Visit the National Academies Press online, the authoritative source for all books from the National Academy of Sciences, the National Academy of Engineering, the Institute of Medicine, and the National Research Council: • Download hundreds of free books in PDF • Read thousands of books online, free • Sign up to be notified when new books are published • Purchase printed books • Purchase PDFs • Explore with our innovative research tools Thank you for downloading this free PDF. If you have comments, questions or just want more information about the books published by the National Academies Press, you may contact our customer service department toll-free at 888-624-8373, visit us online, or send an email to comments@nap.edu. This free book plus thousands more books are available at http://www.nap.edu. Copyright © National Academy of Sciences. Permission is granted for this material to be shared for noncommercial, educational purposes, provided that this notice appears on the reproduced materials, the Web address of the online, full authoritative version is retained, and copies are not altered. To disseminate otherwise or to republish requires written permission from the National Academies Press. ISBN: 0-309-56486-7, 208 pages, 6 x 9, (2000) This free PDF was downloaded from: http://www.nap.edu/catalog/9952.html Protecting Data Privacy in Health Services Research Committee on the Role of Institutional Review Boards in Health Services Research Data Privacy Protection, Division of Health Care Services Protecting Data Privacy in Health Services Research Committee on the Role of Institutional Review Boards in Health Services Research Data Privacy Protection Division of Health Care Services INSTITUTE OF MEDICINE NATIONAL ACADEMY PRESS Washington, D.C. i About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html NATIONAL ACADEMY PRESS 2101 Constitution Avenue, N.W. Washington, DC 20418 NOTICE: The project that is the subject of this report was approved by the Governing Board of the National Research Council, whose members are drawn from the councils of the National Academy of Sciences, the National Academy of Engineering, and the Institute of Medicine. The members of the committee responsible for the report were chosen for their special competences and with regard for appropriate balance. Support for this study was provided by The Agency for Healthcare Research and Quality, and the Office of the Assistant Secretary for Planning and Evaluation, both of the Department of Health and Human Services (Contract No.282-99-0045, Task Order No.1). International Standard Book No. 0-309-07187-9 Protecting Data Privacy in Health Services Research is available for sale from the National Academy Press, 2101 Constitution Avenue, N.W., Box 285, Washington, DC 20055; call (800) 624-6242 or (202) 334-3938 (in the Washington metropolitan area), or visit the NAP's on-line book- store at www.nap.edu. The full text of this report is available on line at www.nap.edu. For more information about the Institute of Medicine, visit the IOM home page at www.iom.edu. Copyright 2000 by the National Academy of Sciences. All rights reserved. Printed in the United States of America. The serpent has been a symbol of long life, healing, and knowledge among almost all cultures and religions since the beginning of recorded history. The image adopted as a logo-type by the Insti- tute of Medicine is based on a relief carving from ancient Greece, now held by the Staatliche Musseen in Berlin. ii About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html “Knowing is not enough; we must apply. Willing is not enough; we must do.” —Goethe INSTITUTE OF MEDICINE Shaping the Future for Health iii About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html The National Academy of Sciences is a private, nonprofit, self-perpetuating society of distinguished scholars engaged in scientific and engineering research, dedicated to the furtherance of science and technology and to their use for the general welfare. Upon the authority of the charter granted to it by the Congress in 1863, the Academy has a mandate that requires it to advise the federal government on scientific and technical matters. Dr. Bruce M. Alberts is president of the National Academy of Sciences. The National Academy of Engineering was established in 1964, under the charter of the National Academy of Sciences, as a parallel organization of outstanding engineers. It is autonomous in its administration and in the selection of its members, sharing with the National Academy of Sciences the responsibility for advising the federal government. The National Academy of Engineering also sponsors engineering programs aimed at meeting national needs, encourages education and research, and recognizes the superior achievements of engineers. Dr. William. A. Wulf is president of the National Academy of Engineering. The Institute of Medicine was established in 1970 by the National Academy of Sciences to secure the services of eminent members of appropriate p rofessions in the examination of policy matters pertaining to the health of the public. The Institute acts under the responsibility given to the National Academy of Sciences by its congressional charter to be an adviser to the federal government and, upon its own initiative, to identify issues of medical care, research, and education. Dr. Kenneth I. Shine is president of the Institute of Medicine. The National Research Council was organized by the National Academy of Sciences in 1916 to associate the broad community of science and technology with the Academy’s purposes of furthering knowledge and advising the federal government. Functioning in accordance with general p olicies determined by the Academy, the Council has become the principal operating agency of both the National Academy of Sciences and the National Academy of Engineering in providing services to the government, the public, and the scientific and engineering communities. The Council is administered j ointly by both Academies and the Institute of Medicine. Dr. Bruce M. Alberts and Dr. William. A. Wulf are chairman and vice chairman, respectively, of the National Research Council. www.national-academies.org iv About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html COMMITTEE ON THE ROLE OF INSTITUTIONAL REVIEW BOARDS IN HEALTH SERVICES RESEARCH DATA PRIVACY PROTECTION BERNARD LO (Chair), Professor of Medicine, Director of Programs in Medical Ethics University of California San Francisco ELIZABETH ANDREWS, Director, World Wide Epidemiology, Glaxo Wellcome JOHN COLMERS, Executive Director, Maryland Health Care Commission GEORGE DUNCAN, Professor of Statistics, Heinz School of Public Policy and Management, Carnegie Mellon University JANLORI GOLDMAN, Director, Health Privacy Project, Georgetown University, Institute for Health Care Research and Policy CRAIG W. HENDRIX, Associate Professor of Medicine, Johns Hopkins University MARK C. HORNBROOK, Associate Director, Center for Health Research, Kaiser Permanente Northwest LISA IEZZONI, Professor of Medicine, Harvard Medical School, Beth Israel Deaconess Medical Center, Division of General Medicine and Primary Care DONALD KORNFELD, Associate Dean Faculty of Medicine, Chairman, Institutional Review Board, Professor of Psychiatry, Columbia University College of Physicans and Surgeons, Presbyterian University ELLIOT STONE, Executive Director and CEO, Massachusetts Health Data Consortium, Inc. PETER SZOLOVITS, Professor, Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science ADELE WALLER, Partner, Bell, Boyd & Lloyd, Chicago Consultants BARTHA-MARIA KNOPPERS, Professor, Faculty of Law, Senior Researcher, C.R.D.P., Legal Counsel, McMaster Gervais, University of Montreal ROSS A. THOMPSON, Professor, Department of Psychology, University of Nebraska Staff LEE ZWANZIGER, Senior Program Officer RITA GASKINS, Senior Project Assistant v About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html BOARD ON HEALTH CARE SERVICES DON E. DETMER (Chair), Professor of Medical Education in Health Evaluation Sciences, University of Virginia BARBARA J. MCNEIL (Vice Chair), Ridley Watts Professor, Department of Health Care Policy, Harvard Medical School LINDA AIKEN, Director, Center for Health Outcomes and Policy Research, and the Claire M. Fagin Leadership Professor of Nursing and Professor of Sociology, University of Pennsylvania STUART H. ALTMAN, Sol C. Chaikin Professor of National Health Policy, the Florence Heller Graduate School for Social Policy, Brandeis University HARRIS BERMAN, Chairman and Chief Executive Officer, Tufts Health Plan BRIAN BILES, Chair and Professor, Department of Health Services Management and Policy, School of Public Health and Health Services, the George Washington University CHRISTINE CASSEL, Chairman, Henry L. Schwarz Department of Geriatrics and Adult Development, and Professor of Geriatrics and Internal Medicine, Mount Sinai Medical Center PAUL D. CLAYTON, Medical Informaticist, Intermountain Health Care, Salt Lake City, Utah PAUL F. GRINER, Vice President and Director, Center for the Assessment and Management of Change in Academic Medicine, Association of American Medical Colleges RUBY P. HEARN, Senior Vice President, Robert Wood Johnson Foundation PETER BARTON HUTT, Partner, Covington & Burling, Washington, D.C. ROBERT L. JOHNSON, Professor of Pediatrics and Clinical Psychiatry, and Director, Adolescent and Young Adult Medicine, University of Medicine and Dentistry of New Jersey, New Jersey Medical School JACQUELINE KOSECOFF, President and Co-Chief Executive Officer, Protocare SHEILA T. LEATHERMAN, Executive Vice President, United Healthcare Corporation, Center for Health Care Policy and Evaluation, Minneapolis UWE E. REINHARDT, James Madison Professor of Political Economy and Professor of Economics and Public Affairs, Princeton University SHOSHANNA SOFAER, Robert P. Luciano Professor of Health Care Policy, School of Public Affairs, Baruch College GAIL L. WARDEN, President and Chief Executive Officer, Henry Ford Health System JANET M. CORRIGAN, Director, Board on Health Care Services, Institute of Medicine vi About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html Preface Health services research (HSR) exemplifies some of the greatest hopes and greatest fears for collecting and analyzing computerized personal health information. Information routinely collected in the course of providing and paying for health care can be used by researchers to investigate the relative effectiveness of alternative clinical interventions, of alternative methods of organizing, delivering, and paying for health care, and of a variety of health care policies. Such research may improve the effectiveness and efficiency of health care. For example, HSR has identified significant variation in outcomes of care for a specific health problem according to the specialty of the clinician, type of insurance or reimbursement, and gender or ethnicity of the patient. At the same time, using personal health information for such research raises concerns about privacy (whether participants should provide the data) and confidentiality (how the data may be used later). Such concerns are intensified because of public concerns that confidentiality is being eroded for many types of computerized personal information, ranging from credit card purchases to addresses on drivers' licenses. Concerns about maintaining confidentiality of medical information are particularly important because patients disclose sensitive information to physicians that they may not tell close relatives and friends, such as information about their mental health, alcohol and substance abuse, and sexual practices. Confidentiality of medical information used in HSR is particularly important because information on many individuals may be analyzed by researchers without their knowledge or consent. The very power of HSR, to juxtapose patient-level data from a variety of sources on a large number of patients, also raises the largest concerns PREFACE vii About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html about confidentiality. It is often not feasible to obtain consent from every patient in a large population to be studied. Even if consent were possible to obtain, the requirement of consent would likely lead to bias and invalid findings, because those who opt out might differ systematically from those giving consent. Thus, for important HSR to proceed, it is important that the privacy and confidentiality of subjects be adequately protected. IRBs play a key role in protecting the subjects of research. This IOM committee was charged with identifing current and best practices of IRBs that review HSR, both HSR that is subject to federal regulation and research that falls outside it. Within restrictions of the scope and time, the committee found a number of examples of IRBs that had put into place thoughtful, effective measures for reviewing HSR. There appears to be considerable variation in how IRBs deal with such difficult questions as how to distinguish HSR from such activities as quality improvement, how to determine whether a HSR project is exempt from IRB review, and how to determine whether informed consent can be waived for a HSR project. If IRBs adopted the best practices more widely, the quality of HSR could be improved, and the public could be more assured that privacy and confidentiality were being properly safeguarded in HSR. Identifying best practices for protecting privacy and confidentiality in HSR is a promising approach that needs to be further developed. Identifying best practices is a quality improvement technique that builds on the achievements of HSR investigators and IRBs on the leading edge of their fields. It stimulates an explicit discussion of ethical concerns about HSR and potential solutions. Best practices give IRBs the flexibility to respond to the particular issues raised by different HSR projects; a technique that effectively safeguards confidentiality in one HSR project may be inappropriate in another. Finally, the approach of best practices not only helps to bring everyone up to a higher level, but also raises the best level higher as improved methods, such as informational technologies, develop and spread. At the same time, the effectiveness of IRBs in reviewing HSR will depend on organizational factors. First, authors of GAO reports and in the popular press have noted that IRBs often do not have sufficient resources to carry out their charges. The committee found that IRBs will need additional resources and training to oversee HSR better, since HSR differs in important ways from clinical research involving new drugs or invasive medical interventions. Second, protecting the confidentiality of personal health information in HSR is easier if health care organizations effectively protect confidentiality of electronic personal health information, whether used for clinical or administrative purposes. Finally, the committee found that many IRBs play an important role in educating investigators about the protection of human subjects in HSR. In the long run, such educational programs will enhance the quality of HSR proposals submitted for IRB review. I was privileged to work with a committee that was so thoughtful, committed, and embodied with good sense. We were grateful to the IRB chairs and administrators, health services researchers, and leaders of health care organizations PREFACE viii About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html who shared with us their wisdom, experience, and commitment protecting human subjects. The IOM staff was extremely helpful in keeping us on track on a tight schedule. Lee Zwanziger was excellent in pulling together information and ideas from many sources into a coherent, readable report. PREFACE ix About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files. Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted. Please use the print version of this publication as the authoritative version for attribution. Copyright © National Academy of Sciences. All rights reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html [...]... attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html xv Protecting Data Privacy in Health Services Research Copyright © National Academy of Sciences All rights reserved About this PDF file: This new digital representation of the original work has been recomposed from XML files created from the original paper book, not from the original typesetting files... Health services research (HSR) is the study of the effects of using different modes of organization, delivery and financing for health care services More precisely, a recent Institute of Medicine (IOM) publication explained, Health services research is a multidisciplinary field of inquiry, both basic and applied, that examines the use, costs, quality, accessibility, delivery, organization, financing,... without research showing the pros and cons of alternatives in health services This information comes from data on the outcomes that individuals or organizations experienced with a particular input—the selection of a health plan, drug, or health care delivery model Yet these same data are information (often personally identifiable health information) about individuals Most individuals value their privacy. .. from the original typesetting files Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted Please use the print version of this publication as the authoritative version for attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html... ABBREVIATIONS 99 APPENDIXES A Study Activities 101 B Institutional Review Boards and Health Services Research Data Privacy: A Workshop Summary Executive Summary Introduction Workshop Summary References Workshop Speakers Workshop Participants 106 C Protecting the Health Services Research Data of Minors, Ross A Thompson 159 D Confidentiality of Health Information: International Comparative Approaches, Bartha... breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted Please use the print version of this publication as the authoritative version for attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html CONTENTS xiii Contents EXECUTIVE SUMMARY 1 1 INTRODUCTION Privacy. .. to share personal information with a health care provider, are then justifiably concerned about possible breaches in the confidential handling of that information The health services research that we need to support informed choices depends on access to data, but at the same time, individual privacy and patient health care provider confidentiality must be protected HEALTH SERVICES RESEARCH AND QUALITY... typesetting files Page breaks are true to the original; line lengths, word breaks, heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted Please use the print version of this publication as the authoritative version for attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html... heading styles, and other typesetting-specific formatting, however, cannot be retained, and some typographic errors may have been accidentally inserted Please use the print version of this publication as the authoritative version for attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html ACKNOWLEDGMENTS xi Acknowledgments The workshop speakers, listed in. .. for attribution Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html EXECUTIVE SUMMARY 1 Executive Summary Our medical system is changing, with choices to be made by consumers, providers, insurers, purchasers, and policy makers at every level of government The need for quality improvement and for cost saving are driving both individual choices and health system dynamics . reserved. Protecting Data Privacy in Health Services Research http://www.nap.edu/catalog/9952.html Protecting Data Privacy in Health Services Research . of Health Care Services Protecting Data Privacy in Health Services Research Committee on the Role of Institutional Review Boards in Health Services Research