Research Riddle


The recent uproar over the Office of Human Research Protections (OHRP) ordering a multicenter study of a Michigan ICU checklist to halt data collection has left quality improvement (QI) researchers, ethicists, and legal experts scratching their heads.

Even before the Michigan debacle, there was considerable confusion about how patient privacy rules included in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) affected QI studies. No one was really sure when institutional review board (IRBs) needed to be involved and when patients needed to be officially consented.

The HIPAA contains specific language addressing how patients and patient data should be handled by researchers. And experts say that’s a good thing—in theory.

Know HIPAA’s Scope

Because most people haven’t read HIPAA carefully, they don’t understand who and what is covered by the legislation, says James G. Hodge Jr., an associate professor and executive director at the Centers for Law and the Public’s Health at Johns Hopkins School of Public Health in Baltimore.

First, Hodge says, you need to understand where HIPAA’s privacy rule starts and stops. “It starts with covered entities and stops with those not covered,” he adds.

What does this mean?

For starters, it means public health authorities are exempt because they are not providing functions covered by HIPAA, Hodge says. What’s covered by HIPAA are “those providing healthcare or data clearinghouses that deal with health benefits.”

Health researchers may or may not be covered by HIPAA’s privacy rules, Hodge says. “They’re not covered by the privacy rule unless they are performing covered functions, such as healthcare,” he adds. “This is an important thing. You don’t think automatically how this may implicate data exchanges.

The rule also has exceptions, Hodge says. “If it’s a covered entity that is providing data to a public authority, that may occur without patient authorization, if it’s for public health related purposes.”

Further, he says: “Covered entities can disclose information is when it is for health oversight research, which I think was meant to include quality improvement. What you don’t get to do is run an experiment that has the potential harm to people who are not aware that they are in a research study.”—LC

But a 2007 study in the Journal of the American Medical Association found that many epidemiologists feel the rules have adversely affected research and done little to improve patient privacy.1

The situation for QI researchers is even more confusing. Many see studies examining the effect of QI interventions as fundamentally different from “human subjects research.” And because of this many were shocked when the OHRP halted data collection from the Michigan care-checklist program.

In that case, the OHRP argued that because the study was prospective, it wasn’t simply QI, but rather “human subjects research.” The OHRP demanded that researchers run their plans by the IRBs of every one of the 103 hospitals involved in the research before relenting Feb. 15 and letting the study resume. (Initial results of the study were published in the New England Journal of Medicine in 2006.2)

Many medical experts view the intervention being studied in Michigan—a simple checklist aimed at reminding physicians to follow some common-sense procedures designed to lower the infection rate associated with central lines—as a straightforward attempt at QI. They argued the study should be exempt from some of the rules regarding human research subjects.

Experts say the OHRP’s initial ruling made what was already a confusing subject into an impossibly muddled morass that may have a chilling effect on the publication of QI studies.

Some say the OHRP has extended HIPAA too far. First of all, legal experts say, it must be understood that HIPAA’s rules don’t apply equally to everyone. For example, public health authorities are allowed to gather patient data without consent if they are trying to prevent the spread of disease. And hospitals are allowed to use data to improve the quality of healthcare, says James G. Hodge Jr. an associate professor at the Johns Hopkins School of Public Health in Baltimore, and executive director of the Centers for Law and the Public’s Health at Johns Hopkins.

One key to resolving the issue may be for healthcare experts to come up with a definition of what constitutes “human subjects research.”

“This is where issues keep coming up,” Hodge says. “Is QI just an extension of clinical care or is it research? The answer to that question will tell you whether it implicates the rule or not.”

Researchers, ethicists, and legal experts hotly debate these issues. No one appears to know exactly where to draw the line that divides human subjects research from QI studies.

Even before the checklist controversy arose, HIPAA was already having a deleterious impact on the exchange of QI information, says Mary Ann Baily, PhD, an associate for ethics and health policy at the Hastings Center in Garrison, N.Y.

Loathe to run afoul of the OHRP, at least one of the larger managed-care providers decided against publishing results of its QI studies, Dr. Baily says. “They’re just trying to stay out of the OHRP’s way,” she explains. “At a recent workshop, researchers said, ‘We don’t publish our data. We make our own system work better and keep our heads down. That way we don’t run into any problems. It’s safer that way.’ ”

This means nobody benefits from that company’s research. “What a waste that is,” Dr. Baily asserts.

Not everyone has taken such a defensive position. But there is a wide range of opinions among QI researchers around the country.

“Certainly as someone who is involved in QI research on an operational level and who is also interested in conducting research looking at the effects of QI interventions I struggle with this regularly,” says Peter Lindenauer, MD, MSC, associate professor of medicine at the Tufts University School of Medicine in Boston and associate medical director, Division of Healthcare Quality, at Baystate Medical Center.

“QI officers don’t look at the work they do as being research,” Dr. Lindenauer notes. “They’re often translating research into practice and implementing and developing strategies designed to improve care. So, when you think about it in those terms, it would never dawn on a typical QI officer to seek IRB approval or to get consent from patients to participate.”

Some researchers avoid the issue by looking only at data with patient identifiers stripped. The assumption is that HIPAA rules apply only to medical records with identifiers intact.

Under that assumption, Lakshmi Halasyamani, MD, has performed two heart failure studies without getting into issues of patient consent. But she sees potential problems with future research.

“Because we were looking at the impact of interventions across the whole population of heart failure patients, it wasn’t a problem,” says Dr. Halas­yamani, vice chair for the department of medicine at St. Joseph Mercy Hospital in Ann Arbor, Mich., and a member of SHM’s Board of Directors. “So long as you’re looking at global outcomes, the regulations don’t have much impact.”

But Dr. Halasyamani and her colleagues may want to start looking at the benefits of interventions on subgroups. And this is where things can get messy, she says.

Healthcare professionals really need to figure out a working definition for what constitutes research—and they need to do it soon, Dr. Halasyamani says. Without a good definition, Dr. Halasyamani can see a slowdown of QI research and the possibility of researchers using a QI loophole to get around IRBs. “I could see where some researchers might be tempted to call their studies QI to avoid bureaucratic hassles and IRB oversight,” she says.

Some experts think the minute you decide to publish, by definition you’re doing research.

“I believe you have an ethical obligation to share what you learn with other hospitals,” says Dr. Lindenauer. “So, of course, you want to write it up. But once you start to talk about publication and sharing you start to get to the point where you’re crossing the line —where you’re creating generalizable knowledge.”

And that is precisely when government organizations like the OHRP think you’ve crossed over into research, Dr. Lindenauer says. “It’s a tricky question,” he adds.

Ethicist Baily agrees that experts need to work on coming up with a practical definition of research. Right now, the situation is impossible, she says. Take, for example, a medical plan that wants to send postcards to encourage patients to show up for an annual physical. If researchers want to learn whether that technique works, do they need to send a postcard, prior to the reminder postcard, to let patients know that they’re going to be part of a study, she asks.

And even more important, with all the staff cuts at medical institutions around the country, shouldn’t QI officers study whether these cost-cutting measures adversely affect patient care, she asks. TH

Linda Carroll is a medical journalist based in New Jersey.


  1. Ness RB, Joint Policy Committee, Societies of Epidemiology. Influence of the HIPAA Privacy Rule on health research. JAMA. 2007 Nov 14;298(18):2164-2170.
  2. Pronovost P, Needham D, Berenholtz S, et al. An intervention to decrease catheter-related bloodstream infections in the ICU. N Engl J Med. 2006 Dec 28;355(26):2725-2732. Erratum in: N Engl J Med. 2007 Jun 21;356(25):2660.

Next Article:

   Comments ()