Over the next two years, scientists who plan to use patient records for medical research will find themselves facing new hurdles. With the growing concern over human subject protection as a backdrop, outgoing US President Bill Clinton has announced new medical records privacy rules.

Concern over the privacy of medical records has been growing. Confidential patient information is increasingly stored in computerized form rendering it easily accessible to hackers, insurers and medical researchers.

In December—after a reporter sent copies of medical records to University of Washington Medical Center—center officials confirmed that a computer hacker had gained access to confidential information on 5,000 cardiology patients. The data included names, social security numbers, risk factors, procedure results and outcomes. The school, which is now cooperating with the Federal Bureau of Investigation in an attempt to find the hacker, says it has no evidence that the person gained access to the main electronic medical records data.

The new rules will give patients more say about how their records can be used and will introduce stiff financial penalties for insurance companies and health providers who use records improperly. Those organizations will need to obtain consent if they want to use records for anything other than patient care.

But will the new rules hinder medical research? John W. Rigs, associate professor of obstetrics at the University of Texas Medical School and a member of the American Medical Informatics Association says, “I believe they will and probably should hinder certain medical research practices.”

But others worry that they go to far. Edward Oldfield, chief of Surgical Neurology at the National Institutes of Neurological Disorders and Stroke, recently completed a study of multiple pituitary adenomas in Cushing Disease that involved examining records for 660 surgical patients. He thinks researchers should seek patients' consent for some studies, such as those that involve detailed analysis of tissue samples. But, in other cases, the new regulations might unnecessarily add to the already high level of paperwork now required of clinical researchers. He says, “It is hard for me to see why doing a retrospective study that is not linked to patients' identities should always require IRB approval.”

“The whole rule reflects an attitude of suspicion and paranoia,” says David Korn of the American Association of Medical Colleges. “There are societal benefits that are being drowned in the concern for individual privacy.” For example, he says, the rules might limit epidemiological research by masking patients' addresses in a way that makes geographic analysis impossible.

Recognizing that such a requirement could be prohibitive for the scientists who mine large databases, the rules allow researchers to seek a consent waiver from either an Internal Review Board or a similarly organized privacy board. Though this makes life easier for scientists, Edward Sobel, a researcher at the Harvard University Program in Psychiatry and Law thinks that consent waivers will leave patients vulnerable once again. “When people find out after the fact that someone might go into their records, it can be upsetting and can effect the kind of information they are going to give,” he says.