Fax: (312) 695-4307
Local perspective of the impact of the HIPAA privacy rule on research
Article first published online: 9 DEC 2005
Copyright © 2005 American Cancer Society
Volume 106, Issue 2, pages 474–479, 15 January 2006
How to Cite
Wolf, M. S. and Bennett, C. L. (2006), Local perspective of the impact of the HIPAA privacy rule on research. Cancer, 106: 474–479. doi: 10.1002/cncr.21599
- Issue published online: 5 JAN 2006
- Article first published online: 9 DEC 2005
- Manuscript Accepted: 8 AUG 2005
- Manuscript Received: 6 JUL 2005
- Pfizer Pharmaceuticals Health Literacy
- privacy rule;
The operational and economic impact of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 was evaluated. The setting was a natural experiment which involved a single-site, clinical research study that was initiated before the enactment of HIPAA and subsequently modified to be compliant with the new policy.
A formative assessment was conducted of the recruitment process to a clinical trial evaluating the efficacy of an educational strategy to inform Veterans about the National Cancer Institute/Department of Veterans Affairs cosponsored Selenium and Vitamin E Cancer Prevention Trial (SELECT). Personnel time and costs were determined based on weekly accrual for study periods before and after the implementation of HIPAA. Root cause analysis was used to assess the recruitment protocol and to identify areas for improvement.
The implementation of HIPAA resulted in a 72.9% decrease in patient accrual (7.0 patients/wk vs. 1.9 patients/wk, P < 0.001), and a threefold increase in mean personnel time spent recruiting (4.1 hrs/patient vs. 14.1 hrs/patient, P < 0.001) and mean recruitment costs ($49/patient vs. $169/patient, P < 0.001). Upon review of the modified HIPAA-compliant protocol, revisions in the recruitment procedure were adopted. The revised protocol improved weekly accrual by 73% (1.9 patients/wk vs. 7.1 patients/wk, P < 0.001) and resulted in improvements in personnel time (5.4 hrs/patient) and recruitment costs ($65/patient).
Enactment of HIPAA initially placed a considerable burden on research time and costs. Establishing HIPAA-compliant recruitment policies can overcome some of these obstacles, although recruitment costs and time are likely to be greater than those observed before HIPAA. Cancer 2006. © 2005 American Cancer Society.
Compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) (45 CFR Parts 160 and 164) was required in April 2003, creating what has been perceived to be new and costly barriers to clinical research that preserve confidentiality of personally identifiable “Protected Health Information” (PHI).1 HIPAA, enacted in response to the increasing ease of electronic information transfer, is meant to maintain PHI confidentiality and to provide a mechanism of authorization for appropriate disclosure for specific purposes. Implementation of HIPAA by Institutional Review Boards (IRBs) has been especially difficult because required elements of the legislation are disparately interpreted by individual IRBs—often in response to recommendations from an individual institution's legal counsel. These individuals are unlikely to be familiar with the operational workings of most medical records departments and medical settings.2, 3 Unfortunately, lack of uniform application can have a significant adverse impact on the efficiency and costs of clinical research, and for some institutions, clinical research may be impracticable.2–7
The Department of Health and Human Services (DHHS) projected the implementation cost of HIPAA to be $17.6 billion over 10 years.6, 7 To date, no study has reported empirical findings on the actual impact of HIPAA. However, in 2003 and 2004 we were able to evaluate the impact of HIPAA compliance in the setting of a natural experiment in which HIPAA regulations were enacted shortly after a single-site study was initiated at our hospital.
MATERIALS AND METHODS
Patients and Procedure
We conducted a formative evaluation of the recruitment process for a randomized controlled trial that evaluated the effectiveness of an educational strategy (low literacy recruitment brochure and video) to inform eligible veterans about the National Cancer Institute/Department of Veterans Affairs cosponsored Selenium and Vitamin E Cancer Prevention Trial (SELECT).8 The companion study to the larger clinical trial was approved and received grant funding in July 2002. Recruitment to the companion study began in January 2003 and was scheduled to be completed by June 2004. All male veterans 50 years of age and older receiving care in firm A (one of three general medicine clinics, called physician practice firms) at the Chicago VA Medical Center were eligible to participate in the intervention arm of this companion study. Similarly, all male veterans 50 years of age and older receiving care in firm B at the same institution were eligible to participate in the control arm of the study. Randomization occurred at the firm level, as each firm operates independently of each other, with veterans randomly assigned to receive care in only one of the three general medicine clinics. Human subjects approval was received from the Northwestern University IRB in December 2002.
In the protocol approved in 2002 (before HIPAA, Table 1), veterans who attended firms A or B at the Chicago VA and who would be eligible for recruitment into the SELECT study were identified by trained research assistants who reviewed clinic appointment lists and approached prospective veterans in the clinic waiting room before their physician visit. Eligible patients in both the intervention and control arms were briefly informed by the research assistant (RA) about both the SELECT study and this companion study. The RA would explain that the purpose of the companion study was to explore patients' knowledge of prostate carcinoma and clinical trials, and to better understand how best to communicate this information to a veteran audience. They were also told that they may or may not be asked to review various related informational materials on prostate carcinoma prevention and SELECT as part of their participation. Veterans in firms A and B who were interested in participating in the study were asked to sign an informed consent. If consent was obtained, patients were administered a brief baseline interview which addressed knowledge, attitudes, and behaviors related to cancer prevention. Those in firm A were given the low-literacy SELECT brochure and video, while those in firm B were only given the current SELECT handout.
|Pre-HIPAA (n = 63)a||Post-HIPAA I (n = 36)b||Post-HIPAA II (n = 94)c|
|1. RA attends General Internal Medicine Clinic.||1. RA attends General Internal Medicine Clinic.||1. RA attends General Internal Medicine Clinic.|
|2. RA confers with clinic administrative and clinical staff, reminder of study.||2. RA confers with clinic administrative and clinical staff, reminder of study.staff, reminder of study.||2. RA confers with clinic administrative and clinical staff, reminder of study.|
|3. RA reviews daily patient list with clinic staff to identify eligible patients.||3. Clinic staff identify available space for RA to be situated.||3. RA waits at check-in desk with clerk; has recruitment flyers placed at desk and in waiting room.|
|4. RA waits at check-in desk with clinic staff.||4. RA leaves recruitment flyers at check-in desk and in waiting room.||4. Clerk checks in patients for appointments.|
|5. Clerk checks in patients for appointments.||5. RA waits in space for eligible and interested patients to be referred to study.||5. Clerk mentions study to patients; hands out flyer.|
|6. RA introduces self to eligible patients and hands them a recruitment flyer.||6. Clerk checks in patients for appointments.||6. Clerk directly asks patients if they are interested; introduces RA to patients.|
|7. RA describes study to patient, using recruitment flyer and consent form.||7. Clerk mentions study to patients; hands out flyer.||7. Nurse triages patients, brings back to exam room.|
|8. RA answers questions, and works with patient to reach resolution for study participation.||8. Nurse triages patients, brings back to exam room.||8. Nurse reviews patient chart, and if eligible, mentions study and hands patient a flyer.|
|9. Patients that are undecided or lack time are given a flyer and asked to contact RA directly if interested.||9. Nurse reviews patient chart, and if eligible, mentions study.||9. Nurse introduces eligible, interested patients to RA for consent before exam.|
|10. If patient calls, RA promotes study via phone.||10. Nurse introduces eligible, interested patients to RA for consent before exam.||10. RA describes study, answers patients' questions, consents patient (with $5 incentive for participation).|
|11. RA describes study and establishes an in-person meeting.||11. RA describes study, answers patients' questions, consents patient.||11. Physician sees patient; if recognized as eligible, physician also discusses study with patient.|
|12. RA meets interested patient at determined location to describe study.||12. If recognized as eligible, physician also discusses study with patient.||12. Physician introduces eligible, interested patients to RA for consent.|
|13. Physician introduces eligible, interested patients to RA for consent.||13. RA describes study to patient, using recruitment flyer and consent form.|
|14. RA describes study to patient, using recruitment flyer and consent form.||14. RA answers questions, and works with patient to reach resolution for study participation.|
|15. RA answers questions, and works with patient to reach resolution for study participation.||15. Patients that are undecided or lack time are given a flyer and asked to contact RA directly if interested.|
|16. Patients that are undecided or lack time are given a flyer and asked to contact RA directly if interested.||16. If patient contacts RA, RA promotes study via phone.|
|17. If patient calls, RA promotes study via phone.||17. RA describes study and schedules meeting.|
|18. RA describes study and schedules meeting.||18. RA meets interested patient to describe study.|
|19. RA meets interested patient at determined location to describe study.||19. RA consents patient to study and/or reaches resolution on participation.|
|20. RA consents patient to study and/or reaches resolution on participation.|
In April 2003, after the adoption of HIPAA regulations at our hospital, RAs were no longer able to screen clinic logs to identify eligible patients, nor could they directly approach patients without a facilitated introduction by a clerk, nurse, or physician who worked in the clinic. Our study protocol was modified accordingly with oversight from the IRB review section (Table 1). Veterans who attended firm A were eligible for this companion study and those recruited on or after April 14, 2003, were first introduced to the study by desk staff and given a promotional handout which described the study, which allowed patients to identify themselves to either clinic or research staff as interested and willing to be approached for the study. Physicians, nurses, and all other clinic staff were also reminded of the study and asked to aid in the identification and introduction of the research to eligible veterans. An RA was stationed in a visible location in the clinic every day to be available to meet with interested veterans, answer questions, administer informed consent, and to conduct the baseline interview.
Study accrual data (N = 286) was analyzed in weekly increments beginning January 27, 2003, through September 3, 2004. Patients who consented to the study before April 14, 2003, were considered ‘pre-HIPAA,’ while patients recruited during or after July 1, 2003, were considered ‘post-HIPAA.’ A 6-week delay in recruitment was incurred by the IRB review of the revised HIPAA compliant protocol, despite timely submission of the revision. Thus, weekly accrual during this time period was not included in the analysis. Beginning in January, 2004, a new study protocol was implemented and recruitment from January 27, 2004, through September 3, 2004, was considered ‘new-protocol.’
To analyze the economic impact of HIPAA after its initial implementation, costs were calculated based primarily on the RA's salary and time per patient accrued. An RA was in the clinic recruiting patients 40 hours a week at an hourly rate of $12. Weekly accruals pre-HIPAA, post-HIPAA, and after implementation of a new protocol were analyzed using a Student t-test and analysis of variance (ANOVA) model with Scheffe multiple comparisons procedure. All statistical analyses were performed using STATA 8.0 (College Station, TX). Root cause analysis, a structured problem-solving method often applied to resolve organizational problems that usually stem from ineffective policies and procedures, was used to systematically identify the ‘root cause’ of accrual difficulties and to subsequently refine the existing data collection protocol.9, 10
Impact of HIPAA Enactment
A total of 63 patients were recruited to the companion study between January 27 and March 25 of 2003 (pre-HIPAA), while 36 patients were recruited from July 1 to October 29 of 2003 (post-HIPAA I). A 72.9% decrease in patient accrual (7.0 patients/wk vs. 1.9 patients/wk, P < 0.001) occurred after HIPAA enactment (Table 2). Taking into account an RA's salary and time, pre-HIPAA compliance, an accrued patient required 4.1 hours of RA time (personnel cost of $49/patient), while post-HIPAA I accrual required 14.1 hours of RA time (personnel cost of $169/patient). Recruitment pre-HIPAA was on target to complete accrual to the companion study in 60 weeks time (N = 400), compared with post-HIPAA accrual, which would require 158 weeks to recruit the remaining 301 patients to the study assuming the current rate.
|Outcome||Pre-HIPAA||Post-HIPAA I||Post-HIPAA II||Post-HIPAA III||P value|
|n = 63||n = 36||n = 94||n = 93|
|Weekly patient accrual||7.0||1.9||7.1||5.2||< 0.001|
|Hours per patient accrued||4.1||14.1||3.9||5.4||< 0.001|
|Cost per patient accrued||$49||$169||$52||$65||< 0.001|
Root Cause Analysis
To better understand how HIPAA impacted our study accrual, we sought to identify the ‘root cause(s)’ of the sentinel event (diminished patient accrual) through an examination of the process and proximate factors associated with recruitment. Within the process for recruiting patients, contributing human, environmental, and other system factors were reviewed to determine actions for change in the study protocol. Table 1 provides an overview of the primary tasks within the original HIPAA-compliant study protocol.
Upon reviewing the new HIPAA-compliant recruitment strategy, problems were isolated around issues that were viewed as initially ‘uncontrollable’ from the standpoint that our study research personnel were not directly involved in those aspects of the process. In particular, the RA was no longer allowed to directly approach potentially eligible veterans within the General Internal Medicine clinic to discuss the study and subsequently achieve consent from interested and eligible patients. Moreover, after the introduction of HIPAA the expanded responsibilities of clinic physicians, nurses, and clerical staff were reevaluated and included: 1) being aware of the general outline and goals of the study; 2) assessing patients for study eligibility; 3) introducing the general outline of the study to patients who appeared to be eligible for the study; 4) assessing whether the patient was interested in learning more about the research project; and 5) introducing interested and potentially eligible patients to the study RA who was waiting in a separate office in the clinical area. After interviews with the research assistant, clinic medical director, nurse, and two clinic administrative clerks, we concluded that this additional list of role responsibilities was not practical, given the operations of the clinic. In particular, clinic staff were not generally aware of the research study and their integral role for identification and introduction of the study to potentially eligible veterans. Furthermore, because the RA's office was physically distant from the patient waiting area, it was logistically difficult for staff to facilitate introduction of potentially eligible veterans to the study RA.
Consequently, modifications to the responsibilities of the RA and the clinic personnel were drafted and approved by the IRB in January 2004 (Table 1). Specific changes included: 1) individual study introductions and descriptions of roles of each research personnel were formally provided to individual clinic physicians, nurses, and administrative staff; 2) endorsement and inclusion of the General Internal Medicine clinic medical director as study key personnel; 3) addition of a $5 per patient incentive; and 4) identification of a more visible base location within the clinic for the research assistant. In addition, the study coprincipal investigator frequently visited the clinic to meet with the staff and to actively encourage them to evaluate patients for eligibility and to promote participation among eligible veterans.
Impact of Modified Protocol
Between January 27 and April 28 of 2004 (post-HIPAA II), study accrual improved from an average of 1.9 patients/week during the post-HIPAA phase to 7.1 patients/week (P < 0.001) after the implementation of the modified protocol, with 94 patients recruited to the study (Table 2). This translated to an average of 3.9 hours of personnel time per accrued patient ($47/patient). Including the addition of the $5 per patient incentive, per patient costs during post-HIPAA II were estimated to be $52 per patient. Recruitment was again tracked between May 3 and September 3 of 2004 (post-HIPAA III) to determine whether the effect of the modified protocol would be maintained. During this time period 93 patients were recruited (5.2 patients/wk). During post-HIPAA III, each accrued patient to the study required 5.4 hours of RA time, at a cost of $65/patient (Table 2).
In our study, implementation of HIPAA initially led to a more than threefold increase in cost and time associated with subject recruitment, and our projected completion date, assuming the decreased rate of accrual, would have been 2 years beyond the funded period. However, after modifications in study design and role responsibilities, costs per accrued patient decreased and weekly recruitment increased by more than 70%, achieving levels that were about one-third greater than those associated with the pre-HIPAA phase of the study. Our initial evaluation of the recruitment process before and after HIPAA policies were enacted showed that valuable time and resources were inefficiently used, resulting in near infeasibility of the study itself. After our root cause analysis, evaluation of the HIPAA-revised protocol uncovered recruitment inefficiencies and procedural difficulties. Revisions in the study protocol and operations allowed for a more timely and affordable completion of the research study. In interpreting our results, several factors should be considered.
First, in today's technology-driven society, a balance must be sought between protecting patients from the misuse of electronic data while taking advantage of new technology to yield innovations that will improve healthcare. Protecting the confidentiality of electronic patient information requires serious consideration, but the challenges of the new HIPAA regulations may hinder the advancement of clinical research.7 HIPAA, though, unlike the Belmont Report of 1978, did not stem from gross ethical violations. Rather, it addresses potential ethical misconduct regarding the use of personal health information, but the current interpretations and implementations of the new regulations are possibly inadequate.11, 12
Second, while not its intention, the current enactment of HIPAA is resulting in both a decline in the efficiency of research and a need to markedly redesign the operations and protocol of field-based studies. The original impetus for HIPAA was to address certain problems imposed by employer-provided health insurance. Because of the structure of income tax law, 90% of health insurance is provided through an employer.13 HIPAA ensures that an employee is offered health insurance benefits within 12 months of starting a new job regardless of preexisting conditions and that affordable health insurance for individuals is available. One motivation for the creation of HIPAA was based on anecdotal evidence of “job-lock.”8, 13–15 HIPAA was designed to improve the efficiency of labor markets. However, little guidance has been provided to research institutions regarding how HIPAA should be implemented within the context of human subjects' research. As a result, the scope of the policy has expanded to various extents as a consequence of disparate interpretations of the policy by local IRBs.
The limitations of this study should also be discussed. Patient accrual post-HIPAA depended on clinic clerks who generally are very busy routing patients in the clinical setting and who previously did not have an active role in the research study. In addition, time and cost estimates are not comprehensive. A research assistant's time and salary is only part of the direct costs of the field work, and indirect and societal costs were not included. While recruitment improved after the root cause analysis led to a modified protocol, costs associated with additional investigator and RA time required to manage clinical and administrative staff relations and communications were not imputed. Furthermore, it should be noted that each institution may interpret HIPAA differently, and how the IRB in this study viewed the recruitment protocol may be different from how another IRB would review it. Future studies should investigate the impact of HIPAA on multiple study protocols at different performance sites.
Although privacy is of the utmost importance in a world of electronic patient information, HIPAA places a considerable burden on research, which questions the ability to conduct studies in a timely and cost-effective manner. A decrease of 72% in patient accrual and a tripling in cost and time necessary to recruit one patient post-HIPAA compared with pre-HIPAA may indicate that ultimately patients will benefit less from the innovations of clinical research. While, in the end, we were able to mitigate the research burden of HIPAA through an intensive evaluation process and intervening administrative strategy, the costs of such a response were not accounted for in our analysis and may prove more difficult to enact in larger, more complex experimental trials. IRB officials, researchers, and policy planners will need to evaluate natural experiments such as ours to identify the true impact of HIPAA regulations and design efficient clinical trial strategies that balance the desire to improve medical care, conduct affordable research studies, and maintain HIPAA compliance.
- 1National Institutes of Health. HIPAA Privacy Rule. Available at: http://privacyruleandresearch.nih.gov [Accessed September 14, 2004].
- 10Using aggregate root cause analysis to improve patient safety. Jt Comm J Qual Saf. 2003; 29: 434–439., , , et al.
- 13Public finance, 6th ed. New York: McGraw Hill, 2002..
- 14Employment-based health insurance: a look at tax issues and public opinion. EBRI Issue Brief 1999; 211: 1-19..