Restrictive Patient Privacy Laws Could Thwart Research

WASHINGTON—When the National Coalition of Cancer Research (NCCR) brought its concerns about the impact of proposed patient privacy regulations on medical research to Capitol Hill, it got strong confirmation about its fears from the founder of the House Cancer Awareness Working Group.

“Privacy is going to be, in the next few years, one of our central research issues,” said Rep. Rick Lazio (R-NY), who voiced agreement with the principle that a patient’s confidential data should remain private. “The question is whether we will build a wall around that data so that the legitimate needs of the research community—and by extension, all of us who benefit from the research—will be thwarted by an overly prescriptive privacy law.”

A rising concern among medical researchers is that efforts to ensure patient privacy will limit or prevent important areas of research.

Several states, including Minnesota and Oregon, have passed privacy legislation, and the Department of Health and Human Services (HHS) has proposed a lengthy set of regulations that would govern the release of health information that might reveal the identity of individual patients.

Medical research organizations, including NCI, the American Cancer Society, American Society of Clinical Oncology, and American Society for Therapeutic Radiology and Oncology, have protested to HHS that the draft rules would threaten vital health research.

The NCCR briefing was intended to acquaint congressional staffers with the issues and the dangers perceived by cancer researchers as the nation debates how best to protect patient privacy. “It is the balance that we are looking at,” said oncology nurse Kathi Mooney, RN, PhD, interim dean for research at the University of Utah College of Nursing.

Several speakers stressed that the medical community was not questioning the need for greater privacy protection. They noted that information can be easily extracted from databases and transmitted, and that the potential for discrimination in employment and insurance is becoming even greater with advances in identifying the genetic basis of many diseases.

“There is a mutually necessary and beneficial partnership between the research community and the patient community, and we believe very strongly that protection of the patient’s confidential medical records is an absolute requirement,” said Anna D. Barker, PhD, president and chief executive officer of Bio-Nova, Inc., Portland, Oregon. “However, we also have to protect the research that will save those same people.”

The issue is neither theoretical nor philosophical, “it is a real problem,” added Lee Joseph Melton III, MD, professor of clinical epidemiology, Mayo Medical School. “We can’t be in a position where people are making life and death decisions and don’t have accurate information on which to base those decisions.”

Dr. Melton acknowledged that a legitimate conflict exists between an individual’s privacy and the need for access to medical data for research purposes. “We’re all patients,” he said. “We don’t want somebody rummaging around in our medical records. Yet there is socially important research that we have to do for the benefit of all of us.”

He cited several examples of the types of research that rely on reviews of medical records and that could suffer under the proposed HHS regulations: monitoring of population health, identifying risk factors and high-risk populations, determining the effectiveness of treatment, quantifying prognosis, assessing the usefulness of diagnostic and screening tests, and analyzing the cost effectiveness of tests and treatments.

Under Minnesota law, researchers must ask patients for the right to use their records for research, and if, after several attempts, a patient fails to respond in writing, this failure is regarded as implied consent. Dr. Melton said that at the Mayo Clinic, 79.5% of patients had given their consent, 3.7% had refused, and 16.8% had failed to respond. Because of implied consent, this gives Mayo researchers access to 96.3% of patient records.

“If we had to get positive consent, then we would only know 80% of the results, and all of our research would be questioned,” he said.

However, 96.3% is an overall consent rate. People with certain conditions that embarrass them or raise fears of employment or insurance discrimination—most notably, mental illnesses—give their consent at a lower rate. “Right now, at the Mayo Clinic, I would not do another study of mental health,” Dr. Melton said.

Depression is increasingly recognized as a significant problem among cancer patients, he noted. Yet if Mayo did a study showing depression was not a major problem, “would that be true or would the findings result because the depressed patients didn’t allow use of their data?”

National Law Desired

Dr. Barker said that medical researchers want a national privacy law to avoid a patchwork of varying and perhaps conflicting privacy laws at the state level.

“We have to preempt these state privacy laws; we have to have one national set of standards that everyone understands and can live with,” she said. “We have to go to realistic standards to de-identify information, so that the data we need for research have some value.”

Today, clinical trials are carried out under what is known as the “Common Rule,” which relies heavily on an institutional review board (IRB) at each center to supervise the work, including assuring that informed consent is obtained from patients.

IRBs are “an effective way of protecting the confidentiality of patient records and also the individual identification of patients,” Dr. Barker said. “The bottom line is that in 40 years of clinical trials from the National Cancer Institute, to our knowledge, there has never been a breach of confidentiality. We in the research community believe that we can empower and fund the IRBs already in place and solve this problem without the added bureaucracy.”