Statement regarding confidentiality of patient medical records

The Biotechnology Industry Organization (BIO) is encouraged that the Subcommittee on Health and the Environment of the House Commerce Committee is holding this hearing and working to develop legislation to protect the confidentiality of patient medical records. Although it is critical to protect patients’ confidentiality rights, this legislation must be carefully written to allow the continuation of vital medical research. Specifically, federal legislation must recognize that medical researchers use – and sometimes share – information and should not impose undue burdens on these efforts. Federal legislation should create national, uniform confidentiality protections, rather than leaving researchers subject to a patchwork of state laws. Further, legislation should not interfere with existing FDA rules governing adverse event reporting. While it is critical to protect patients, imposing too many restrictions on access to important data will slow research efforts. Federal legislation must facilitate the positive uses of medical information to help ensure that the biotechnology industry will continue to make breakthrough scientific achievements into the next century.


The Biotechnology Industry Organization (BIO) represents 832 companies, academic institutions and state biotechnology centers engaged in biotechnology research on medicines, diagnostics, agriculture, pollution control and industrial applications. BIO would like to take this opportunity to provide input into the continuing congressional debate on legislation to protect the confidentiality of patient medical records.

BIO is pleased that the Congress is developing federal medical confidentiality legislation. As you know, under existing law, if Congress does not act by August of this year responsibility automatically shifts to the Secretary of the Department of Health and Human Services to prepare regulations regarding the use and disclosure of patient information in electronic transactions. Thus, if Congress does not enact legislation, the rules governing patient confidentiality will be a patchwork comprised of these regulations and a myriad of state laws. This environment could slow important research efforts.

BIO has been a supporter of national legislation to protect the confidentiality of medical information. BIO strongly supports enactment of a law that protects patients’ confidentiality, just as we supported barring discrimination on the part of group health plans based on "genetic information". We view it as a moral duty – and good public policy – to reassure the public that the great promise of biotechnology research will not be tarnished by abuses of this technology.

However, the legislation must be carefully written to allow the continuation of vital medical research. This research is essential if we are to realize the promise of developing new treatments and cures for many diseases. Legislation that unreasonably restricts researchers’ access to and use of medical information will slow, and could halt, research efforts, thereby creating a barrier to the development of new drugs and biologics.

Thus, Congress must craft legislation that balances protecting patients’ confidentiality while encouraging research. We are optimistic that this can be accomplished and want to work with you to develop legislation that achieves this balance.

The legislation must carefully define protected health information.

The public has an interest in protecting the confidentiality of identifiable medical information. Information that can be used to identify an individual raises privacy concerns. Therefore, legislation should define "protected health information" to include individually identifiable information to ensure that patients’ confidentiality rights are not breached.

Information that is coded, encrypted, or otherwise made anonymous, however, is not as threatening. Use of this data does not raise privacy concerns and therefore should not be subject to the same strict regulations as identifiable information. In addition, this information is critical for health research. For example, it is often used for outcomes research or in disease management programs. This data can provide valuable assistance to researchers as they monitor patient outcomes or try to determine the appropriate dosages for certain drugs. Therefore, legislative language should include information that is coded, encrypted, or made anonymous in its definition of "nonidentifiable health information."

While most of the pending bills contain such a definition, we are concerned that HR 1941, the Health Information Privacy Act, sponsored by Mr. Condit, Mr. Waxman, and others, does not. Legislation that doesn’t precisely define nonidentifiable information is likely to have a chilling effect on research because researchers will fear that by sharing certain information they are violating federal law and will be subject to prosecution.

The legislation should not create new external review boards.

Under current law, patients who participate in clinical trials are protected by FDA regulations and the "common rule". This includes safeguards such as oversight by Institutional Review Boards (IRBs), informed consent requirements, and other protections. In certain situations, the common rule provides for expedited review to ensure a timely response to a research request.

Some medical research, however, falls outside the common rule. Examples include medical record review and certain "pre-clinical" research. Federal confidentiality legislation should not impose excessive restrictions or layers of bureaucracy on this research. Specifically, new legislation should not create an external review process that will impose overly burdensome requirements. Requiring that all research not governed by the common rule be approved by an external review board or satisfy other external monitoring processes will impede research.

Unfortunately, the two bills pending before this subcommittee, HR 1057, the Medical Information Privacy and Security Act, sponsored by Representative Markey, and HR 1941 contain provisions that will significantly impede medical research by requiring that all research be monitored by an external entity. HR 1057 would require all medical research, including research that is privately funded or does not involve human subjects, to be reviewed by an IRB.

HR 1941 goes even farther. It requires that all research be reviewed by an entity certified by the Secretary. It should be noted that this entity is required under the bill to determine that "the importance of the health research outweighs the intrusion into the privacy of the protected individuals who are the subjects of the protected information" before it approves the use of protected information. This standard is more restrictive than that used by IRBs.

Rather than creating additional layers of oversight, legislation should protect patients by establishing clear rules governing the use of information and penalties for violations of these rules.

Federal legislation should create national, uniform protections.

Federal legislation should create national, uniform confidentiality protections. Clinical trials are multi-state ventures. National standards allow researchers to create informed consent and other procedures that will be legal in all states. If federal legislation allows individual states to impose restrictions on top of these standards, research will be slowed.

Strong national standards will also give the public peace of mind because they will know that their medical information is subject to appropriate protections. This, in turn, will make them more willing to share information with medical researchers.

Unfortunately, neither HR 1057 nor HR 1941 provide such standards. By allowing state laws to remain in force, these bills will foster a patchwork of standards and rules that inhibit research.

We urge Congress to enact pre-emption language that will supercede all state laws that would inhibit access to information important to research. If broad pre-emption language is not adopted for the provisions of the entire bill, we urge that pre-emption language governing medical research be adopted.

The legislation should not interfere with existing FDA rules governing adverse event reporting.

The safety of drugs is monitored by existing FDA rules that require physicians and other providers to report to drug manufacturers instances of adverse events for safety and efficacy surveillance. These programs, which are already regulated by the FDA, are an important source of information about the use and efficacy of certain drugs. It is critical that new confidentiality legislation not contain provisions that will discourage reporting and thereby interfere with these programs.

In our view, once again, HR 1057 and HR 1941 fall short since they do not contain these provisions.

The Secretary’s Study.

During this debate, some have argued that the Secretary of the Department of Health and Human Services should evaluate the common rule with an eye toward protecting the confidentiality of patients’ medical information. We would urge you to be cautious about legislatively authorizing such a study.

The Secretary already has the authority to study these issues since the common rule requires IRBs to consider patient confidentiality as one of the risks to be evaluated when considering a research request. If federal confidentiality legislation directs her to review the common rule, it should make clear that she should do so in a manner that weighs all the benefits and risks to the subject of the research including short and long term safety and discomfort, and not just focus on confidentiality. Confidentiality concerns should not outweigh other factors. Moreover, the legislation should make clear that the product of any study be a report to Congress, rather than new regulations. Given the controversial nature of this matter, the issues should receive a full debate prior to the promulgation of new regulations.


As the Congress debates confidentiality legislation, we urge you to remember that the public has a strong interest in the medical achievements of biotechnology. The biotechnology industry is on the cusp of developing promising new drugs and treatments for people with serious diseases.

While it is critical to protect patients’ confidentiality rights, imposing too many restrictions on access to important data will slow research efforts. Congress must facilitate the positive uses of medical information to continue the breakthrough scientific achievements into the next century.

BIO encourages you to develop this critical legislation. We appreciate the opportunity to submit this statement for the record and look forward to working with you in this endeavor.