Privacy Versus Public Health: The Impact of Current Confidentiality Rules

Abstract

Public health research and practice often have been facilitated through the evaluation and study of population-based data collected by local, state, and federal governments. However, recent concerns about identify theft, confidentiality, and patient privacy have led to increasingly restrictive policies on data access, often preventing researchers from using these valuable data.

We believe that these restrictions, and the research impeded or precluded by their implementation and enforcement, have had a significant negative impact on important public health research. Members of the public health community should challenge these policies through their professional societies and by lobbying legislators and health officials to advocate for changes that establish a more appropriate balance between privacy concerns and the protection of public health.

WITH INCREASING frequency, valid concerns are being raised about the privacy of medical records (hereafter, protected health information) and other personal information. Consequences of breaches in the privacy of this information are extremely serious. Negative effects include inappropriate and unjustified employment termination, loss of individual health insurance, and illegal use of one's identity in a host of ways, from charges on credit cards to passport fraud.

In response to these privacy concerns, various professional groups, such as local institutional review boards (specially constituted review bodies established or designated by an entity to protect the welfare of human participants in biomedical or behavioral research¹) and the National Institutes of Health's Office of Human Subjects Protection, have introduced rules and regulations to ensure the confidentiality of patients and participants more effectively. Most notably, the US Congress passed the Health Insurance Portability and Accountability Act (HIPAA; 42 USC §201 et seq) in 1996 and promulgated HIPAA's Privacy Rule in 2003, in part in an effort to strike a balance between protecting the confidentiality of personal health information and legitimate use of these data. According to the US Department of Health and Human Services,

The HIPAA Privacy Rule establishes national standards to protect individuals' medical records and other personal health information and applies to health plans, health care clearinghouses, and those health care providers that conduct certain health care transactions electronically. The Rule requires appropriate safeguards to protect the privacy of personal health information, and sets limits and conditions on the uses and disclosures that may be made of such information without patient authorization.²

In short, this broad-reaching rule regulates the use and disclosure of protected health information throughout the United States.²

UNINTENDED CONSEQUENCES

Although these well-intentioned national and local standards are designed primarily to protect human participants' rights and confidentiality, they have unintended consequences. They have had a major negative impact on the conduct of public health research and practice. According to a recent report published by the National Institute of Medicine, “[T]he HIPAA Privacy Rule does not protect privacy as well as it should, and … as currently implemented, it impedes the conduct of important health research.”^3(p2) There is no question that these privacy protections are important and serve the public interest. In today's tense climate of fears of identity theft, privacy violations, and other unwanted personal intrusions, however, it is easy for the public, and regulators, to lose sight of how easily the increasingly broad body of restrictions limiting access to medical and public health data can undermine efforts to better understand and improve public health.

For example, tremendous health benefits have accrued to society from epidemiological research. Notable successes include control of many infectious diseases,⁴ identification of numerous carcinogens and other hazardous substances,⁵ and improved understanding of modifiable risk factors for many types of diseases, including leading causes of death in the United States such as cardiovascular and respiratory diseases.⁶ These advances have led to more effective disease prevention, decreases in disease-related disabilities, and remarkable increases in life expectancy.⁷ Unfortunately, however, the rapidly accelerating movement to limit data access already has impeded or precluded the conduct of many similarly designed studies.

We believe it is time for scientists and regulators to recognize more fully the consequences of these restrictive actions and to challenge such impediments to properly planned and valid epidemiological research that uses protected health information. These studies can both protect personal identity and lead to improved public health, as has been demonstrated by valuable research previously conducted under the medical and public health community's well-established history, culture, and oversight process for protecting privacy and confidentiality.⁸ Other institutions, such as credit agencies, compile and maintain detailed databases of personal information and, because of the value of their services and their history of protecting such data, are allowed to continue these practices. Health scientists, too, should have access to relevant personal data for research purposes, with appropriate oversight.

EXPLORING RESTRICTIONS

We focus on restrictions to accessing routinely collected, population-based data, also known as public health surveillance, rather than enrollment of individual human participants in clinical or epidemiological studies—an important topic, but one that is dealt with elsewhere.⁹ These data, which include nationwide birth and death records as well as data in disease-specific registries, are important resources for descriptive and analytic epidemiology. They are used routinely to gauge the health of a state or the nation,^10,11 to track broad-scale changes over time in disease patterns,¹² and—in the conduct of analytic studies in which individual participants with and without disease are linked through geographic location, time, and other factors to specific exposures and risk factors of concern—to assess possible disease causation and prevention and the effectiveness of interventions.¹³

A variety of approaches for using these types of data to improve public health have been extremely successful in addressing public health concerns. In London in the 1850s, John Snow identified contaminated drinking water as the cause of fatal cholera outbreaks, principally by mapping the relative residential proximity to the water source of those who died as compared with those who did not.¹⁴ In 1975, the National Cancer Institute published its first Atlas of Cancer Mortality,¹⁵ which used geographic information for discovering new etiologies, confirming suspected etiologies, and identifying high-risk populations. In the early 1990s, studies for the first time established clear links between short-term fluctuations of air pollution and occurrence of acute and chronic cardiorespiratory disease and mortality in individuals,¹⁶ and recent studies continue to support and refine these results.^17–19 Relatively recent cancer studies using individual data have identified geographically based barriers affecting cancer screening for individuals.^20,21 Although the relevance and importance of these findings support their conduct, obtaining individual consent to use protected health information in such studies is not practical and is also not ethically required since reporting of research findings already is limited to aggregate results and individual participants do not need to be contacted. However, new, increasingly restrictive regulations continue to block access to complete spatial, temporal, and relevant medical information for research of this type.

Historical Perspective

This problem of restricted data access is not new. More than 25 years ago, in this journal, noted epidemiologist Ken Rothman lamented the impact of “mounting concerns for privacy and confidentiality”^22(p1309) on epidemiological research. Suggesting that the privacy concerns originated in the context of patient protection, and that the abuses were perpetrated through physical interventions or deliberate deception in the name of science, Rothman argued that “epidemiologic studies which typically involve either a record review with no patient contact, or patient contact only to conduct an interview”^22(p1309) were not the intended focus of this increased scrutiny. Rothman asserted that “the real roadblock for epidemiologic research”^22(p1310) is the difficulty in addressing these privacy concerns adequately without compromising the quality of the research, and he stressed the value to individuals and society of expanding knowledge in medicine and public health.

Supporting this view, Nathan Hershey, a lawyer writing about the same time as Rothman, noted that “epidemiological studies have played a substantial and valuable role in identification of relationships between environmental conditions and disease, and in identifying populations subject to risk which, once the risks are known, can be eliminated or minimized.”^23(p1155) The conflict, he similarly pointed out, lies in how to strike a balance between the medical and public health benefits that accrue to individuals and to society from the results of epidemiological research versus maintenance of the privacy of medical records, which is “an important and increasingly recognized value in our society.”^23(p1155) Federal institutional review board regulations of the time, however, were “directed toward the protection of human subjects, rather than toward the facilitation of epidemiologic research.”^23(p1156) Similarly, we are concerned that today's restrictive policies continue to limit opportunities for improving societal health and well-being through ongoing scientific analysis of routinely collected health-related data.

Gilbert Beebe, the eminent radiation epidemiologist, writing around the same time as Rothman, also stated these concerns and goals clearly:

To cope with the increasing demands of our society for prevention, treatment, and compensation, we need more, precise, information on health hazard; yet we have not been willing to face up to the implications of these needs. To satisfy them will require better planning and integration of existing information systems, additional funds, and some trifling sacrifice of personal privacy.^24(p246)

All 3 of these scholars foresaw the problems and implications of the data access restrictions we face today. At the time of Rothman's commentary in 1981, the routine collection of population-based, health-related information in uniform computerized form was still in its infancy. Vital records were collected by all the states, and the National Death Index, a national repository of death certificates for all fatalities occurring in the United States,²⁵ had recently been established. Systematically collected data on cancer incidence were available only in selected areas of the United States, and population-based information on other major chronic conditions was far more limited. Just a few years later, we built one of the first, crude, real-time, interactive, statewide geographic information systems linking several years of vital records data with comparable environmental hazard data,^26,27 foreshadowing approaches that would become possible as the technology and computing power advanced.

Current Databases and Access

The improvements in technology and data quality and the scope of data collection have been enormous. Currently, all births and deaths in the United States are recorded routinely in states' vital records registries, and cancer incidence data are available for all 50 states, with detailed information about time, location of events, and the sociodemographic and medical characteristics of the individuals. Recent developments include comprehensive databases on emergency department visits, hospital admissions, medical care claims, and pharmacy records that facilitate in-depth evaluation for specific public health issues. For example, several cities and states have implemented near real-time hospital emergency department data collection and analysis systems that, on a round-the-clock basis, search for anomalies in patterns of disease that might indicate a bioterrorist attack.^28–31

These advances have helped facilitate considerably more probing epidemiological analyses than were possible even 20 to 30 years ago, thereby fostering a better understanding of etiology and contributing to improvements in the health of the American people through disease prevention, treatment, and control programs. However, researchers rarely are granted unfettered access to these data, and sometimes are entirely prevented from access even when they provide detailed, technical protocols and assurances of the methods they will use to protect the confidentiality of the data.

For example, the federal government's National Center for Health Statistics (NCHS), through its National Vital Statistics Program, compiles detailed information about time, location, and sociodemographic and medical characteristics of every birth, death, and fetal death in the United States, through a cooperative agreement with all states, facilitated by the National Association for Public Health Statistics and Information Systems (NAPHSIS). The NCHS has provided detailed downloadable “public-use micro-data files” for research and evaluation.³² At the request of NAPHSIS members, however, the temporal and spatial resolution of directly downloadable data has been decreasing (i.e., made less specific) over time. For example, the files for 1969 through 1988 contain county or city and exact date of event; for 1989 through 2004, they contain state, but city or county only if the population is 100 000 or greater, and only day of the week, month, and year; from 2005 on, they contain no geography, only day of the week, month, and year. Currently, some higher-resolution data may be made accessible by the NCHS through a more formal NCHS request and approval process, but, for nonfederal employees, access and analysis are possible only on their Research Data Center computers, on site or remotely. Full-resolution data with mothers' exact residential address or exact geocode (i.e., latitude and longitude), which allows more accurate linkage with other relevant databases, and exact date of birth are available only by direct application to the states themselves, and are not granted by all states.

Similarly, the National Cancer Institute's Surveillance, Epidemiology and End Results (SEER) Program,³³ which began in 1973 to collect, analyze, and disseminate data useful in the prevention, diagnosis, and treatment of cancer, provides only year of birth and month and year of diagnosis along with county of residence at diagnosis for individuals, thereby limiting epidemiological investigations.

What is most puzzling and distressing is that, in spite of our increasingly sophisticated technology and electronic data systems, researchers' direct online access to federal vital records data has become increasingly limited over time, impeding and sometimes precluding potentially valuable etiologic investigations, such as those of daily fluctuations in air pollution levels, a fruitful line of research exemplified more than 15 years ago by Pope, Schwartz, Dockery, and others—studies that it would not be possible to undertake similarly today.^16,34–38 Some of these studies used the very NCHS daily mortality data that are no longer available as downloadable, public use files. Using this finely scaled temporal data set, these and similar studies demonstrated the tight spatiotemporal association between the variation of daily levels of particulates in the air at a given location and daily mortality. The findings helped provide a basis for our current regulatory standard for ambient levels of particulates.³⁹

Following a similar approach, recent research suggests that in utero exposures to environmental agents, such as local air pollutants, may have negative effects on newborns.^40–44 Other studies evaluate associations of additional health outcomes associated with exposures occurring in close proximity to residences.^45–48 It is disappointing that the NCHS, which is “the Nation's principal health statistics agency [that] compile[s] statistical information to guide actions and policies to improve the health of our people,”⁴⁹ has reduced the public health relevance of the downloadable birth data they provide. For example, the individual birth records in NCHS' current natality “public use micro-data files”³² do not include the state of the mother's residence and date of birth that are essential for linking births to environmental exposures. These data fields were included in the files of births in the 1980s.

Another far-reaching example of data-access restrictions confronting researchers is HIPAA. According to the US Department of Health and Human Services, HIPAA is “the first comprehensive Federal protection for the privacy of personal health information.”⁵⁰ HIPAA and its definition of protected health information have often been used to restrict access to specific data fields essential for certain analyses using routinely collected surveillance data. The public health impact likely is substantial.⁵¹

Even more severe restriction on access to existing data records is often implemented through the Family Education Rights and Privacy Act,⁵² which has been interpreted to limit the access of researchers—including state health officials—to educational records containing identifiable health information if they do not obtain individual informed consent beforehand.⁵³ Mental health evaluations contained in these records have been used, under special conditions, to identify cases of autism spectrum disorders. Failure to make such data readily available to researchers, with appropriate confidentiality controls, impedes the study of the causes of autism spectrum disorders, a disease currently on the rise and of great public concern. In the simplest situation, identifiers of cases and noncases are needed only to link health status data to risk factor information, after which the identifiers can be stripped from research databases, preserving confidentiality. However, requests for such data are often denied outright, or entwined in such complex approval processes as to preclude timely and efficient research.

A third, more general example of restrictions on data access is the recent decision by the Department of Veterans Affairs, which is exempt from state reporting laws, to instruct their hospitals to no longer provide cancer surveillance data to state and federal health officials, just when state laws requiring routine reporting of all cancers are finally in place for all 50 states.⁵⁴ The department's concern, once again, is stated as protecting patient privacy, whereas no mention is made of consideration of the potential public health impact. In addition to creating a gap in national cancer surveillance, this action will limit the opportunities for analysis of Gulf War veterans' cancers, and thereby may negatively affect the provision of care and compensation.

A further complication to these general issues of data access is that researchers must confront not only federal statutes that restrict access but the wide array of laws and policies enacted by individual state legislatures and agencies. These further restrict access to patient-identifiable medical data unless one either obtains individual informed consent or follows extremely onerous authorization procedures. Consequently, for multistate studies, which may capture cross-border transport of environmental hazards (e.g., industrial air emissions) or other common or geographically related risk factors, researchers have to comply with separate, and often inconsistent, policies from neighboring states.

Unfortunately, few discussions of privacy protection consider explicitly the consequences of lost opportunities for innovative and valid epidemiological research. These issues, like many other policy considerations, require a careful and thoughtful balance between risks and benefits. As health professionals, we need to look toward the greater good. Therefore, in the spirit of protecting the public health, it seems to us essential that a broadly defined research community be enabled to access routinely collected, population-based data for valid research endeavors. Such access would pose only minimal risks to privacy, a concern that can be addressed appropriately through carefully designed oversight.

We are aware of methods available to “anonymize” data by blurring the exact residential locations through the use of a variety of algorithms, but there is no generally agreed-upon approach or consistent set of goals and procedures.^55–62 Although further efforts may identify an approach that does not seriously compromise research while providing ironclad protection of an individual's privacy, we must be careful not to impose too many restrictions on the research or the effort will be for naught.

CONCLUSIONS

In summary, at the same time as society is being challenged daily by new and grave threats to public health, research efforts are being constrained by what seems to us to be excessive limitations on access to data requested for the explicit purpose of improving public health. What is particularly distressing is that high-resolution data, which were the basis of population-based epidemiological studies central to the development of health protective regulations, are no longer as readily available—if available at all—to researchers, and that the trend is toward more stringent restrictions. As individuals, scientists have little recourse when their requests for data access are denied. As a research community, however, we can campaign for changes in policy that will facilitate this critical research while appropriately and thoroughly addressing reasonable and broad-reaching concerns about confidentiality and patient privacy.

We need to enlarge the scope of the discussion on privacy protection to include greater attention to the public health impact of increasingly restrictive rules on access to health data. It is important for diverse groups of scientists to join in this dialogue and to remind others of the value to society of epidemiological research and the urgency of providing increased and easier access to relevant health data. Professional groups should help to develop and implement the most effective strategies and methods for effecting a rollback of these overly restrictive data-access policies that may run counter to basic public health goals. One need only look to the credit agencies, which have far more detailed and sensitive personal data than most research studies require, to see that these data can be released and managed safely and responsibly.

Individual scientists should challenge their professional societies to get involved, and to lobby local, state, and federal agencies for broader data access. They should also talk to governmental representatives about the value of releasing these data to bona fide researchers, under appropriate controls, and they should engage the public in this important debate.