Academic health centers are committed to ensuring the privacy and confidentiality of the patients and research participants whom they serve and support the establishment of appropriate compliance standards and infrastructures for patient protection.

The Health Information Technology for Economic and Clinical Health (HITECH) Act of the American Recovery and Reinvestment Act (ARRA) directs the Department of Health and Human Services (HHS) to issue a series of regulations and guidance documents that will expand the privacy and security obligations of covered entities, business associates, personal health record vendors, and others (already regulated by HIPAA).

The AAHC is concerned that adding to the already extensive privacy restrictions of HIPAA will continue to stifle research at academic health centers and threaten the nation’s global competitiveness.

Read the AAHC’s comment on and
recommendations for the HITECH enforcement rule.

The AAHC continues to monitor and inform its members of the latest developments

 

AAHC Position Statement on the HIPAA Privacy Rule and Research

• The Association of Academic Health Centers (AAHC) believes the negative impact of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule on research has created the need for a new regulatory framework to govern, protect, and enhance the privacy of research participants while at the same time ensuring the advance of the nation’s research enterprise. 

• The AAHC recommends that Congress authorize the Secretary of Health and Human Services to create the new regulatory framework to protect the privacy of research participants.  
• The AAHC recommends that once this new framework for privacy of research participants is established, research should be exempted from the Privacy Rule. 
  • The new framework should include the creation of a certification process for institutions to qualify as “safe harbor” entities similar to what occurs in Canada and the United Kingdom. 
• The new framework should establish significant penalties for the intentional and malicious breach of privacy as well as a solid mechanism to enforce such penalties. 
  
• The AAHC recognizes that the establishment of a new framework and the exemption of research from the Privacy Rule will take time. 
  • In the interim, the AAHC recommends that the U.S. Department of Health and Human Services take immediate action to harmonize the HIPAA Privacy Rule with the Common Rule and all other federal regulations governing research.  
• The AAHC recommends that Congress develop legislation to ensure that the Common Rule and the new framework extend to all research conducted in the United States regardless of its funding, sponsor, or location.  

To read the full Position Statement, click here.

To learn more about AAHC educational and advocacy activities, contact the AAHC office.

 

AAHC Findings

The AAHC surveys on the HIPAA Privacy Rule revealed significant negative impact on the research infrastructure and confirmed threats to the nation’s research enterprise.

Negative consequences include:

• Difficulty recruiting participants
• Barriers to diversity in research studies
• A slowing in the pace of research
• Increased costs to research
• Unfinished research studies
• Inability to access critical information
• Potentially greater obstructions to multi-site research
• Hindered access to specific sources of stored data
• Complex and duplicative administrative procedures

68.2% of vice presidents for research at academic health centers who responded to the survey said the impact of the HIPAA privacy rule on the pace of research throughout the nation was negative or strongly negative.

The AAHC surveys also showed a significant impact on Institutional Review Board (IRB) processes, including:

• 76.6% of the survey respondents said their institution’s IRB had assumed additional responsibilities to address the Privacy Rule, including approving waivers of HIPAA authorizations.
• 62.3% of the respondents characterized the impact of these additional responsibilities on the IRB members and staff as negative or strongly negative.

             For more details, read the report.

The AAHC surveys had significant findings about the understanding of the HIPAA Privacy Rule by staff, researchers, and research participant.

• 82.7% of respondents rated the average research participant’s understanding of the language in HIPAA authorization documents as average or worse.
• 78.1% rated the average research participant’s understanding as average or worse in minimal risk studies.

 

To sustain the research enterprise, the AAHC calls for harmonization of the HIPAA Privacy Rule with the Common Rule and other regulations governing research (read the full AAHC Position Statement).

 

AAHC findings are detailed in its reports: The HIPAA Privacy Rule:  Lacks Patient Benefit, Impedes Research Growth and HIPAA Creating Barriers to Research and Discovery.

 

 

To learn more about establishing and optimizing the research administrative infrastructure, consider the AAHC Clinical Trials Administration Toolkit.