Medical Records Privacy: Access Needed for Health Research, but Oversight of Privacy Protections Is Limited

Pursuant to a congressional request, GAO reviewed the types of health research conducted outside the Common Rule and Federal Drug Administration (FDA) regulations, focusing on: (1) examining how medical information is used for research and the need for personally identifiable information; (2) identifying research that is and is not subject to current federal oversight requirements; (3) examining how institutional review boards (IRB) ensure the confidentiality of health information used in research; and (4) identifying the safeguards health care organizations have put in place to protect the confidentiality of health information used in research.