The Centers for Disease Control and Prevention violated federal regulations when it failed to notify postal workers potentially exposed to anthrax in the 2001 attacks that their confidential medical information would be included in a study, medical privacy experts and postal employees told United Press International.
The CDC collected the personal information for a study on the side effects of the extensive course of antibiotics given to postal workers in Washington, Connecticut, New York and New Jersey to prevent anthrax infection. However, the postal workers told UPI they were never informed the information was being collected for a study.
The CDC's failure to notify the workers is a serious infraction of federal regulations set up to protect medical research participants, experts on research protections told UPI. Due to the sensitive nature of medical information, researchers are required to inform subjects why the information is being collected and how their privacy will be protected.
"There are multiple violations going on," said Vera Hassner Sharav, founder of the advocacy organization Alliance for Human Research Protection. "If the CDC withheld full information about the nature and purpose of this study, how it will be used, who is using the information and keeping it ...it is a violation of medical research regulations."
"If the facts stand up it violates the regulations for medical research," Adil Shamoo of the University Maryland School of Medicine told UPI. "It's an inappropriate way of conducting research with so many human beings." Shamoo is a former member of the National Human Research Protections Advisory Committee, which advised the Department of Health and Human Services on medical research protections.
The CDC study, which was published in the October issue of the journal Emerging Infectious Diseases, included information about minor problems such as nausea and headaches and more serious matters such as neurologic problems including seizures. Though not published, postal workers told UPI they also disclosed potentially damaging information about psychiatric problems including depression and post-traumatic stress disorder.
The data was collected in such a way that it could be linked to an individual's name, address and telephone phone number -- although it was not published that way in the study.
A major concern for the postal employees is that the information could be disclosed to third parties and impact their future ability to obtain insurance or employment, said Kathleen Rand Reed, president of Geographic Genetic Systems, a Washington consulting company that focuses on human research protections. The CDC has "raped those people. This is so egregious," said Reed, who serves on an Institutional Review Board -- a panel that reviews studies to ensure they do not compromise protections accorded to human research participants -- at the National Heart, Lung, and Blood Institute.
Federal regulations require that researchers notify people upfront that a study is being conducted. However, many of the postal workers first learned of the study from reports of it in the media or when UPI contacted them. Many were under the impression the CDC was collecting the information in an attempt to help them with health problems they were still experiencing nearly three months after the anthrax attacks.
Employees at postal facilities in Washington, Trenton, N.J., and New York -- all of which were contaminated with anthrax -- said they were not informed of the CDC study.
"I'm not happy about it," said William Smith, president of the New York Metro Area Postal Union. "The CDC wants to use (the employees) as guinea pigs... . This is a crisis these employees have been through and this should not be used as a test issue with their lives."
Both the CDC and RTI, a medical research firm in Research Triangle Park, N.C., contracted to collect the information by phone, insisted the employees were informed at the beginning of the phone calls the information was being collected for a study.
However, Colin Shepherd, an epidemiologist with the CDC and lead author of the study, acknowledged the only written notice the subjects got about the study was a one-page letter from Julie Gerberding, then acting deputy director of the CDC. Gerberding now is director of the agency.
The letter states the phone interviews were being conducted to help the agency evaluate its program for distributing antibiotics, but it "does not say anything about a study," said Dena Briscoe, a postal worker at the Brentwood facility in Washington.
UPI obtained a copy of the letter dated Jan. 24, 2002 and found it makes no specific reference to the study. The closest it comes is saying, "The CDC would like to evaluate this program to see if we can improve our service. CDC also wants to know how you did while taking antibiotics to prevent anthrax."
The letter goes on to say the CDC has enlisted "RTI, a not-for-profit firm" to contact people by phone. The letter does not state what type of corporation RTI is, why RTI is gathering information for the CDC or what the company plans to do with it, all of which are required under federal regulations.
CDC failed to respond to calls and emailed questions from UPI about why the letter did not mention the study or identify RTI.
Failure to adequately inform the postal workers of the purpose for collecting the information would mean the CDC and RTI "collected the information without their informed consent and their using it without it could well violate their rights to privacy," said Jim Pyles, a Washington lawyer who focuses on medical privacy issues. The courts have found that people have a right not to have their information disclosed without their consent, said Pyles, who is affiliated with the firm Powers, Pyles, Sufter and Verville.
The workers' concerns about the information they disclosed might not be over because RTI still holds the data. The medical information is kept separately so it is not identifiable to an individual, but Reid Maness, RTI's public affairs director, said it can be linked back "for the purpose of follow-up," which the CDC already has announced it plans to do.
Maness said RTI would not release the confidential health information to any third party, but he conceded, "If the CDC were to engage another contractor then we would have to hand off the confidentiality and the information."
That possibility is very troubling to Pyles.
"The federal government has a pretty abysmal record for holding confidential information," he said. Indeed, a report released in September 2002 by the U.S. General Accounting Office found confidential information collected by the federal government "was shared extensively with other federal agencies, other government entities (state, local, tribal, and foreign), and private individuals and organizations through authorized procedures."
Another report from the GAO in 1999 found two examples of confidential information being released without the research subjects' consent. In the first instance, "a university inadvertently released the names of multiple study participants testing positive for HIV to... a local television station." In the second case, the identity of a patient "suffering from extreme depression and suicidal impulses stemming from a history of childhood sexual abuse (was) distributed" at a national meeting.
