Working With Human Research Protections

PURPOSE

To provide a primer for novice nurse scientists about the increasingly regulated human research environment.

ORGANIZING CONSTRUCTS

Federal regulations and international guidelines about protection of human research participants are discussed, with particular attention to institutional review boards for human research.

CONCLUSION

Understanding the processes used by institutional review boards to foster ethical human research promotes collaborative interactions and supports compliant research work.

Conforming to HIPAA regulations and compilation of research data

PURPOSE

A set of deidentified patient data compliant with the Health Information Portability and Accountability Act (HIPAA) was compiled, the data lost as a function of unique data elements (UDEs) were measured, and the deidentified data were tested for potential for reidentification.

METHODS

After approval by the institutional review board of an integrated health system, a limited-data set was created by querying the health system's pharmacy, administrative, and financial files for patients discharged between January 1 and December 31, 2000. Using the HIPAA "safe-harbor" method, this limited-data set was converted into a deidentified-data table for future statistical analysis, and UDEs in both data sets were identified and quantified. Unique combinations of commonly available data were also identified.

RESULTS

The limited-data set, representing 4,738 patient discharges, contained 810,456 UDEs in 322,657 records organized into four data tables (demographics, diagnoses, medication orders, and laboratory test results). The deidentified-data table, representing 4,722 discharges, contained 562,171 UDEs in 128 data-type columns in a single data table. About 31% of the data volume was lost. Much of the information lost was of the type that is of special interest to researchers (e.g., time between episodes of care, ages of >89 years).

CONCLUSION

A study suggested that deidentified patient data with a reasonable degree of protection against reidentification were less complete than may be necessary for good research.

Requirements for the group health insurance market; non-federal governmental plans exempt from HIPAA Title I requirements. Final rule

This rule finalizes existing exemption election requirements that apply to self-funded non-Federal governmental plans. In it, we clarify the conditions under which plan sponsors may exempt these plans from most of the requirements of title XXVII of the PHS Act, and provide guidance on the procedures, limitations, and documentation associated with exemption elections. Finally, we revise the requirements to reinforce beneficiary protections for exemption elections.

E-mail consultation: clinical, financial, legal, and ethical implications

BACKGROUND

Communication via e-mail has become widespread. Nearly every practicing neurosurgeon is confronted with numerous unsolicited e-mail requests for medical advice, guidance, or information. Neurosurgeons need to be aware of the clinical, financial, legal, and ethical implications of providing medical consultation via e-mail.

METHODS

A literature review of the penetration of e-mail consultation in medical practice was performed. The data on the potential for reimbursement for provision of these services is presented. Precedents for legal liability are discussed, and issues of compliance with HIPAA regulations are reviewed.

RESULTS

Communication between patients and physicians via e-mail is increasing in prevalence, and a substantial number of physicians are providing medical information via e-mail consultation. Billing for online consultation has been approved by the American Medical Association, and several medical insurance carriers are evaluating the economic consequences of reimbursement for e-mail consultation. E-mail consultation raises potential medico-legal concerns, including establishment of the physician-patient relationship, malpractice liability, and HIPAA compliance.

CONCLUSIONS

The increasing prevalence of e-mail consultation raises new concerns for neurosurgeons. Some of these concerns have yet to be addressed by regulatory commissions or in the courts. If used appropriately, e-mail communication can facilitate physician-patient interactions, improve access to care, save time for each interaction, and possibly reduce costs of care.

The Health Insurance Portability and Accountability Act Privacy Rule

BACKGROUND

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, intended to address potential threats to patient privacy posed by the computerization and standardization of medical records, provides a new floor level of federal protection for health information in all 50 states. In most cases, compliance with the Privacy Rule was required as of April 2003. Yet considerable confusion and concern remain about the Privacy Rule and the specific changes it requires in the way healthcare providers, health plans, and others use, maintain, and disclose health information. Researchers worry that the Privacy Rule could hinder their access to health information needed to conduct their research.

OBJECTIVES

In this article, we explain how the final version of the Privacy Rule governs disclosure of health information, assess implications of the Privacy Rule for research, and offer practical suggestions for researchers who require access to health information.

CONCLUSION

The Privacy Rule is fundamentally changing the way that healthcare providers, health plans, and others use, maintain, and disclose health information and the steps that researchers must take to obtain health data. The Privacy Rule requires researchers who seek access to identifiable health information to obtain written authorization from subjects, or, alternatively, to demonstrate that their research protocols meet certain Privacy Rule requirements that permit access without written authorization. To ensure continued access to data, researchers will need to work more closely than before with healthcare providers, health plans, and other institutions that generate and maintain health information.

Roadmap to HIPAA: keeping occupational health nurses on track

So what does HIPAA require most covered entities to do? At this point, the Privacy Rule compliance date has already passed for all covered entities except small health plans. Most of the requirements under the Privacy Rule dictate the development of appropriate policies and procedures, a notice of privacy practices and other forms, implementation of measures to secure the privacy of PHI, contracting with Business Associates, and training of all involved. For covered entities, testing of the electronic standard transactions to exchange data between participating parties should have begun by April 16, 2003. Although full implementation of the electronic transactions should have taken place by October 16, 2003, the government has allowed covered entities that are still actively working toward compliance to operate under contingency plans. It remains unclear when the use of such plans will be disallowed. After standards are published for claim attachments and first report of injury, these electronic standard transactions will be incorporated by the designated compliance date. Appropriate use of national identifiers will be implemented after final rules and standards are published. For the occupational health nurse who is not a covered entity, the most critical implementation factor is a HIPAA compliant authorization form so the occupational health nurse can continue to obtain necessary PHI. This is essential when attempting to obtain medical information, even for workers' compensation or disability case management. Although these plans are not considered health plans under HIPAA and, therefore, would not require the designation of covered entity, the occupational health nurse frequently needs to obtain PHI to manage these cases. Most providers in the health care community will be covered entities under HIPAA and will not be able to release PHI without a signed HIPAA compliant authorization form. In addition, providers will want a HIPAA compliant authorization form signed when requesting health information from the occupational health nurse. The HIPAA's privacy regulations are considered "the floor" or minimum standard for the protection of PHI. As such, it is likely that these privacy regulations will become the "industry standard" to which all health care professionals will be held. Even though the occupational health nurse may not be a covered entity, implementing appropriate HIPAA procedures is recommended. Knowing that most of HIPAA's privacy rule contains requirements already in place and in practice for most occupational health nurses can take some of the worry out of this complex regulation. Additionally, the nurse interacts with the health care system in a variety of roles. As a health care consumer, occupational health nurses can assert their own patient rights when interacting with covered entities. As the trusted advisor and consultant to many employees, the occupational health nurse can play a vital role in educating employees about HIPAA and assisting employees with navigating an ever-complex health care system. As a health care professional, the occupational health nurse continues to protect and safeguard all PHI while respecting employees' rights and delivering quality care. Staying knowledgeable and up-to-date on the HIPAA regulations as they continue to evolve and change allows occupational health nurses to stay on the right course while mapping their way toward regulatory compliance (see Sidebar for recommended resources).