|
Advertisement |
|
|
||
 |
|
|||||
|
|||||
|
 |
||||||
|
||||||
|
||||||
|
Originally published as JCO Early Release 10.1200/JCO.2009.23.6695 on July 20 2009 © 2009 American Society of Clinical Oncology.
Cancer Research and Privacy: The Problem With Being Joined at the HipStanford University Medical Center, Stanford, CA The Health Information Portability and Accountability Act (HIPAA) passed in 1996 had three objectives: to make insurance portable between jobs, to provide tax provisions to make insurance portable, and to simplify administration of electronic health information. Because of concerns that access to electronic health information could endanger privacy, confidentiality standards were created under the HIPAA Privacy Rule. Only after prolonged debate and consideration did the US Department of Health and Human Services elect to subject health research to the final Privacy Rule passed in August 2002.1 The decision to bond research and privacy has affected the cancer research enterprise broadly but unevenly, as evidenced in the report by Goss et al,2 which describes variations in attitudes toward and application of the regulation, in this issue of Journal of Clinical Oncology. What does the HIPAA Privacy Rule actually say, and why is the interpretation so varied and sometimes overly conservative? HIPAA establishes conditions under which protected health information, consisting of any of 18 identifiers including dates other than year and geographic regions smaller than state, may be disclosed for research purposes. Individuals may provide authorization or institutional review or privacy boards may issue waivers of authorization for use of such protected health information for research purposes.1 The interpretation of "specific and meaningful" authorization by individuals under HIPAA is a major source of inconsistent oversight and often results in prohibition of future use of data or biospecimens.3 The extensive but imprecise criteria for waivers of authorization are another major cause of inconsistent application. Despite issued guidance, some institutions have interpreted the vagaries of "minimal risk," "adequate," and "practicably" terminology in the rule so conservatively that even low-risk research has not been able to proceed.3 In the ASCO-sponsored study presented by Goss et al,2 structured interviews with compliance officers and investigators were conducted across a range of sites to provide diversity in geography, size, and nature of institution conducting research. Leading research institutions in this country were represented in the study, yet the inconsistencies in future-use language and application of authorization waivers were striking. The practical result of this variance in setting compliance standards is that multisite research may be complicated, slow, and more costly; it may even be abandoned. How applicable are these data to real-life scenarios and high-impact cancer research? The December 2008 Oncologic Drugs Advisory Committee evaluated the impact of KRAS mutation status on the efficacy of epidermal growth factor receptor (EGFR) –directed therapy in metastatic colorectal cancer.4 A total of 5,500 patients were accrued to seven multicentric, multinational randomized clinical trials conducted with standard treatment with and without EGFR-directed monoclonal antibodies (cetuximab or panitumumab). Despite the fact that 100% of patients had tissue assessed for EGFR expression, tissue availability for KRAS testing ranged from 23% to 92% in individual studies. Among the most frequent reasons for lack of tissue availability and release of additional material was the determination by the institutional review boards and pathology departments of participating institutions that KRAS testing was not explicitly covered by the informed consent in the original studies. Although the retrospective KRAS observations in colorectal cancer are to be applauded as an advance toward personalized medicine and an example of wiser use of health care resources, a restrictive interpretation of authorization might have disallowed KRAS evaluation in a sizeable proportion of participating patients.4–6 Of note, ascertainment in a large portion of randomly selected patients is one of five conditions cited by the US Food and Drug Administration that should be met for retrospective biomarker analyses.4 The KRAS example confirms the variation reported in the ASCO study2 and bodes ominously for future studies that could take advantage of valuable data and biospecimen repositories. The Institute of Medicine (IOM) recently concluded that the HIPAA Privacy Rule is significantly flawed, because it fails to protect privacy, and it impedes health research.3 To provide current, systematic data for deliberation on the impact of the Privacy Rule on research, the IOM commissioned several new surveys and focus groups, as well as the ASCO structured interviews summarized by Goss et al.2 These studies and others demonstrated that a reliance on consent impedes valuable research by reducing recruitment, creates selection bias, produces research obstacles involving repositories and genetic data, and sometimes causes physicians and entire hospitals to opt out of research.7,8 In truth, patients often do not read or understand complex informed consent documents or privacy forms, and ill and distressed patients may not be capable of handling complex decision making.9 Perhaps most importantly, consent does not protect against security breaches, a major concern with electronic health information. The ASCO study2 demonstrates the complexities of interpreting and applying the HIPAA Privacy Rule in scenarios ranging from survivorship research to recruitment for genetic studies to establishment and use of data and biospecimen repositories. As a result, Goss et al call for additional institutional training and the development of best practice guidelines for interpretation of the Privacy Rule. The IOM Committee on Health Research and the Privacy of Health Information, in recognition of fundamental flaws in the Privacy Rule, concluded that a new, innovative framework is needed to both enhance privacy and improve health through research.3 Under the new framework recommended in the committee report, health research would be exempt from HIPAA. Instead, the prior federal standard for human subject research, the Common Rule, would apply to all interventional research.10 The Common Rule allows authorization for future use of data and biologic samples and applies more lenient standards for de-identification. The new framework recommends a different approach for lower-risk, information-based research. Ethical oversight would consider the potential benefits of the proposed research and measures to protect data security and privacy. Emphasis would shift from consent to data security, transparency, and accountability such that patients would gain robust privacy safeguards. If policy makers do not adopt the new framework, the IOM committee recommends a revision of the HIPAA Privacy Rule.3 In particular, authorization for future use of data and biospecimens with ethical oversight and a single consent form for a clinical trial and acquisition and storing of biologic samples should be allowed. Also recommended are greater use of de-identified data, distinction between research and practice for quality improvement, and consistent rules for identifying and recruiting potential research participants. The tension between compliance officers and researchers described by Goss et al2 demonstrates that privacy and research are currently viewed as conflicting values. However, both personal privacy and high-quality research are important societal goals, and policy makers must seek to enhance and promote both. Educating the public about the value of research and how it is done is an essential component of gaining support for shifting the focus from consent to security in information-based research. It is also important for researchers to be knowledgeable and sensitive regarding public concerns about privacy and autonomy.11 With health reform and comparative-effectiveness research at the top of the national agenda and the unprecedented opportunity to personalize cancer care, there is an urgent need to break down the barriers to high-impact research imposed by the current application of the HIPAA Privacy Rule.12 It is time to move from a prescriptive to a goal-oriented approach that uniformly promotes high-quality research together with high-quality privacy protection. AUTHOR'S DISCLOSURES OF POTENTIAL CONFLICTS OF INTEREST The author(s) indicated no potential conflicts of interest. REFERENCES 1. US Department of Health and Human Services. Standards for Privacy of Individually Identifiable Health Information. Final Rule. 45 CFR Parts 160 and 164. http:/www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule. 2. Goss E, Link MP, Bruinooge SS, et al: The impact of the Privacy Rule on cancer research: Variations in attitudes and application of regulatory standards. J Clin Oncol 27:4014–4020, 2009. 3. Nass SJ, Levit LA, Gostin LO. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: National Academies Press, 2009. 4. Oncologic Drugs Advisory Committee. Summary minutes of the Oncologic Drugs Advisory Committee meeting on December 16, 2008. http://www.fda.gov/ohrms/dockets/ac/08/minutes/2008-4409m1-Final.pdf. 5. Van Cutsem E, Kohne CH, Hitre E, et al: Cetuximab and chemotherapy as initial treatment for metastatic colorectal cancer. N Engl J Med 360:1408–1417, 2009. 6. Karapetis CS, Khambata-Ford S, Jonker DJ, et al: K-ras mutations and benefit from cetuximab in advanced colorectal cancer. N Engl J Med 359:1757–1765, 2008. 7. Greene SM, Bennett S, Kirlin B, et al. Impact of the HIPAA Privacy Rule in the HMO Research Network. Seattle, WA: Group Health Cooperative Center for Health Studies, 2008. 8. Ness RB: Influence of the HIPAA Privacy Rule on health research. JAMA 298:2164–2170, 2007. 9. Breese P, Burman W, Rietmeijer C, et al: The Health Insurance Portability and Accountability Act and the informed consent process. Ann Intern Med 141:897–898, 2004. 10. US Department of Health and Human Services. Federal Policy for the Protection of Human Subjects. 45 CFR Part 46. http:/www.hhs.gov/ohrp/policy/common.html. 11. Westin A. How the public views privacy and health research. http://www.iom.edu/Object.File/Master/48/528/%20Westin%20IOM%20Srvy%20Rept%2011-1107.pdf. 12. Garber AM, Tunis SR: Does comparative-effectiveness research threaten personalized medicine? N Engl J Med 360:1925–1927, 2009.
Related Article
This article has been cited by other articles:
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|||||||||||
|
|||||||||||
|
|
Copyright © 2009 by the American Society of Clinical Oncology, Online ISSN: 1527-7755. Print ISSN: 0732-183X
|
