The new HIPAA (Health Insurance Portability and Accountability Act of 1996) Medical Privacy Rule: help or hindrance for clinical research?

The Federal Policy for Protection of Human Research Subjects, adopted by 17 federal agencies as a common regulatory framework (the “Common Rule”) for most federally sponsored human subjects research, acknowledges the centrality of privacy and confidentiality to the ethical conduct of research by mandating, both implicitly and explicitly, that institutional review boards (IRBs) address these concerns.1 Regulations adopted by the US Food and Drug Administration (FDA) require IRBs to assess protections for privacy and confidentiality in a similar manner.2 Implicit in the requirement (of both the Common Rule and FDA regulations) that IRBs weigh the risks and benefits of proposed research is the expectation that risks to privacy and confidentiality will be among those the IRB considers. Moreover, both the Common Rule and FDA regulations require IRBs to make an explicit finding that a researcher has proposed adequate protections to minimize the possibility of a breach of privacy or confidentiality and the attendant risk that subjects could suffer embarrassment, stigmatization, or discrimination.3 Despite these regulatory mandates, critics state that the existing system of IRB oversight does not ensure that subjects’ privacy rights are respected fully and their confidentiality protected adequately. It is argued that heavily burdened IRBs, particularly those in academic settings, may devote insufficient attention to, and may lack the expertise to evaluate, risks to privacy and confidentiality in an electronic age in which barriers to data transmission are low and in which data stripped of names and other facial identifiers may yet be re-identified for questionable purposes through the use of computer algorithms and diverse databases publicly available from private and governmental sources.4 Claims that some commercially sponsored research may be little more than thinly disguised marketing have further heightened anxiety about an erosion of health information privacy in an age of information technology, managed health care, and aggressive pharmaceutical direct-to-consumer promotion. Touted as an answer to these and other health information privacy concerns is the new federal medical Privacy Rule, officially known as Standards for Privacy of Individually Identifiable Health Information. This regulation, authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and drafted, due to congressional default,* by the Department of Health and Human Services (DHHS), was released in the final days of the Clinton administration and then re-issued with only minor modifications by the Bush administration. In response to a storm of unhappy comment letters from many affected parties, the Bush administration agreed to a further round of revision and released a substantially modified Final Rule in August 2002, with a compliance date of April 14, 2003. The Privacy Rule will be enforced by