American Journal of Law & Medicine

How research will adapt to HIPAA: a view from within the healthcare delivery system .(Health Insurance Privacy and Accountability Act)


While the new Health Insurance Privacy and Accountability Act (HIPAA) (1) research rules governing privacy, confidentiality and personal health information will challenge the research and medical communities, history teaches us that the difficulty of this challenge pales in comparison to the potential harms that such regulations are designed to avoid. Although revised following broad commentary from researchers and healthcare providers around the country, the HIPAA privacy requirements will dramatically change the way healthcare researchers do their jobs in the United States. (2) Given our reluctance to change, we risk overlooking potentially valid reasons why access to personal health information is restricted and regulated. In an environment of electronic information, public concern, genetic information and decline of public trust, regulations are ever-changing. Six categories of HIPAA requirements stand out as transformative: disclosure accounting/tracking, business associations, institutional review board (IRB) changes, minimum necessary requirements, data de-identification, and criminal and civil penalties. However, the silver lining is that these requirements will push research organizations to improve data policies, processes and technology, and these improvements may lead to enhanced trust on the part of the American public. It is time to find constructive ways to implement HIPAA--ways that will accommodate the interests of science while protecting the privacy of medical records.


"[It is] the most dangerous attack on academic freedom in this land in modern times." (3) Discussions around the academic water cooler would certainly lead one to believe this quote came from a modern scientist's discussion of HIPAA. It might refer to HIPAA's privacy standards, as today's researchers are wary and indignant about its limitations: much research will have to be "delayed or perhaps forgone"; (4) the rule "[burdens] biomedical and behavioral research with onerous procedural requirements, ambiguous regulatory standards, and extensive new liability concerns"; (5) "access to medical information may become more burdensome and costly, and some [medical research] may not happen." (6) In a letter to the Secretary of Health and Human Services, the Association of American Medical Colleges (AAMC) complained that "[these] limits ... will seriously impair our ability to conduct clinical trials, clinico-pathological studies of the natural history and therapeutic responsiveness to disease, epidemiological and health outcome studies, and genetic research." (7)

The above quotation, (8) however, is not a comment on the HIPAA privacy standards. Instead, it was the reaction of a political scientist testifying before Congress in the late 1970s as he described the institutional review of ethics in scientific research. This reaction represents a valuable historical lesson that, although our society's attitude toward scientific research and the resulting limitations placed on research are ever-changing, this does not precipitate a dramatic end to research. Indeed, this is not the first time we have changed research as we know it. It is also not the first time that researchers have bewailed such regulations.

In 1978, a document known as the Belmont Report declared that certain ethical principles and guidelines should be used to resolve the problems that "underlie the conduct of research involving human subjects." (9) This report culminated years of intense and often caustic debate--a debate that began in earnest with the opening of the Nuremberg Trial in 1946--about "the medical ethics applicable to experimentation on human beings." (10) The Nuremberg Trial exposed crimes committed during World War II by Nazi physicians against prisoners of war. The investigating tribunal produced a set of comprehensive principles on the ethical conduct of research involving human subjects. These principles, which still drive regulatory efforts today, maintain that:

* Study participants need to give voluntary consent, and have the right to withdraw from the study at any time;

* Studies must yield some good to society, and the potential benefit must be weighed against any risk of harm;

* Studies should be run by qualified researchers;

* Studies should avoid and not cause any adverse effects on individuals (including even the remote possibilities of unnecessary suffering, injury, disability or death). (11)

These guidelines ultimately became the core of all future standards, including those of the Belmont Report.

Although the problems to which the Belmont Report responded were less horrific than the war crimes dealt with at Nuremberg, they were no less disturbing. Perhaps the most infamous example is the Tuskegee Syphilis Study which observed poor African-American men with (and without) syphilis in Alabama from 1932 to 1972. (12) The researchers never provided the subjects with the facts required for informed consent and, even worse, they did not treat the men with the disease, even years after penicillin was found to be a cure. (13)

Another research study that highlighted the need for regulations took place in Staten Island, New York, where researchers injected profoundly mentally disabled children with a mild form of hepatitis serum. (14) Although the parents did sign a consent form, it seemed to indicate that the youths would receive a vaccine against the hepatitis virus. In the end, researchers were found to be at fault for "their deliberate attempt to infect the children with or without parental consent, as opposed to studying the course of disease in children who naturally became sick." (15) In 1963, a similar research project at the Brooklyn Jewish Chronic Disease Hospital involved the injection of live cancer cells into indigent elderly patients without their consent. (16) These tragic studies, and others like them, led to a comprehensive review of research practices in the United States, and, ultimately, the Belmont Report. …

Log in to your account to read this article – and millions more.