Impact of the HIPAA Privacy Rule on Health Services Research Deborah Klein Walker (Abt) AcademyHealth Meeting, Seattle, June 25, 2006

Impact of HIPAA Privacy Rule 2 The Health Insurance Portability and Accountability Act (HIPAA) HIPAA passed in 1996 HIPAA regulations, Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) went into effect on April 14, 2003, for most covered entities A covered entity is a health plan, health care clearinghouse or health care provider that transmits any health information in electronic form in connection with a transaction covered by the Rule. Introduction and Background for Study

Impact of HIPAA Privacy Rule 3 Introduction and Background (continued) The HIPAA Privacy Rule created a category of protected health information (PHI) which may be disclosed to others only under specified circumstances and conditions

Impact of HIPAA Privacy Rule 4 Introduction and Background (continued) Oh No

Impact of HIPAA Privacy Rule 5 Questions What are the most significant effects of the Privacy Rule so far? – Are researchers avoiding certain types of studies based on changes in data release policies? – Is restricted data access leading to bias in certain types of studies? – Are organizational policies being altered to reflect HIPAA compliance in ways that go beyond what the Privacy Rule intended? – And many more questions

Impact of HIPAA Privacy Rule 6 Impact of the HIPAA Privacy Rule on Health Services Research AHRQ Goals for the Study: Phase I – Examine initial effects that the HIPAA Privacy Rule is having on health services research Phase II – Determine what steps AHRQ could take to help

Impact of HIPAA Privacy Rule 7 Literature Review Conducted in July, 2004 Searched websites, listservs and Medline Results of search – Articles about the potential impact on researchers (6 citations) – Articles about the actual impact on health services researchers (16 citations) Well-documented impact studies (4) Impacts on registries and public health research (6) Informal or indirect documentation (6)

Impact of HIPAA Privacy Rule 8 Objectives of Study To document the impact of the HIPAA Privacy Rule, above and beyond the Common Rule, on health services research To document problems, if any, with IRBs in processing research containing PHI To document changes made in designing or implementing research To understand perceptions about the impact of the Privacy Rule To obtain suggestions for action needed to mitigate the impact of the Privacy Rule

Impact of HIPAA Privacy Rule 9 Study Design Qualitative study Interviews with 33 senior health care researchers, privacy officers, research compliance officers and IRB directors Semi-structured customized discussion guide for minute interview Interviews conducted from September to December, 2004 Content analyses of interviews organized by study purposes

Impact of HIPAA Privacy Rule 10 Sample Characteristics Purposive sample selected using nominations from peer health services researchers, a review of literature, and programs from health services association meetings Used AHRQ definition of health services research 16 senior health services researchers and 17 privacy officers, research compliance officers and IRB directors Total response rate was 77% Variety of educational backgrounds: PhD (13), MD (7), JD (6), masters degree (6) and bachelors degree (1)

Impact of HIPAA Privacy Rule 11 Sample Characteristics Represented 18 states in all regions of US Represented a variety of health settings – University with medical and health components (8) – Academic medical school (5) – Public health school or department (9) – Academic policy school of center (2) – Private health system (5) – Research and consulting firm (3) – State government (1)

Impact of HIPAA Privacy Rule 12 Organizational Context of Respondents 31 of the 33 respondent settings had an IRB; the number of IRBs ranged from one to eight Most universities were hybrid entities, with the medical school and related services being a covered entity; all research firms and schools of public health were non- covered entities. In most cases, the IRB had responsibility for both the Common Rule and the HIPAA Privacy Rule – Some had a subcommittee to handle HIPAA issues – One had a separate Privacy Board linked to the IRB

Impact of HIPAA Privacy Rule 13 Findings re: Perceived Impacts Yes, the HIPAA Privacy Rule has had an impact (94%) Those reporting substantial impact were – Involved with multi-site studies where follow-up information on patients in a large number of settings was needed – Experiencing a decline in patients agreeing to participate in research studies because of long and complicated consent and authorization forms – Experiencing a lack of participation from small hospitals and provider groups due to a lack of resources

Impact of HIPAA Privacy Rule 14 Findings: Areas of Perceived Impacts Increased costs and resources (90%) Increased time for IRB preparation and participant recruitment (87%) Bias in samples (74%) Problems in obtaining consent of participants (68%) Conflicting IRB interpretations (65%)

Impact of HIPAA Privacy Rule 15 Findings: Areas of Perceived Impacts Difficulties working with multiple IRBs in multi-site studies (65%) Institutions/providers not participating in research (42%) Problems obtaining de-identified data (39%) Problems obtaining waivers or expedited reviews (26%)

Impact of HIPAA Privacy Rule 16 Findings re: Changes in Research Design 90% stated they had made changes in how they plan for and conduct research – More budgeting for longer time periods to recruit research subjects – More budgeting for resources to obtain de-identified data sets Almost half (45%) described a study that had been stopped or altered because of the HIPAA Privacy Rule

Impact of HIPAA Privacy Rule 17 Attribution of HIPAA Privacy Rule Problems The 31 key informants who had experienced an impact of the HIPAA Privacy Rule on health services research suggested the following reasons for the problems: – HIPAA Privacy Rule as written (55%) – Misinterpretations of the HIPAA Privacy Rule (61%) – Overly conservative interpretations of the HIPAA Privacy Rule (61% – All three reasons (26%)

Impact of HIPAA Privacy Rule 18 Conclusions The HIPAA Privacy Rule has had a major impact on health services research during the first 18 months of its implementation The perceived impacts are of two types: – Impacts that may be ameliorated with increased time, resources and clearer guidance and – Impacts that may not be ameliorated without considering changes in the Privacy Rule

Impact of HIPAA Privacy Rule 19 Implications for Policy, Delivery and Practice Monitoring the impact of the HIPAA Privacy Rule on health services research is needed to continually document barriers, as well as facilitators of the removal of barriers, to health services research Develop guidance to address key issues of concern: – Consent and authorization forms – Accessing information using verbal consents – Accessing information using preparatory work for research option in regulations – Creation of de-identified data sets certified by a statistician

Impact of HIPAA Privacy Rule