A new rule introduced by the US Department of Health and Human Services (HHS) to assure the privacy of medical records may have created a morass of red tape that will make many types of medical research difficult or impossible. That is the concern voiced by over 180 universities and research centers in a letter to HHS secretary, Tommy Thompson.

The focus of the furor is the 'Standards for Privacy of Individually Identifiable Health Information', a rule issued by HHS at the behest of Congress. Initially proposed during the Clinton administration, the rule followed a tortuous path to reach its current form, and HHS received over 50,000 comments about the proposal from patient privacy and research advocates.

“I think there was at least the expectation that some of the [researchers'] concerns would be responded to,” says Jennifer Kulynych, director of biomedical and health sciences research for the Association of American Medical Colleges, but the final rule, set to take effect in April 2003, still leaves scientists with ample cause for concern.

Currently, research involving human subjects in the US is covered by the “Common Rule,” which requires an Institutional Review Board (IRB) to review each study. Under the new rule, each study will have to undergo an additional level of review, carried out either by an IRB or a newly created entity called a “Privacy Board,” to determine that patients' privacy rights are protected. Unfortunately, “there isn't any agreed-upon metric for what is a privacy right,” according to Kulynych, making it unclear what standards the research has to meet in order to comply with the rule. Violators could face stiff civil and criminal penalties.

The rule also covers many types of research that were previously exempt from IRB review. For example, a scientist who wants to access tissue samples that are accompanied by patient data will have to convince an IRB or Privacy Board that the data meet strict 'de-identification' requirements meant to ensure that the samples cannot be traced to a particular individual. Many researchers are concerned that the de-identification process will strip away useful demographic information, complicating public health and pathology studies.