Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research (2009)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

Summary BEYOND THE HIPAA PRIVACY RULE: ENHANCING PRIVACY, IMPROVING HEALTH THROUGH RESEARCH Ethical health research and privacy protections both provide valuable benefits to society. Health research is vital to improving human health and health care—and protecting individuals involved in research from harm and preserving their rights is essential to the conduct of ethical research. The pri- mary justification for protecting personal privacy is to protect the interests of individuals. In contrast, the primary justification for collecting personally identifiable health information for health research is to benefit society. But it is important to stress that privacy also has value at the societal level because it permits complex activities, including research and public health activities, to be carried out in ways that protect individuals’ dignity. It is also important to note that health research can benefit individuals, for example, when it facilitates access to new vaccines, therapies, improved diagnostics, and more effective ways to prevent illness and deliver care. The U.S. Department of Health and Human Services (HHS) developed a set of federal standards for protecting the privacy of personal health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).1 The HIPAA Privacy Rule set forth detailed regulations 1 The HIPAA Privacy Rule (“Standards for Privacy of Individually Identifiable Health Informa - tion: Final Rule”) can be found at 45 Code of Federal Regulations (C.F.R.) parts 160 and 164. http://www.hhs.gov/ocr/AdminSimpRegText.pdf (accessed August 2, 2008). A summary of the HIPAA Privacy Rule, prepared by the HHS Office for Civil Rights, is available at http://www. hhs.gov/ocr/privacysummary.pdf (accessed August 2, 2008).  

 BEYOND THE HIPAA PRIVACY RULE regarding the types of uses and disclosures of individuals’ personally identifi- able health information—called “protected health information”—permitted by “covered entities” (health plans, health care clearinghouses, and health care providers who transmit information in electronic form in connection with transactions for which HHS has adopted standards under HIPAA).2 A major goal of the HIPAA Privacy Rule is to ensure that individuals’ health information is properly protected while allowing the flow of information needed to promote high-quality health care. The HIPAA Privacy Rule also set out requirements for the conduct of health research. The Institute of Medicine Committee on Health Research and the Pri- vacy of Health Information (the committee) was charged with two principal tasks3: (1) to assess whether the HIPAA Privacy Rule is having an impact on the conduct of health research, defined broadly as “a systematic inves- tigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge”4; and (2) to propose recommendations to facilitate the efficient and effective conduct of impor- tant health research while maintaining or strengthening the privacy protec- tions of personally identifiable health information. The committee’s conclusion is that the HIPAA Privacy Rule does not protect privacy as well as it should, and that, as currently implemented, the HIPAA Privacy Rule impedes important health research. The commit- tee found that the Privacy Rule (1) is not uniformly applicable to all health research, (2) overstates the ability of informed consent to protect privacy rather than incorporating comprehensive privacy protections, (3) conflicts with other federal regulations governing health research, (4) is interpreted differently across institutions, and (5) creates barriers to research and leads to biased research samples, which generate invalid conclusions. In addition, security breaches are a growing problem for health care databases. In devel- oping its recommendations to improve this situation, the committee was guided by three overarching goals: (1) improve the privacy and data security of health information; (2) improve the effectiveness of health research; and (3) improve the application of privacy protections for health research. A summary of the committee’s recommendations is presented in Box S-1. 2 45 C.F.R. § 160.103 (2006). 3 The study was funded by the National Institutes of Health, the National Cancer Institute, the Robert Wood Johnson Foundation, the American Cancer Society, the American Heart Association/American Stroke Association, the American Society for Clinical Oncology, the Burroughs Welcome Fund, and C-Change. 4 45 C.F.R. § 164.510 (2006). 

 SUMMARY RECOMMENDATION I. DEVELOP A NEW APPROACH TO PROTECTING PRIVACY IN ALL HEALTH RESEARCH The committee’s first and foremost recommendation (Recommenda- tion I) is that Congress should authorize HHS and other relevant federal agencies to develop a new approach to protecting privacy in health research that would apply uniformly to all health research. When this new approach is implemented, HHS should exempt health research from the HIPAA Pri- vacy Rule. The new approach should enhance privacy protections through improved data security, increased transparency of activities and policies, and greater accountability, while also allowing important health research to be undertaken with appropriate oversight. The new approach should do all of the following: • Apply to any person, institution, or organization conducting health research in the United States, regardless of the source of data or funding. • Entail clear, goal-oriented, rather than prescriptive, regulations. • Require researchers, institutions, and organizations that store health data to establish strong data security safeguards. • Make a clear distinction between the privacy considerations that apply to interventional research and research that is exclusively information based. • Facilitate greater use of data with direct identifiers removed in health research, and implement legal sanctions to prohibit unauthor- ized reidentification of information that has had direct identifiers removed. • Require ethical oversight of research when personally identifiable health information is used without informed consent. HHS should develop best practices for oversight that should consider: o Measures taken to protect the privacy, security, and confiden- tiality of the data; o Potential harms that could result from disclosure of the data; and o Potential public benefits of the research. • Certify institutions that have policies and practices in place to pro- tect data privacy and security in order to facilitate important large- scale information-based research for clearly defined and approved purposes, without individual consent. • Include federal oversight and enforcement to ensure regulatory compliance. 

 BEYOND THE HIPAA PRIVACY RULE BOX S-1 Summary of the Committee’s Recommendations The committee’s foremost recommendation is the following: I. Congress should authorize HHS and other relevant federal agencies to develop a new approach to protecting privacy that would apply uniformly to all health research. When this new approach is implemented, HHS should exempt health research from the HIPAA Privacy Rule. → Apply privacy, security, transparency, and accountability obligations to all health records used in research. If national policy makers choose to continue to rely on the HIPAA Privacy Rule rather than adopt a new federal approach (Recommendation I), the committee recommends the following: II. HHS should revise the HIPAA Privacy Rule and associated guidance. A. HHS should reduce variability in interpretations of the HIPAA Privacy Rule in health research by covered entities, Institutional Review Boards (IRBs) and Privacy Boards through revised and expanded guidance and harmonization. 1. HHS should develop a dynamic, ongoing process to increase empirical knowledge about current “best practices” for privacy protection in responsible research using protected health information (PHI), and promote the use of those best practices. 2. HHS should encourage greater use of partially deidentified data called “limited datasets” and develop clear guidance on how to set up and comply with the associated data use agreements more efficiently and effectively, in order to enhance privacy in research by expanding use and usability of data with direct identifiers removed. 3. HHS should clarify the distinctions between “research” and “practice” to ensure appropriate IRB and Privacy Board oversight of PHI disclosures for these activities. 4. HHS guidance documents should simplify the HIPAA Privacy Rule’s provisions regarding the use of PHI in activities preparatory to research and harmonize those provisions with the Common Rule, in order to facilitate appropriate IRB and Privacy Board oversight of identification and recruitment of potential research participants. B. HHS should develop guidance materials to facilitate more effective use of existing data and materials for health research and public health purposes. 1. HHS should develop guidance that clearly states that individuals can autho- rize use of PHI stored in databases or associated with biospecimen banks for specified future research under the HIPAA Privacy Rule with IRB/Privacy 

 SUMMARY Board oversight, as is allowed under the Common Rule, in order to facilitate use of repositories for health research. 2. HHS should develop clear guidance for use of a single form that permits indi- viduals to authorize use and disclosure of health information in a clinical trial and to authorize the storage of their biospecimens collected in conjunction with the clinical trial, in order to simplify authorization for interrelated research activities. 3. HHS should clarify the circumstances under which DNA samples or sequences are considered PHI, in order to facilitate appropriate use of DNA in health research. 4. HHS should develop a mechanism for linking data from multiple sources so that more useful datasets can be made available for research in a manner that protects privacy, confidentiality, and security. C. HHS should revise provisions of the HIPAA Privacy Rule that entail heavy burdens for covered entities and impede research without providing sub- stantive improvements in patient privacy. 1. HHS should reform the requirements for the accounting of disclosures of PHI for research. 2. HHS should simplify the criteria that IRBs and Privacy Boards use in making determinations for when they can waive the requirements to obtain authoriza- tion from each patient whose PHI will be used for a research study, in order to facilitate appropriate authorization requirements for responsible research. Regardless of whether Recommendation I or II is implemented, the following rec- ommendations, which are independent of the Privacy Rule, should be adopted: III. Implement changes necessary for both policy options above (Recom- mendations I and II). A. All institutions (both covered entities and non-covered entities) in the health research community should take strong measures to safeguard the security of health data. → HHS should also support the development and use of new security technolo- gies and self-evaluation standards. B. HHS—or, as necessary, Congress—should provide reasonable protec- tion against civil suits for members of Institutional Review Boards and Privacy Boards who serve in good faith to encourage service on IRBs and Privacy Boards. → But no protection for willful or wanton misconduct. C. HHS and researchers should take steps to provide the public with more information about health research by: 1. Disseminating research results to study participants and the public. 2. Educating the public about how research is done and what value it provides. 

 BEYOND THE HIPAA PRIVACY RULE Informative examples for such an approach include Ontario’s Personal Health Information Protection Act (PHIPA)5 and a similar model recently proposed in the United Kingdom.6 Ontario’s PHIPA shares a number of similarities with the HIPAA Privacy Rule. In general, both rules require the holder of personally identifiable health data to get informed consent (referred to as authorization in the Privacy Rule) before using those data for a purpose other than providing services directly related to the health care of the patient. If a researcher wishes to use personally identifiable health data without getting informed consent, both rules require the researcher to obtain a waiver of informed consent approved by an independent ethics board before the study begins. However, the HIPAA Privacy Rule and PHIPA do have some key dif- ferences. One major difference is that unlike the HIPAA Privacy Rule, which applies privacy obligations unevenly across the health care sector, PHIPA applies to health information custodians (HICs; e.g., providers, hospitals, and pharmacies) that collect, use, and disclose personally iden- tifiable health information, as well as to non-HICs that receive personally identifiable health information from a HIC. Thus, the privacy protections follow the data. Another important difference is that PHIPA permits HICs to disclose personally identifiable health information without consent to “prescribed persons or entities” that have in place privacy practices, policies, and pro- cedures approved by Ontario’s Information and Privacy Commissioner. The prescribed persons or entities may then disclose information to researchers either in deidentified form, or in identifiable form with approval of a Research Ethics Board (Canadian equivalent of an Institutional Review Board [IRB] or Privacy Board). Consistent with the principle of transpar- ency, a prescribed entity must also make public a description of its functions and a summary of its practices, policies, and procedures. A similar approach was recommended in a report commissioned by the United Kingdom’s Prime Minister on secondary uses of personal information. This report suggested the creation of “safe harbors,” which have three defining characteristics: (1) they provide a secure environment for processing personally identifiable health data, (2) they are restricted to “approved researchers” who meet relevant criteria, and (3) they implement penalties and allow for criminal sanctions against researchers who abuse their access to personally identifi- able data. The committee believes that such an approach, combined with strong security measures, offers adequate privacy protections for personally 5 Personal Health Information Protection Act, Statutes of Ontario 2004, Ch. 3, Schedule A; Ontario Regulation 329/04. 6 In a report commissioned by the United Kingdom’s Prime Minister on secondary uses of personal information. 

 SUMMARY identifiable health information in information-based health research, while greatly expanding research opportunities. The committee’s new framework entails a two-part practical approach to protecting health information privacy because there are fundamental differences between information-based research (e.g., using medical records or stored biological samples) and direct, interventional human subjects research. Applying the same human subjects protections in these two dif- ferent scenarios is neither appropriate nor justifiable. Promoting individual autonomy is essential when a person’s health care or participation in clini- cal research is considered. The purpose of informed consent in this type of research is mainly to protect research participants from physical harm by providing a description of the potential risks and benefits of the study. In contrast, in information-based research that relies solely on medical records and stored biospecimens, the research participant faces no risk of direct physical harm. In this context, informed consent (authorization) is intended to ensure that individuals are able to exercise control over their personal information that is held by third parties, and to give individuals the right to determine whether their personal information can be used in a particular research project (or a series of such projects, if consent for future research is permitted). Because of these fundamental differences between information-based research and direct, interventional human sub- jects research, the committee makes a clear distinction between the privacy considerations that apply to interventional research and research that is exclusively information based. First, the committee recommends that all interventional research, regardless of funding source and support, should be required to comply with the Common Rule,7 and all researchers who gain access to personally identifiable health information as part of the interventional research should be required to protect that information with strong security measures. Research participants should be allowed to provide consent for future research uses of data and biological materials collected as part of the inter- ventional study as long as an IRB reviews and approves the future uses, ensuring that the new study is not incompatible with the original consent. Second, the committee recommends that HHS and other relevant fed- eral agencies develop a new approach to uniform, goal-oriented oversight of information-based research, with a focus on best practices in privacy, security, and transparency as in PHIPA and the proposed United Kingdom model. This new approach should include a mechanism by which some programs or institutions could be certified by HHS or another accredit- ing body, similar to a prescribed entity as in PHIPA or a safe harbor as in 7 The “Common Rule” is the term used by 18 federal agencies who have adopted the same regulations governing the protection of human subjects of research. 

 BEYOND THE HIPAA PRIVACY RULE the United Kingdom model. Such entities could then collect and analyze personally identifiable health information for clearly defined and approved purposes, without individual consent. Because of the administrative require- ments in becoming certified, this option is most appropriate for disease registries and other very large scale research databases. Certified entities could also aggregate personally identifiable data from multiple sources, and then provide data to researchers with direct identifiers removed, under strict security requirements. This would facilitate greater use of data with direct identifiers removed in research because the aggregated datasets would be more complete and thus would lead to more accurate conclusions. To fur- ther protect privacy, unauthorized reidentification of information that has had direct identifiers removed should be prohibited by law, and violators should face legal sanctions. In cases where researchers cannot use data with direct identifiers removed, and personally identifiable health information is needed for research, approval and oversight by an ethics oversight board should be required, partially analogous to what is now done under the HIPAA Privacy Rule and PHIPA. This board could perhaps entail a new body specifi- cally formulated to review medical records research, rather than relying on traditional IRBs that were created to review interventional research. If researchers seek a waiver of patient consent, an ethics oversight board should consider the measures the researchers propose to take to protect the privacy and confidentiality of the data, the potential harms that could result from disclosure of the data, and the potential public benefits of the proposed research study. In order to facilitate consistent application of this option, HHS will need to develop clear guidance and best practices on how to assess the potential harm, the proposed measures to protect privacy and confidentiality, and the potential public benefits of a research study, as has been done under PHIPA. Although expectations regarding privacy vary among different demo- graphic groups, public opinion polls suggest that a significant portion of the American public would like to control all access to their medical records for research via an individual consent mechanism. However, obligations to implement comprehensive privacy protections—such as security, transpar- ency, and accountability—are independent of patient consent. Moreover, the committee concluded, based on considerable testimony and other evi- dence, that a universal requirement for informed consent can lead to invalid results because of significant differences between patients who do or do not grant consent, and missed opportunities to advance medical science because it can be prohibitively costly and difficult to obtain consent for studies that require analysis of very large datasets. As a result, the committee’s new framework includes two alternatives to consent that can be used in certain circumstances (e.g., disclosure to a certified entity and waiver of informed 

 SUMMARY consent by an ethics review board), which are intended to facilitate research that is socially beneficial and to protect privacy through increased security, transparency, and accountability. If society seeks to derive the benefits of medical research in the form of improved health and health care, information should be shared to achieve that greater good, and governing regulations should support the use of such information, with appropriate oversight. In the committee’s proposed new framework, the greater emphasis on ensuring the security protections of personally identifiable health information (as in the committee’s Recom- mendation III.A), facilitating research using data with direct identifiers removed, and ensuring the scientific merits of any proposed research in the new framework should help to foster its acceptability. Nonetheless, effective communication with the public about how health research is done and the value it provides (the committee’s Recommendation III.C) will be important to address concerns and gain acceptance. RECOMMENDATION II. REVISE THE PRIVACY RULE AND ASSOCIATED GUIDANCE If this comprehensive new approach is not implemented (or, for the interim while the new framework is being developed), the committee pro- poses as an alternative that HHS revise the current HIPAA Privacy Rule and the associated guidance. These revisions would address some of the problems uncovered during the course of this study. Recommendation II.A. The committee recommends that HHS develop guidance materials to reduce variability among IRBs and Privacy Boards in their interpretation of the HIPAA Privacy Rule as applied to research. One of the weaknesses in the current privacy protection system is that there is extreme variability in the regulatory interpretations and approval deci- sions among IRBs and Privacy Boards. Regulatory language often is not easily understandable and is subject to wide interpretation. Thus local IRBs and Privacy Boards interpret state and federal regulations independently, resulting in a great deal of variation in how the regulations are imple- mented. To address this problem, the committee developed four specific recommendations. First, HHS should develop a dynamic, ongoing process to increase empir- ical knowledge about current “best practices” for privacy protection in responsible research using protected health information (PHI), and promote use of those best practices. To accomplish this, HHS should regularly convene consensus development conferences in collaboration with health research stakeholders to collect and evaluate current practices in privacy protection. Second, HHS should encourage greater use of partially deidentified data called “limited datasets” and develop clear guidance on how to set 

0 BEYOND THE HIPAA PRIVACY RULE up and comply with the associated data use agreements (DUAs) more efficiently and effectively. Currently, there is pervasive confusion regarding the conditions of DUAs and how recipients may meet those conditions. As a result, in some health care settings, the burden of establishing a DUA prevents research from going forward. At the other extreme, some covered entities sign DUAs as a matter of course, providing little meaningful privacy protection to the patient. Third, HHS should clarify the somewhat artificial distinction it has made between “research” and “practice” to ensure appropriate IRB and Privacy Board oversight of PHI disclosures for these closely related activi- ties. This will require HHS to consult with relevant stakeholders to develop standard criteria for IRBs and Privacy Boards to use when making distinc- tions between health research and related endeavors, such as public health practice and quality improvement practices. These criteria should be evalu- ated regularly by HHS to ensure that the criteria are helpful and producing the desired outcomes. Fourth, HHS should simplify the guidance regarding the use of PHI in activities preparatory to research and harmonize these provisions with the Common Rule. The committee recommends that all researchers (including those internal to a covered entity) be required to obtain IRB approval (as required under the Common Rule) prior to contacting potential research participants. When making a decision about whether to approve research projects, the IRB should review and consider the investigator’s plans for contacting patients, and ensure that the information will be used only for research projects approved by the IRB and will not be disclosed elsewhere. Recommendation II.B. The committee recommends that HHS develop guidance materials to facilitate more effective use of existing data and materials for health research and public health purposes. Many institutions create and maintain databases with patient health information or reposito- ries with biological materials collected from patients. These databases and biospecimen banks are used for many types of health research, including studies to understand diseases or to compare patient outcomes following different treatments. Current interpretations of provisions of the HIPAA Privacy Rule sometimes make it difficult to effectively use these valuable resources for health research. The committee developed four specific recom- mendations to facilitate important health research by maximizing the use- fulness of patient data associated with biospecimen banks and in research databases, thereby allowing novel hypotheses to be tested with existing data and materials as knowledge and technology improve. The recom- mendations would align interpretation of the HIPAA Privacy Rule with the Common Rule on several points, simplify or clarify the relevant processes in research, and develop new tools for data aggregation. 

 SUMMARY First, the committee recommends that HHS develop guidance which clearly states that individuals can authorize use of PHI stored in databases or associated with biospecimen banks for specified future research under the HIPAA Privacy Rule with IRB oversight, as is allowed under the Com- mon Rule. Future uses should be described in sufficient detail to allow individuals to give informed consent, and researchers should be required to have IRBs determine that the new research is not incompatible with the initial consent. Second, the committee recommends that HHS develop clear guidance for use of a single form that permits individuals to authorize use and disclosure of health information in a clinical trial and to authorize the storage of their biospecimens collected in conjunction with the clinical trial. This will simplify the authorization process for interrelated research activi- ties by integrating all relevant information into one simple document. Third, the committee recommends that HHS clarify the circumstances under which DNA samples or sequences are considered PHI. Genetic infor- mation does not itself identify an individual in the absence of other identify- ing information. However, in some circumstances, a person’s genetic code could be construed as a unique identifier in that it could be used to match a sequence in another biospecimen bank or databank that does include identi- fiers. The committee advocates a focus on strong security measures and the adoption of strict prohibitions and legal sanctions against the unauthorized reidentification of individuals from DNA sequences, by anyone. Fourth, HHS should develop a mechanism for linking data from mul- tiple sources so that more useful datasets can be made available for research in a manner that protects privacy, confidentiality, and security. One way this could be accomplished, for example, might be through data warehouses that are certified for the purpose of linking data from different sources. The organizations responsible for such linking would be required to use strong security measures and would maintain the details about how the linkage was done, should another research team need to recreate the linked dataset. Recommendation II.C. The committee recommends that HHS revise provisions of the HIPAA Privacy Rule that currently hinder research but do not provide substantive privacy protections. First, HHS should reform the requirements for the accounting of disclosures (AOD) of PHI made for research and public health purposes. Until technology advances make automatic AOD tracking feasible, affordable, and widely available, the HIPAA Privacy Rule should permit covered entities to inform patients in advance that PHI might be used for health research with IRB/Privacy Board oversight or for public health purposes. As an alternative to AOD, to ensure transparency, institutions should maintain a list, accessible to the public, of all studies approved by an IRB/Privacy Board. In addition, HHS should simplify the criteria that IRBs and Pri- vacy Boards use in determining whether to waive the requirement that 

 BEYOND THE HIPAA PRIVACY RULE researchers obtain authorization from each patient whose PHI will be used in a research study. If HHS decides to retain the current waiver criteria, HHS should provide clear and reasonable definitions to the vague terms used in the waiver criteria (i.e., what constitutes “minimal risk” to the privacy of individuals and what constitutes “impracticable”), as well as providing specific case examples. This would be especially helpful for multi-institutional studies, which fall under the jurisdiction of multiple IRBs or Privacy Boards. RECOMMENDATION III. IMPLEMENT CHANGES NECESSARY FOR BOTH POLICY OPTIONS ABOVE (RECOMMENDATIONS I AND II) The committee’s last set of recommendations do not directly relate to the HIPAA Privacy Rule, but should be adopted in order to achieve the committee’s overarching goals under both policy options described above (the new framework or revisions to the HIPAA Privacy Rule and associated guidance). Recommendation III.A. The committee recommends that all health research institutions improve the security of personally identifiable health information. For example, institutions could: appoint a security officer responsible for assessing data protection needs and implementing solutions and staff training; make greater use of encryption and other techniques for data security; include data security experts on IRBs; implement a breach notification requirement, so that patients may take steps to protect their identity in the event of a breach; and implement layers of security protec- tion to eliminate single points of vulnerability to security breaches. In addi- tion, the federal government should support (1) the development and use of genuine privacy-enhancing techniques that minimize or eliminate the col- lection of personally identifiable data, and (2) standardized self-evaluations and security audits and certification programs to help institutions achieve the goal of safeguarding the security of personal health data. Recommendation III.B. The committee also recommends that HHS— or, as necessary, Congress—provide reasonable protection against civil suits brought pursuant to state or federal laws for members of IRBs and Privacy Boards for decisions made within the scope of their responsibilities under the HIPAA Privacy Rule and the Common Rule. The limitation on liability should not include protection for willful and wanton misconduct in review- ing the research, but should instead be reserved for good-faith decisions, backed by minutes or other evidence. Effective oversight of health research depends on the recruitment of qualified and knowledgeable volunteers to serve on IRBs and Privacy Boards. But the increasing workload and com- plexity of IRB and Privacy Board service have made it difficult to recruit 

 SUMMARY and retain knowledgeable IRB members and to ensure time for the ethical reflection necessary to make appropriate decisions about human research projects. Moreover, because of the growth over the past decade of lawsuits naming individual IRB members as defendants, fear of penalties and civil suits can be a significant deterrent in recruiting qualified volunteers to serve on IRBs and Privacy Boards. Recommendation III.C. Finally, the committee recommends that HHS and researchers take steps to provide the public with more information about health research. Surveys indicate that the vast majority of Americans believe health research is important, and they are interested in the findings of research studies. Yet patients often lack information about how health research is conducted and are rarely informed about research results that may have a direct impact on their health. The committee recommends that researchers inform interested research participants (who granted authori- zation for a particular study) with a simplified summary of the results at the conclusion of a research study. HHS should also encourage researchers to register their trials and other studies in public databases, particularly when the research is being conducted under a waiver of authorization. In addition, HHS and the health research community should work to educate the public about how research is done, and what value it provides. These recommendations could be accomplished without any changes to HIPAA or the Privacy Rule by making them a condition of funding for research grants from HHS and other research sponsors, and by providing additional funds to cover the cost.