Could HIPAA hamper research?

Information Management Journal, Sep/Oct 2003 by Swartz, Nikki

Experts say the U.S. Health Insurance Portability and Accountability Act (HIPAA) is making it more difficult for medical researchers to access large amounts of patient data, and some researchers fear that could jeopardize critical studies on drug safety, medical devices, and how to better predict and prevent diseases.

HIPAA, designed to protect individuals' personal medical information, explicitly outlines how medical records can be given to third parties and carries stiff penalties for violations. It was not intended to hamper academic medicine, but many say it may be doing just that. Major teaching hospitals like Johns Hopkins University in Baltimore have systems in place to manage the process of making medical data available for research under HIPAA, and some ongoing, large-scale research efforts rely on volunteer participants. But researchers are concerned about the fate of new studies that seek to examine large population samples. Such studies typically rely on data not only from teaching hospitals, but also from community hospitals, medical clinics, and other smaller facilities.

In an interview with Computer World, Dr. David Savitz, chair of the department of epidemiology at the University of North Carolina Chapel Hill, said HIPAA has "increased the perceived risks" for smaller institutions to cooperate with researchers. HIPAA provides ways for smaller hospitals to share data with medical researchers. However, information that could be matched to individual patients is restricted unless permissions or waivers are granted.

Researchers worry that the HIPAA guidelines are so cumbersome and the penalties for violations so steep that many community hospitals and clinics may decide it is safer and easier not to share data.

The widespread use of a standard HIPAA-compliant computerized recordkeeping system could solve the problem, allowing records to be quickly "de-identified" and transmitted. But many hospital records are not in digital form, and experts say preparing records for researchers would be burdensome. The Association of American Medical Colleges hopes to compile a database so it can document the effect of HIPAA on research activities.