Privacy and Individual Right of Access to Personal Health Records
Subsequent to completion of NBAC’s report, DHHS issued the Health Insurance Portability and Accountability Act (HIPAA) regulation on privacy of health records entitled Standards for Privacy of Individually Identifiable Health Information. After considering additional public comment on the final rule, President Bush reaffirmed that the privacy rule would be effective on April 14, 2001, and that guidance or recommended modification of the rule would be forthcoming in the near future. Currently, this regulation provides an individual the right of access to information about himself or herself, including personal research results, with limited exceptions. While the Privacy Act of 1974 has similar provisions that affect records held by federal agencies, the new HIPAA regulation has markedly changed the landscape with respect to disclosure of information and thereby is in conflict with some of NBAC’s recommendations. This issue is treated more extensively in the Working Group’s response to Recommendation 14.
As time passes, an increasing share of human biological materials research is likely to be in the area of human genetics. Anecdotal information suggests that some IRBs appear to be particularly cautious when reviewing genetic studies. Some IRBs assume that any research involving genetics is likely to be more than minimal risk, even if the study uses proven strategies to minimize risk. That is not necessarily so. The Working Group suggests, therefore, that IRBs need specific guidance to deal with genetic studies. That guidance should emphasize to IRBs that research involving genetic testing or genetic information2 should be evaluated against specific criteria (either existing or, if existing criteria are inadequate, new criteria), and not judged to be more than minimal risk simply by virtue of involving genetics.