Practice-based research network studies in the age of HIPAA

Area of Science:

• Health Services Research
• Medical Informatics
• Public Health Policy

Background:

• Practice-based research networks (PBRNs) conduct research in real-world clinical settings.
• The Health Insurance Portability and Accountability Act (HIPAA) governs the privacy and security of protected health information (PHI).
• HIPAA implementation poses unique challenges for PBRNs due to their multi-institutional nature and data collection practices.

Purpose of the Study:

• To explore the effects of HIPAA on the research activities of PBRNs.
• To understand how PBRNs navigate HIPAA compliance while conducting research.
• To identify strategies for PBRNs to advance research under HIPAA regulations.

Main Methods:

• Literature review to understand existing approaches.
• Analysis of PBRN experiences in adhering to HIPAA standards.
• Discussions with HIPAA officers, PBRN researchers, and HIPAA drafters.

Main Results:

• HIPAA necessitates careful handling of protected health information (PHI).
• PBRNs face challenges with patient authorization for PHI use, potentially impacting study validity.
• Alternative strategies include using de-identified data, limited data sets with data use agreements, or business associate agreements for quality improvement research.

Conclusions:

• PBRN researchers can comply with HIPAA without obtaining individual patient consent for every study.
• Proactive planning and consideration of HIPAA during study design are crucial for PBRN research success.
• Active engagement with institutional privacy boards can facilitate PBRN research compliance.