Health Information Is Needed for a Variety of Research Purposes

The organizations that we contacted primarily conduct health research to advance biomedical science, understand health care use, evaluate and improve health care practices, and determine patterns of disease. Federal Requirements Do Not Apply to All Research, but Some Organizations Voluntarily Apply Those Requirements to All Studies

Some of the research conducted by the organizations we contacted must conform to the Common Rule or FDA regulations because it is either supported or regulated by the federal government. While it does not have an IRB, this PBM uses external advisory boards to review its research proposals. IRB Reviews Provide Limited Oversight of Confidentiality

While many organizations have in place IRB review procedures, recent studies that pointed to weaknesses in the IRB system, as well as the provisions of the Common Rule itself, suggest that IRB reviews do not ensure the confidentiality of medical information used in research. Federal Regulations Contain Limited Provisions for Overseeing Confidentiality

Under the Common Rule, IRBs are directed to approve research only after they have determined that (1) there are provisions to protect the privacy of subjects and maintain the confidentiality of data, when appropriate, and (2) research subjects are adequately informed of the extent to which their data will be kept confidential. Organizations Conducting Research Have Measures to Reduce Access to Personally Identifiable Information

Each organization that we contacted reported that it has taken one or more steps to limit access to personally identifiable information in their research. Some have used encrypted or encoded identifiers to enhance the protection of research and survey subjects. In addition to electronic security, officials at some of the organizations told us they use various security measures to prevent unauthorized physical access to medical records-based information, including computer workstations and servers. However, while reasonable safeguards may be in place in these companies, external oversight of their research is limited.
Why GAO Did This Study

Pursuant to a congressional request, GAO discussed the privacy of medical records used for health research, focusing on: (1) to what extent medical information used for research depends on personally identifiable information; (2) research that is and is not subject to current federal oversight requirements; (3) how the institutional review board (IRB) ensures the confidentiality of health information used in research; and (4) what steps organizations have taken to safeguard information.

What GAO Found

GAO noted that: (1) the survey revealed that a considerable amount of health research relies on personally identifiable information; (2) while some of this research is subject to IRB review--either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research--some of the organizations conduct records-based research that is not reviewed by an IRB; (3) the process of IRB review does not ensure the confidentiality of medical information used in research--primarily because the provisions of the Common Rule related to confidentiality are limited; (4) according to recent studies, the IRB system on the whole is strained; and (5) nevertheless, although external review of their research is limited, most of the organizations in GAO's study told GAO that they have various security safeguards in place to limit internal and external access to paper and electronic databases, and many say they have taken measures to ensure the anonymity of research and survey subjects.