Researchers pack Hurd Hall to learn more about how HIPAA will affect the way they work.

Nonetheless, the new regulations will mean a major change in the way Hopkins and its entities do business. Here is a sampling of how HIPAA will affect a few key areas.

Louise Thompson
Administrator, Medical Record Services,
Johns Hopkins Hospital

The hospital has 4 million medical records. Most of them are in our archives, of course, but there are still thousands active on this campus. We get 3,500 requests per month to release patient information. The requests come from lawyers, insurance companies, patients, doctor's offices, researchers, the public health department, auditors. We always demand a written authorization to release records. Our staff is attuned to not releasing information over the telephone.

With the advent of HIPAA, the biggest change for medical record departments will be keeping an audit trail. By law, we'll need to keep track of what we release-history and physical, discharge summary, operative notes-and to whom we released it. So if patients call and want to know how often we released their records, what we released and to whom, we will have to have that information going back six years. That's new, and it might even help us gain some efficiencies.

Now we will not always have to release the entire record but a standard data set, which will contain meaningful information, like the narrative summary, operative notes and path report. And that is helpful because when it is released, we might be able to avoid having to copy numerous pages in the entire record.

Overall, it's good for us. Our staff of 120 will get a lot of good training, and it makes what we're already doing more formal.

Christopher Saudek, M.D.
Director, General Clinical
Research Center

We've worked hard, here and around the country, to build the public trust in clinical research. We design good, ethical studies, and then fully inform people who areinterested in taking part. I think we have to wait and see whether HIPAA will improve protection of research participants, and improve their confidence and understanding of research, or just confuse people. It's hard to tell at the moment.

In my view, anything that slows or inhibits the process without clear benefit is a step backward. And there are parts of HIPAA that will slow down progress in ways I'm not sure will benefit anyone. For instance, we may have drawn a tube of blood in a diabetes study and told participants that it will be used to test "insulin levels and other tests related to diabetes." A year down the road, it turns out that we'd like to measure a newly discovered risk factor for diabetes. With the new regulations, we'll have to go back and find every volunteer, asking for written permission to perform the new test. But realistically, how many people would join the study agreeing to have their insulin level tested but not this new risk factor?

We already know that HIPAA will mean an increased workload for everybody in the research process. New forms, new assurances, new training and record keeping. We will certainly comply, and we do believe in protecting the privacy of our research participants. Ideally, HIPAA will help protect that privacy without unnecessary bureaucracy. We'll see.

Beth Beale
Vice President, Client and Corporate Services,
Johns Hopkins HealthCare

We have three lines of business-EHP, Priority Partners and U.S. Family Health Plan. As an insurance company, our perspective is different from a provider's. First, we must send out privacy statements to our members, about 150,000 pieces of mail. We have to train 500 employees. Our customer service representatives will be given scripts to help them answer members' questions. We expect there will be a lot of confusion at first, because if a wife calls to inquire about her husband's condition, which happens every day, we will no longer be able to have those discussions without a signed release form. Once we get release forms, they'll all have to be entered into our system. We also have had to put in place about 100 business associate agreements with everyone we interface with-our EHP employer customers, those who provide our lab, vision, dental and drug services. HIPAA will have a dramatic impact on us, not only because of the increased paperwork, but because it won't be business as usual in the way we serve our members.

John Zeller
Associate Vice President for Development

We raise $140 million a year from grateful patients, and all but a tiny percentage of that money comes via major gifts. Typically, a patient comes here to see a physician, expresses an interest in supporting the physician's research or program. In turn, the physician calls his or her development officer or the Fund for Johns Hopkins Medicine to determine the appropriate follow-up. With HIPAA, the patient will need to sign an authorization before the physician can have a substantive gift conversation or give the patient's name to the development office. The authorization inserts a potentially awkward step, and it will be hard to determine its impact. Private philanthrophy has a remarkable impact on Johns Hopkins Medicine-it supports novel research that can't get funding elsewhere, it sets up endowed professorships, it helps build the buildings on campus and even supports the School of Medicine's operating margin. So potentially, HIPAA might have a significant impact on us.

Joann Rodgers
Deputy Director and Director of Media
Relations, Office of Communications and Public Affairs, Johns Hopkins Medicine

Working with HIPAA experts here, we now have a good consent form for inpatients to grant permission for us to share their protected information with the media. We are planning to work with the media as the new rules roll out. Some reporters and editors know little about HIPAA, which will change the way we work together.

But I'm optimistic. We've been hit with barriers to communication in the past. The state of Maryland, for example, adopted rules about what we can and can't
say that are often more rigorous than in the rest of
the country.

By and large, I'm not worried. When there are new rules, people tend to think worst-case scenario. But then people relax, and the new becomes routine. If in truth we care about patient privacy, this is a good thing.

-Reported by Mary Ellen Miller