Protecting Patients, Protecting Privacy?

Susan Semeleer, Associate Director of Communications, FasterCures
I consider myself a pretty savvy patient. Since being diagnosed in my teens with a rare heart condition, I have seen at least a dozen specialists, undergone still more tests and procedures, and openly provided my most sensitive information to medical personnel. I remember when I first started getting with every procedure goldenrod yellow authorization forms on which my caregivers pledged to guard the privacy of my health information. My first reaction was, “What had you been doing with it?”

Last week, I attended my first FasterCures briefing – a discussion of a new Institute of Medicine report entitled Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health through Research. In 1996, Congress enacted the Health Insurance Portability and Accountability Act, which called for a set of federal standards for protecting the privacy of all personally identifiable health information. The statute attempted to walk a regulatory tightrope: preserving a patient’s reasonable expectation of privacy, while maintaining the free-flow of information necessary for high-quality health care.

The FasterCures panel was the second in a new series of discussions on issues of importance to facilitating medical research. The fact is, though we at FasterCures have been hearing HIPAA bemoaned as an impediment to research since we launched in 2003, the IOM study is the first attempt to gauge its full impact.

Biomedical researchers use health information culled from sources like patient registries, medical records, biobanks and government-supported statistics databases; the HIPAA Privacy Rule was enacted to ensure that patient privacy was not compromised by the compilation of these data. But, according to the findings of the IOM report, HIPAA has compromised both patient privacy and medical discovery, and needs to be revamped if it is to serve the interests of patients as well as researchers.

Panelist Marc Boutin is Vice President of Policy, Development and Advocacy for the National Health Council, and a member of the IOM committee. He says that on the question of medical privacy, a vast difference exists between public perception and legal reality; the average patient assumes a level of protection under the Privacy Rule that simply doesn’t exist, and entities covered under the Rule inconsistently interpret the definition of “privacy.” IOM calls for a revamping of HIPAA, which would include an entirely new framework for health research that would enhance protection of medical data through improved security, transparency and accountability – not just a one-size-fits-all provision that, in reality, fits no one.

What it seems HIPAA has managed to do is create a labyrinthine tangle of regulations, codes and procedures that have thrown roadblocks on the path to medical discovery. The heaviest unintended consequences of HIPAA are felt in research that is abandoned, and opportunities that are lost. In its efforts to protect privacy, HIPAA has hamstrung basic components of medical research, increased research costs, and rendered useless a lot of biomedical data that could help cure disease. What’s more, according to an IOM-commissioned survey, only 13 percent of respondents said they did not want their medical data used “under any circumstances.” What IOM calls for is a mechanism that respects the wishes of those patients, while making it possible to gain safe, transparent access to the potentially-critical medical data of patients who are willing to share it. The key here is accountability, and sensible, practical distinctions between interventional research, and research that is exclusively information-based.

I want my privacy protected. I don’t want my family, my friends, the government, my employer, or my nosy next door neighbor to have the ability to troll my medical data. That said, I came to work for FasterCures for a reason: to dedicate my professional life to finding cures for diseases that kill and cripple. If my medical information is shared on a “need to know” basis – and if that hurdle is sufficiently high – then I have absolutely zero objection to clinicians and researchers seeing my blood work or echocardiograms. Have at it. Find a cure. Save a life.