Research Subject Privacy Protection in Otolaryngology

Background  Health Insurance Portability and Accountability Act regulations, which took effect on April 14, 2003, placed new constraints on the use of protected health information for research purposes.

Objective  To review practices of research subject privacy protection in otolaryngology in order to determine steps necessary to achieve compliance with Health Insurance Portability and Accountability Act regulations.

Study Design  Literature review.

Methods  Articles appearing in 2001 in 3 widely circulated otolaryngology journals were classified according to study design. The "Methods" section of each article was reviewed to determine whether the informed consent and institutional review board processes were clearly documented.

Results  Descriptive studies involving case reports and case series were more common than observational studies that include a control group (66% vs 11%). Few case series documented the consent process (18%) and institutional review board process (19%). Observational designs demonstrated better documentation of the consent process (P<.001) and the institutional review board exemption and approval process (P<.001).

Conclusions  Methods used to protect subject privacy are not commonly documented in case series in otolaryngology. More attention needs to be given to research subject privacy concerns in the otolaryngology literature in order to comply with Health Insurance Portability and Accountability Act regulations.

The case series is a study design that describes clinical characteristics of a group of similar patients. The case series is found throughout the surgical literature and performs a critical role in focusing attention on potentially helpful or harmful interventions. In addition, the case series often provides the first line of evidence concerning a new disease entity or epidemic. The first published research to recognize the possibility of a new disease causing immunodeficiency in homosexual men was a case series.¹ Once a case series helps to formulate ideas concerning a disease entity, a more rigorous research design can be performed to test the clinical hypothesis.

The major appeal of the case series design is that it can be performed by full-time clinicians, academic and nonacademic, who have a wealth of clinical information but a dearth of time and funding at their disposal. The educational value of the case series should not be underestimated. The case series often provides medical students and residents with their first research experience. The excitement of a publication or meeting presentation may encourage the trainee to pursue an academic career.

Case series depend on access to individual medical records as the primary source of subject information, because the data for case series are frequently obtained in retrospective fashion via a medical chart review. Obtaining authorization from patients for the use of their medical information for research purposes requires time and money and is therefore less likely to occur in unfunded research such as case series. Federal policy, generally referred to as the Common Rule, allows for the informed consent process to be waived by an institutional review board (IRB) if the proposed research involves no more than minimal risk and will not affect the rights and welfare of subjects.² This policy applies to all research involving human subjects conducted, supported, or otherwise subject to regulation by any federal department or agency that takes appropriate administrative action to make the policy applicable to such research.

In response to growing public concern about electronically based medical records, Congress mandated new patient privacy legislation in the Health Insurance Portability and Accountability Act (HIPAA) of 1996. Compliance with the patient privacy regulations of the HIPAA was required by April 14, 2003. Although the new mandates apply mostly to the use of medical information for clinical and billing purposes, the HIPAA places new constraints on the use of individual medical records for research purposes. The HIPAA mandates that waiver of authorization for use of medical information may be granted by an IRB only after meeting certain broadly defined criteria that have been previously published.^2,3 Although debate regarding the proper use of individual medical records for research purposes with respect to the HIPAA will continue, there is little doubt that all research derived from medical records will be subject to increasing scrutiny by IRBs, the federal government, and the public.

The present study is a survey of documentation of the informed consent and IRB processes as practiced in the otolaryngology literature. The first hypothesis is that the case series is the most common research design in otolaryngology. The second hypothesis is that adherence to the Common Rule is less well documented in case series compared with more rigorous study designs such as observational cohort studies or clinical trials.

The primary objective of the study was to determine the extent of documentation of research subject privacy protection in the otolaryngology literature. We restricted our search to 3 widely circulated otolaryngology journals with peer review: Archives of Otolaryngology–Head & Neck Surgery, The Laryngoscope, and Otolaryngology–Head and Neck Surgery. The journals were reviewed for the year 2001. Each of the journals is issued monthly; therefore, 36 issues were reviewed.

Using a standardized data collection form, each article was reviewed and classified by study design using standard definitions of research design (Table 1). The "Methods" section of each article was then reviewed to determine if the consent and IRB processes were documented. Articles were given credit if a statement was made regarding the obtaining or exemption of consent or IRB approval. Each article was independently reviewed by 2 of us (K.C.W. and M.B.G.). There was disagreement in 4.3% (38/891) of the articles over which study design to assign. These articles were then reviewed by all the authors, and a consensus was reached.

The different study designs and journals were compared with regard to documentation of the consent and IRB processes by Pearson product moment correlation χ² tests (Stata; Stata Corporation, College Station, Tex). A difference was considered statistically significant at P≤.05.

From the 3 journals, 891 articles were reviewed. Descriptive research consisting of case reports and case series was more prevalent than observational cohort designs that include a control group (66% vs 11%, P>.05). This finding was in agreement with the hypothesis that the case series is the most common research design in the otolaryngology literature. The distribution of study designs among the 3 journals for 2001 was similar (Table 2).

All articles were reviewed to determine if the consent process was clearly documented within the "Methods" section of the paper. Few case series (18%) documented the consent process (Table 3). Clinical trials documented the consent process to a significantly better degree than did observational cohort designs (P<.001). Observational cohort designs documented the consent process significantly more often than did case series (P<.001). There was no significant difference among the 3 journals with respect to documentation of the consent process (P>.05).

Documentation of the IRB process was assessed for each article. Again, few case series (19%) reported the method of IRB approval or exemption (Table 4). Clinical trials demonstrated significantly better documentation of the IRB process than did observational cohort designs (P<.001), while observational cohort designs demonstrated significantly better documentation than did case series (P = .001).When the different journals were compared with each other, Archives of Otolaryngology–Head & Neck Surgery demonstrated significantly better documentation of the IRB process than The Laryngoscope (P = .004).

Health care workers, hospitals, pharmacies, insurance companies, and other health care institutions record and track patient health information. Electronic record keeping and transmission make securing these data more challenging. The HIPAA was enacted to make health insurance more affordable and accessible. In addition, the HIPAA contained provisions to develop comprehensive privacy legislation to protect medical records and personal health information. In August 2002, the US Department of Health and Human Services issued a comprehensive federal regulation called the Privacy Rule that gave patients broad protection over the privacy of their medical records.³ The final regulation took effect on April 14, 2003, and mandatory compliance pertains to all health care entities, including health care workers, hospitals, pharmacies, insurance companies, laboratories, and medical researchers. The new rule was adopted for 3 major reasons: to give patients access to and control of their medical information, to restore trust in the health care system by protecting patient information, and to improve the efficiency and effectiveness of health care delivery.²

The federal policy known as the Common Rule requires research protocols and consent forms to be reviewed by an IRB. The IRB has the ability to waive the requirement of informed consent if it decides that the research involves no more than minimal risk and that the rights and welfare of the subjects will not be adversely affected. The new HIPAA regulations for patient privacy are more stringent. For researchers to use health information, they must obtain individual authorization or "deidentify" the medical record of 18 specific identifiers or receive a waiver by an IRB. The new regulations require that research subjects sign a form authorizing the use and disclosure of their health information. The required elements for the authorization of disclosure include a description of the information to be used, a description of how the information will be used, the name of the person requesting the use of the information, an expiration date for use of the information, a statement of the subject's right to revoke authorization, and the signature of the individual. If the subject's authorization cannot be obtained, the researcher may use the information if it is stripped of all identifiers. These identifiers include the following: name; address; telephone and fax numbers; e-mail address; Social Security number; medical record number; health plan account numbers; certificate, license, vehicle, and medical device serial numbers; World Wide Web universal resource locator (URL) and Internet protocol (IP) addresses; biometric identifiers; full-face photographs; and any other unique identifying number, character, or code.² If individual authorization cannot be obtained and the information cannot be deidentified, the researcher may use health information with an IRB or privacy board waiver.

Privacy boards were founded to help researchers meet the privacy requirements of the HIPAA. Under the HIPAA Privacy Rule, any research that involves protected health information, regardless of the source of funding, must be authorized by the individuals whose health data are intended to be used, or the researcher must obtain a waiver of authorization. Privacy boards were specifically established to review requests for a waiver of authorization. To receive a waiver, the researcher must show that the 3 criteria of the Privacy Rule have been satisfied. The 3 criteria include the following: (1) There must be minimal risk to an individual's privacy based on an adequate plan to protect the identifiers from improper use and disclosure, an adequate plan to destroy the identifiers at the earliest opportunity, and adequate written assurances that the information will not be reused or disclosed. (2) The researcher must show that the information could not be deidentified and the research could not be conducted if the research participant's authorization were required. (3) The researcher must demonstrate that the research could not be conducted without access to the information. The regulations also allow all patients or subjects access to their medical information and provide a mechanism for correction of errors in the medical record.

Documentation of compliance with the new regulations will become more important as medical research undergoes closer scrutiny by IRBs, the federal government, and the public. This study demonstrates that documentation of the consent and IRB processes in the otolaryngology literature is infrequent. Documentation is worse among case series compared with prospective cohort studies. There are several reasons that may explain this observation. Physicians may believe that, because they helped to create the data contained in the medical record, they have a right to use that information for their research endeavors. Second, there may be the perception that case series comprise an informal research endeavor that is not subject to the level of oversight required by more rigorous study designs. Because most case series are unfunded and performed by full-time clinicians, there may be insufficient time and money to obtain patient authorization and eliminate all patient identifiers from the medical record. Some researchers may believe that they have adequately protected patient information on their own and do not need to seek approval from an IRB. Likewise, many academic medical centers have patients sign a general waiver to cover the use of their medical information for research purposes that may provide a means of avoiding the consent process.

We recognize that it is likely that the consent and IRB processes were performed but not documented in the publication in certain studies. This is certainly the case for the 20% of clinical trials in the otolaryngology literature that failed to document the informed consent and IRB approval. The failure of documentation is likely secondary to the lack of requirement of such documentation for publication. The one journal (ie, The Laryngoscope) that demonstrated significantly less documentation of the IRB process is also the only journal that made no mention of a requirement of patient consent and IRB approval in its instructions to authors.

What effect will HIPAA regulations have on research? The regulations may help research by restoring trust in the health care and research fields. Patients are more likely to participate in research if they believe that their health information will be protected. The requirement that an IRB approve a patient release of medical information form or waive such forms may improve the overall quality of research, because IRBs require written protocols that clearly state the research question, measures, and methods. Studies, including case series, that follow systematic protocols of data acquisition are less subject to bias and chance findings and will therefore have greater validity. Conversely, more stringent regulations may reduce research productivity. Deidentifying medical information could result in data of questionable completeness, raising concerns about the validity of conclusions.² Some identifiers, such as the location of a subject's home, are important components of epidemiological studies. Academic clinicians and private practitioners may choose not to participate in research activities because of uncertainty about the new regulations or because of the extra effort required to comply. In addition, new burdens will be placed on already overworked IRBs across the country.

The general public values privacy of the medical record and the advances of medical research. The effect of HIPAA regulations on these 2 elements remains to be seen. Of more certainty, however, is the mandatory compliance with these regulations that took effect on April 14, 2003. The most common type of research published in the otolaryngology literature is the case series. This type of research is also the most poorly documented regarding the consent and IRB processes. Improved documentation of the consent and IRB processes will show compliance with the new privacy regulations. Lack of documentation of the consent and IRB processes does not necessarily mean that these processes were not done and does not reflect the quality of the research. Therefore, the absence of this documentation should not be used as a sole criterion to reject an article for publication.

Corresponding author: M. Boyd Gillespie, MD, Department of Otolaryngology–Head & Neck Surgery, Medical University of South Carolina, 135 Rutledge Ave, PO Box 250550, Charleston, SC 29425 (e-mail: gillesmb@musc.edu).

Submitted for publication February 18, 2003; final revision received June 18, 2003; accepted July 14, 2003.