Yale University
CASE 3
IRB CASE 3: REASONABLE RIGHT TO PRIVACY FOR PATIENTS ACCESSING HOSPITAL SERVICES
Type of Institution: Community Hospital
Type of IRB: Biomedical/Socio-behavioral
Type of Case: Biomedical/IRB Operational
Author: Chairman of the IRB
From the Editors:
When research involves hospital patients, part of the IRB’s risk/benefit analysis of a study often involves weighing the impact of subject recruitment methods on the rights of hospital patients to maintain the confidentiality of their hospital medical information. This case illustrates a number of important regulatory and administrative IRB issues that intersect with ethical and regulatory considerations regarding subject recruitment, respect for confidentiality of patient records and the public’s perception of the hospital in the community it serves.
Background
The recent publicity regarding the epidemic of obesity in the United States has led a number of funders, including the National Institutes of Health, to support a variety of research approaches to studying this issue. The ability of a number of herbal and naturopathic compounds to aid in weight reduction, ameliorate insulin resistance and in other ways facilitate metabolic changes aimed at decreasing BMI are being extensively tested around the world. There has been discussion for some time about the use of chromium as a dietary supplement as one approach towards weight reduction through its impact on the alteration of glucose metabolism. This study involved the use of chromium in subjects with impaired glucose tolerance (IGT) and was designed to test the hypothesis that dietary supplementation with chromium could improve impaired glucose tolerance and possibly prevent progression to Type 2 diabetes.
Study Design
The researchers planned to recruit subjects with impaired glucose tolerance (IGT) and test the efficacy of chromium as a dietary supplement along with dietary counseling compared with subjects who received only counseling. The outcome measures included a number of metabolic parameters including weight, glucose tolerance, lipids, and several other related tests of therapeutic efficacy.
Recruitment
Normally, this research group has little difficulty in recruiting subjects to participate in its studies, relying on its well-publicized research platform in the community and strong hospital and community support for its work. Their recruitment efforts have generally consisted of advertising in local newspapers, the hospital newsletter, referrals from local physicians and clinics, and sending informational letters to individuals who have participated in one or more of their previous studies and have provided the research organization with permission to be contacted for possible participation in future research efforts.
In order to participate, subjects were required to meet the standard American Diabetes Association definition of impaired glucose tolerance (IGT) defined as a 2-hour plasma glucose measure of between 140 – 199 mg/dl on a 75-gram oral glucose tolerance test (OGTT). A 2-hour test result greater than 200 defines Type 2 diabetes.
The size of the potentially eligible group was limited to those individuals who
· had undergone 75-gram oral glucose tolerance testing AND
· had results consistent with IGT AND
· who knew their diagnosis AND
· could be notified of the existence of the study.
The recruitment strategies for the study that were initially approved by the IRB involved the standard techniques employed by this research group with an expectation of reasonable enrollment. The researchers discovered, however, that while the results of many oral glucose tolerance tests performed at the hospital were consistent with a diagnosis of IGT, many individuals tested were unaware their results met the definition of IGT and still fewer understood the significance of the diagnosis. This greatly limited direct recruitment from within the local community. Local physicians did not refer many eligible subjects to the researchers as the relationship between the investigators and community primary care providers was found to be less than optimal. Finally, the standard advertising approach and use of the organization’s database of previous study participants failed to substantially enhance enrollment.
Request to Amend Recruitment Methods
Midway through the first year of study implementation, the investigators approached the IRB with this enrollment problem and proposed the study be amended in the following manner. They requested the IRB grant the researchers a Waiver of HIPAA Research Authorization in order to permit direct access to the hospital’s laboratory database. They wished to be provided with an identified list of outpatients who had glucose tolerance testing performed at the hospital lab in the prior 18 months with results that met their inclusion criterion definition for impaired glucose tolerance. The researchers then planned to take the minimum amount of Protected Health Information (PHI) from the laboratory database necessary to mail a letter to each of these individuals informing them that, on the basis of their glucose tolerance testing performed in the hospital laboratory, they were candidates for participation in a study being conducted by the research organization and were requested to call if they would like more information regarding the study. Patients who enrolled in the study would be required to sign the standard informed consent and HIPAA Research Authorization forms in order to participate in the study.
Amendment Discussion
Although the initial study met all Office of Human Research Protection (OHRP) criteria necessary for expedited review, it was not reviewed on an expedited basis but rather was presented to the full IRB for formal consideration. The decision whether or not to expedite a study was made solely by the Chairman of the IRB who often was also the primary reviewer of the protocol as in this case. However, it was the custom in this IRB that all pertinent study documents provided expedited review and approval by the Chairman be presented to the full IRB at the next meeting, even though this is not required by OHRP regulations.
When the request to amend this protocol was received by the IRB office, it was reviewed by the Chairman of the IRB who determined that the amended protocol would still meet all OHRP criteria necessary to permit expedited review. He deemed that the study was not greater than minimal risk and met Research Category #5 of the OHRP Categories of Research that May Be Reviewed by the IRB through an Expedited Review Procedure. He therefore approved the amendment, including the Waiver of HIPAA Research Authorization , on an expedited basis with full knowledge that this amendment would be submitted to the full IRB committee for formal review at the next meeting.
When the committee met, most members strongly disagreed with the Chairman’s expedited approval on the grounds that granting the amendment and thus providing the researchers with identified patient laboratory data without their express authorization constituted an unacceptable breach of patient privacy according to the members’ interpretation of local privacy standards. The committee voted not to approve the amendment request and as a consequence, the Chairman agreed to work with the researchers to create alternative approaches to enhance study enrollment.
Ethical/Regulatory/Operational Issues
The request by the investigators for access to the hospital laboratory database for use as a tool in directly recruiting subjects for participation in the study raised several important operational and ethical considerations for this IRB.
· How much protection should be afforded patients’ PHI in a research hospital? Does a hospital have the right to establish rules for use and disclosure of PHI in its institution that are more stringent than those proposed by the Privacy Rule? What are the considerations that govern disclosure of PHI?
Granting a Waiver of HIPAA Research Authorization to allow researchers to access patient PHI certainly constitutes a breach of patient privacy, yet is routinely performed both ‘…preparatory to research’ and during the course of certain types of studies, and is provided to investigators in accordance with HIPAA regulations as codified in Section 45 of the Code of Federal Regulations, Parts 160 and 164. Here the Office of Civil Rights defines Protected Health Information (PHI) and delineates regulations that govern individual and institutional access to and use of such protected information. It also explicitly describes criteria that must be met for an IRB to alter some or all of the elements that govern how researchers may and may not use PHI in activities related to research. These regulations also differentiate access to PHI in preparation to conducting research (‘preparatory to research’), as well as during the conduct of the study.
Frequently, for example, investigators request and are provided with an identified list of hospital patients who all have the same diagnosis so that researchers may determine the prevalence of the disease entity they wish to study at that hospital. However, researchers’ access to identified patient lists in directly recruiting subjects for study participation without patient authorization depends on the ability of the investigators to successfully argue that their study meets the four criteria necessary to qualify for a Waiver of HIPAA Research Authorization.
These are:
· The research could not practicably be conducted without access to and use of the protected health information.
· There is an adequate plan to protect the identifiers from improper use and disclosure.
· There is an adequate plan to destroy the identifiers at the earliest opportunity consistent with the conduct of research
· There are adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except…for authorized oversight of the research project…
While all IRB’s are provided rough guidance in their decision-making by the language in the HIPAA regulations, they often must be sensitive to local community-defined privacy standards. They are also obliged to consider pertinent patient forms that often delineate important hospital policies concerning payment for hospital services, access to patients’ PHI, and other practice information the hospital deems vital for the patients to know.
IRB Decision
The IRB determined that patients who access routine services at this hospital have a reasonable expectation their PHI will be kept private by the hospital and disclosed only under certain specific conditions as detailed in the hospital’s privacy notice, the hospital admission forms or in some other documents provided to patients. The Patient Acknowledgement forms in use at this hospital include a check box that gives patients the ability to permit or deny hospital researchers the right to use their de-identified information for the purposes of research. Additionally, while the hospital’s Notice of Privacy does inform the patients their PHI may be used for research purposes, it does not state whether it can be used in an identified manner such as for recruitment.
While the IRB recognized they had the legal authority to grant the requested waiver, the hospital’s Notice of Privacy and the two Patient Acknowledgement forms (outpatient and inpatient) did not satisfy the committee’s concerns that hospital patients receive adequate notification regarding how, when and why their medical information might be disclosed for use in research. Specifically, the committee concluded that patients utilizing hospital services should be informed of the possibility their identified PHI might be used or disclosed for use in research. The IRB also expressed concern that disclosing patient PHI to researchers for use in direct subject recruitment without patient authorization might result in a public relations problem for the hospital in the community it serves and should be taken into account in its decision-making regarding the granting of the Waiver. In addition, concerns were voiced that the CEO of the hospital would share these public relations fears. The committee decided, given the language in use in the pertinent hospital documents and the public relations concerns, not to affirm the expedited approval of the amendment by the Chairman.
· How should an IRB judge researchers’ claims they have exhausted all standard recruitment avenues in their enrollment efforts when they are requesting a Waiver of HIPAA Authorization in order to cast a wider and often easier net for eligible subjects?
The investigators provided the IRB with a summary of the range of recruitment efforts conducted by the research team in an attempt to make the case to the IRB that they had, indeed, made good faith efforts at subject enrollment through their usual means and had nonetheless failed. They also expressed concerns to the committee that the need for increased expenditure of time and funds to improve recruitment using the standard approaches would likely jeopardize their relationship with the funder for this and future projects. Finally, they reminded the IRB of the importance of the study given the epidemic of obesity and Type 2 diabetes and the promise of chromium as a potentially important tool in combating these problems.
IRB Decision
Despite the researchers’ arguments and notwithstanding the committee’s thorough understanding of the potential importance of the study, the IRB felt the investigators had not yet worked sufficiently hard in their recruitment efforts and therefore had not met the first element for alteration or waiver of HIPAA authorization:
· The research could not practicably be conducted without access to and use of the PHI.
The committee felt that the study could practicably be conducted without the Waiver and without direct access to patient PHI through enhanced enrollment efforts on the part of the researchers. Despite the committee’s understanding that the Privacy Rule does provide IRB’s the ability to grant investigators access to identified patient information for the purpose of subject recruitment ‘…preparatory to research,’ this IRB defined such access as an unacceptable breach of patient privacy particularly since the hospital forms did not specifically inform patients their identified information might be used for research purposes. The IRB voted to insist that the investigators work harder at subject recruitment and denied them access to the hospital’s lab database.
· What is the obligation of the committee to take into account the expedited approval of the Chairman under such circumstances?
Prior to the full IRB meeting, the Chairman had reviewed the amendment requested by the investigators and had provided them with approval to access the lab database for the recruitment purposes described. A copy of the sample letter to be sent to prospective subjects was submitted as well and also granted expedited approval for use. However, as per the routine of this IRB, all study documents granted expedited approval are submitted for review by the full IRB committee for affirmation of the Chairman’s approval. The committee, however, has the freedom to vote to disapprove the documents or to approve them pending receipt of requested modifications.
IRB Decision
As was the custom in this IRB, the full committee met, reviewed the investigator’s request for the Waiver of HIPAA Research Authorization as well as the Chairman’s expedited approval and overwhelmingly rejected this request by not affirming the decision of the Chairman to grant this amendment expedited approval. It was then the responsibility of the Chairman to inform the investigators that the amendment had not been approved and to discuss with them alternate approaches to improve subject recruitment.
· What actions can the Chairman of an IRB take in helping investigators improve study design and implementation?
The Chairman believed that the IRB had erred in its conclusions regarding the request for a Waiver of HIPAA Research Authorization. He considered the IRB mistaken by confusing ‘protection of human subjects’ with ‘protection of the hospital.’ Clearly, the committee had denied the request for the Waiver, in part, due to concerns regarding potentially negative community responses to receiving investigator letters inviting study participation without first having provided the researchers with permission to access their hospital data. Accordingly, the Chairman sought to revisit the discussion of the Waiver at the next meeting in order to encourage the IRB to reverse itself and approve the amendment . In preparation for the next meeting, he attempted to defuse the IRB’s community relations concerns as well as find ways to support the investigators in creating alternative approaches to subject recruitment.
He took the following actions prior to the next meeting of the IRB committee:
· He reviewed this issue of the potential for a negative public reaction from the community with the hospital CEO who concluded that the potential problem resulting from providing the researchers with access to the laboratory database without patient authorization would likely be nominal, although he agreed that the final decision regarding granting the Waiver rested with the IRB. The hospital CEO also recommended the Chairman of the IRB work with the hospital Privacy Officer to revise the Notice of Privacy and the Patient Acknowledgement forms to inform patients utilizing routine hospital services of the possibility their identified information might be used in research conducted at the hospital.
· The Chairman of the IRB met with the researchers to discuss alternative approaches to enhance subject recruitment using changes in inclusion criteria as well as in working differently with local physicians.
IRB Decision
When the IRB met the following month, the Chairman discussed his conversation with the hospital CEO and requested the committee re-consider its prior decision by removing potentially negative hospital community relations concerns from its consideration of the Waiver. However, at the same meeting, the committee was also presented with a revised amendment submitted by the investigators requesting approval of expanded study inclusion criteria and revised recruitment efforts through improved relations with several local physicians. The IRB again rejected the original Waive r request but did approve the new inclusion criteria as well as the new plans for subject recruitment. The IRB clearly believed the investigators’ new proposal supported their original contention that the researchers had not yet worked hard enough at subject enrollment. The IRB stated again that the criteria for approval of a Waiver of HIPAA Research Authorization had not yet been met since the researchers had not yet proven that the study “…could not practicably be conducted without access to and use of protected health information.” The committee recommended the investigators continue to pursue all possible avenues of subject enrollment but left open the possibility of revisiting the Waiver request at a future meeting should these new recruitment efforts still prove to be inadequate. The IRB members made it clear to the researchers, however, of their very high threshold for performing ‘due diligence’ in recruitment efforts which, if reached but still without adequate enrollment, might lead to a reconsideration of the Waiver request.
