BMJ  2006;332:130-131 (21 January), doi:10.1136/bmj.332.7534.130

Editorial

Using personal health information in medical research

Overzealous interpretation of UK laws is stifling epidemiological research

Recent growth in the regulation of research involving patients or their personal data in the United Kingdom—such as research governance, the European clinical trials directive, the Data Protection Act 1998, the Human Tissue Act 2004, the Mental Capacity Act 2005, and guidance from the General Medical Council—has caused delays, higher costs, and sometimes cessation of research projects.^{1 2} Rules around privacy, confidentiality, and consent have become particularly complex and confusing.

The people appointed to protect personal health data sometimes seem to feel no need to facilitate research. These include Caldicott guardians (board members and senior health professionals appointed by each health authority, NHS trust, and primary care group to safeguard the confidentiality of patient information) and data protection officers who often work with medical records departments. These guardians and officers and their organisations are averse to risk and often restrict or deny access to personal medical data, interpreting the Data Protection Act as insisting that patients must consent directly to participate in research or that patients' data must be completely anonymised.

This causes particular problems for epidemiological research,³ which often requires access to routinely collected identifiable personal data, or requires identification of research participants from such data. Obtaining individual consent from large numbers of patients may be onerous or simply impossible, for example if patients have died or moved away, and participation bias may undermine the data. Anonymising data is difficult and expensive and greatly limits their future value.

The information commissioner—an independent official appointed by the Crown to oversee the Data Protection Act 1998, the Freedom of Information Act 2000, and the Environmental Information Regulations 2004—takes a more liberal view. The commissioner has decided that, while obtaining consent for medical research involving identifiable personal health data is the default position, consent is not required where such access to the data is necessary (for example in a research protocol approved by an ethics committee), is considered proportionate and no more with respect to privacy and public interest, and where there is "fair processing" (meaning that the patient should be informed of the data collection and have the right to opt out).⁴ Even informing the patient may be waived if the effort to do so is disproportionate, especially if the research is "historical or statistical." Transparency and proportionality are also emphasised in the NHS research governance framework.⁵ Many data controllers responsible for the implementation of the Data Protection Act seem unaware that there are reasonable exceptions to the general rule of consent.

The risks to the individual patient from epidemiological research, subject to high standards of data handling and preservation of confidentiality, are minimal when compared with the risks in interventional research.⁶ The potential benefits to the public are great but many people have misinterpreted the regulations to imply that both types of research have similar standards for informing patients and obtaining consent. But proportionality of risk is a judgment, not an absolute, and needs to be considered impartially by an appropriate body independent of the researchers, probably an ethics committee in most cases.

These issues are considered comprehensively in an excellent new report from the UK Academy of Medical Sciences, which argues strongly for a clearer framework for using personal health data in research.⁷ Furthermore, a paper in this issue by Iversen and colleagues (p 165) supports the arguments of the academy, and might almost have been written to illustrate the worst excess of over-regulation identified by the academy, specifically misinterpretation of the Data Protection Act.⁸ The contentious issue is less the law than its overly conservative interpretation—although if the Office for National Statistics can't get it right, who can?

One study suggests, however, that the public do not uncritically support free access to their records by medical researchers, though the participants in this work seemed to have only limited understanding of the purposes and conduct of medical research.⁹ The academy reports consultations with well informed patient groups which have more palatable findings for researchers.⁷ And Iversen suggests that poor response rates in research are related more to patients' apathy rather than antipathy.⁸ Both reports argue for greater engagement of the public and more empirical research on these issues.

Are there legal risks for researchers? No researchers in the United Kingdom have been prosecuted for misusing data in properly conducted and approved research, but there is no case law to support the use of data in this way. The General Medical Council's advice, however, seems to lack any consideration of proportionality, and goes beyond the Data Protection Act in requiring express consent for the use of personal data in research (but not in disease registries—a fine distinction) in all but the most exceptional circumstances, where patients are unable to consent or when they cannot be traced.¹⁰

There are encouraging signs that some thought is going into containment of bureaucracy, better coordination of research ethics committees, and unified documentation for ethics applications and use of NHS data for other purposes. Recent consultation on the NHS research and development strategy acknowledges the risks inherent in research and promises "not to over-react in ways that stifle potentially valuable research in complex bureaucracy."¹¹ These matters need urgent resolution, not least so that researchers can mine opportunities presented by the development of electronic data systems in the NHS information technology programme.

Royal Liverpool and Broadgreen University Hospitals, Liverpool L7 8XP
(twalley{at}liv.ac.uk)

---

Competing interests: TW is responsible for the administration of research governance in his trust.

Analysis and comment p 165

References

1. Warlow C. Overregulation of clinical research: a threat to public health. Clin Med 2005;5: 33-8.[ISI][Medline]
2. Coleman MP, Evans BG, Barrett G. Confidentiality and the public interest in medical research—will we ever get it right? Clin Med 2003;3: 219-28.[ISI][Medline]
3. Ward H, Cousens S, Smith-Bathgate B, Leitch M, Everington D, Will R, et al. Obstacles to conducting epidemiological research in the UK general population. BMJ 2004;329: 277-9.[Free Full Text]
4. Information Commissioner. Use and disclosure of health data: application of the Data Protection Act 1998. Information Commissioner's Office, 2002. www.ico.gov.uk/documentUpload/Use%20and%20Disclosure%20of%20Health%20Data.pdf (accessed 6 Jan 2006).
5. Department of Health. Research governance framework for health and social care. 2nd ed. London: DoH, 2005. www.dh.gov.uk/assetRoot/04/12/24/27/04122427.pdf (accessed 13 Jan 2005).
6. Verity C, Nicholl A. Consent, confidentially and the threat to public health surveillance. BMJ 2002;324: 1210-3.[Free Full Text]
7. Academy of Medical Sciences. Personal data for public good: using health information in medical research. London: AMS, 2006.
8. Iversen A, Liddell K, Fear N, Hotopf M, Wessely S. Consent, confidentiality and the Data Protection Act. BMJ 2006;332: 165-9.[Free Full Text]
9. Robling MR, Hood K, Houston H, Pill R, Fay J, Evans HM. Public attitudes towards the use of primary care patient record data in medical research without consent: a qualitative study. J Med Ethics 2004;30: 104-9[Abstract/Free Full Text]
10. General Medical Council. Confidentiality: protecting and providing information. www.gmc-uk.org/guidance/library/confidentiality_faq.asp (accessed 6 Jan 2006).
11. Department of Health. Best research for best health: a new national health research strategy. London: DoH, 2005. www.dh.gov.uk/assetRoot/04/11/69/35/04116935.pdf (accessed 13 Jan 2006).

CiteULike    Complore    Connotea    Del.icio.us    Digg    Reddit    Technorati    What's this?

Related Articles

National survey of British public's views on use of identifiable medical data by the National Cancer Registry

Geraldine Barrett, Jackie A Cassell, Janet L Peacock, and Michel P Coleman
BMJ 2006 332: 1068-1072. [Abstract] [Full Text] [PDF]

Consent, confidentiality, and the Data Protection Act

Amy Iversen, Kathleen Liddell, Nicola Fear, Matthew Hotopf, and Simon Wessely
BMJ 2006 332: 165-169. [Full Text] [PDF]

Obstacles to conducting epidemiological research in the UK general population

Hester J T Ward, Simon N Cousens, Blaire Smith-Bathgate, Margaret Leitch, Dawn Everington, Robert G Will, and Peter G Smith
BMJ 2004 329: 277-279. [Extract] [Full Text] [PDF]

Education and debate: Consent, confidentiality, and the threat to public health surveillance • Commentary: Don't waive consent lightlyinvolve the public

Chris Verity, Angus Nicoll, and Donal Manning
BMJ 2002 324: 1210-1213. [Extract] [Full Text] [PDF]

This article has been cited by other articles:

• Brown, L., Parker, M., Dixon-Woods, M. (2008). Whose interest? British newspaper reporting of use of medical records for research. J Health Serv Res Policy 13: 140-145 [Abstract] [Full text]  
• Metcalfe, C, Martin, R M, Noble, S, Lane, J A, Hamdy, F C, Neal, D E, Donovan, J L (2008). Low risk research using routinely collected identifiable health information without informed consent: encounters with the Patient Information Advisory Group. J. Med. Ethics 34: 37-40 [Abstract] [Full text]  
• Masterton, G., Shah, P. (2007). How to approach a research ethics committee. Adv. Psychiatr. Treat. 13: 220-227 [Abstract] [Full text]  
• Hilbrich, L., Sleight, P. (2006). Progress and problems for randomized clinical trials: from streptomycin to the era of megatrials. Eur Heart J 27: 2158-2164 [Abstract] [Full text]  
• Barrett, G., Cassell, J. A, Peacock, J. L, Coleman, M. P (2006). National survey of British public's views on use of identifiable medical data by the National Cancer Registry. BMJ 332: 1068-1072 [Abstract] [Full text]  

Rapid Responses:

Read all Rapid Responses

Patients, privacy, confidentiality and consent - where's the evidence?

Brian Buckley
bmj.com, 1 Mar 2006 [Full text]