Below are the first 10 and last 10 pages of uncorrected machine-read text (when available) of this chapter, followed by the top 30 algorithmically extracted key phrases from the chapter as a whole.
Intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text on the opening pages of each chapter.
Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.
Do not use for reproduction, copying, pasting, or reading; exclusively for search engines.
OCR for page 293
Appendix B
Commissioned Survey Methodology
A review of the literature demonstrated a dearth of systematic data to
determine what impact the Health Insurance Portability and Accountability
Act (HIPAA) Privacy Rule was having on health research. As a result, the
Institute of Medicine (IOM) committee sought larger surveys with national
coverage. In consultation with committee members, the IOM took the
unusual step of commissioning1 several surveys to assess current percep-
tions among health researchers of the effect of the Privacy Rule on research
and to measure the public’s perception of and expectations for privacy in
health research.
The first survey entailed a national web-based survey of U.S. epidemiol-
ogists, overseen by Dr. Roberta Ness at the University of Pittsburgh. A sec-
ond project, undertaken by Sarah Greene and Dr. Ed Wagner at the Group
Health Center for Health Studies in Seattle, involved a survey of HMO
Research Network (HMORN) investigators and a survey of HMORN
Institutional Review Boards (IRBs). The third survey was a Harris Interac-
tive Poll of the public, developed by Alan Westin of the Privacy Consulting
Group. The methods used in conducting these surveys are described below.
The results are described in Chapters 2 and 5 of this report and are reported
in more detail in Ness (2007), Westin (2007), and Greene et al. (2008).
1 The surveys were commissioned with private funding. No federal funds were used to sup-
port collection of survey data.
OCR for page 294
BEYOND THE HIPAA PRIVACY RULE
NATIONAL SURVEY OF U.S. EPIDEMIOLOGISTS
Participants
Epidemiologists were surveyed because they are an identifiable profes-
sional group of scientists engaged in human subjects research, and their
research often involves the use of medical records. Support was enlisted
from all professional groups that were known to represent U.S. epidemi-
ologists employed in academia, industry, government, and nongovernment
organizations. These included the American Academy of Pediatrics, Section
on Epidemiology; American College of Epidemiology; American College of
Preventive Medicine; American Diabetes Association, Council on Epidemi-
ology & Statistics; American Public Health Association, Epidemiology Sec-
tion; International Genetic Epidemiology Society; International Society for
Environmental Epidemiology; International Society for Pharmacoepidemiol-
ogy; Society for Clinical Trials; Society for Epidemiologic Research; Society
for Healthcare Epidemiology; Society for Pediatric and Perinatal Epidemiol-
ogy; and Society for the Analysis of African-American Public Health Issues.
Of 14 societies approached, the 13 listed above participated.
Each society e-mailed all its active members and requested that they
respond to a web-based survey on the Privacy Rule. E-mail lists are updated
annually for dues collection. Identical e-mails requesting participation in
the survey were sent to the membership of each society three times, once
a month during a 3-month period (January–April 2007). In an effort to
avoid response duplication—because a substantial number of epidemiolo-
gists belong to more than one organization—respondents were asked, both
in the cover e-mail and in the introduction to the survey, to respond only
once. Individual responses were submitted anonymously over the Internet
so that they could not be linked to any individual. IRB approval as an
exempt protocol was obtained at the University of Pittsburgh and reviewed
and approved by the National Academies’ IRB.
The 13 participating epidemiology societies sent e-mails to a total of
10,347 individual addresses. A cover e-mail asked professionals who are
engaged in the conduct of U.S.-based human subjects research and who
recognized the term Health Insurance Portability and Accountability Act or
HIPAA to respond. A total of 2,805 individuals accessed the Website, and
2,376 individuals answered a screening question that asked, “Since HIPAA
was implemented in April 2003, how many new applications involving
human subjects have you submitted to a U.S. IRB?” Respondents answer-
ing zero were thanked for their time, and no further questions were asked.
The 1,527 respondents who provided a response of one or more are the
participants in these analyses.
OCR for page 295
APPENDIX B
Survey Content
The survey questionnaire was developed by Roberta Ness with input
and review by the IOM committee. Questions were asked about both posi-
tive and negative potential influences of the HIPAA Privacy Rule, including
the influence of the Privacy Rule on participant privacy, confidentiality, and
public trust, as well as on research procedures. Four general approaches
were used to ascertain information. First, questions with quantitative
response categories were asked. These questions addressed issues such as
the frequency of various types of data collection undertaken by respondents;
changes in participant recruitment before and after the implementation of
the Privacy Rule; frequency of IRB modifications secondary to Privacy Rule
provisions and their effect; level of difficulty in obtaining deidentified data
and waivers; familiarity with covered entities’ opting out of research because
of the Privacy Rule; studies conceived but not submitted to IRBs because of
Privacy Rule concerns; and perceived effect of the Privacy Rule on patient
confidentiality. Survey respondents were also asked about their gender, train-
ing, employment, and sources of funding.
Second, researchers were asked for their perceptions rated on a 5-point
Likert scale about issues such as the ease and difficulty of conducting
research under the Privacy Rule and the effect the Privacy Rule has had on
participant privacy/confidentiality. Third, respondents were asked whether
and under what circumstances their IRB would approve each of five case
studies. These involved retrieval of historical identified medical records;
access to identified participants in a hospital-based cancer registry; access to
deidentified data in a hospital-based tissue bank; review of medical records
of deceased individuals; and request for a limited dataset (defined by the
Privacy Rule) from a nonaffiliated hospital. Finally, respondents were asked
open-ended qualitative questions, including a final request: “Please tell us
your stories about HIPAA. These will help us to understand all of the cir-
cumstances in which HIPAA has affected your research.”
After development of a draft instrument, survey content was vetted
and modified by members of the IOM committee. In a pilot phase, ques-
tions were distributed to 10 epidemiologists at the University of Pittsburgh.
After completing the survey, the respondents were debriefed to identify
ambiguities, streamline the instrument, and determine how readily a typical
epidemiologist could answer questions. After the instrument was finalized,
timed pilot tests took 10 to 15 minutes to complete.
Statistical Analysis
Simple descriptive statistics, retaining each distinctive response cat-
egory, were used to analyze these data. The 5-point Likert scales that were
OCR for page 296
BEYOND THE HIPAA PRIVACY RULE
anchored by “none” and “a great deal” were collapsed into 1 to 2, 3, and
4 to 5. Categories were reported rather than central tendencies in order to
retain the full and unedited character of the data. Only univariate analyses
were reported because the focus was on a description of the self-reported
impact of the Privacy Rule, rather than predictors of responses.
HARRIS INTERACTIVE POLL OF THE PUBLIC
Successive drafts of the survey questionnaire were prepared by Alan
Westin, with input and review by the IOM committee members. The final
version was then reviewed and edited by David Krane, vice president,
Harris Interactive. The survey was conducted online by Harris Interactive
between September 11 and 18, 2007, with 2,392 respondents. Both closed
and open-ended questions were used. The results were adjusted by Harris
to represent the total adult U.S. population in 2007, estimated at 225 mil-
lion persons, not just those who go online. Figures for age, gender, race/
ethnicity, education, region, and household income were weighted where
necessary to bring them in line with their actual proportions in the popula-
tion. Propensity score weighting was also used to adjust for respondents’
propensity to using the Internet.
Respondents for this survey were selected from among those who have
agreed to participate in Harris Interactive surveys. Because the sample is
based on those who agreed to participate in the Harris Interactive panel,
no estimates of theoretical sampling error can be calculated. According to
Harris Interactive, all sample surveys and polls, whether or not they use
probability sampling, are subject to multiple sources of error. These errors
are most often not possible to quantify or estimate, including sampling
error, coverage error, error associated with nonresponse, error associated
with question wording and response options, and postsurvey weighting
and adjustments. Therefore, Harris Interactive avoids the term “margin
of error” because it is misleading. All that can be calculated are different
possible sampling errors with different probabilities for pure, unweighted,
random samples with 100 percent response rates. These are only theoretical
because no published polls come close to this ideal.
For analytic purposes, standard demographics for cross-tabulations
were collected for region, age, generation, gender, race, party affiliation,
education, income, marital status, children in the household, sexual ori-
entation, disabilities, political philosophy, and employment. In addition, a
set of custom health demographics was created from respondents’ answers
to questions about their overall health status, whether they have been care-
givers, whether they have or have had six specified types of health condi-
tions, and whether they have had a genetic test.
Generally, a group with a 5 percent or higher variation from the total
OCR for page 297
APPENDIX B
public’s response, from one of our demographic, health-aspect, or attitudi-
nal subsets, was reported as a significant demographic variation. When the
public total is 18 percent or less, 3 or 4 percent higher variation was used.
SURVEY OF HMORN RESEARCHERS AND IRB ADMINISTRATORS
Researcher Survey
A Web-based survey was used to collect data about researchers’ expe-
rience with the HIPAA Privacy Rule (e.g., how their research protocols
may have been affected by HIPAA, knowledge of and attitudes toward the
HIPAA Privacy Rule regulations, and limited demographic information).
To be eligible, participants had to be members of the scientific faculty
(i.e., assistant, associate, or full investigator level, or the equivalent rank-
ing system, plus research associates or staff scientists) at one of the HMO
Research Network sites listed below:
1. Geisinger Health System, Center for Health Research and Rural
Advocacy
2. Group Health Center for Health Studies
3. Harvard Pilgrim Health Care, Department of Ambulatory Care &
Prevention
4. HealthPartners Research Foundation
5. Henry Ford Health System, Center for Health Services Research &
the Research Epidemiology Programs in cancer and biostatistics
6. Kaiser Permanente Colorado, Clinical Research Unit
7. Kaiser Permanente Northern California, Division of Research
8. Kaiser Permanente Northwest, The Center for Health Research
(includes investigators from Kaiser Permanente Georgia & Kaiser
Permanente Hawaii)
9. Kaiser Permanente Southern California, Department of Research
and Evaluation
10. Lovelace Clinic Research Foundation, Health Services Research
Division
11. Marshfield Clinic Research Foundation, Epidemiology Research
Center
12. Meyers Primary Care Institute
13. Scott & White Health System, Research and Education Department
Successive drafts of the survey questionnaire were prepared by Sarah
Greene, with input and review by the IOM committee. An invitation e-
mail was sent to all faculty members with a link to a web-based survey.
Each respondent received a unique website address taking him/her to the
OCR for page 298
BEYOND THE HIPAA PRIVACY RULE
survey, and once a respondent completed the survey the website address
could not be reused. The recipients also received two e-mail reminders to
complete the web-based survey. A total of 235 investigators were invited
to complete the web-based survey. Of those, 26 of the e-mail invitations
bounced back, and 2 individuals actively refused to complete the survey.
A total of 89 individuals completed the survey, and the remaining 118
individuals never responded to the invitations. The information obtained
from the investigators included:
• The degree to which a study protocol was affected by the HIPAA
Privacy Rule;
• Characteristics of the affected study;
• Attitudes toward the HIPAA Privacy Rule provisions;
• Specific structures or personnel created at their site to address
HIPAA;
• Studies considered, but not implemented due to real/perceived
HIPAA-related concerns;
• Open-ended “comments” fields to allow researchers to elaborate
on their responses;
• Select demographic items including number of years in research;
• HMORN site membership; and
• Request to contact researcher for follow-up interview if web survey
answers warrant it.
Nineteen respondents who reported a HIPAA-affected study in the web
survey indicated a willingness to participate in a follow-up interview. These
subjects were contacted via e-mail to initiate an appointment for a tele-
phone interview at a mutually convenient time. Three individuals opted out
when they were contacted about scheduling the interview, and two could
not be reached after 4 weeks of both e-mail and phone attempts. Twelve
interviews were completed.
The interviews were semi-structured to ensure systematic collection
of key study details, but also to allow each individual to describe his/her
unique experience about conducting research under the HIPAA Privacy
Rule. At least two members of the study team were present for each inter-
view to assist with note taking and capturing all relevant information.
The principal investigator then reviewed the qualitative data for common
themes and unique issues. Each response was rated as positive, negative, or
neutral. The information obtained from these investigators included:
• A general description of the study (e.g., purpose, design, protocol,
data sources, intervention)
OCR for page 299
APPENDIX B
• What types of changes were made to the study as a result of the
HIPAA regulations
• Whether these changes had a negative impact on the study design
or time line
• For multisite studies, whether differences arose across sites, and the
nature of those differences
• Perceptions about their site’s interpretations of HIPAA
For the web survey, descriptive characteristics were reported as means,
medians, or frequencies. Frequencies were generated for categorical vari-
ables, and chi square tests were used to analyze continuous variables.
Survey responses were stratified by site, years of experience, and number
of studies affected by HIPAA provisions.
For the semi-structured interviews, qualitative information provided
by the respondents was synthesized to determine the characteristics of the
affected studies. The content of the interviews was also analyzed to identify
recurrent themes.
IRB Administrator Survey
A mailed survey was used to collect data about IRB administrators’
experience with the HIPAA Privacy Rule. The IRB administrators were
the 15 who work at the HMO Research Network sites. Responses were
received from 11 of the 15 sites. The survey was developed by Sarah
Greene, with input and review by the IOM Committee. The survey asked
questions regarding:
• The role of the IRB as it relates to HIPAA Privacy Rule compliance
• Knowledge of and attitudes toward the research-related provisions
of the HIPAA Privacy Rule
• Procedures in place (or planned) to ensure adherence to HIPAA
Privacy Rule provisions
• Approaches (e.g., training, new staff) established at the site to
address HIPAA compliance
• Specific type of HIPAA Privacy Rule–related training/education
developed by the site’s IRB
• Sample scenarios of privacy breaches to see how each IRB would
respond
• Impact of HIPAA Privacy Rule on IRB process flow
• Desired training/guidance from federal agencies specifically about
the HIPAA Privacy Rule
• Open-ended “comments” fields to allow respondents to elaborate
on their responses
OCR for page 300
00 BEYOND THE HIPAA PRIVACY RULE
Given the small sample size (nmax = 11), the analysis was limited primar-
ily to reporting frequencies, means, and medians. If warranted, selected
frequencies were stratified based on characteristics (e.g., volume of IRB
applications and perceived impact of the Privacy Rule).
REFERENCES
Greene, S. M., S. Bennett, B. Kirlin, K. R. Oliver, R. Pardee, and E. Wagner. 2008. Impact of
the HIPAA Privacy Rule in the HMO Research Network. Seattle, WA: Group Health
Cooperative Center for Health Studies.
Ness, R. 2007. Influence of the HIPAA Privacy Rule on health research. JAMA 298(18):
2164–2170.
Westin, A. 2007. How the public views privacy and health research. http://www.iom.edu/
Object.File/Master/48/528/%20Westin%20IOM%20Srvy%20Rept %2011-1107.pdf
(accessed November 11, 2007).
