ABA Health eSource
August 2010 PPACA Special Edition

Reforming Health Care: The Legal, Ethical and Regulatory Challenges in Comparative Effectiveness Research

By Claudia E. Haywood, MBA, JD, J. Craig Venter Institute, Inc., Rockville, Maryland

AuthorWith the passage of the Patient Protection and Affordable Care Act (PPACA), 1 Congress has boldly taken a second step in its funding and support of a national program for Comparative Effectiveness Research (CER). 2 CER is the generation and synthesis of evidence that compares the benefits and harms of alternative methods to prevent, diagnose, treat and monitor a clinical condition or to improve the delivery of care. 3 Building on the established paradigms that already exist in evidence-based medicine, CER seeks to provide comparison data and information about the clinical outcomes, effectiveness and appropriateness of drugs, devices, clinical treatments and procedures that are used to prevent, diagnose, or treat disease, disorders and other health conditions effecting the population. 4

The intent of CER, in general and as defined in PPACA, is to provide useful and practical information to clinicians, healthcare providers and health insurers to ensure that the most effective interventions are delivered to patients at the individual level and across the population as a whole. 5 By conducting such “head to head” comparison studies, it is expected to improve the quality of healthcare delivered and result in a reduction in costs. 6 Thus beyond curtailing the rising costs of healthcare in the U.S., CER has the potential to substantially improve the way healthcare is managed and delivered across the country.

Institutional Considerations. Invariably because of the possible improvements in healthcare delivery and reduction in costs, many healthcare organizations, including hospitals and third-party insurers, will be involved in CER. The research methodological approaches to CER include conducting systematic reviews of existing literature, electronic database research patient information, observational studies and randomized clinical trials. 7 Although funding has been established for infrastructure and program activities, no consideration has been given as of yet to the legal, ethical and regulatory implications of comparative effectiveness research. Organizations considering engaging in CER must be cognizant of some of the legal, ethical and regulatory implications involved in CER.

Regulatory Guidance for CER. It is imperative that organizations interested in participating in CER consider how CER activities fit within their existing regulatory compliance programs, including those involving human subjects research, in advance of regulatory guidance. Although the Department of Health and Human Services (DHHS) is expected to work closely with the Patient-Centered Outcomes Research Institute, the non-governmental entity established to provide oversight to CER, the Office of Human Research Protections (OHRP) for example has not given consideration to the regulatory impact of CER. 8 Unlike evidence based medicine activities which are often conducted as “quality improvement” activities, CER falls squarely within the definition of “research” 9 and will likely fall within the purview of the OHRP. OHRP, while providing leadership in the protection of the rights, welfare and well-being of subjects participating in human subjects research, also promulgates regulatory guidance for DHHS supported research. 10 This includes guidance to organizations with Institutional Review Boards or Ethics Committees that routinely review human subjects’ research activities within their organizations.

Institutional Review Boards have long provided oversight to clinical trials and other research studies involving human subjects and therefore, will likely provide oversight to CER activities, as well. In some aspects, existing IRB regulatory guidance is incompatible with the intent of CER activities since CER activities encompass both traditional notions of clinical trial research and health care quality improvement activities For example, using established review criteria, IRBs must make a number of ethical determinations in regulating research, including whether the risks to subjects are reasonable in relation to anticipated benefits. 11 While the risks to participants of any CER primary research study may be readily identifiable from the side effects, the benefits of participation are analogous to those seen in health care quality improvement activities. Thus, the ethical determinations will likely differ from the traditional clinical research context and must be articulated in the informed consent.] Moreover, OHRP regulatory guidance specifically states that “the IRB should not consider possible long-range effects of applying knowledge gained in the research” including the possible effects it might have on public policy; in contrast, CER studies are specifically focused on the short and long range effects, including the possible changes to the standards of care widely used today. 12 Such guidance is in conflict with the underlying precepts of CER since the intent of CER is to provide the critical information to clinicians to be used in establishing best medical practices. 13 Therefore, until such time as the federal regulatory agencies have provided sufficient regulatory guidance updates, IRBs must be prepared to review CER studies from an alternative perspective, armed primarily with an understanding of the intent of CER, rather than relying on the current regulatory guidance.

Ensuring the Adequacy of Informed Consent. As a general principle, the informed consent for research should explain in sufficient detail all of the information that a reasonable person would want to know to about participating in a study. 14 Ensuring the adequacy of informed consent in CER studies will pose a number of ethical challenges for IRBs reviewing the informed consent for CER randomized clinical trials. These trials are intended to fill the knowledge gap that exists in comparing two approved medical interventions, specifically in targeted segments of the population (e.g., race, ethnicity, gender) that may not have been the focus of the study in the drug or device FDA approval process. 15 The informed consent, while identifying the risks and benefits of participation in CER randomized clinical trials, must address the unique nature of CER studies, specifically, that the study is designed to provide information about the choices made in clinical practice between one or more treatment alternatives. 16 IRBs must be cautious not to overstate the benefits since no “experimental arm” is implicated in the research and the underlying randomization may be between two (or more) suitable alternatives currently utilized in medical practice. Although the risks are not comparable to that involved in an experimental research clinical trial 17 , there exists the risk of receiving a treatment alternative that may be less efficacious based on the research participant’s race or gender. Finally, there are also risks that a third-party insurer may not pay for the related costs of the interventions involved in CER during the study and potentially thereafter, although this aspect of CER has yet to be determined. 18 The informed consent provided to the potential research participant must make notable distinctions with clearly articulated risks and benefits.

Privacy of Medical Information. CER studies will rely heavily on access to large scale databases of patient medical information to provide considerable comparative data across various segments of the population. 19 Critical data will be necessary from stakeholders including information held by large national insurers, integrated health systems and practice-based research networks. 20 Access to patient registry information, as well as information and data related to the outcomes of currently utilized treatment interventions from clinicians is also crucial to the effective implementation of any CER study. 21 Thus, ensuring the privacy of this data on a large scale will be critical.

While the HIPAA Privacy Rule 22 is intended to protect the confidential nature of individually identifiable protected health information, since its implementation, it has been widely criticized as impeding the growth of health related research. 23 To the extent possible to meet study objectives, researchers engaged in CER studies will be able to successfully utilize “deidentified health information” or “limited data sets” in order to maintain patient privacy and confidentiality. 24 However, a number of studies may require linkages to different databases at the individual level and therefore, may require accessing individual patient identifying information in order to ensure the adequacy of the information and therefore, an authorization at a minimum may be required from the participant. 25

In addition, the effective implementation of CER on a national level requires extensive coordination among healthcare organizations. CER’s success is contingent on data sharing among the numerous organizational stakeholders across the various sectors of healthcare. Collaboration, while not specifically mandated in the anticipated funding guidelines for CER, is encouraged to broaden the diversity of information across geographical regions of the United States. Invariably with collaboration across entities there will be greater access to information by the CER workforce. This will mandate a heightened awareness of the HIPAA privacy and security regulations 26 and an infrastructure that provides training for an expanded CER workforce in order to adequately protect individual privacy. Organizations involved in CER research should give serious consideration to existing HIPAA training strategies to reduce the potential liability associated with a breach of privacy as the result of CER activities.


CER is considered an essential part of reforming the nation’s healthcare system. 27 In PPACA, the federal government has made a substantial supplemental investment in supporting the continued growth of the CER infrastructure and the further development of CER programs to ensure its success. Yet as is the case in any governmental reform, there will be implementation challenges and unanticipated consequences. While evidence based medicine and health outcomes research have existed for decades in the United States, the establishment and support of a national CER initiative by the federal government is likely to pose a set of unique challenges that require further legal and regulatory clarification. Until such time as the regulatory infrastructure is consistent with CER, organizations must recognize these challenges and understand the implications of organizational decision making on the CER enterprise.

1 Patient Protection and Affordable Care Act of 2010 (Public Law 111-148) . In addition to PL 111-148, Congress subsequently passed the Health Care and Education Reconciliation Act of 2010 (H.R. 4872).
2 In the American Recovery and Reinvestment Act (ARRA) of 2009 (P.L. 111-5), Congress appropriated approximately $1.1 billion to support CER activities in the U.S. This unprecedented amount of funding, intended as a down-payment for future federal support, included establishing the initial infrastructure and funding priorities for future CER activities in the U.S.
3 Committee on Comparative Effectiveness Research Prioritization. Initial National Priorities for Comparative Effectiveness Research. Institute of Medicine, National Academies Press, Washington, DC. (2009)
4 Id.
5 Id.
6 Congressional Budget Office. Research on Comparative Effectiveness of Medical Treatments: Issues and Options for an Expanded Federal Role. 2 Congressional Budget Office. December, 2007.
7 In addition to these methodologies, funding was set aside for the development of new methodologies for conducting CER as well.
8 Confirmed via email exchange with Michael Carome, Director, Regulatory Affairs, Office of Human Research Protections (OHRP), Department of Health and Human Services on July 16, 2010.
9 45 CFR Part 46.102(d) (2009) The term “ r esearch is defined as “a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge.”

United States Department of Health and Human Services, Office of Human Research Protections, http://www.hhs.gov/ohrp/about/ohrpfactsheet.htm (last visited June 4, 2010)

11 45 CFR Part 46.111 (a) (2) (2009)
12 Id.
13 Arguably, the establishment of the standard of care and best medical practices is equivalent to healthcare policy making.
14 45 CFR Part 46(a) (1)-(8); 45 CFR Part 46 (b) (1)-(6)
15 Committee on Comparative Effectiveness Research Prioritization (2009) Initial National Priorities for Comparative Effectiveness Research. Institute of Medicine, National Academies Press, Washington, DC.
16 Id.
17 This assumes that the risks identified include those known side effects provided to the patient during the course of medical treatment.
18 Id. Variation in third-party payer exists geographically and is one of the driving needs for nationwide information for use in clinical evaluation and treatment.
19 Id.
20 Id.
21 Id.
22 Health Insurance Portability and Accountability Act (HIPAA) of 1996 §§261-264; 45 CFR § 164.101 et..seq.
23 Id.
24 Health Insurance Portability and Accountability Act (HIPAA) of 1996 §§261-264; 45 CFR § 164.101 et..seq. HIPAA’s Privacy Rule allows institutions to de-identify data by removing all of the 18 elements that could be used to identify an individual. A limited data set is a data set that excludes 16 of the HIPAA Privacy Rule direct identifiers and may be used or disclosed, for purposes of research, public health, or health care operations, without obtaining either an individual's Authorization or a waiver or an alteration of Authorization for its use and disclosure, with a data use agreement. U.S. Department of Health and Human Services, National Institutes of Health, HIPAA Privacy Rule, Information for Researchers, http://privacyruleandresearch.nih.gov/pr_08.asp
25 Id. This is particularly the case when utilizing larger national datasets from a variety of sources (e.g., pharmacies, clinical offices, hospitals) which potentially lack standardized definitions or may not otherwise be electronically compatible.
26 HIPAA’s Privacy Rule allows for the use of protected health information for research without an individual’s authorization in limited circumstances including with a waiver of the Authorization requirement by an IRB or Privacy Board, as a limited data set with a data use agreement, preparatory to research, and for research on decedents' information. HIPAA’s Security Rule provides strict guidelines governing the appropriate administrative, physical and technical safeguards of an individual’s protected health information to ensure its confidentiality, integrity, and security. U.S. Department of Health and Human Services, Office of Civil Rights, Health Information Privacy, http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/index.html
27 Eugene C. Rich, The Policy Debate over the Public Investment in Comparative Effectiveness Research, 24 Journ of Gen Intern Medicine 752, 752-53 (2009)

The ABA Health eSource is distributed automatically to members of the ABA Health Law Section . Please feel free to forward it! Non-members may also sign up to receive the ABA Health eSource.