HIPAA Privacy Rule and Clinical Trials

¶ … HIPAA has made finding subjects for clinical trials easier or more difficult is moot. HIPAA was passed almost twenty years ago. Since 1996, HIPAA rules protect the privacy of test subjects, strengthen informed consent, and have generally changed the culture around these issues, further protecting people who are involved in clinical trials. It's law, and that's what clinical researchers have to work with. Further, the privacy rule was designed with one objective (protect privacy), so evaluating it against another objective (making research easier) is a red herring.

The theory is that HIPAA should make it easier to find subjects, but it wasn't written for that so much as just to assuage apprehension about the privacy of medical information. Because HIPAA is law, it doesn't much matter if it has made it harder or easier, the only thing that matters is that practitioners understand the best practices as to how to recruit in the current legal environment.

Once a law is passed, worrying about its impacts isn't as important as actually doing what you can to manage those impacts. 2. Considering how old I was when HIPAA was enacted, I can safely say that this is another moot question. When HIPAA was enacted, I was a minor, so not capable of agreeing to be involved in a clinical study. But in the theoretical abstract, I do not believe that privacy protection is a deal-breaker or deal-maker for this decision, at least not for me.

Indeed most patients have never heard of HIPAA, don't really understand the issue, and therefore cannot offer a reasoned opinion on the matter. I like that there are better privacy protections than they used to be, but as someone in the health care field I am pretty sure that if a clinical study offered me a chance to make a greater contribution to the field, and had the potential to offer me better treatment than I could otherwise receive, I would do it.

My decision to participate in a clinical trial would be related to medical factors and my personal views about the value of clinical trials, and those issues would override any privacy issues, I should think. As for providing biological material or genetic information, those issues to some extent remove the "can it help me with my condition" part of the above equation.

As such, I would be less likely to submit to such tests in general, and with substantially lower upside for me I assume I would think about tangential factors like privacy a little bit more. For example, I do not necessarily trust the Genetic Information Nondiscrimination Act all that much (the Civil Rights Act hasn't exactly prevented discrimination in the workplace, so why would GINA?).

Thus, I would value privacy protections for my genetic information but maybe wouldn't trust HIPAA to help with that, mostly because HIPAA will never be as effective as not releasing that information (or material) in the first place). 3. In light of my above response, no, HIPAA would not convince me that my biological or genetic information would be protected. This is not a failing of HIPAA -- the law itself is fine. But philosophically, HIPAA is an input, not an output.

If you think about what stands between HIPAA and actual protection of that information, it's quite a bit. Human error, fraud, hackers, leaks…there are a lot of ways that information gets out. Logically, we ban murder but people still do it. The existence of a law mandating a certain behavior increases the likelihood of that behavior, but it does not eliminate the possibility of transgressions. Unfortunately, HIPAA can only go so far as a preventative measure.

No law, no matter how well written, could convince me that my information will be protected. HIPAA convinces me that people are obligated to protect my information, and that they can be punished if they do not, but HIPAA as a law, and the bodies that enforce it, cannot offer anything close to a guarantee of protection, and I recognize that. 4. I have thought about this -- would I get tested for.