Beyond the HIPAA Privacy Rule Enhancing Privacy, Improving Health Through Research (2009) / Chapter Skim
Currently Skimming:
3 The Value, Importance, and Oversight of Health Research
3 The Value, Importance, and Oversight of Health Research
Pages 111-152
The Chapter Skim interface presents what we've algorithmically identified as the most significant single chunk of text within every page in the chapter.
Select key terms on the right to highlight them within pages of the chapter.
From page 111... ...
Privacy Rule and the Common Rule, "research" is defined as "a
|
From page 112... ...
approval of a drug for a particular indication is based on a series of controlled clinical trials, often 1 Epidemiology is the study of the occurrence, distribution, and control of diseases in populations. 2 Health services research has been defined as a multidisciplinary field of inquiry, both basic and applied, that examines the use, costs, quality, accessibility, delivery, organization, financing, and outcomes of health care services to increase knowledge and understanding of the structure, processes, and effects of health services for individuals and populations (IOM, 1995)
|
From page 113... ...
. Furthermore, medical records research has demonstrated that preventive services (e.g., mammography)
|
From page 114... ...
, a targeted therapy that is effective for many women with HER-2–positive breast cancer. Folic acid and birth defects: Medical records research led to the discovery that supplementing folic acid during pregnancy can prevent neural tube birth defects (NTDs)
|
From page 115... ...
Results from two subsequent retrospective reviews of 27,000 and 37,000 medical records of elderly patients who had been treated with either conventional or atypical antipsychotic drugs indicated that conventional antipsychotic medications are at least as likely as atypical agents to increase the risk of death among those patients. As a result, the FDA now requires that the prescribing information for all antipsychotic drugs includes the same infor mation about this risk in a boxed warning and a warnings section.
|
From page 116... ...
As noted by the National Committee on Vital and Health Statistics, "Clinically rich information is now more readily available, in a more structured format, and able to be electronically exchanged throughout the health and health care continuum. As a result, the information can be better used for quality improvement, public health, and research, and can significantly contribute to improvements in health and health care for individuals and populations" (NCVHS, 2007a)
|
From page 117... ...
Under caBIG, each institution retains legal responsibility for the research data it generates; this includes responsibility for complying with the HIPAA Privacy Rule, the Common Rule, as well as any applicable state laws. The institutions also retain the right to determine who they will share their data with, what type of data (deidentified versus identifiable)
|
From page 118... ...
It can also reexamine data accrued in other research studies, such as clinical trials, to answer new questions quickly and inexpensively. However, informationbased research does have limitations.
|
From page 119... ...
The surveys reviewed in this chapter focus on interventional clinical trials. A review of survey questions to gauge the public willingness to allow their medical records to be used in research can be found in Chapter 2.
|
From page 120... ...
However, the available evidence suggests that most research participants have positive experiences. A recent Harris Poll found that 13 percent of respondents had participated in some form of health research, and 87 percent of those felt comfortable about their experience (Westin, 2007)
|
From page 121... ...
. Another study found that 8 of 10 Americans would consider participating in a clinical trial if faced with cancer.
|
From page 122... ...
OVERSIGHT OF HEALTH RESEARCH Historical Development of Federal Protections of Health Information in Research The development of international codes, federal legislation, and federal regulation of human subjects often occurred in response to past abuses in biomedical experiments (reviewed by Pritts, 2008)
|
From page 123... ...
As a result, in 1991, other federal departments and agencies joined HHS in adopting a uniform set of rules for the protection of human subjects of research, identical to Subpart A of 45 C.F.R. 46, which is now informally known as the "Common Rule." Eighteen federal agencies have now adopted the Common Rule as their own respective regulations.
|
From page 124... ...
The Code established a set of ethical standards for physical experiments on humans emphasizing the following principles: • The need to obtain the informed consent of the research subject; • The duty to avoid all unnecessary physical and mental suffering and injury; and • The requirement that any and all risks associated with the research must be outweighed by associated benefits. Declaration of Helsinki In 1964, The World Medical Association adopted the "Ethical Principles for Medical Research Involving Human Subjects," also known as the "Declaration of Helsinki," noting that all "[m]
|
From page 125... ...
The framework for achieving the goal of protecting human subjects is based on two foundational requirements: the informed consent of the
|
From page 126... ...
Scope of the Common Rule In general, the Common Rule applies only to research on human subjects that is supported by the federal government.12 As noted previously, research is defined as "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge."13 Under the Common Rule, a "human subject" is defined as "a living individual about whom an investigator .
|
From page 127... ...
The Common Rule requires an informed consent to include a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.16 Institutional Review Boards Adopting the principles of the Belmont Report, the Common Rule requires that protocols for human subjects research be reviewed by an IRB 15 See 45 C.F.R.
|
From page 128... ...
The Common Rule requires that an IRB determine the following factors are satisfied to approve proposed research: • Risks to subjects are minimized; • Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result; • The selection of subjects is equitable; • Informed consent will be sought in accordance with the rules and will be documented; • When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects; and • When appropriate, adequate provisions are in place to protect the privacy of subjects and to maintain the confidentiality of data.18 An IRB may waive the requirement to obtain informed consent or approve an alteration of the consent form for some minimal risk research. The IRB may also waive the requirement for signed consent in certain circumstances.19 Anonymized Data As noted above, the Common Rule considers use of "private identifiable information" to be human subjects research.
|
From page 129... ...
[T] he collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.21 Otherwise identifiable data may be deidentified or "anonymized" for purposes of the Common Rule if it is coded and certain other conditions are met (HHS, 2004)
|
From page 130... ...
Under this standard, when a researcher accesses or receives data that have been coded and does not have access to the identifying key, the research is not considered human subjects research and is not subject to the Common Rule's requirements of informed consent or IRB review and approval of protocol. Enforcement of the Common Rule The Common Rule requirements for informed consent do not preempt any applicable federal, state, or local laws that require additional information to be disclosed to a subject in order for informed consent to be legally effective.22 Federal funding can be suspended or withdrawn from an institution when it is found to be in material violation of the Common Rule.23 There is no authority to impose penalties directly on individual researchers for violations.
|
From page 131... ...
. DISTINGUISHING HEALTH RESEARCH FROM PRACTICE The Common Rule and Privacy Rule make a somewhat artificial distinction between health research and some closely related health care practices, such as public health practice, quality improvement activities, program 24 See also Grimes v.
|
From page 132... ...
The regulations give the FDA the right to request modifications to the proposed study, or the right to reject the proposal as presenting an unacceptable risk to human subjects. Additionally, the FDA Protection of Human Subjects Regulations allow the FDA to conduct onsite inspections of IRBs to determine whether they are adhering to the requirements of the regulation.
|
From page 133... ...
Only research requires formal IRB or Privacy Board review and informed consent.33 Inappropriate classification of an activity as research can make it difficult or impossible for important health care activities, such as public health practice and quality improvement, to be undertaken. On the other hand, failure to correctly identify an activity as research could potentially allow improper disclosure of personally identifiable health information without sufficient oversight.
|
From page 134... ...
. The foundations for this model are specific definitions of public health research: "the collection and analysis of identifiable health data by a public health authority for the purpose of generating knowledge that will benefit those beyond the participating community who bear the risks of participation," and public health practice: "the collection and analysis of identifiable health data by a public health authority for the purpose of protecting the health of a particular community, where the benefits and risks are primarily designed to accrue to the participating community." The model is based on two primary assumptions.
|
From page 135... ...
; • Supported by principles of public health ethics that focus on populations while respecting the dignity and rights of individuals." Public health research: • "Involves living individuals; • Involves, in part, identifiable private health information; • Involves research subjects who voluntarily participate (or participate with the consent of their guardian) absent a waiver of informed consent; • Supported by principles of research ethics that focus on the interests of indi viduals while balancing the communal value of research." Stage 2 Legal authority: If authorized by a specific legal authority, the activity is health care practice.
|
From page 136... ...
. Quality improvement activities do not require IRB or Privacy Board approval under the Common Rule or the Privacy Rule, which classify quality improvement as a component of health care operations.35 However, in many cases, it is difficult for health care providers, IRBs, and Privacy Boards to determine whether a particular activity is purely for quality improvement, or whether it also entails research.
|
From page 137... ...
OHRP stated that "quality improvement activities can also be research activities" and that "JHU failed to ensure the requirements for obtaining and documenting the legally effective informed consent of the subjects." On February 15, 2008, OHRP reversed its initial decision, and concluded that this activity was a quality improvement effort and was not required to comply with the regulations governing human subjects research. The Michigan hospitals have been allowed to continue implementing and studying the effectiveness of the CDC-recommended procedures in ICUs, and have not been required to get IRB approval or informed consent.
|
From page 138... ...
Requiring the investigator to revisit an IRB every time a small adjustment is needed in such an activity significantly increases the amount of time and effort required to conduct the initiative and to produce meaningful data. Also, the investigators involved in quality improvement activities ordinarily are already involved in the clinical care of participants and bear responsibility for the quality and
|
From page 139... ...
Rather, the report recommended integrating the ethical oversight of quality improvement activities into the ongoing management of an institution's health care delivery system, suggesting that oversight of quality improvement could be left with the managers of clinical care organizations, and that consent to receive treatment should include consent to participate in any quality improvement project that is minimal risk. However, the report stated that if a project has the characteristics of both quality improvement and research, the project should be reviewed as both human subjects research and quality improvement (Baily et al., 2006; Lynn et al., 2007)
|
From page 140... ...
When patients consent to the use of their medical records in a particular study, health researchers should make greater efforts at the conclusion of the study to inform study participants about the results, and the relevance and importance of those results. Learning about clinically relevant findings from a study in which a patient has participated could make patients feel more integrated into the process and could encourage more to participate in future studies.
|
From page 141... ...
However, although the development of such registries is an important first step toward providing high-quality clinical trial information to the public, no centralized system currently exists to disseminate information about clinical trials of drugs or other interventions, making it difficult for consumers and their health care providers to identify ongoing studies. The current statutory requirements for registration and data reporting in the United States are not as broad as the transnational policies of the ICMJE or the World Health Organization, which call for the registration of all interventional studies in human beings regardless of intervention type (Laine et al., 2007; Sim et al., 2006)
|
From page 142... ...
Those surveys further indicate that patients who wish to be asked for consent for each study are most concerned about the potentially detrimental affects of inappropriate disclosure of their personally identifiable health information, including discrimination in obtaining health or life insurance or employment. As noted in Chapter 2, strengthening security protections of health data should reduce the risk of security breaches and their potential negative consequences, and thus should help to alleviate patient concerns in this regard.
|
From page 143... ...
A universal requirement for consent or authorization in medical records research leads to incomplete datasets, and thus to biased results and inaccurate conclusions. Some large medical institutions with a strong research history and reputation (e.g., Mayo Clinic)
|
From page 144... ...
. Conveying to the public the importance of health care improvements derived from medical records research and stressing the negative impact of incomplete datasets on research findings may increase the public's participation in research and their willingness to support information-based research that is conducted with IRB or Privacy Board oversight, under a waiver of patient consent or authorization.
|
From page 145... ...
Moreover, direct feedback could lead to improved health care for study participants if the results indicate that an altered course of care is warranted. Thus, the committee recommends that when patients consent to the use of their medical records in a particular study, health researchers should make greater efforts when the study ends to inform study participants about the results, and the relevance and importance of those results.
|
From page 146... ...
It will also be important for HHS and researchers to convey the value of health care improvements derived from medical records research, and to stress the negative impact of incomplete datasets on research findings. Representative samples are essential to ensure the validity and generalizability of health research, but datasets will not be representative of the entire population if some people withhold access to their health information.
|
From page 147... ...
Therefore, they can be undertaken without consent or authorization, or an IRB/Privacy Board waiver of consent or authorization. However, it can be a challenge for IRBs and Privacy Boards to distinguish among activities that are or are not subject to the various provisions of the Privacy Rule and the Common Rule, and inappropriate decisions may prevent important activities from being undertaken or could potentially allow improper disclosure of personally identifiable health information.
|
From page 148... ...
2001. The quality improvement-research divide and the need for external oversight.
|
From page 149... ...
2003. Institutional review boards and the HIPAA Privacy Rule.
|
From page 150... ...
2005. An enhanced approach to distinguishing public health practice and human subjects research.
|
From page 151... ...
2008. The importance and value of protecting the privacy of health information: Roles of HIPAA Privacy Rule and the Common Rule in health research.
|
From page 152... ...
2005. Federal protection for human research subjects: An analysis of the Com mon Rule and its interactions with FDA regulations and the HIPAA Privacy Rule, CRS report for Congress.
|
Key Terms
This material may be derived from roughly machine-read images, and so is provided only to facilitate research.
More
information on Chapter Skim is available.