Last week at my job, I was going through the consenting process with a research participant who raised a concern that gave us fodder for a rather non-clinical discussion. Our chat revolved around the Health Insurance Portability and Accountability Act consent form for the study, and whether he could expect any real guarantee of privacy given the ominous scope of the Patriot Act (originally instituted in October 2001, and reauthorized by President Bush in 2006).
The concerns my participant - who is black - expressed were endemic of the legacy of past atrocities committed on blacks by medical professionals under the auspices of the federal government. This has been an ongoing issue in the field of research, but you needn't be black to be afraid of the government.
For the study, he would be providing not only a genetic sample, but also detailed information about his medical and psychiatric health, which would be stored indefinitely in a federally funded repository. In accordance with the policies of HIPAA and the Institutional Review Board - a Penn committee that oversees research on human participants - the consents he signed provided seemingly rigorous safeguards to de-identify this data from the individual.
However, it also seemed that the Patriot Act rendered moot these protections, since the Act allows for the warrantless, undisclosed (and undisclosable) collection of any "tangible items" a federal agency might consider useful in the investigation of "terrorism."
Those items include medical records.
Conspicuously, Section 802 of the Patriot Act defines terrorism so broadly that the efforts of organizations such as Greenpeace and anti-WTO demonstrators could be considered terrorist actions. And, surely, some participants in research belong to such organizations. So it would seem legitimate for such an individual to worry that the government could, on little more than a whim, access not only his or her genetic sample but a wide range of information about his or her emotional health. The most frightening thing is that there is no telling how and for what purposes this information might be used or re-disclosed once it's in the hands of the government.
The HIPAA consent form tells research participants that their personal information will not be used for purposes outside the study unless it is required by law. The same document also states that the IRB "may grant permission to the principal investigator [of the study] or others (emphasis mine) to use your information for another purpose," despite the fact that such information, according to the document, does not become part of your official medical record. Thus, given these statements, and the authority granted to the government by the Patriot Act to seize medical records in the highly dubious "pursuit of terrorism," what do these words actually mean?
I've always presumed that they simply allowed for government or internal audits of research studies. However, the actual basis for the caveats is that HIPAA allows the disclosure of protected health information in response to a court order, subpoena or other lawful process. And even under HIPAA itself - before the enactment of the Patriot Act - such disclosures could be made without a warrant in certain cases. The primary changes to HIPAA provided by the Patriot Act lessen the warrant requirements and impose stronger restrictions on disclosure to the involved parties.
According to one psychiatrist, who declined to provide his name, "What this means for psychiatrists is that if the government wants your record, you give it to them. Period. And you can't tell your patient. Ever."
The Act does not require Penn to enumerate to research participants all of the potential misuses of their information, and Penn's HIPAA documents do not. Despite the fact that doing so might further hinder participation in research, to neglect to do so is deceptive.
In fact, the Patriot Act does not require medical providers or researchers to tell you just how easy it is for a federal agency to obtain your information. HIPAA itself requires no such disclosure, only that "the description [of potential disclosures to law-enforcement agencies] must include sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by this subpart and other applicable law."
Finding out why the University made the decision to be less than fully informative in its consent forms is not simple, especially since the phone number for the Office of Audit, Compliance and Privacy leads directly to voicemail. However, it would be interesting to learn how many times and for what specific purposes medical information of patients and research participants in the Health System have actually been disclosed. But then again, under the Patriot Act, it would be illegal for the IRB or OACP to disclose such statistics!
The ACLU suggests the Patriot Act applies not only to treating physicians, but also to medical-research facilities, including those within the School of Medicine. So, it would seem that the information collected as part of a research study is just as likely to be seized under the Patriot Act as that which you might provide to your treating physician. This paints a picture not of the Patriot Act superseding HIPAA, but acting in conjunction with this law to make records of all types of medical transactions even more accessible to federal agencies.
The history of the government abusing participants in medical research, coupled with legislation easing unrestricted access to personal health information, makes it seem a wonder that people are willing to participate in research at all.
Jarrod Gutman is a research coordinator in the School of Medicine from Philadelphia, Pa. The Fifth Column appears on Fridays.
