Researchers and HIPAA

To the Editor: Medicaid data have been used for pharmacoepidemiologic research since the early 1980s, and there is now optimism about using Medicare Part D data for such studies. Database studies often require hospital records to validate study outcomes.1 Unfortunately, the Health Insurance Portability and Accountability Act (HIPAA) has made obtaining medical records much more challenging. We sought to develop and test a mechanism to obtain hospital records for research. As part of a study of drug-induced sudden death and ventricular arrhythmia, the Centers for Medicare and Medicaid Services (CMS) provided us with Medicaid claims data from 5 states (California, Florida, New York, Ohio, and Pennsylvania) covering 1999–2000. Because Medicaid claims are often incomplete for persons who are also eligible for Medicare,1 we also obtained Medicare data for all dually eligible persons from those states. Quality Improvement Organizations (QIOs) are a national network of contractors whose mission is to improve the quality of health care provided to Medicare beneficiaries. As part of this mission, QIOs have traditionally abstracted hospital medical records. More recently, primary responsibility for this role has shifted from QIOs to a single, national CMS-funded Clinical Data Abstraction Center (CDAC), which obtains and abstracts inpatient medical records nationwide. Our proposed mechanism for obtaining inpatient records was as follows. First, we used Medicaid and Medicare data to identify a list of hospitalization outcomes to be validated. We then provided information about these hospitalizations to the CDAC. This information included social security number, Medicaid statistical information system identification number and/or Medicare health insurance claim number, sex, date of birth, admission date, discharge date, and hospital identifiers. The CDAC would then contact the hospital and request a photocopy of the relevant record for research purposes. The hospital would photocopy the record and mail the photocopy to the CDAC, which would reimburse the hospital for photocopying and shipping. The CDAC would then redact direct personal identifiers and ship the redacted records to the academic center. The University of Pennsylvania's institutional review board approved the study and granted waivers of informed consent and HIPAA authorization, and CMS granted the needed data reuse agreement. Once we had executed a business associate agreement with the CDAC, we provided the CDAC with an electronic file containing the information needed to request records. As required by the HIPAA Privacy Rule, we accounted for this disclosure of protected health information. The CDAC requested 164 inpatient records of 164 patients, and received full inpatient records of 128 (78%) of these. We would expect a higher success rate for more recent records, and a lower rate for less recent ones. The CDAC recontacted nonresponding hospitals, which provided the following reasons for not providing requested records: unable to locate record (n = 17), hospital closed or otherwise unable to be contacted (n = 4), refused (n = 2), and no reason given (n = 13). The CDAC charged $15,000 including hospital reimbursements, which comes to $117 per chart retrieved. We believe that this mechanism for obtaining hospital records can greatly enhance the scientific and public health value of data now available from CMS, as well as Medicare Part D data, which we hope will become available soon. We see no reason why other researchers cannot use this same mechanism. A mechanism to obtain outpatient records would also be valuable, since not all outcomes result in hospitalization. However, this may prove more challenging, since outpatient providers, unlike hospitals, are unaccustomed to responding to requests by the CDAC or QIOs. Sean Hennessy Charles E. Leonard Warren B. Bilker Center for Clinical Epidemiology and Biostatistics and Center for Education and Research on Therapeutics, University of Pennsylvania School of Medicine, Philadelphia, PA [email protected]