A Mosquito in the Ointment: Adverse Hipaa Implications for Health-Related Remote Sensing Research and a Reasonable Solution

Abstract

Consider the following scenario: a researcher investigating the spread of West Nile Virus in the United States seeks to determine whether increased precipitation levels in different geographical regions across the country correlate with (through a larger population of mosquitoes) a higher frequency of West Nile Virus in humans. After gathering the relevant precipitation georeferenced data through remote sensing techniques, the researcher still requires health information from numerous local hospitals and other health care providers and agencies to attempt to link the precipitation data with the number of West Nile Virus cases in a given location. Unbeknownst to our well-meaning researcher, he is about to face numerous procedural hurdles as he seeks access to this necessary health information for his research protocol.

Although the connection between this researcher's information-gathering conundrum and space law may not at first glance appear evident, this type of dilemma has important ramifications for space law in general, as remote sensing law has become an increasingly significant and emerging area within the field of space law. Indeed, over recent years, remote sensing has been utilized for a growing number of applications, including in the areas of public and human health research. It is this connection between remote sensing and health research that this article seeks to explore in light of the newly enacted Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the first comprehensive federal statute dealing with health information privacy concerns.

Prior to April 14, 2003, this remote sensing researcher in the hypothetical above would most likely have been able to contact these health care providers and work out an arrangement to obtain the necessary health information, all the while pledging to maintain, to the greatest extent possible, the confidentiality of the health records of the affected individuals. Today, however, the enactment of HIPAA, and the subsequent promulgation of the HIPAA Privacy Rule, has altered the applicable legal rules for any remote sensing researcher contemplating the use of health information as part of his or her research. Indeed, it is the central thesis of this article that the new HIPAA Privacy Rule is a fly (or, better put, a mosquito) in the ointment; a more inconvenient than necessary procedural scheme that could potentially, and inadvertently, derail new advances in medical research made possible for the first time by innovative remote sensing technologies.

Interestingly enough, this change in legal orientation for remote sensing researchers engaged in health-related research does not derive from the fact that a remote sensing researcher is a covered entity under the HIPAA Privacy Rule; in almost all cases, they are not. Nevertheless, hospitals, doctors, and other health care providers from whom health information must be obtained are normally considered covered entities. As a result, under HIPAA authorization standards, the health care provider must obtain a signed HIPAA-compliant authorization form from each individual from whom the researcher seeks protected health information (PHI). Since there may be thousands, if not hundreds of thousands of individuals being studied for a particular research study, it might be very difficult to obtain an authorization from every individual; and/or at the very least, it would be prohibitively expensive.

On the other hand, recognizing that researchers still need access to health information to conduct medical research, the HIPAA Privacy Rule contains an express exception from the authorization requirement for researchers. Under this approach, the researcher normally must obtain a waiver of, or alteration to, the authorization requirement through either the use of an institutional review board (IRB) or HIPAA privacy board (HPB).

Unfortunately, the waiver standards utilized by these review boards are vague and ambiguous and could potentially cause disparate and inequitable results in whether, and how, such health information is disclosed to researchers. For this reason, this article proposes that the HIPAA Privacy Rule's research waiver standards be modified to substitute more readily understandable, and precedentially-based, legal terminology. This proposed legal salve incorporates application of a Fourth Amendment-like reasonableness approach to future research waiver cases.

As discussed in more detail below, the benefits of substituting this new standard are many. As currently written, the research waiver standards under the HIPAA Privacy Rule may lead to many unanticipated, and undesirable, results, including: (1) a dramatic increase in the cost associated with the collection of health data; (2) an increase in time expended before such data can be obtained; and, in the end, (3) a reduction in the use of sophisticated remote sensing techniques altogether in medical research. In short, compliance with the HIPAA Privacy Rule might generate difficulties with a West Nile Virus-type research study as a consequence of remote sensing researchers not being able to know for certain whether they will ever receive the necessary health-related information to complete their studies. On the other hand, the proposed constitutional ointment has the advantage of being part of a well-developed area of law to which researchers and covered entities alike may turn for guidance when deciding whether to grant a waiver to the HIPAA authorization requirement and whether to release PHI to remote sensing researchers for research purposes.

Keywords: HIPAA, health-related research, West Nile Virus, remote sensing

JEL Classification: I11, I18, I19