Summary: A considerable amount of health research relies on personally identifiable information. Although some of this research is subject to review by institutional review boards -- either because it is federally supported or regulated research or because the organization voluntarily applies federal rules to all of its research -- some of the organizations conduct records-based research that is not reviewed by an institutional review board. In any case, the process of institutional review board review does not ensure the confidentiality of medical information used in research, primarily because the provisions of the Common Rule related to confidentiality are limited. Moreover, according to recent studies, the institutional review board system on the whole is strained. Nevertheless, although external review of their research is limited, most of the organizations in GAO's study indicated that they have security safeguards in place to limit internal and external access to paper and electronic databases, and many say that they have taken steps to ensure the anonymity of research and survey subjects. This testimony summarizes the February 1999 GAO report, GAO/HEHS-99-55.
