washington

An effort to write a comprehensive law to protect medical privacy was launched in the US Congress last week. The initiative is supported by privacy advocates, but has been criticized by researchers and industry lobbyists, who argue that it would create damaging barriers to the use of patient information in research.

At the centre of the debate is the Medical Information Protection Act of 1998, a draft bill from Senators Robert Bennett (Republican, Utah) and James Jeffords (Republican, Vermont), chairman of the Senate Labor and Human Resources Committee. It was presented at a committee hearing last week.

The bill would establish protection against — and criminal and civil penalties for — the improper disclosure of protected patient information. Most of these provisions would affect the use of information by the broader health-care industry.

The bill extends to the private sector federal protective measures for human research subjects that now apply only to government-funded researchers. These would require pharmaceutical, biotechnology and health-care companies to obtain informed consent from subjects, and approval from local ethics committees called institutional review boards (IRBs), for a wide range of research using identifiable records that currently goes forward without federal oversight.

Of greatest potential concern to biomedical researchers — most of whom already operate under federal rules on the use of human subjects — are provisions that would affect scientists who rely on the use of existing, ‘identifiable’ medical records, or the estimated 283 million archived, ‘identifiable’ pathological specimens.

Such records and specimens carry either patient names or codes that would ultimately allow patient identification. Two paths generally provide ready access to these resources.

First, under federal regulations, an IRB can waive the informed consent requirement for the use of identifiable records or specimens in retrospective studies, if it accepts that it would be impractical to do the research if informed consent had to be obtained, and that the study would pose no more than minimal risk to subjects. Alternatively, researchers seeking access to identifiable records or specimens can use ‘expedited’ IRB review, in which one board member is authorized to rapidly approve such studies.

The Bennett-Jeffords bill would eliminate expedited review, forcing formal IRB review for such studies. It would also bring IRB waivers of informed consent in these cases under much closer scrutiny. For instance, in what critics complain is unduly vague and subjective language, the board would have to determine that a waiver is “necessary for the effectiveness of the research”.

The bill also requires the Institute of Medicine to study the “research issues relating to protected health information, such as the quality and uniformity of [IRBs] and their practices with respect to data management for researchers”.

Lobbyists for medical researchers say the draft bill is a threat to valuable research that has only been made possible by the flexibility of the current regulations.

“There is real concern that the IRBs will be inundated with this huge amount of research that they have never had to worry about,” says David Korn, vice-president for biomedical and health sciences research at the Association of American Medical Colleges, which is drafting a critique of the bill.

“The concern is that they will be tied up in knots trying to debate within their own members what to require of this research,” says Korn, a pathologist by training and the former dean of the Stanford University Medical School.

The Pharmaceutical Research and Manufacturers of America last week issued an extensive, critical analysis of the bill. It complained that the IRB system would be “quickly overburdened” by an extension of the requirement for approval to non-government-funded research.

But privacy advocates say the time is ripe both for that extension, and for more scrutiny of how IRBs deal with ‘identifiable’ records. Research based on records, they say, can put human subjects at as much risk as participating in trials.

IRBs are “more comfortable and more used to focusing on people than information,” says Janlori Goldman, director of the Health Privacy Project at the Institute for Health Care Research and Policy at Georgetown University in Washington DC, who testified at the Senate hearing. “But this is a cultural change that must occur within the research community.”

Some researchers agree. Ronald Levy, chief of the division of oncology at Stanford University Medical School, has relied on archived specimens and records for his work on non-Hodgkin's lymphoma. While he is comfortable with the status quo, Levy says: “I don't know how one can make an argument that there should be an easy way to violate privacy,” although describing the potential loss of expedited review as “a nuisance”.

The bill was to have been introduced last week, but was delayed because of criticism from privacy advocates that it did not clearly block the release of patient data to marketers of medical products. This issue is high on the public agenda in Washington since it was reported recently that the drugstore chain CVS and Giant Food Inc., a grocery-pharmacy chain, were selling prescription information to a marketing company.

An official on Jeffords's staff says the bill will be introduced within a couple of weeks. But lobbyists say this is unlikely, given what they call the bill's extensive problems.

Under the Health Insurance Portability and Accountability Act, which became law in 1996, Congress must write privacy legislation by August 1999.