Unexpected consequences of HIPAA

Although I began programming in 1965 and began working professionally on a compiler project in 1979, I have maintained a lifelong interest in science in general and biology in particular. My original field of study (almost 40 years ago) was biology. My doctorate was in invertebrate zoology and applied statistics (!). One of the journals I read regularly is Science, from the American Association for the Advancement of Science. A recent article brought to light some unexpected consequences of the Health Insurance Portability and Accountability Act, or HIPAA.

Jocelyn Kaiser wrote a report in the March 17 issue entitled, “Rule to protect records may doom long-term heart study.” (Science 311:1547-1548). It seems that a major research study on heart attacks, the Minnesota Heart Survey, is suffering some serious interference in its data gathering due to the strict requirements for patient confidentiality imposed by HIPAA and by state regulations. Specifically, “the Privacy Rule… gives patients access to their medical records and restricts how healthcare providers use them… One key change from existing practices requires researchers outside the provider organization to obtain written consent from each patient… or… to get a waiver from their institutional review board (IRB). Researchers can also receive a data set stripped of identifying information.”

According to principal investigator Professor Russell Luepker, these rules are making it extremely difficult to obtain medical information for their research. The article details a number of workarounds, but the essential point is that the HIPAA Privacy Rule and state laws have unexpectedly made some types of valuable contributions to the progress of medical science far more difficult than ever before.

Luepker and other scientists need _some_ identifier for the patient records because they are conducting longitudinal studies – time series that look at patient histories. Stripping out _all_ identifying data ruins the data set for their needs.

But as long as there’s a _single_ unique identifier that allows records to be correlated, one could provided stripped data (no name, no address, for example) with lots of value for the researchers while preserving patient confidentiality.

Here’s where information security technologies might be helpful. It would be simple to encrypt a unique or nearly unique identifier such as the Social Security number (SSN) using public key cryptography (PKC) so that patient records would be correlated even across medical institutions. One would need to establish a single public key held by, say, the National Institutes of Health (NIH). All researchers could receive patient data sets anonymized by converting the patients’ SSNs to a unique ciphertext using that NIH public key. The trick would be that the secret key generated at the same time as that public key would be destroyed; that is, no one would have a reasonable means of decrypting a particular ciphertext to deduce the original SSN. So patient confidentiality would be preserved but all the juicy clinical details would still be available for the scientists.

On a more general note, the wording of the Privacy Rule in HIPAA and of similar state laws illustrates the rule of unintended consequences. In our own work in information assurance, we ought to be careful to run pilot programs and studies to see if our brilliant ideas and stunningly precise policy formulations are actually having the effects we want – and only the effects we want.

Anyone interested in some of my work in the late sixties and seventies can read an account on my Web site in HTML or PDF.