Testimony on the Proposed Rule on Confidentiality of Patient Records

Testimony of Joanna C. Horobin, MD
Executive Vice President For Commercial Development
EntreMed Inc. on behalf of
Biotechnology Industry Organization (BIO)
Before the Senate Health, Education, Labor and Pensions Committee
RE: The Proposed Rule on Confidentiality of Patient Records Could Impede Research

April 26, 2000

Good morning. My name is Joanna Horobin. I am Executive Vice President for Commercial Development for EntreMed, Inc., a biotechnology company in Rockville, Maryland. I am testifying on behalf of the Biotechnology Industry Organization (BIO). BIO represents 916 companies, academic institutions and state biotechnology centers engaged in biotechnology research on medicines, diagnostics, agriculture, pollution control and industrial applications.

EntreMed is developing antiangiogenic drugs designed to inhibit the abnormal new blood vessel growth associated with a broad range of diseases such as cancer and heart disease. Our company has several products currently in clinical trials being conducted at major cancer centers in four states. As the program on these products expands, multi-center protocols will be initiated at several centers in different states and potentially overseas.

My objective throughout my career - whether as a prescribing physician, clinical researcher, or as a business executive responsible for the launch of new drugs - has always been to provide the best therapeutic options for patients.

Let me make three points.

BIO Support for Confidentiality Protections

First, BIO has consistently supported national legislation to protect the confidentiality of medical information. BIO strongly supports enactment of a law that protects patients' confidentiality, just as we supported barring discrimination on the part of group health plans based on "genetic information". We view it as a moral duty - and good public policy - to assure the public that the great promise of biotechnology research will not be tarnished by abuses of this technology.

We are proud of the fact that BIO worked effectively in 1996 to secure enactment of an amendment to the Health Insurance Portability and Accessibility Act that provides important protections against discrimination by health insurance companies based on "genetic information" about the individual. The protections against discrimination based on "genetic information" were not included in original House or Senate version of the legislation. The bills provided protections against discrimination based on "pre-existing conditions," but this was defined as a condition for which there had been a diagnosis and treatment. Adding "genetic discrimination" means that individuals who take a predictive genetic test to determine if they will or are likely to manifest symptoms of a genetic-based disease are also protected. In fact, they have greater protections than individuals with pre-existing conditions (not being subjected to a waiting period for health benefits coverage).

We now need to supplement this first ban on discrimination based on genetic information with confidentiality protections for this and other medical information.

BIO Support for Confidentiality Legislation

Second, BIO supports enactment of a national law to protect the confidentiality of medical information. As you know, despite the best efforts of the Chairman, the Ranking Member and many others, legislation has not yet been enacted on this subject. We urge the Committee to continue to work towards enactment of legislation. As we will explain, it is the best way to secure the protections patients need in a way that is compatible with medical research.

We specifically support the legislative proposal that you, Chairman Jeffords, presented in your Chairman's mark. Specifically, it contained a bi-partisan proposal crafted by Senators Frist and Kennedy - and was agreed to by the Administration - for oversight of research not subject to the Common Rule that would provide privacy protection to individuals without hurting research. These provisions created an effective mechanism for reviewing privacy issues raised by proposed uses of health information for research purposes. The mark also created a definition of "nonidentifiable health information" that included coded data, thereby facilitating use of scientifically valuable information by medical researchers without jeopardizing patient privacy.

Mr. Chairman, we also need federal legislation to create a set of national, uniform confidentiality protections. Clinical trials are multi-state ventures. National standards would allow researchers to create informed consent and other procedures that will be legal in all states. The fact that this is not true today is becoming an increasingly vexing problem for biotechnology companies. A 1999 study of state health privacy laws showed the vast differences among the states. In addition to existing differences, state laws in this area are in flux. During this past state legislative session, 26 states debated laws concerning privacy. This environment will slow important research efforts.

It is important to note that with respect to the research implications, the differences among states do not seem to start from differences in the level or degree of protection, but reflect different state legislature's' views of the specific procedures or requirements for accomplishing the same objective. Nonetheless, the requirements and penalties are different enough to require every researcher to hire lawyers to assure compliance with the laws of more than 50 states and local jurisdictions in designing informed consent documents for a multi-state trial.

Strong national standards will also give the public peace of mind because they will know that their medical information is subject to appropriate protections. This, in turn, will make them more willing to share information with medical researchers.

The Executive Branch does not have the authority to create such a system. That's why Congress must act. Thus, BIO urges Congress to pass necessary legislation. It should contain language that will pre-empt all state laws that would inhibit access to information important to research.

BIO Position on Pending Confidentiality Regulations

Finally, until we are able to secure enactment of Federal legislation, we need to ensure that the medical confidentiality regulations proposed by the Secretary of DHHS strike this same balance. The current proposal does not do so.

As with the Chairman's mark, federal privacy regulations must be carefully written to allow the continuation of vital medical research. This research is essential if we are to realize the promise of developing new treatments and cures for many diseases. Legislation or regulations that unreasonably restrict researchers' access to and use of medical information will slow, and could halt, research efforts, thereby creating a barrier to the development of new drugs and biologics.

Regulatory proposals must protect patients' privacy rights while creating an environment that encourages vitally important medical research to continue. These goals are not mutually exclusive. During the public debate over this issue, no one - from patient groups to privacy advocates, providers, payers, and government officials - has said that research should be made more difficult or costly by the legal framework established to protect medical privacy.

Unfortunately, the proposed rule has precisely that unintended adverse effect on research. It will severely hurt medical research. Although the proposed rule does not directly regulate BIO 's member companies, virtually all data used in the clinical phases of biotechnology research and in monitoring the safety and efficacy of products after marketing comes from patients who are receiving care from a "covered entity" (e.g., hospital, health plan) subject to the proposed rule. As a result of its significant new requirements on covered entities and its restrictions on their use of data, the proposal will have a substantial adverse impact on biotechnology companies' ability to carry out research.

BIO has submitted formal comments to the proposed rule that describe in detail our analysis and recommendations. I would like to focus on a few critical issues today.

The proposed rule creates barriers to information for companies engaged in research and clinical trials.

BIO believes a covered entity should be permitted to disclose protected health information after making reasonable efforts to ensure that disclosure is limited to the minimum information necessary. A covered entity should be permitted to rely upon the determinations of its own IRB or the central IRB in a multi-center clinical trial for purposes of determining whether disclosures have been appropriately limited. However, the proposed rule would impose civil and criminal sanctions on an entity unless it can prove it made "all reasonable efforts" to limit disclosures. This will be a disincentive for covered entities to share information and will deter them from responding to the recent call of the Institute of Medicine to reduce the frequency of medical errors by affording all providers in the chain of care timely access to an integrated clinical information system.

Moreover, the proposed regulation requires each covered entity to make its own independent "minimum necessary" determination for every research use or disclosure. This means that the covered entity must reach an independent judgment that the purpose of each use or disclosure could not be reasonably accomplished with information that is not identifiable. This is simply unworkable within the context of a large, multi-center clinical trial.

IRBs that review biotechnology research protocols must make complex judgments about the value of the research, the scope of disclosure in the consent form, and the sufficiency of protections for patient privacy. Existing federal regulations permit institutions cooperating in multi-center clinical trials to delegate basic decisions about the structure of the research protocol, the contents of the consent form, and the scope of any patient waivers or authorizations to a central IRB. Delegation of review authority allows participating sites in a multi-center trial to rely upon an IRB whose members have special expertise and understanding of the proposed research. Unnecessary duplication of effort and expense is avoided, data collection is standardized, and the trial coordinator does not face the administrative burden of managing data and patient records from multiple sites whose IRBs might otherwise place differing requirements and limitations upon the protocol.

These arrangements likely would not be feasible under the "minimum necessary" rule, as drafted. Covered entities arguably could no longer delegate the substantive review of protocols and consent forms to the central IRB in a multi-center trial, because such review necessarily involves determinations about the amount of information necessary for the research purpose.

BIO recommends that these provisions in the proposed rule be appropriately modified.

The proposed rule creates an unworkable scheme for creating "de-identified" information.

Researchers often use data sets of de-identified information (information that is made anonymous or coded so an individual's identity is not revealed and cannot readily be determined by the researcher). Such research projects include epidemiological studies, outcomes analyses, and studies of incidence of disease or access to care across populations, areas or time. For biotechnology companies, these studies are essential to identify unmet medical needs and develop hypotheses about the environmental, social, behavioral, and genetic roots of diseases and conditions.

Whether information meets the proposal's definition of "de-identified" is critical because if it does not, it is deemed to be "protected health information", and its use or disclosure without compliance with the proposed rule's provisions will subject the user and discloser to civil and criminal penalties.

The proposed rule says that encrypted and coded data is de-identified. However, to avoid risk of civil and criminal penalties, entities with health information are likely to only share that information with medical researchers if they meet the rule's two-part test that determines if the health information can be presumed to be de-identified.

The first part of the test lists 18 specific identifiers. If any are present, the information cannot be presumed to be de-identified. However, removing all of the elements on the list of asserted identifiers would result in medical history data of questionable completeness, raising serious doubts about the validity of conclusions drawn from any research using a de-identified database. For example, one listed identifier is birth date. There would be serious questions about the validity of most studies that failed to specify the age of the subjects.

In addition, the last item in the list of identifiers would require removal of "[a]ny other unique identifying . . . characteristic . . . that the [discloser of information] has reason to believe may be available to an anticipated recipient of the information." For biotechnology companies, the disease or condition under investigation often afflicts a limited population of individuals. Therefore, the disease under investigation arguably could be considered a "unique identifying characteristic" available to the researcher, who (as a clinical expert in the disease) may otherwise be able to identify the patients afflicted with the disease. Thus, information from patients with rare diseases or conditions might never be presumed to be de-identified.

The second prong of the proposed rule's de-identification test requires that the entity providing the information to the researcher have "no reason to believe that any anticipated recipient of such information could use the information, alone or in combination with other information, to identify an individual." This creates an extremely high standard, and the proposed regulation provides no guidance regarding how to meet the "reason to believe" standard, even though failure to meet the standard could lead to civil and criminal penalties.

Thus, BIO believes that the proposed rule's provisions governing de-identified data are too restrictive. When combined with civil and criminal penalty provisions, the proposed rule creates a strong disincentive to use this type of data, thereby depriving biomedical researchers access to critical information. The proposed rule should be changed to create a more reasonable set of identifiers that may be used to meet a test of presumptively de-identified data.

The proposed rule creates burdensome restrictions on the disclosure and use of protected information not subject to the Common Rule.

Under current law, FDA regulations and the "Common Rule" protect patients who participate in clinical trials. This includes safeguards such as oversight by Institutional Review Boards (IRBs), informed consent requirements, and other protections.

Some medical research, however, falls outside the Common Rule. Examples include medical record review and certain "pre-clinical" research.

The proposed rule, in effect, extends the Common Rule to all research. Not only does this go beyond the Secretary's authority under HIPAA, but it will also impose excessive restrictions or layers of bureaucracy on this research.

Instead of the language in the proposed rule, BIO supports the structure developed in the Frist-Kennedy provisions contained in the Chairman's mark.

Conclusion

As the Congress reviews and debates issues relating to the privacy of personal health information, our industry urges you to remember that the public has a strong interest in the medical achievements of biotechnology. The biotechnology industry is on the cusp of developing promising new drugs and treatments for people with serious diseases.

While it is critical to protect patients' confidentiality rights, imposing too many restrictions on access to important data will slow research efforts. Congress must facilitate the positive uses of medical information to continue the breakthrough scientific achievements into the next century.

I appreciate the opportunity to testify and look forward to working with you in this endeavor.