HIPAA: an impediment to research.

The Health Insurance Portability and Accountability Act (HIPAA), which became effective on April 14, 2003, was intended to help ensure patient privacy and to increase patients' control of their personal health information. However, implementation has created numerous practical problems. Many of these drawbacks are familiar to clinicians who have had to deal with increased costs and decreased efficiency of patient care, without obvious benefit to patient safety or privacy. Economic consequences of HIPAA were recognized promptly after it was implemented. (1) However, in addition to clinical and economic consequences, the adverse effects of HIPAA upon research should not be underestimated. These effects are particularly troublesome because of difficulties created by HIPAA in performing research based upon review of medical records.

Although retrospective chart reviews do not have the cachet of blinded, randomized, prospective research, they have been an important component of our literature in the evolution of our specialty, and most other medical specialties. For generations, residents and clinicians have reviewed clinical data retrospectively to assess outcomes, identify areas of success and failure, seek opportunities for improvement, and define questions that warrant prospective, randomized, controlled studies. For most of the twentieth century, no institutional review board (IRB) approval was sought or expected for retrospective studies, especially since patients were not identified. More recently, most IRBs approved retrospective studies, waiving informed consent, or opined that IRB approval was unnecessary. Under HIPAA, however, a physician must obtain informed consent from each individual in order to review his or her health information and report it (even anonymously), or be able to demonstrate that it is "not practicable" to obtain informed consent. Understandably, many IRBs interpret "not practicable" extremely conservatively in order to protect themselves and their institutions from a stricter interpretation that might be made by federal auditors.

Adverse effects of this HIPAA provision have been noted by other writers. (2-4) Previous researchers have noted that applications for IRB approval have increased, but nearly 70% of the applicants fail to complete the IRB process because of the increased documentation requirements; and there has been a drop of approximately 25% in retrospective case research. (2)

While one might argue that there are potential benefits to this situation, they certainly seem to be overshadowed. The brightest "silver lining" to this regulatory cloud is the possibility that it may stimulate more prospective controlled research, since the IRB regulatory hurdles are nearly as imposing for a chart review as they are for a prospective invasive surgical study. Hence, one might theorize that if investigators have to jump through most of the same hoops anyway, perhaps they might proceed with the longer, more complex evidence-based study. However, although the theory sounds good, that is not the way it works in practice, especially for medical students and residents. Rather, this regulation impedes and stifles young researchers, and I suspect it discourages many who might otherwise have been academically productive.

Throughout my career, I have taught medical students and residents continuously. Like many of my colleagues, I believe that scholarly activity is essential to intellectually vital medical practice, and that writing and research are habits that should be developed early. I have always provided training and support for students' and residents' scholarly activities, and even third-year medical students have been informed that some scholarly activity is expected during their rotation if they wish to receive an "honors" grade. Until HIPAA, this encouragement led many students to start their first research projects and write their first papers, many of which were chart reviews. Moreover, many of them were scholarly and insightful, and they often led to clinical insights and additional research to improve patient care. Now, HIPAA has made such research virtually impossible unless projects are planned and IRB applications are filed months in advance of these students' rotations.

There is certainly no way that a student (even with substantial faculty help) can prepare the multiple complex forms required by an IRB, submit them, and have them reviewed, revised, resubmitted, and approved during a 3- or 4-week rotation. As a result, too many students simply give up on the idea of writing papers and do other things rather than dealing with HIPAA-imposed IRB bureaucracy.

While residents can be more productive because they have longer periods during which they can go through the process, they, too, are spending less time on retrospective reviews than they used to, and they do not appear to be compensating by doing more prospective, controlled studies. They are simply doing less research. It is almost hard to blame them. In some cases, the amount of time and writing involved in obtaining IRB approval exceeds that required for reviewing charts, collating data, and drafting a paper. This is especially true if the IRB requires that they obtain consent from each of the 50 or 100 or 200 patients whose charts they want to review.

Physicians, legislators, and hospital administrators need to work together to find solutions to this problem. While I believe that it was not an intended consequence of the HIPAA regulations, its implications for medical knowledge and academic medical practice are disturbing. Various solutions have been suggested and tried. Nationwide or institution-wide de-identified databases would solve the problem, but they do not permit study of the kind of subtleties that can be obtained from a complete medical record.

I created a consent form for participation in research on the outcomes of otolaryngology treatment that contained all the appropriate HIPAA language and presented it to each of my patients at the time of their initial visit. It required a signature and had a check box in which each patient could consent to (or decline) the anonymous use of his/her personal data for research. The IRB at my previous institution approved this form, but when I changed institutions 2 years ago, my new IRB rejected it as "too general," requiring a separate consent form for each individual paper contemplated.

The HIPAA obstacles to medical research constitute a threat to medical education and good clinical care and should be addressed. Probably the best solution would be an amendment to HIPAA acknowledging that consent is unnecessary for retrospective research. Perhaps it is time for all of us to contact our legislators and get this law fixed.

References

(1.) Kilbridge P. The cost of HIPAA compliance. N Engl J Med 2003; 348(15):1423-4.

(2.) O'Herrin JK, Fost N, Kudsk KA. Health Insurance Portability Accountability Act (HIPAA) regulations: Effect on medical record research. Ann Surg 2004;239(6):772-6; discussion 776-8.

(3.) Kulnych J, Kom D. The effect of the new federal medical-privacy rule on research. N Engl J Med 2002;346(3):201-4.

(4.) Henke PK, Fewel M, Fewel M. Surgical research and the new privacy laws. Bull Am Coll Surg 2007;92(6):26-9.

Robert T. Sataloff, MD, DMA 

Editor-in-Chief

EAR, NOSE & THROAT JOURNAL