The conduct of clinical research under the HIPAA privacy rule

This article is the report of a work group of the American Academy of Orthopaedic Surgeons Council on Research, Quality Assessment, and Technology. The task assigned to the group by the Chair, Joshua Jacobs, MD, was to review, codify, and disseminate information for the Fellowship on the compliance requirements for conducting clinical research under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The ethical conduct of clinical practice has an established precedent extending to ancient times and the beginnings of the healing professions, encoded in the Code of Hammurabi and the Hippocratic oath. These guides were intended to regulate the conduct and ethics of the purveyors of medical treatment in the ancient world. They also prescribed boundaries of behavior and penalties for transgressions, including corporal punishment. Comparatively, medical research does not have such a history and was largely without published standards of conduct until the twentieth century. The Nazi physician trials in 1946 exposed atrocities committed under the guise of experimental human medical research, which resulted in the 1947 Nuremberg Code for human research1. Included in the ten precedents that it established were the important requirements that subject participation be informed and voluntary and that human research must be scientifically valid and conducted solely for the benefit of society as a whole. The Nuremberg Code was accepted by the fifty-one signatory nations of the Charter of the United Nations. In 1953, the Clinical Center of the United States National Institutes of Health produced the first federal policy to protect human research subjects. The years after World War II saw an increase in scientific technology applied to medical treatment protocols. The new policy was consistent with the Nuremberg Code and gave special emphasis to the protection of healthy adult research volunteers. This policy established the beginning of …