Irreconcilable Differences? The Case for a Balanced Approach to Health Information Privacy Regulation

I marked my 10th college reunion with a miscarriage.  It was my first pregnancy, and although I was well past 30, I was not remotely prepared for the physical loss, let alone the emotional one. 

I flew home to the East Coast that night.  When I arrived at the registration desk of a highly regarded academic medical center for a D&C the next day, I was handed an “informed consent” document typical of the period.  It included provisions to the effect that excess specimens (which otherwise might be discarded) and information about me and the care I received might be used for research and that as a patient at an institution of higher learning, I agreed to this disposition.  My profound grief temporarily gave way to outrage, and I marked up the document – an occupational predilection of a young lawyer regardless of distressed mental state – to allow the hospital to bill my insurance company for my treatment but not much more.  I handed it back to the receptionist, who curtly informed me that I could sign the form “as is” or be denied treatment.  I had no energy to put up a fight and was in too much pain to walk away, so signed a fresh copy with some vague intention to take it up again later.

 Many years (and three healthy kids) later, I understand the significance of that simple consent – or really notification – process in enabling the clinical trials, health services research, and related public health activities so critical to learning about disease, developing new prevention strategies and interventions, and improving health outcomes.  I appreciate that our expectation of continuous advances in science and medicine requires some measure of sacrifice.  And I now recognize that it is imperative to make the best use possible of existing data and human tissue that otherwise would be discarded, especially as health care costs soar, resources disappear, and consumers, payors, and government officials increasingly and loudly demand that  health care delivery and payment systems become more efficient and effective.  Barak Obama pointed to the importance of health services research during his 2008 presidential campaign in his Plan for a Healthy America:

One of the keys to eliminating waste and missed opportunities is to increase our investment in comparative effectiveness reviews and research. Comparative effectiveness studies provide crucial information about which drugs, devices and procedures are the best diagnostic and treatment options for individual patients. This information is developed by reviewing existing literature, analyzing electronic health care data, and conducting simple, real world studies of new technologies.

Congress embraced this approach in the American Recovery and Reinvestment Act (“ARRA”), appropriating $1.1 billion to comparative effectiveness research and establishing a Federal Coordinating Council for Comparative Effectiveness Research to “foster optimum coordination” and avoid “duplicative efforts”.  The legislation requires the Council, whose members were named in mid-March, to submit its first report to Congress on June 30, 2009, and in it to describe current activities and recommendations for use of the appropriated funds. 

Yet we are in real danger of squandering the tremendous opportunities those funds provide to advance scientific knowledge and translate that knowledge to medical practice.  Why?  Because single-issue privacy hawks have succeeded in recent years in focusing public attention and concern on individual privacy rights without regard to the consequences for society.  The foundational conceptions of a civil society or the common good seem almost entirely absent – or at best an afterthought – in current academic and political discourse on the “ethics” of research with human biospecimens and personal health data.

For example, the federal HIPAA Privacy Rule, which recently has been integrated in significant part and expanded upon in federal legislation through a section of ARRA titled the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, do not recognize research or public health activities as integral to a functioning health care system.  The Institute of Medicine is just the latest organization to investigate the challenges this rule imposes to the pursuit of research and public health activities and recommends several policy changes aimed at mitigation.  I have opined elsewhere that the challenges are due largely to the failure of the HIPAA Privacy Rule to recognize research as equally integral to the delivery of health care as accreditation, peer review, quality improvement, and other activities without which there is no ultimate accountability in the health care system.  This failure, in turn, results in over-valuing “autonomy,” a core privacy right that the HIPAA Privacy Rule is designed to protect.

To my knowledge, the cost of this construct to advancing knowledge and discovery and informing public policy has not been systematically weighed against the questionable benefits the HIPAA Privacy Rule and similar efforts bestow on individual rights.  Fred Cate’s brief but cogent piece delivered to the 2007 Privacy Symposium in Cambridge, The Autonomy Trap, explains how our overwhelming concern with individual choice or control, reflected in laws and regulations mandating various procedural protections, does not actually do a very good job serving its intended purpose of protecting substantive privacy rights.  He argues forcefully that we should permit the use of medical records for research without individual consent, by recognizing the distinction between “privacy of the body – the right to refuse treatment or to choose among medically appropriate treatments – and privacy about the body.”  Quoting from Helena Gail Rubinstein’s article, “If I Am Only for Myself, What Am I?  A Communitarian Look at the Privacy Stalemate,” 25 Am. J. Law & Med. 203 (1999), Cate observes that “relying on consent refuses to recognize ‘in exchange for the vast improvements in medical care, a correlative responsibility on the part of the individual, as a potential consumer of health care services, toward the community.  As individuals rely on their right to be let alone, they shift the burden for providing the data needed to advance medical and health policy information.  Their individualist vision threatens the entire community[.]’” 

 As the current Administration and responsible agencies work to develop regulations to implement the HITECH Act’s (and GINA’s) new privacy and security provisions, it will be incumbent on them to consider the impact the regulations will have on comparative effectiveness and other health services research, with the ultimate goal of reasonably balancing individual privacy rights against scientific discovery, biomedical innovation, and quality improvement.  The stakes are far too high to continue pursuing the goals of scientific and medical advancement, on one hand, and protection of individual privacy rights, on the other, in separate silos.  It is my hope that, pursued together, these initiatives will result in reasonable compromise, for example by enhancing education and transparency about research uses of secondary data (and excess biospecimens) while reducing unnecessary regulatory barriers to bona fide research uses of these invaluable resources.

-Rachel Nosowsky, Senior Counsel at Miller Cannfield