UCSD's HIV Privacy Gap

The U.S. Department of Health and Human Services has determined that a research project conducted by UCSD’s Antiviral Research Center violated the privacy and confidentiality rights of an unspecified number of human research subjects taking part in an HIV infection study. According to a February 4, 2011, letter from Health and Human Services official Lisa Buchanan to Gary S. Firestein, M.D., the university’s vice chancellor of translational medicine, the investigation was triggered by a research subject who alleged that researchers had “...sent out all my laboratory specimens [sic] to private laboratory with my first name, last name, DOB and SSN.”

The project leader was Dr. Susan Little, an associate professor of medicine in the Department of Medicine, Division of Infectious Diseases, at the university. According to her biography on UCSD’s website, “Little has developed one of the leading and most productive National Institute of Allergy and Infectious Diseases–sponsored programs in the United States for the identification, enrollment, and treatment of individuals with acute and recent HIV-1 infection.”

A November 2007 news release promoted what UCSD said was “free and confidential HIV testing to people who may have a very recent infection with HIV.” It quoted Little as saying, “An individual can get the Early Test, which also detects hepatitis C infections, as early as one week after a potential HIV exposure. This is especially important because newly infected individuals have a very high viral load.”

The government’s investigation of the research subject’s privacy complaint revealed that the use of names and birthdates on lab specimens, common during the study, had violated federal laws. The practice also circumvented a confidentiality rule mandated by the university’s own institutional review board, which is supposed to monitor research projects involving human subjects.

“Given the information we reviewed, at least one subject may have suffered harm that might have been avoided if the research referenced above had been carried out as approved by the [university’s review board],” said Buchanan. The review board acknowledged that it “…was not aware that [Little] was including names to identify samples sent to outside laboratories…[and it]…approved [her] research…with the understanding that [she] was coding all samples as described in her research plan.”

In a May 4 follow-up letter to UCSD’s Firestein, Buchanan outlined the actions that the university had agreed to take in the wake of the findings, including an audit of Little’s work to “assess compliance with [institutional review board–]approved research procedures for protecting patient confidentiality.”

The audit “found 100% noncompliance” with review board “procedures for coding data to protect subject confidentiality.” As a result, UCSD has agreed to “conduct random audits of all active research protocols on which Dr. Little serves as [principal investigator] for compliance with [review board–]approved procedures and all aspects of managing patient confidentiality for the next 2 years.”

Queried about the case in a telephone interview last week, Little said that all of the privacy issues called out by regulators had been resolved. “Was it a mistake? Yes, it was. Should we have done better? Absolutely.” However, Little added, federal HIV reporting guidelines are “in constant evolution” and the privacy lapses that occurred during the course of the study were not “cavalier, reckless, or negligent.”

Little and the Antiviral Research Center are currently promoting Lead the Way, an effort to test all residents in the city’s 92103 and 92104 zip codes for HIV, backed by the endorsement of local celebrities, including Father Joe Carroll. “HIV testing is easy, confidential and is the simplest way to help our local community fight the spread of HIV/AIDS,” Little says on the project’s website.