J Med Sys (2006) 30(1): 65–69 DOI 10.1007/s10916-006-7406-z
RESEARCH ARTICLE
Barriers of HIPAA Regulation to Implementation of Health Services Research Jay J. Shen · Linda F. Samson · Elmer L. Washington · Phyllis Johnson · Constance Edwards · Amy Malone
Received: May 2005 / Accepted: June 2005 C Springer Science+Business Media, Inc. 2006
Abstract Although many perspectives on the impact of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) on health services research have been wide spread, little empirical evidence has been reported about HIPAA-related barriers during the implementation of research projects. Using three cases of health services research projects, this study examined practical barriers created by HIPAA regulation. During the stage of implementation of the three projects, we experienced some HIPAA-related concerns, previously raised in the field of health services research. We found that technically complicated consent forms and privacy protection forms as well as socially-sensitive clinical conditions make patients less willing to participate in research projects; concerns about safety of patient medical information makes health organizations more hesitant to let researchers have access to the patient’s information, especially through electronic transfer; more restrictive IRB processes and challenging patient recruiting processes make health services researchers reluctant to go through the process; and as a result, they may compromise with the scientific soundness of the project. Overall, HIPAA complicates the research process and requires more resources and longer time to conduct research. Keywords HIPAA · Health Services · Research · IRB · Consent form J. J. Shen (B) Department of Health Administration, College of Health Professions, Governors State University, University Park, Illinois e-mail:
[email protected] L. F. Samson · P. Johnson College of Health Professions, Governors State University University Park, Illinois E. L. Washington Aunt Martha’s Youth Service Center, 233 W. Joe Orr Road Chicago Heights, Illinois C. Edwards Department of Nursing, Governors State University University Park, Illinois A. Malone Department of Physical Therapy, Governors State University University Park, Illinois
Introduction The new privacy regulations, authorized by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) with a compliance date of April 4, 2003, has stimulated many perspectives on the potential impact on the health care system. Although the regulation aims to strengthen the protection of patients’ privacy and confidentiality as well as promote patient access to their medical records [1], it restricts the use and disclosure of patients’ information, which potentially creates more obstacles for health service research and implementation of health intervention programs [2]. Some researchers believe that HIPAA imposes new regulatory burdens on health care research already subject to federal regulation [3, 4], others predict that HIPAA significantly affects three key areas of the research process: first, accessing data that includes recruiting subjects and using their medical information; second, creating data that includes interventional studies, survey, and interview research; and finally disclosing data of other researchers and institutions [5]. With the level of concerns about the HIPAA effect on health care research being high, empirical reports about the adverse impact of the HIPAA on research so far have been rare. A study done by O’Herrin, Fost, and Kudsk [6] evaluated the effect of impending HIPAA regulations on Applications for Exemptions from Institutional Review Board (IRB) approval in an academic institution and found that current HIPAA implementation strategies increase workload for the IRB and researchers and increased the dropout rate for proposed studies when investigators were unable or unwilling to meet the regulatory requirements. They concluded that “HIPAA appears to inhibit medical record and database research.” Although this study reported barriers created by HIPAA during the process of grant applications, little empirical evidence has been reported about HIPAA-related barriers during the implementation of research projects. In other words, whether barriers created by HIPAA are merely perceptions or based on reality, remain to be seen. 65
66
Therefore, the purpose of this study was, through the stage of implementation of intervention and health services research projects, to examine practical barriers created by HIPAA regulation. Findings of our study may provide valuable lessons about how to smoothly adjust the research process during the current HIPAA transition period and may create suggestions on how HIPAA regulations might be adopted to eliminate unnecessary barriers to research while maintaining protections for consumers of health care. Methods We used the case study approach to summarize and analyze practical barriers relating to HIPAA regulation after implementing three health services research projects. The three projects were fully or partially supported by a National Institute of Health (NIH) grant, aiming to improve minority health research. All the three projects were implemented in the south suburbs of Chicago, where minority populations, especially African Americans and Hispanics disproportionately reside. According to 2000 census data, percentages of African American and Hispanic populations ranged from 25 to 98%, the median household income in the areas ranged from $17,500 to $48,299, percentages of persons living with income below 200% of the federal poverty line ranged from 16 to 77% in these areas [7]. The first case, a school-based educational program for childhood obesity prevention was implemented in four schools in two school districts. All of the four schools had high percentages of minority students with African Americans ranging from 74 to 85%. Two schools in one district were the experimental group and two schools in the other district were the comparison group. We developed educational programs for fourth-grade students and their parents by adapting an existing curriculum, Step-ForKids [8]. Both educational programs focused on improving nutrition and physical activity for the students and their families. The programs for the students and their parents were offered in April and May, 2004. We held a series of focus-group meetings with school districts, teachers, and parents to discuss barriers to the parents’ and children’s participation. The second case, an ambulatory clinic-based project for the screening of depression in adolescents, was implemented in a community health center, about 60% of whose patients were minorities and of low socioeconomic status. The project started in September, 2004 and is still ongoing. The purpose of this project is to validate a slightly modified version of the PHQ (Patient Health Questionnaire) (modified to make the tool more applicable to the adolescent population) as a tool for screening for depression in adolescents using the Columbia Diagnostic Interview for Children (CDISC) as the validating tool [9]. If the modified version of the PHQ is validated, it will enhance the ease and efficiency of routine screening for depression in the adolescent population. Given the higher risk for depression and associated complications in our population, routine screening is of particular importance.
J Med Sys (2006) 30(1): 65–69
The third case, a hospital-based project for studying potentially unnecessary emergency department (ED) visits among Medicaid patients was implemented at a community hospital from April to August, 2004. Over half of the Medicaid patients who visited the ED of the hospital were minorities. Local community leaders were concerned about unnecessary ED visits among Medicaid patients, which might be caused by insufficient access to ambulatory care. Unnecessary ED visits also contribute to ED crowding [10– 12]. Using questions adapted from the National Health Care Survey (NHCS) [13], we surveyed patients with regard to their access to regular sources of care, reasons for the ED visit, general health status, and satisfaction related to both ambulatory care and care at ED. Comparison was made between Medicaid HMO patients and Medicaid FFS patients with regard to the ED visit. In addition, the most common factors contributing to ED visits in both the populations were considered. Results and discussion The school-based educational program for childhood obesity prevention During the period of implementing this intervention program, we experienced two problems that were related to the HIPAA regulation: parental reluctance limiting participation in the project caused, in part, by complicated consent forms and restrictions limiting the research team’s access to students and families. The lengthy and dry consent form and the project description we used distanced the parents from the project because of lack of familiarity with the forms and requirements as well as the length of the document. According to feedback from the school administrators, teachers, and patents, the consent form was one of the main factors that prevented parents from participating, which resulted in a low participation rate. Among the 480 fourth graders in the four schools, 101 students’ parents (21%) gave signed permission for their children to participate. Among the 37 parents in the two experimental schools who said they would participate in the parental workshop, only eight (30%) attended the parent workshop. Nevertheless, the most sentences appearing on the consent form were taken directly from the federal regulation, which is technical and difficult to comprehend [14]. Our original consent form was a bit shorter and less technical, but we were asked by our IRB to include more specifications, which produced the version used in the pilot project. Terms such as “risk” and “withdraw from the project” raise an alarm and create a barrier that prevents perception of the benefits of participation. Although, recent regulations allow some softening of language, it still seems reasonable to discharge nonclinical interventions from the strictness to which clinical interventions are held. According to the lessons learned from this project, we thought that due to the educational and noninvasive nature of the project, our consent form could have been simpler, shorter, and much softer.
J Med Sys (2006) 30(1): 65–69
Fig. 1 Information flow between parent and researcher
The implication for the IRB in an organization is how to interpret and treat the consent form of nonclinical interventions differently from that of clinical intervention without compromising the federal regulation. In other words, for practical purposes, two versions of the consent form, one for clinical interventions and one for nonclinical interventions, may be used as appropriate to the type of intervention. In addition to the consent form, privacy regulations also presented challenges to the implementation of the project. The schools were not willing to reveal parents’ contact information to the research team, which made it impossible for us to directly contact them. As shown in the left part of Fig. 1, we only had indirect contact with the parents. Every informational change was processed through either the school (i.e., principal, teacher, or student) or the patientteacher organization (PTO). Since the schools did not have adequate resources (even with support from the project), their efforts during implementation were compromised. For example; after distributing two rounds of flyers; when it was time to invite the parents to attend the parental workshop, the research team wanted to make two phone calls to those parents who agreed to participate; one during the week before the workshop and another during the week of the workshop. The schools only wanted their own staff to make the phone calls. We compensated school staff for the extra time calling parents. It turned out that most of the time they could only leave messages for parents because the parents were not at home to receive the calls. This was probably one of the reasons that most of the parents did not attend the workshop. If we had had direct access to reach the parents (the right part of the Fig. 1), we could have tried to call them until we spoke to them directly. We even could have gone to their homes for a face-to-face invitation. We believe that the information flow model, as shown in the right part of the Fig. 1, where the three components (i.e., school, PTO, and researcher) work as an integrated entity, is a more effective model. The ambulatory clinic-based project for screening adolescent depression As a part of the HIPAA regulations, staff were trained to thoroughly explain the nature of the study; how protected
67
health information (PHI) would be used; and to document understanding of the nature of use of PHI by having the guardian of the study participant sign a HIPAA compliant authorization form. After enrolling study participants over a 2 month period, the study results were negatively affected by the high refusal rates and rates of negative results from administration of the CDISC that were not consistent with results that would be expected in a relatively high-risk population. These challenges were not completely unexpected given resistance to screening for mental health problems that had been encountered previously during routine treatment and screening of the clinic population. These barriers had previously been overcome by creating a system of care that seamlessly integrated mental health care with primary health care so that any stigma could be avoided. However, when conducting research on this population, the nature of the authorization process required by HIPAA clearly distinguished the activity related to study participation from the routine integrated mental health and primary care. We believe that by establishing a clear distinction between the research related to mental health and the other services received at the clinic, fear of stigmatization occurred in the potential study population contributing to high refusal rates and unexpectedly high rates of normal test results. To overcome these problems; after implementing the study protocol with minimal effectiveness during the first 2 months, we began to recruit study participants among patients who were already being seen for a mental health condition by the psychiatrist on site (as opposed to those patients who were being treated by a primary care physician). Initial results have shown much higher levels of acceptance among the new study population with fewer refusals and what appears to be more open disclosure during the screening process. Our experience in this project indicates that the HIPAA regulations put even more obstacles for conducting research on mental health conditions and that research on other diseases with social stigma may run into similar problems. Researchers need to be more aware of this type of “extra” barrier and come up with well-prepared plans to recruit patients before implementation. The hospital-based project for studying unnecessary emergency ED visits among medicaid patients Several concerns emerged that limited our ability to successfully implement this process. First, we originally planed to link our survey data to patients’ medical information in the hospital’s electronic database by asking the hospital to send the research team patients’ electronic medical information following related privacy protection rules, as shown in Fig. 2. Hospital staff and administrators, however, were concerned about HIPAA regulations and how much (if any) of the medical record researchers should be allowed to access. There were enormous hassles in trying to get patients to sign the related forms and to go through the IRB process. The hospital was also worried about the potential leaking of the patients’ electronic data if
68
J Med Sys (2006) 30(1): 65–69
would occur only after the visit had already taken place and that retroactively, patients who were identified as having Medicaid insurance would be contacted. This posed some problems because patients frequently could not be reached by phone resulting in a large number of eligible patients who could not be included in the survey. Fig. 2 Link of patient survey data to electronic patient medical information
the data went out of the hospital. Eventually, we gave up the link idea and compromised some of in-depth analysis on the issue. Our experience indicates that under the HIPAA regulation, more resources and time are needed before researchers are able to access patients’ medical information. In other words, in this new HIPAA environment, health services research becomes more expensive and takes longer than it used to take. This concern was compounded by Emergency Medical Treatment and Active Labor Act (EMTALA) regulations which ultimately resulted in the decision of not to approach patients before they were seen at the ED to recruit them into the study, provide informed consent, and facilitate signing of a HIPAA compliant authorization form. Since the study was geared to focus on Medicaid patients, concerns about EMTALA were compounded by concerns about the appearance of discrimination by insurance status if the case could be made that by recruiting patients into the study before they were seen in the ED, we were also erecting a barrier to accessing services in the ED in an under insured population. To effectively address these concerns, we used an approach that allowed for the study to be completed while avoiding potential problems with HIPAA, EMTALA, and concerns about allegations of discrimination by insurance status. First, to avoid HIPAA violations, we used hospital staff to contact patients and recruit them into the study. When staff contacted patients, this contact occurred outside of the context of the preceding ED visit with no information related to that visit available to the staff contacting the patients or the researchers. Further, no identifying information was available except what was voluntarily provided by the patient to interviewing staff. In addition, the patient was informed that this information was unrelated to treatment and was not confidential. No information was allowed on the forms that could statistically be linked to the patient (e.g., no name, birthdate, age, or date of ED visit). Efforts to adhere to confidentiality requirements on the part of the hospital and the researchers limited the specificity of the information that could be accessed and consequently, limited the quality of the study. No electronic or paper records could be accessed; nor could information be accessed that could link relevant patient data obtained from the patient visit to the research efforts, since accessing this information would have required a HIPAA compliant authorization and potentially raised concerns about the study creating barriers to accessing care in the ED along with concerns about discrimination. To allay EMTALA issues and concerns about insurancerelated discrimination, it was decided that data collection
Conclusions Based on our experience, implementing the three empirical health service research projects, HIPAA, and some of the other federal regulations designed to protect health care consumers can create barriers to performing needed research in difficult to reach populations. Several modifications to current HIPAA rules could be implemented to maintain consumer protections while reducing some of the barriers to research. First, for research where the primary risk is breach of patients’ confidentiality (and there is no experimental treatment involved), an authorization should not be required if obtaining the authorization would be likely to pose a barrier to the quality of the project. Instead, language about the potential use of PHI (Patient Health Information) for research should be included on the Notice of Privacy Practices and the patient given the opportunity to request that his/her information not be used for specific purposes as determined by the patient. This will make it much less difficult and costly for researchers to access patients’ medical information, especially electronic medical information. In following this recommendation, ensuring that research is ethical would remain a primary purpose of the Institutional Review Board. Second, one of the underpinnings of the privacy laws; the concept that informed consent is an ongoing dialogue between the patient and physician; should be a standard for assessing the extent to which informed consent for research is adequate. For this process to work effectively, the amount of information provided to potential subjects should be based upon the subject’s ability to comprehend the information and make a judgment that is based upon an understanding of the issue but not unduly affected by fear or misperceptions due to being inundated with information that may be excessively detailed or difficult to comprehend. Third, the information provided should be decided based upon the decision-making process by the researchers and IRB and should consider the nature of the research and the study population. Elaborate consent processes that incorporate HIPAA compliant documentation and consume more time than study participants are willing to give should be considered unnecessary in research of minimal risk. Finally, the IRB should incorporate standards for ensuring that the data collection process is consistent with principles of cultural competence as applicable to the study population and consistent with patient preferences. By reducing the documentation requirements for informed consent while simultaneously ensuring that systems are in place to protect the best interests of the study population, regulatory processes can serve the intended function of protecting the study population while avoiding barriers that excessively restrict research in high risk populations.
J Med Sys (2006) 30(1): 65–69 Acknowledgement This study was supported by the National Institutes of Health, National Center for Minority Health and Health Disparities through grant no. R24 MD00509-1, and Health Care Consortium of Illinois.
References 1. Ross S, Lin C (2003) The effects of promoting patient access to medical records: A review. J Am Med Inform Assoc 10(2):129– 138 2. Dimond K (2002) The impact of privacy regulations on clinical research. J Biolaw Bus 5(3):50–53 3. Amatayakul M (2002) American health information management association. Another layer of regulations: Research under HIPAA. J Am Med Inform Assoc 74(1):16A–16D 4. Kulynych J, Korn D (2003) The new HIPAA (Health Insurance Portability and Accountability Act of 1996) medical privacy rule: Help or hindrance for clinical research? Circulation 108(8):912–914 5. Olsen D (2003) HIPAA privacy regulations and nursing research. Nurs Res 52(5):344–348 6. O’Herrin J, Fost N, Kudsk K (2004) Health Insurance Portability Accountability Act (HIPAA) regulations: Effect on medical record research. Ann Surg 239(6):772–776, discussion 776– 778
69 7. Cook County Health Department, Statistics: 2000 census data. 2004. Available at http://www.cookcountypublichealth.org/. Accessed on November 3, 2004 8. Swoboda C (2004) Steps for Kids 2003. Food and health communications. Available at www.foodandhealth.com. Accessed on August 23, 2004 9. Lucas C, Zhang H, Fisher P, Shaffer D, Regier D, Narrow W, Bourdon K, Dulcan M, Canino G, Rubio-Stipec M, Lahey B, et al. (2001) The DISC predictive scales (DPS): Efficiently screening for diagnoses. J Am Acad Child Adolesc Psychiatry 40(4):443–449 10. Derlet RW, Richards JR (2000) Overcrowding in the nation’s emergency departments: Complex causes and disturbing effects. Ann Emerg Med 35(1):63–68 11. Lambe S, Washington DL, Fink A, Laouri M, Liu H, Scura FJ, Brook RH, Asch SM (2003) Waiting times in California’s emergency departments. Ann Emerg Med 41(1):35–44 12. Miro O, Antonio MT, Jimenez S, De Dios A, Sanchez M, Borras A, Milla J (2000) Decreased health care quality associated with emergency department overcrowding. Eur J Emerg Med 7(1):79–80 13. National Center for Health Statistics, 2004, National Health and Nutrition Examination Survey. Available at http://www.cdc. gov/nchs/. Accessed on January 3, 2005 14. Office of Human Subjects Protections. Consent forms from federal regulation, 2004. Available at http://moved.osophs.dhhs. gov/. Accessed on September 3, 2004
