Practice-based research network studies in the age of HIPAA.

ABSTRACT

PURPOSE: We wanted to explore potential effects of the Health Insurance Portability and Accountability Act (HIPAA) on research activities of practice-based research networks (PBRNs). METHODS: To understand the approaches PBRNs are using to advance their research while adhering to HIPAA standards, we combined a literature review, our experiences, and discussions with local HIPAA officers, PBRN researchers in the United States, and individuals involved in drafting HIPAA. RESULTS: HIPAA requires researchers to pay special attention to how they handle patients' protected health information (PHI). For researchers working within PBRNs, which collect information from patients and health care professionals in multiple institutions, the HIPAA Privacy Rule presents additional challenges. PBRN researchers can obtain patient authorization to use PHI, but this process is difficult and may taint the findings of some research studies. Some institutions may allow patients to provide a blanket authorization for study recruitment. PBRNs additionally can collect only "de-identified" data (data with identifying information removed) or, with a data use agreement, can work with a limited data set. PBRNs that blend quality improvement and research can work with PHI, but the researcher and practices must enter into a business agreement. PBRN researchers may need to play active, educational roles in institutional privacy boards to facilitate their research. CONCLUSIONS: There are a number of ways for PBRN researchers to comply with HIPAA short of obtaining patient consent and authorization for every study. Careful planning and consideration of HIPAA issues during study design can go a long way toward reducing frustration later.