The Health Insurance Portability and Accountability Act (HIPAA) was created to fortify patient confidentiality by restricting access to medical records. But a caveat of the law is impeding research. Restrictions have made it hard for some researchers to identify potential subjects, stalling medical device and procedure approval.

For instance, in a preeclampsia study at the University of Pittsburgh, recruitment fell from 12.4 women each week preHIPAA, to between 2.5 to 5.7 women per week after HIPAA. And a poll of 331 U.S. investigators by the Association of American Medical Colleges found 72% of them reporting problems with research that could be traced back to the implementation of HIPAA. Over 68% of respondents reported HIPAA-related effects on patient recruitment, data access, and data acquisition. Investigators have also voiced concerns in the journal Science and in newspapers such as the Washington Times and the San Francisco Chronicle.

Preeclampsia study head Dr. Roberta Ness, M.D., M.P.H. has been among the first to report this trend. She notes the problem stems largely from varying interpretation of HIPAA by regional Institutional Review Boards (IRB). “The IRB has responsibility for interpreting these federal guidelines issued by the Department of Health and Human Services (HHS). Less conservative IRBs permit applications for waivers, which let investigators review records and flag eligible subjects, which the health providers then contact. But more conservative IRBs interpret HIPAA as precluding researcher access to medical records without patient consent,” she notes.

Inconsistencies in how academic institutions interpret HIPAA regulations remain a real threat to clinical and biomedical research. The University of California, for instance, discontinued its 16-year-long rapid cancer case reporting relationship with the California State Cancer Registry. For over a year, researchers were barred from access to large numbers of recently diagnosed cancer cases in that state. Fortunately, the University of California reversed its stance.

The University of Pittsburgh is recognizing this detrimental side affect and is allowing waivers in some studies. Patient records must stay on site, but researchers can screen through and see who might be eligible for studies. Ness says these waivers have been granted in a few studies and have made a great deal of difference.

So what's the next step? “In the best of all worlds, the solution is for the HHS to provide more guidance,” says Ness. Prior to HIPAA, the regulations on clinical research already safeguarded the privacy of human subjects. It's not clear that HIPAA adds any additional protection. Patients may not entirely understand HIPAA consent forms. If they did understand, it's entirely possible patients wouldn't trade delays in research for additional privacy. A committee of the Department of Health and Human Services that advises on such issues has proposed modifying HIPAA rules to harmonize them with the Common Rule that determines other IRB activities. Among other things, this would eliminate accounting for disclosures in connection with research.

If someone doesn't step up to the plate, institutions with conservative IRBs will lose research subjects, and their competitive edge in the bargain. And that's not good for anybody.