21, 2008). Furrow, B. R., T. L. Greaney, S. H. Johnson, T. S. Jost, and R. L. Schwartz. 2004. Bioethics: Health care law and ethics. 5th ed. St. Paul, MN: Thomson/West. GAO (Government Accountability Office). 1996. Scientific research: Continued vigilance criti- cal to protecting human subjects. Washington, DC: GAO. Genetics & Public Policy Center. 2007. U.S. public opinion on uses of genetic information and genetic discrimination. http://www.dnapolicy.org/resources/GINAPublic_Opinion_ Genetic_Information_Discrimination.pdf (accessed August 21, 2008). Gill, S., S. Bronskill, S. Normand, G. Anderson, K. Sykora, K. Lam, C. Bell, P. Lee, H. Fischer, N. Herrmann, J. Gurwitz, and P. Rochon. 2007. Antipsychotic drug use and mortality in older adults with dementia. Annals of Internal Medicine 146:775–786. Giuliano, A. R., N. Mokuau, C. Hughes, G. Tortelero-Luna, B. Risendal, R. C. S. Ho, T. E. Prewitt, and W. J. McCaskill-Stevens. 2000. Participation of minorities in cancer research: The influence of structural, cultural, and linguistic factors. Annals of Epidemi- ology 10:S22–S34. Goldman, J., and A. Choy. 2001. Privacy and confidentiality in health research. In Ethical and policy issues in research involving human participants. Bethesda, MD: National Bioethics Advisory Commission. Pp. C1–C34. Gostin, L. O. 2008. Surveillance and public health research: Personal privacy and the “right to know.” In Public health law: Power, duty, restraint. Berkeley, CA: University of Cali- fornia Press. Grady, C., L. A. Hampson, G. R. Wallen, M. V. Rivera-Goba, K. L. Carrington, and B. B. Mittleman. 2006. Exploring the ethics of clinical research in an urban community. Ameri- can Journal of Public Health 96(11):1996–2001. Hatfield, M., H. F. Sonnenschein, and L. E. Rosenberg. 2001. Exceptional returns: The eco- nomic value of America’s investment in medical research. http://www.laskerfoundation. org/advocacy/pdf/exceptional.pdf (accessed August 21, 2008). Herbst, A. L., H. Ulfelder, and D. C. Poskanzer. 1971. Adenocarcinoma of the vagina. Asso- ciation of maternal stilbestrol therapy with tumor appearance in young women. New England Journal of Medicine 284(15):878–881. HEW (Department of Health, Education and Welfare). 1979. The Belmont Report: Ethical principles and guidelines for the protection of human subjects of research. http://ohsr. od.nih.gov/guidelines/belmont.html (accessed August 21, 2008). HHS (Department of Health and Human Services). 2003. Institutional review boards and the HIPAA Privacy Rule. http://privacyruleandresearch.nih.gov/pdf/IRB_Factsheet.pdf (accessed August 21, 2008).

0 BEYOND THE HIPAA PRIVACY RULE HHS. 2004. Guidance on research involving coded private information or biological speci- mens. http://www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.pdf (accessed August 21, 2008). Hodge, J. G., Jr. 2005. An enhanced approach to distinguishing public health practice and human subjects research. Journal of Law, Medicine & Ethics 33(1):125–141. Hodge, J. G., and L. O. Gostin. 2004. Public health practice vs. research: A report for public health practitioners including cases and guidance for making distinctions. Atlanta, GA: Council of State and Territorial Epidemiologists. IOM (Institute of Medicine). 1995. Health services research: Work force and educational issues. Washington, DC: National Academy Press. IOM. 2000a. Protecting data privacy in health services research. Washington, DC: National Academy Press. IOM. 2000b. To err is human: Building a safer health system. Washington, DC: National Academy Press. IOM. 2002. Responsible research: A systems approach to protecting research participants. Washington, DC: The National Academies Press. Jacobsen, S., Z. Xia, M. Campion, C. Darby, M. Plevak, K. Seltman, and L. Melton, 3rd. 1999. Potential effect of authorization bias on medical record research. Mayo Clinic Proceedings 74:330–338. Laine, C., R. Horton, C. D. DeAngelis, J. M. Drazen, F. A. Frizelle, F. Godlee, C. Haug, P. C. Hébert, S. Kotzin, A. Marusic, P. Sahni, T. V. Schroeder, H. C. Sox, M. B. Van Der Weyden, and F. W. A. Verheugt. 2007. Clinical trial registration—looking back and moving ahead. New England Journal of Medicine 356(26):2734–2736. Lee, B. 2000. Comparison of FDA and HHS human subject protection regulations. http:// www.fda.gov/oc/gcp/comparison.html (accessed August 21, 2008). Lindenauer, P. K., E. M. Benjamin, D. Naglieri-Prescod, J. Fitzgerald, and P. Pekow. 2002. The role of the institutional review board in quality improvement: A survey of quality officers, institutional review board chairs, and journal editors. The American Journal of Medicine 113:575–579. Lowrance, W. W. 2002. Learning from experience, privacy and the secondary use of data in health research. London: The Nuffield Trust. Lowrance, W. W., and F. S. Collins. 2007. Identifiability in genomic research. Science 317:600–602. Lynn, J., M. A. Baily, M. Bottrell, B. Jennings, R. J. Levine, F. Davidoff, D. Casarett, J. Corrigan, E. Fox, M. K. Wynia, G. J. Agich, M. O’Kane, T. Speroff, P. Schyve, P. Batalden, S. Tunis, N. Berlinger, L. Cronenwett, M. Fitzmaurice, N. N. Dubler, and B. James. 2007. The ethics of using quality improvement methods in health care. Annals of Internal Medicine 146(6):666–674. Mandelblatt, J., S. Saha, S. Teutsch, T. Hoerger, A. L. Siu, D. Atkins, J. Klein, and M. Helfand. 2003. The cost-effectiveness of screening mammography beyond age 65: A systematic review for the U.S. Preventive Services Task Force. Annals of Internal Medicine 139:835–842. Mick, S., L. L. Morlock, D. Salkever, G. de Lissovoy, F. Malitz, C. G. Wise, and A. Jones. 1994. Strategic activity and financial performance of U.S. rural hospitals: A national study, 1983 to 1988. Journal of Rural Health 10(3):150–167. Mosconi, P., P. Poli, A. Giolo, and G. Apolone. 2005. How Italian health consumers feel about clinical research: A questionnaire survey. European Journal of Public Health 15(4):372–379. Murphy, K., and R. Topel. 1999. The economic value of medical research. Chicago, IL: Uni- versity of Chicago Press.

 HEALTH RESEARCH NCI (National Cancer Institute). 2008. Getting connected with caBIG: Data sharing and security framework. https://cabig.nci.nih.gov/working_groups/DSIC_SLWG/data_sharing_ policy/ (accessed October 27, 2008). NCURA (National Council of University Research Administrators). 2007. Report on research compliance. http://www.reportonresearchcompliance.com (accessed March 4, 2008). NCVHS (National Committee on Vital and Health Statistics). 2007a. Enhanced protections for uses of health data: A stewardship framework for “secondary uses” of electroni- cally collected and transmitted health data. http://ncvhs.hhs.gov/071221lt.pdf (accessed December 19, 2007). NCVHS, Ad Hoc Work Group on Secondary Uses of Health Data. 2007b. Testimony of the cancer Biomedical Informatics Grid (caBIG) Data Sharing and Intellectual Capital (DSIC) workspace. August 1, 2007. Needleman, J., P. Buerhaus, S. Mattke, M. Stewart, and K. Zelevinsky. 2002. Nurse- staffing levels and the quality of care in hospitals. New England Journal of Medicine 346(22):1715–1722. NSF (National Science Foundation). 2006. Science and technology: Public attitudes and under- standing. In Science and Engineering Indicators 00. Arlington, VA: National Science Foundation. Chapter 7. OHRP (Office for Human Research Protections). 2008a. IRB guidebook, part I.A. http://www. hhs.gov/ohrp/irb/irb_guidebook.htm (accessed August 21, 2008). OHRP. 2008b. OHRP concludes case regarding Johns Hopkins University research on hos- pital infections. http://www.hhs.gov/ohrp/news/recentnews.html#20080215 (accessed August 21, 2008). Partridge, A., and E. Winer. 2002. Informing clinical trial participants about study results. JAMA 288:363–365. Partridge, A. H., A. C. Wolff, P. K. Marcom, P. A. Kaufman, L. Zhang, R. Gelman, C. Moore, D. Lake, G. F. Fleming, H. S. Rugo, J. Atkins, E. Sampson, D. Collyar, and E. P. Winer. (2008). The impact of sharing results of a randomized breast cancer clinical trial with study participants. Breast Cancer Research and Treatment June 10. Pitkin, R. 2007. Folate and neural tube defects. American Journal of Clinical Nutrition 85(1):285S–288S. Pritts, J. 2008. The importance and value of protecting the privacy of health information: Roles of HIPAA Privacy Rule and the Common Rule in health research. http://www.iom. edu/CMS/3740/43729/53160.aspx (accessed March 15, 2008). Research!America. 2007. America speaks: Poll summary. Vol. 7. Alexandria, VA: United Health Foundation. Schneeweiss, S., S. Setoguchi, A. Brookhart, C. Dormuth, and P. Wang. 2007. Risk of death associated with the use of conventional versus atypical antipsychotic drugs among elderly patients. Canadian Medical Association Journal 176:672–632. Shalowitz, D. I., and F. G. Miller. 2008a (May 13). Communicating the results of clinical research to participants: Attitudes, practices, and future directions. PLoS Medicine 5(5): e91. Shalowitz, D. I., and F. G. Miller. 2008b (September). The search for clarity in communicating research results to study participants. Journal of Medical Ethics 34(9):e17. Shaul, R. Z., S. Birenbaum, and M. Evans. 2005. Legal liability in research: Early lessons from North America. BMC Medical Ethics 6(4):1–4. Shavers, V. L., C. F. Lynch, and L. F. Burmeister. 2002. Racial differences in factors that influ- ence the willingness to participate in medical research studies. Annals of Epidemiology 12:248–256. Sim, I., A.-W. Chan, A. M. Gülmezoglu, T. Evans, and T. Pang. 2006. Clinical trial registra- tion: Transparency is the watchword. The Lancet 367(9523):1631–1633.

 BEYOND THE HIPAA PRIVACY RULE Slamon, D., G. Clark, S. Wong, W. Levin, A. Ullrich, and W. McGuire. 1987. Human breast cancer: Correlation of relapse and survival with amplification of the her-2/neu oncogene. Science 235(4785):177–182. Snider, D. E., and D. F. Stroup. 1997. Defining research when it comes to public health. Public Health Reports 112:29–32. Thorpe, K. E., C. S. Florence, D. H. Howard, and P. Joski. 2004. The impact of obesity in rising medical spending. Health Affairs Web Exclusive. http://content.healthaffairs.org/ cgi/content/abstract/hlthaff.w4.480v1 (accessed August 21, 2008). Trauth, J. M., D. Musa, L. Siminoff, I. K. Jewell, and E. Ricci. 2000. Public attitudes regard- ing willingness to participate in medical research studies. Journal of Health & Social Policy 12(2):23–43. Veurink, M., M. Koster, and L. Berg. 2005. The history of DES, lessons to be learned. Pharmacy World & Science 27(3):139–143. Wendler, D., R. Kington, J. Madans, G. Van Wye, H. Christ-Schmidt, L. A. Pratt, O. W. Brawley, C. P. Gross, and E. Emanuel. 2006. Are racial and ethnic minorities less willing to participate in health research? PLoS Medicine 3(2):201–210. Westin, A. 2007. How the public views privacy and health research. http://www.iom.edu/ Object.File/Master/48/528/%20Westin%20IOM%20Srvy%20Rept %2011-1107.pdf (accessed November 11, 2008). Williams, E. D. 2005. Federal protection for human research subjects: An analysis of the Com- mon Rule and its interactions with FDA regulations and the HIPAA Privacy Rule, CRS report for Congress. Washington, DC: Congressional Research Service. Williams, I. C., and G. Corbie-Smith. 2006. Investigator beliefs and reported success in recruit- ing minority participants. Contemporary Clinical Trials 27:580–586. Winston, F. K., D. R. Durbin, M. J. Kallan, and E. K. Moll. 2000. The danger of premature graduation to seat belts for young children. Pediatrics 105(6):1179–1183. WMA (World Medical Association). 1964. Declaration of Helsinki: Ethical principles for medical research involving human subjects. http://ohsr.od.nih.gov/guidelines/helsinki. html (accessed August 21, 2008). Woolley, M., and S. M. Propst. 2005. Public attitudes and perceptions about health-related research. JAMA 294(11):1380–1384. Zarin, D. A., and T. Tse. 2008. Moving toward transparency of clinical trials. Science 319:1340–1342. Zarin, D. A., T. Tse, and N. C. Ide. 2005. Trial registration at ClinicalTrials.gov between May and October 2005. New England Journal of Medicine 353(26):2779–2787.

Next: 4 HIPAA, the Privacy Rule, and Its Application to Health Research »
Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research Get This Book
×
Buy Paperback | $43.00 Buy Ebook | $34.99
MyNAP members save 10% online.
Login or Register to save!
Download Free PDF

In the realm of health care, privacy protections are needed to preserve patients' dignity and prevent possible harms. Ten years ago, to address these concerns as well as set guidelines for ethical health research, Congress called for a set of federal standards now known as the HIPAA Privacy Rule.

In its 2009 report, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, the Institute of Medicine's Committee on Health Research and the Privacy of Health Information concludes that the HIPAA Privacy Rule does not protect privacy as well as it should, and that it impedes important health research.

  1. ×

    Welcome to OpenBook!

    You're looking at OpenBook, NAP.edu's online reading room since 1999. Based on feedback from you, our users, we've made some improvements that make it easier than ever to read thousands of publications on our website.

    Do you want to take a quick tour of the OpenBook's features?

    No Thanks Take a Tour »
  2. ×

    Show this book's table of contents, where you can jump to any chapter by name.

    « Back Next »
  3. ×

    ...or use these buttons to go back to the previous chapter or skip to the next one.

    « Back Next »
  4. ×

    Jump up to the previous page or down to the next one. Also, you can type in a page number and press Enter to go directly to that page in the book.

    « Back Next »
  5. ×

    To search the entire text of this book, type in your search term here and press Enter.

    « Back Next »
  6. ×

    Share a link to this book page on your preferred social network or via email.

    « Back Next »
  7. ×

    View our suggested citation for this chapter.

    « Back Next »
  8. ×

    Ready to take your reading offline? Click here to buy this book in print or download it as a free PDF, if available.

    « Back Next »
Stay Connected!