Clinical Researcher—January 2020 (Volume 34, Issue 1)

PEER REVIEWED

Marina Albuquerque de Souza Dantas, MD; Lacey B. Robinson, MD; Elie Mitri; Catalina Gallegos; Ashley F. Sullivan, MS, MPH; Carlos A. Camargo Jr, MD, DrPH

 

Medical records are a valuable source of data for clinical research, and the ongoing shift to electronic medical records (EMRs) allows for increased access to important data sources.{1} In 1996, privacy rules were established through the Health Insurance Portability and Accountability Act (HIPAA) to safeguard medical information and protect patients’ privacy.{2} The HIPAA Privacy Rule is frequently misinterpreted by healthcare providers, contributing to difficulties in medical records collection and complicating research execution.{3} A national survey of clinical scientists in the U.S. showed that the HIPAA Privacy Rule was perceived to add uncertainty, cost, and delay to the conduct of health-related research.{4}

To date, little has been published on strategies for medical records collection in clinical research, which may discourage investigators from conducting robust studies relying on medical records, such as large multicenter studies. Therefore, a better understanding of the applicability of the HIPAA Privacy Rule, along with possible solutions to commonly encountered problems in records collection, would be of substantial benefit to clinical researchers.

To address this scientific gap, we describe our experience of collecting medical records in two multicenter pediatric cohorts, known as the 35th Multicenter Airway Research Collaboration (MARC-35), a prospective cohort study of severe bronchiolitis and risk of recurrent wheezing and asthma, and the 43rd Multicenter Airway Research Collaboration (MARC-43), a study of the airway microbiome asthma phenotypes in healthy infants. We have faced several challenges in medical records collection, but with experience, we have overcome many problems and improved our processes to obtain a high level of completeness of medical records. These experiences encouraged us to share the lessons we have learned for the benefit of future studies.

The MARC-35 and MARC-43 Cohorts

MARC-35 and MARC-43 are multicenter cohort studies following children from early infancy to approximately age 6 years for multiple outcomes, including clinician-diagnosed asthma. From 2011 to 2014, 1,016 infants (age < 1 year) were enrolled in MARC-35 in 17 U.S. hospitals (enrollment sites) during an inpatient hospitalization for bronchiolitis. In 2013 and 2017, a total of 720 healthy infants were enrolled in MARC-43 in five U.S. hospitals.{5,6}

Study procedures in these two parallel cohorts include serial telephone interviews with the legal guardians every six months, in-person physical exams every few years, and complete medical records review from birth to study completion at age 6 years or older. Complete medical records review includes physician review of records from all primary care providers (e.g., pediatrician) and specialists (e.g., pulmonologist, allergist), along with all urgent care visits, emergency department visits, and hospitalizations. All study activities are coordinated by the Emergency Medicine Network (EMNet) at Massachusetts General Hospital.

Informed consent and HIPAA-compliant authorization forms for records release were obtained at enrollment, authorizing the EMNet Coordinating Center to obtain all records for participants from birth until study completion. Per the HIPAA Privacy Rule, authorization forms may be valid until an established date (e.g., until the end of the research study) or never expire. We decided to use a form that was valid until one year after completion of participant follow-up.

Medical Records Collection

We used a systematic approach for medical records requests and inventory (see Figure 1). Core medical records include records from the participating enrollment sites and the children’s primary care providers (PCPs). Requests for these core records are made regularly on a predefined schedule. In November of each year, due to the existence of a Data Use Agreement, the EMNet Coordinating Center requests all medical records on file for the previous year from each participating enrollment site, including all visits to site-affiliated facilities within a shared EMR system.

Figure 1: A Systematic Approach to Medical Records Requests and Inventory

PCP information is confirmed and updated every six months by serial telephone interviews with legal guardians and stored in REDCap,{7} a HIPAA-compliant, web-based data capture tool. Time points for PCP requests were predefined at ages 1, 3, 5, and 6 years. Every three months, we query which participants meet these specified age timepoints and send medical records requests to the PCPs they saw in the interval of interest. The requests are submitted twice by mail to PCPs, and any non-responders are then contacted by telephone.

After the core medical records are received, EMNet coordinators conduct a pre-review of the records by age section (e.g., 0–0.9 years, 1–2.9 years, and so forth). Pre-review includes checking medical records for consistency (e.g., ensuring available records match healthcare encounters reported by legal guardians) and identifying missing or incomplete records. Information regarding completeness of each age range, dates of submission, and details about problems with collection are recorded in Microsoft Access, a database management system.

During pre-review, medical records not obtained from PCPs through the initial core request (approximately 15–20%) are re-requested and followed up until the missing medical records are obtained. Urgent care visits, emergency department visits, specialist visits, and hospitalizations not obtained through participating enrollment sites are also requested at this time. The medical record is deemed complete when we have no chronological gaps and all well-child checks and sick visits are present for a given age section.

When complete, the medical records are assigned for review by trained physicians who extract relevant data portions and enter them in REDCap. If the physician reviewer identifies any remaining missing medical records, medical records requests are sent to the identified facilities.

Challenges

We encountered multiple challenges during the process of medical records collection (see Table 1). We will discuss our most common and difficult challenges and share our solutions.

Table 1: Medical Records Collection: Challenges and Solutions

Challenges	Suggested Solutions
Delivery of MEDICAL RECORDS REQUEST to the correct provider	1. Maintain periodic contact with participants after enrollment to update information about past and current healthcare providers. 2. Maintain a database with contact information for all participants’ PCPs, including preferred method of contact.*
	3. Ensure knowledge of records allocation rules in the case of facility closure.
LACK OF response to MEDICAL RECORDS requests	1. Perform systematic follow-up after submission with telephone calls. 2. Track submission of requests and all subsequent contacts in an EMR tracking system.**
	3. Use Data Use Agreements to make large bulk requests when possible.
Declined AUTHORIZATION FORMS FOR RECORDS RELEASE	1. Use multiple checkpoints to ensure accuracy of authorization forms at time of completion.
	2. Adapt authorization forms to follow state-specific requirements.
	3. Avoid making authorization forms provider-specific and instead use broad authorization from many care providers.
	4. Set authorization form date of expiration after outcome of interest to allow additional time for medical records collection.
	5. Contact participants periodically to obtain a new authorization form if needed.
	6. Use an electronic system for authorization form signature.

^*We use REDCap for this purpose. ^**We use Microsoft Access for this purpose.

Delivery of Medical Records Requests to the Correct Provider

During the many years of follow-up, children’s PCPs frequently change, and facilities relocate or undergo closure, complicating delivery of medical records requests to the correct provider. Often, updated PCP information is provided by legal guardians, but at other times we only suspect PCP changes have happened due to gaps in the received medical records.

The HIPAA Privacy Rule forbids providers to release any protected health information by phone, including the name of other providers, and prevents facilities from sending records of others, thus hindering medical records collection in cohort studies that do not have longitudinal contact with participants. The serial telephone interviews with legal guardians included in both cohorts enable us to obtain updated contact information for PCPs in a timely and efficient manner. This process is aided by recording of alternate contacts for all legal guardians, increasing our ability to complete the serial telephone interviews.

However, in some cases, we are unable to obtain updated PCP contact information from the legal guardian (e.g., participant lost to follow-up) and then rely on information in the available medical records. For example, PCP names may be recorded on hospital discharge summaries or immunization records.

After the PCPs and other healthcare providers are identified, the submission of medical records requests is complicated by other factors, including inaccuracies in the contact information for PCPs or other healthcare providers received from legal guardians. To decrease errors, when the correct contact number and address of any healthcare provider are identified, we update REDCap and Microsoft Access with this verified information. Additional notes are entered, including best mode of communication (e.g., telephone vs. fax).

Although uncommon, some healthcare facilities undergo closure. Many factors influence the transfer of medical records upon closure, such as state and/or federal laws, Medicare and/or Medicaid requirements, recommendations from state licensing boards and professional societies, and the general circumstances of closure.{8} Therefore, medical records may end up with another healthcare provider, the state Department of Health, in commercial storage, or even destroyed if no transfer is possible.

When a closed facility hasn’t released a public note listing the new custodian of its medical records, we contact the Department of Health for the state for further information. A summarized list of each state’s requirements for medical records disposition after facility closure can be found via the American Health Information Management Association website.{9}

Lack of Response to Medical Records Requests

Even upon identification of the correct healthcare providers and their contact information, medical records request submissions frequently do not result in transfer of requested records to the research facility. In many cases, there is no direct communication on the status of requested records. The initial request to PCPs, submitted by mail, usually obtains a response rate of approximately 50%, with rates for a second mailing of requests typically increasing to 70%, and with the final requests by telephone, the response rate rises to at least 80%.

During the medical records pre-review, additional medical records requests to newly identified PCPs or other healthcare facilities are submitted first by fax, and then by telephone call if no response is received. After two attempts, the overall response rates for these groups is > 95%.

To increase the response rate for initial medical records requests to PCPs, we have established a systematic telephone follow-up system, in which EMNet coordinators call facilities that did not respond to the initial requests once per week to identify potential issues. All activities are registered in Microsoft Access, giving an overview of what has already been performed and what is due, and enabling monitoring of the status of submitted and pending requests in an organized system that can be accessed by all key personnel.

Through the use of Data Use Agreements with enrollment sites, yearly bulk medical records requests can be completed for all study participants at each enrollment site. Records from sites and all affiliated healthcare facilities are then sent directly to the EMNet Coordinating Center for review, with a uniform response rate of 100%. This process increases efficiency, as there is a decrease in the overall number of individual requests.

Declined Authorization Forms for Medical Records Release

Even when medical records requests are received by healthcare providers, many authorization forms are declined, often due to different interpretations of the adequacy of the form. We use strictly HIPAA-compliant forms, but to decrease rates of declined forms we suggest attention to state-specific requirements, allowance of multiple providers to release records, and an expiration date after study completion.

Despite emphasis on the importance of accurate completion of the authorization form, we found that many returned forms have blank fields or incorrect dates which invalidate them. To decrease these errors, we performed additional training and established multiple checkpoints during the completion of the form, improving their completeness and validity.

Several facilities require use of a specific authorization form or report more strict state laws than the HIPAA Privacy Rule. Examples of these stricter rules include protections for specific conditions such as sexually transmitted disease, substance abuse and psychiatric conditions.{10,11} In these cases, we create new forms that account for these specific rules; these must be approved by the respective enrollment sites’ institutional review boards and then signed by legal guardians. This process significantly delays collection of medical records.

In our experience, many legal guardians only include the participant’s current PCP on the authorization form, and thus a new form has to be obtained to request information for any other providers. This is problematic because participants frequently switch PCPs or obtain care from multiple healthcare providers (e.g., from specialists, in urgent care settings, or various hospitals). One strategy we employed to minimize the need for separate forms for each medical provider is to authorize “all providers” at “all healthcare facilities” to release records. Stating a class of providers (e.g., all primary care providers or all providers) in the authorization form is allowed by the HIPAA Privacy Rule.{2}

Another common source of rejection of authorization forms is tied to the form’s expiration date. In our experience, many facilities are unfamiliar with the fact that the HIPAA Privacy Rule allows the form to expire at the end of the research study or to never expire, thus facilities often refuse to provide medical records for service after the date of the signature on the form. This obstacle is problematic for prospective cohort studies, in which the form is usually signed at enrollment and meant to be valid for many years (e.g., until the end of the planned study period).

When facilities decline authorization forms because of signature dates, we discuss the applicability of HIPAA Privacy Rules directly with the facilities’ medical records department staff by telephone. When necessary, we fax the federal HIPAA Privacy Rule to the facility, highlighting the specific paragraphs related to the flexible expiration date of the authorization form for research use. If the form was still declined, we would then contact the legal guardian and ask him/her to complete a new form.

Due to these reasons for rejecting an authorization form, it is not rare to need to obtain a new form outside a prespecified study visit. Initially, when a new form was required, we contacted the legal guardian and requested completion of a new form to be returned by mail. However, using this system we had very low rates of returned forms. We thus implemented a HIPAA-compliant electronic system (Ingram Micro Adobe Sign) to obtain a signature on the form, which has proven to be extremely helpful, as the rates of completed forms have increased. Our ability to contact subjects periodically during the study period is instrumental in our success in receiving updated forms when needed.

Conclusion

Medical records collection is a time-consuming activity that may become the rate-limiting point of any study without careful logistical planning. In the MARC-35 and MARC-43 multicenter studies, we faced many problems with records collection—from successful delivery of medical records requests to providers to declined authorization forms—but were able to develop and implement many successful solutions.

Some studies are solely based on medical record review, but in our experience the ability to periodically contact legal guardians has been vital to our success. This longitudinal follow-up allows us to update providers’ information and obtain new authorization forms when required. Through use of electronic databases (REDCap and Microsoft Access), the information given by legal guardians is complemented by our experience contacting each provider, increasing the chances of successfully reaching these providers in the future. In the unlikely event that a healthcare facility closes, we recommend contacting the state’s Department of Health to locate the medical records.

Before requests are submitted, it is crucial to have a medical record tracking system such as Microsoft Access in place, as it will provide an up-to-date view of which records are ready for review and which need to be requested. This tracking system provides the basis for systematic follow-up of already submitted medical records requests—an important strategy to achieve a satisfactory response rate. Similar systems for medical record completeness documentation have been previously applied with success.{12} For multicenter studies, having a Data Use Agreement with participating enrollment sites decreased the number of individual requests and increased the rate of medical record collection.

Finally, much focus has to be devoted to the components of the authorization form, since they are the main source of medical records requests rejection. From the beginning of a multicenter study design, investigators should make sure the authorization forms contain state-specific elements, are not provider-specific, and expire after the outcome of interest, allowing time for medical record collection. Despite these precautions, authorization forms may still be declined, and thus we recommend having the ability to contact legal guardians to obtain a new form.

References

1. Smailes P. 2017. The ethics of research access to electronic medical record data. Clin Res 31(3):18–9. https://acrpnet.org/2017/06/01/data-tech-connect-ethics-research-access-electronic-medical-record-data/
2. National Institutes of Health, U.S. Department of Health and Human Services. 2004. Protecting Personal Information in Research: Understanding the HIPAA Privacy Rules. https://privacyruleandresearch.nih.gov/pdf/HIPAA_Booklet_4-14-2003.pdf
3. Nass S, Levit L, Gostin L. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research (Institute of Medicine). www.nap.edu/catalog/12458.html
4. Ness R. 2007. Influence of the HIPAA Privacy Rule on health research. JAMA 298(18):2164.
5. Hasegawa K, Stewart C, Celedón J, Mansbach J, Tierney C, Camargo CA Jr. 2018. Serum 25-hydroxyvitamin D, metabolome, and bronchiolitis severity among infants—a multicenter cohort study. Ped Allergy Imm 29(4):441–5.
6. Hasegawa K, Linnemann R, Avadhanula V, Mansbach J, Piedra P, Gern J, Camargo CA Jr. 2015. Detection of respiratory syncytial virus and rhinovirus in healthy infants. BioMED Cent Res Notes 8(1):1–5.
7. Harris P, Taylor R, Thielke R, Payne J, Gonzalez N, Conde J. 2009. Research Electronic Data Capture (REDCap)—a metadata-driven methodology and workflow process for providing translational research informatics support. J Biomed Informatics 42(2):377–81.
8. American Health Information Management Association. 2011. Protecting Patient Information After a Facility Closure (2011 Update). https://library.ahima.org/doc?oid=105074#.XNL5i-VKhpg
9. American Health Information Management Association. 2011. Protecting Patient Information After a Facility Closure (Appendix C: States with Laws, Regulations, or Guidelines Pertaining to Facility Closure). http://bok.ahima.org/doc?oid=105007#.XNL5TOVKhpg
10. Oklahoma State Department of Health. 2014. Oklahoma Standard Authorization to Use or Share Protected Health Information (PHI). https://bit.ly/2FEXVVH
11. Electronic Frontier Foundation. The Law and Medical Privacy. https://www.eff.org/issues/law-and-medical-privacy
12. Gareen I, Sicks J, Adams A, Moline D, Coffman-Kadish N. 2013. Identifying and collecting pertinent medical records for centralized abstraction in a multi-center randomized clinical trial: the model used by the American College of Radiology Arm of the National Lung Screening Trial. Contemp Clin Trials 34(1):36–44.

Marina Albuquerque de Souza Dantas, MD, (marinaalbuquerquede.dantas@nicklaushealth.org) is a Resident in Pediatrics at Nicklaus Children’s Hospital in Miami, Fla., and a former Research Fellow in the Department of Emergency Medicine at Massachusetts General Hospital in Boston, Mass.

Lacey B. Robinson, MD, is a Research Fellow in the Division of Rheumatology, Allergy, and Immunology at Massachusetts General Hospital and an Instructor in Medicine at Harvard Medical School.

Elie Mitri is a Senior Clinical Research Coordinator at the Emergency Medicine Network at Massachusetts General Hospital.

Catalina Gallegos is a Senior Clinical Research Coordinator at the Emergency Medicine Network at Massachusetts General Hospital.

Ashley F. Sullivan, MS, MPH, is Director of the Emergency Medicine Network Coordinating Center at Massachusetts General Hospital.

Carlos A. Camargo Jr, MD, DrPH, is Division Chief of the Emergency Medicine Network at Massachusetts General Hospital, Professor of Emergency Medicine and Medicine at Harvard Medical School, and Professor of Epidemiology at Harvard T.H. Chan School of Public Health.