PURPOSE: We wanted to explore potential effects of the Health Insurance Portability and Accountability Act (HIPAA) on research activities of practice-based research networks (PBRNs). METHODS: To understand the approaches PBRNs are using to advance their research while adhering to HIPAA standards, we combined a literature review, our experiences, and discussions with local HIPAA officers, PBRN researchers in the United States, and individuals involved in drafting HIPAA. RESULTS: HIPAA requires researchers to pay special attention to how they handle patients' protected health information (PHI). For researchers working within PBRNs, which collect information from patients and health care professionals in multiple institutions, the HIPAA Privacy Rule presents additional challenges. PBRN researchers can obtain patient authorization to use PHI, but this process is difficult and may taint the findings of some research studies. Some institutions may allow patients to provide a blanket authorization for study recruitment. PBRNs additionally can collect only "de-identified" data (data with identifying information removed) or, with a data use agreement, can work with a limited data set. PBRNs that blend quality improvement and research can work with PHI, but the researcher and practices must enter into a business agreement. PBRN researchers may need to play active, educational roles in institutional privacy boards to facilitate their research. CONCLUSIONS: There are a number of ways for PBRN researchers to comply with HIPAA short of obtaining patient consent and authorization for every study. Careful planning and consideration of HIPAA issues during study design can go a long way toward reducing frustration later.
PURPOSE: We wanted to explore potential effects of the Health Insurance Portability and Accountability Act (HIPAA) on research activities of practice-based research networks (PBRNs). METHODS: To understand the approaches PBRNs are using to advance their research while adhering to HIPAA standards, we combined a literature review, our experiences, and discussions with local HIPAA officers, PBRN researchers in the United States, and individuals involved in drafting HIPAA. RESULTS: HIPAA requires researchers to pay special attention to how they handle patients' protected health information (PHI). For researchers working within PBRNs, which collect information from patients and health care professionals in multiple institutions, the HIPAA Privacy Rule presents additional challenges. PBRN researchers can obtain patient authorization to use PHI, but this process is difficult and may taint the findings of some research studies. Some institutions may allow patients to provide a blanket authorization for study recruitment. PBRNs additionally can collect only "de-identified" data (data with identifying information removed) or, with a data use agreement, can work with a limited data set. PBRNs that blend quality improvement and research can work with PHI, but the researcher and practices must enter into a business agreement. PBRN researchers may need to play active, educational roles in institutional privacy boards to facilitate their research. CONCLUSIONS: There are a number of ways for PBRN researchers to comply with HIPAA short of obtaining patient consent and authorization for every study. Careful planning and consideration of HIPAA issues during study design can go a long way toward reducing frustration later.
Authors: Jack V Tu; Donald J Willison; Frank L Silver; Jiming Fang; Janice A Richards; Andreas Laupacis; Moira K Kapral Journal: N Engl J Med Date: 2004-04-01 Impact factor: 91.245
Authors: Michelle D Hamilton; Philip A Cola; Joshua J Terchek; James J Werner; Kurt C Stange Journal: J Am Board Fam Med Date: 2011 Sep-Oct Impact factor: 2.657
Authors: John M Westfall; Linda Zittleman; Elizabeth W Staton; Bennett Parnes; Peter C Smith; Linda J Niebauer; Douglas H Fernald; Javan Quintela; Rebecca F Van Vorst; L Miriam Dickinson; Wilson D Pace Journal: Ann Fam Med Date: 2011 Jan-Feb Impact factor: 5.166