Health Insurance Portability Accountability Act (HIPAA) regulations: Effect on medical record research

Objective: To evaluate the effect of impending HIPAA regulations on Applications for Exemptions from Institutional Review Board (IRB) approval. Summary Background Data: HIPAA was implemented to reduce potential for misuse of personal information and restricts access to medical records by insurers, employers, and clinical researchers. We hypothesized that HIPAA regulations adversely impact medical records research. Methods: The UW-Madison Human Subjects Committee database was accessed to evaluate success and delays in processing Applications for Exemption between September 1999 and March 2003. The number of protocols submitted, number of required revisions, and number considered nonexempt (requiring full IRB review) were determined. Results: Prior to 2000, applications for medical records research were rare (11 applications in 1999-2000). In anticipation of the implementation of HIPAA regulations, a new application process was instituted in 2001. During that year, 92 of 103 were approved by an expedited process with few requiring full IRB approval. In 2002 to 2003, submissions increased to 199 and approval without revision dropped to 59% (P < 0.0001) as the number requiring revision (25%) and full IRB approval (16%) increased significantly (P < 0.0001 and P < 0.05, respectively). Of the 31 requiring full IRB approval, 7 were pursued while 24 (77%) were abandoned. Conclusion: HIPAA appears to inhibit medical record and database research. Ethical considerations in healthcare research are paramount, but current HIPAA implementation strategies increase work-load for HSC and researchers, and increase the dropout rate for proposed studies when investigators are unable or unwilling to meet the regulatory requirements. It is unclear whether or to what degree the new requirements add to protection of privacy. Studies designed to investigate the costs and effects on quantity and/or quality of research should be prospectively implemented.