ompletion of the sequencing of the human genome presages new opportunities for understanding health and disease. It should facilitate the ability of medical scientists to link genotype with phenotype, to design drugs and treatments tailored to specific polymorphisms, and to suggest lifestyle modific ations based on the nuances of each person's DNA. Regrettably, the opportunities to pursue these long-sought goals may soon be compromised if the privacy regulations issued in the last months of the Clinton administration in response to the federal Health Insurance Portability and Accountability Act (HIPAA) of 1997, and reaffirmed in 2001 by the Bush administration, are implemented.
Congress enacted the HIPAA legislation to make it easier for people to retain medical insurance coverage when they change jobs or insurance plans or to get insurance if they have a pre-existing conditionall good intentions. But Congress was unable to meet its own deadline for developing guidelines for protecting the privacy of health information, leaving it to the administration to do so.
The privacy rules that resulted create extremely stringent controls on the use of medical records and criminal penalties for their misuse. That may sound good. But as the Association of American Medical Colleges President Jordan Cohen pointed out in a July 9, 2001, letter to Secretary of Health and Human Services Tommy Thompson, the new rules are "needlessly burdensome and so complex as to be practically unadministrable." They will create major problems for all forms of medical and health research, and for medical education.
Cohen's letter describes in detail the ways the rule's restrictions on the use and disclosure of protected health information will impair the conduct of clinical trials, clinico-pathologic studies of the natural history and therapeutic responsiveness of disease, epidemiological and health outcomes studies, and genetic research. For example, the rule's requirement to remove some 18 identifying characteristics from medical records to protect the privacy of research participants could essentially render the data useless for post-marketing studies of devices and for epidemiological and other forms of population-based research, such as gene hunting.
Under these new regulations, academic medical centers, health care providers, and insurers will be forced to cope with new legal liabilities and burdens. For example, under the rule a patient can demand that a hospital account for all disclosures of health information for research purposes during the six years preceding the patient's request. Responding to such a request can be difficult for a large academic medical center that has thousands of patients and makes many disclosures for research. To protect themselves, hospitals and insurers may choose to not disclose any data to unaffiliated investigators for research purposes.
Performing multi-center clinical trials of new drugs and devices also would become more difficult, costly, and time-consuming under the new rules. Because of the liability burdens from potential disclosures, each institution in a multi-center trial might choose to perform its own privacy audit, rather than accept the authorization of an external IRB, as is done currently in some clinical trials. This will create a cumbersome and costly privacy bureaucracy.
My criticisms of the HIPAA privacy rules should not be mistaken as a call for changing the medical profession's long-standing respect for individual autonomy, for protecting the privacy of medical and health information, and for assuring informed consent before making protected health information, blood, and tissue samples available for research. But there is a need for balance between the legitimate and compelling need to protect the privacy of individuals and the equally legitimate and compelling need to assess the health of the public and the outcomes of treatment, and to perform research that will lead to their improvement. The public understands this. Research!America reports that 67 percent of people polled indicated a willingness to participate in clinical research so long as their medical and health information cannot be used prejudicially.
Rather than writing rules to regulate every use and disclosure of the medical and health records and specimens of every man, woman, and child in the United States, it seems more reasonable to write laws that enable patients to uncover the unauthorized possession and use of medical data by employers, insurers, and financial institutions and that impose stiff penalties on such possession and use. As they currently stand, the new rules disadvantage health care institutions, impede research, and thereby penalize the public.
Implementation of the new rules as written could not only endanger our ability to advance the science of medicine, it also could reduce our capacity to monitor the quality of health care, the efficacy of drugs and devices, and the health of the public. In addition to endangering our ability to advance medical science and to monitor health care quality, implementation of the new rules also could discourage physicians from reporting unusual infections, thereby adding yet another impediment to our ability to detect episodes of bioterrorism.
The AAMC wrote Secretary Thompson again in November to reiterate its concerns about the problems with these privacy regulations and to request that they be reopened for public comment and modification. So far, the secretary has not responded. The new rules are scheduled to go into effect between Feb. 26 and April 14 of 2003. It is not too soon for all health professionals, and particularly for medical educators and investigators, to familiarize themselves with these rules and to consider their potentially negative consequences. If on reflection you agree the concerns I have raised are important, I suggest you urge scientific and medical societies, university presidents and medical school deans, schools of public health, city and state health departments, and elected officials to call for their revision. (For additional information on the impact of the privacy rules on medical research, contact Jennifer Kulynych at firstname.lastname@example.org.)
Samuel C. Silverstein, M.D., is the John C. Dalton Professor and Chairman of Physiology and Cellular Biophysics and professor of medicine. Robin Eisner, editor of In Vivo, provides editorial guidance for Point of View contributions.