Our modern electronic world has many benefits and conveniences, but the free flow of information also creates privacy concerns. In the realm of health care, privacy protections are needed to preserve patients' dignity and prevent harms such as discrimination. But such protections can also have unintended consequences for health care, and the health research that is vital for making medical advances. More than 10 years ago Congress called for a set of federal standards, now known as the HIPAA Privacy Rule, to protect the privacy of personally identifiable health information while still allowing the flow of information needed to promote high-quality health care.
In its 2009 report, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research , the Institute of Medicine's Committee on Health Research and the Privacy of Health Information concludes that the HIPAA Privacy Rule does not protect privacy as well as it should, and that, as currently implemented, it impedes important health research. The committee recommends an entirely new approach to protecting privacy in health research. However, if national policy makers choose to continue to rely on the HIPAA Privacy Rule rather than adopt the new approach, the committee recommends a series of changes to improve the rule and the guidance that the HHS provides on how to comply with it. More specific recommendations related to these approaches are available in the report brief.
Privacy protections and ethically-conducted health research provide valuable, interrelated benefits to society, and society should strive to support both to the extent possible. In order to preserve patients' dignity and ensure continued progress in improving our nation's health and health care, Congress and HHS must implement more effective privacy protections in health research.