Medical Records Privacy

A considerable amount of health research relies on personally identifiable information. Although some of this research is subject to review by institutional review boards -- either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research -- some of the organizations conduct records-based research that is not reviewed by an institutional review board. In any case, the process of institutional review board review does not ensure the confidentiality of medical information used in research, primarily because the provisions of the Common Rule related to confidentiality are limited. Moreover, according to recent studies, the institutional review board system on the whole is strained. Nevertheless, although external review of their research is limited, most of the organizations in GAO's study indicated that they have security safeguards in place to limit internal and external access to paper and electronic databases, and many say that they have taken steps to ensure the anonymity of research and survey subjects. This testimony summarizes the February 1999 GAO report, GAO/HEHS-99-55.

GAO noted that: (1) the survey revealed that a considerable amount of health research relies on personally identifiable information; (2) while some of this research is subject to IRB review--either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research--some of the organizations conduct records-based research that is not reviewed by an IRB; (3) the process of IRB review does not ensure the confidentiality of medical information used in research--primarily because the provisions of the Common Rule related to confidentiality are limited; (4) according to recent studies, the IRB system on the whole is strained; and (5) nevertheless, although external review of their research is limited, most of the organizations in GAO's study told GAO that they have various security safeguards in place to limit internal and external access to paper and electronic databases, and many say they have taken measures to ensure the anonymity of research and survey subjects.