The San Francisco Chronicle is carrying an article on the impact of HIPAA on health registries, such as the California Cancer Registry:

Medical privacy law said to be chilling cancer studies / Scientists fight for fast access to patient files:

"...Since April 14, 2003, however, a new federal law designed to protect the privacy of medical records has made it harder, if not impossible, for medical researchers in the United States to troll through patient charts, whether they are trying to unravel the riddle of cancer or studying complications in childbirth.

Citing the privacy rule, at least 17 Bay Area hospitals have imposed restrictions on the state Cancer Registry's accustomed rapid access to patient records.

'The door kind of slammed in our face,' said Dr. Dee West, chief scientific officer for the Northern California Cancer Center, which collects data in the Bay Area for the state registry.... "

Under Ontario's new Personal Health Information Protection Act, personal health information may be disclosed without consent for research purposes if approved by a Research Ethics Board and if the researcher enters into an agreement with the custodian in the form presecribed by the Act.

43. (1) A health information custodian may disclose personal health information about an individual to a researcher if the researcher,

(a) submits to the custodian,

(i) an application in writing,

(ii) a research plan that meets the requirements of subsection (2), and

(iii) a copy of the decision of a research ethics board that approves the research plan; and

(b) enters into the agreement required by subsection (5).

Research plan

(2) A research plan must be in writing and must set out,

(a) the affiliation of each person involved in the research;

(b) the nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates; and

(c) all other prescribed matters related to the research.

Consideration by board

(3) When deciding whether to approve a research plan that a researcher submits to it, a research ethics board shall consider the matters that it considers relevant, including,

(a) whether the objectives of the research can reasonably be accomplished without using the personal health information that is to be disclosed;

(b) whether, at the time the research is conducted, adequate safeguards will be in place to protect the privacy of the individuals whose personal health information is being disclosed and to preserve the confidentiality of the information;

(c) the public interest in conducting the research and the public interest in protecting the privacy of the individuals whose personal health information is being disclosed; and

(d) whether obtaining the consent of the individuals whose personal health information is being disclosed would be impractical.

Decision of board

(4) After reviewing a research plan that a researcher has submitted to it, the research ethics board shall provide to the researcher a decision in writing, with reasons, setting out whether the board approves the plan, and whether the approval is subject to any conditions, which must be specified in the decision.

Agreement respecting disclosure

(5) Before a health information custodian discloses personal health information to a researcher under subsection (1), the researcher shall enter into an agreement with the custodian in which the researcher agrees to comply with the conditions and restrictions, if any, that the custodian imposes relating to the use, security, disclosure, return or disposal of the information....

Thanks to PrivacySpot and Topix.Net for the pointers to the Chronicle article.

Labels: health information, information breaches, phipa