BMJ  2006;333:255-258 (29 July), doi:10.1136/bmj.333.7561.255

Analysis and comment

Confidentiality and consent in medical research

Consent for the use of personal medical data in research

¹ Centre for Health Informatics and Multi-professional Education (CHIME), University College London, London N19 5LW, ² MRC National Survey of Health and Development, Department of Epidemiology and Public Health, Royal Free and University College London Medical School, London WC1E 6BT

Properly obtained consent is needed for all clinical trials, yet one size doesn't necessarily fit all. This article looks at different consent models and emphasises the need to support choice rather than just observing the formalities of "gaining consent"

This article deals mainly with the secondary use of medical records in research; primary use may have been for a clinical trial or for medical treatment. Well known examples of successful secondary use of data are discovery of the links between antidepressants and suicide and between tranquilisers and road accidents.^{1 2} These insights are important, even if they are not conclusive and may need to be confirmed by specific studies or trials.

Explicit consent is needed for all aspects of clinical trials, including the retention of medical records, either as identifiable data or in anonymised form.³ Consent is usually for that trial only (this can go to extremes; see box 1). Difficulties can arise over re-use of data, either for new questions that arise within the study, or for questions that could be considered once the data have been gathered but were not anticipated at the outset when consent was gained. In terms of efficiency and consistency of results, it is preferable to re-use data rather than re-collect it. Projects should therefore allow participants to choose at the outset whether data (and possibly tissues) can be retained for future research in a secure and confidential form.

The two main legal instruments are the Data Protection Act 1998 (DPA98) and the common law of confidence (confidentiality), which are discussed in another article in this series.⁴ Essentially, consent is needed to use personal data in medical research unless the person is dead; the researchers are all healthcare professionals or equivalent; or the data do not identify the person.

Box 1: How much consent is enough? Recently, one of us was a subject in a research study in which a blood test was assessed. He had to sign four forms. One form covered consent to participate in the study, and 10 questions were asked; a second form was designed to waive any intellectual property rights; the two other forms were for a related study by the same team on diet—the forms were the same, but the study title was different. It took longer to complete the forms than for the blood samples to be taken, although not as long as it took to complete the nutritional questionnaire that followed. The research ethics committee was worried that on reflection participants might change their mind about the study, so participants were given a fifth form to take away, complete, and send back to the study coordinator. If this form was not signed and returned, then the person could not be included in the studies. This procedure did not recognise personal autonomy—the right to be able to agree with the proposal without the unnecessary administrative burden on the participants and research team. The extra paperwork needed cannot be justified in terms of benefit to the participants.

Some people think that the common law of confidentiality is more restrictive than the Data Protection Act as data are given in confidence to clinicians, so consent is always needed. In this article, we will assume that some form of choice should be offered and will discuss what options are available and their implications.

Types of consent and choice

We use "choice" in its simplest sense, free from the context of the current "patient choice" initiative. Consent is a person's expression of agreement with a proposed action. The recording of consent is distinct from the fundamental decision that the person has made, though how we approach candidates and the options we provide will influence their choice.

Consent may be a positive action such as signing a form saying "yes" or just nodding. This is usually called "express consent" or "assent." It may be hard to determine the expression of consent because of speech or language difficulties, though this may be eased by a member of the family or an interpreter.

Box 2: Information for consent The following details should be sent with the invitation to participate in a study, so that people have the necessary information to decide whether to consent or not: A description of the aims of the work in lay terms, with an outline of the intended benefits of the research for health in general Summaries of the types of information needed from the participant (for example, questions on housing, occupation, and diet) and measures to be used (for example, measures of blood pressure, x rays of knees); for unusual measures (such as whole body scans) the procedures should be described, so that participants know what to expect in terms of invasiveness, discomfort or pain, and undressing A statement that any aspect of the data collection can be declined at the time of fieldwork. It should be mentioned that this may not be possible for specific future uses of stored biological specimens (including DNA) Information on who is expected to be involved in the analysis and in any data sharing; this can be descriptions of the types of workers (for example, NHS healthcare professionals and publicly funded health research scientists) Assurance about the confidentiality of information collected. The steps being taken to ensure confidentiality should be explained to potential participants A request for consent to access to medical records and other information sources, if applicable Details of the period for which each aspect of consent is sought—for example, specify that medical records will be followed up more than once Information on all foreseeable uses of the data, as any later changes in use require new consent In long running studies, it should be stated at the outset that refusal to continue to participate will not be taken to indicate the need to withdraw data already collected, unless specifically requested, and where data will have been anonymised, then it cannot subsequently be removed.

More simply, a patient might hold out his arm for an injection without indicating consent as such. This is called "implicit consent" or "implied consent," though it might simply show compliance rather than consent—a lack of objection rather than a positive choice.

In the past, compliance has sometimes been presumed by researchers (such as in the retention of tissues), so no information is provided, no question is posed, and no question of assent or dissent arises. This is not consent as no choice has been offered.

"Informed consent" is sometimes used to emphasise the need for adequate information on which to make a decision and give consent. If the information provided is inadequate, any assent given is qualified by the missing information. "Fully informed consent" describes the ideal of providing full information before seeking consent but is perhaps meaningless in practice. How can we determine how much information is full? What if the potential participant does not want to know all the options available and the range of consequences of each choice? Education has a cost, both to the provider and the trainee.

The term "free choice" reflects that participants should not be coerced or cajoled into making a choice preferred by the questioner. However, people are usually constrained by their circumstances and personal experience, so no choice is wholly free, but we should try to make the choice as free as possible.

We think that too much emphasis can be given to the precise definition of consent rather than dealing with the fundamental need to provide options for people and helping them to make the optimum choice in light of their circumstances, needs, and values, including their perceptions of the benefits from medical research. The NHS confidentiality code of practice model puts emphasis on choice.⁵

Choice and consent processes and models

What we aim to achieve is a reflection of a person's choice. We need to recognise that how we seek consent will influence the choice that we record. People may agree (or disagree) simply to end the interview and get away. Faced with a 16 page consent form, discretion may seem the better part of altruism. People may choose "not to choose" or to defer choice by seeking more information.

This is particularly crucial for "opt-in" or "opt-out" consent processes, whereby people are informed of the choices available to them, and action is taken only with their active assent (opt-in) or by default unless they object or choose an alternative (opt-out). In either case, the choice is being made for people who choose not to choose.

Opt-in is often viewed as a better form of consent. This is true if we do not know what people's preferences are likely to be. But if most people (say 90%) would probably be happy to take part in a study, then an opt-out arrangement is the most efficient method (for participants and researchers) and does not undermine the principle of providing choice.

Balancing costs and benefits

The cost implications of any research project need to be weighed against the likely benefits to determine whether a project should proceed (we will not consider the ethical aspects of projects where the benefits do not justify the cost).

We will compare (purely in terms of cost) four possible consent processes:

Opt-in—where each potential participant is individually informed about the study and their consent is sought (and possibly formalised on paper)

Opt-out—where each potential participant is individually informed about the study and included unless they object

"Social contract"—where people are informed generally about research, information is freely available on specific projects, and people are included unless they object (either generally to being a research subject or to being included in a specific study)

"Anonymous"—where we presume that there is a viable option to anonymise so that consent is not legally required.

We are discussing only the secondary use of data and the choice of approach needs to include assessment of risk to participants. If security and confidentiality measures are assured, risks should be very low.

Let us consider some broad measures of the costs and benefits on a per case basis and how these are likely to vary with the size of a study (more details are available on bmj.com).

Benefits per case
The statistical power of a study will increase with the square root of the number of cases (reducing the standard deviation of the sample mean), but the likely outcome will be uncertain, so we may have to use an upper and lower bound for the likely benefit.

Box 3: Feedback of findings If tests are carried out as part of the research, it is important to decide at the outset whether to give the results to the participants. Feedback can benefit the participant if potentially treatable conditions are found and can act as an incentive to take part in health surveys. Feedback can also have damaging effects if the information adversely affects life insurance premiums or employment opportunities, or if it indicates non-treatable personal or familial risks, as may be the case with genetic information. The decision to feedback information has several implications: Participants should be told about the test results that they will receive Participants should be offered an interpretation of the findings, either by the research team or a general practitioner If participants are asked to consult their general practitioner about results, or any other aspect of the study, the general practitioner will need to be informed. Participants may need to provide information about the name and address of their general practitioner Consent will be needed from participants before the study team contacts the general practitioner. Participants should be told that results may be fed back this way Studies should have a website that provides abstracts and references to publications and talks.

Box 4: Data sharing and data linkage Decide policies for data sharing at the outset, because participants and ethical committees will need to know Methods to preserve anonymity when data are shared should be decided at the outset Data should not be used for purposes other than those specified in the original consent agreement, so if reuse or sharing might be considered, then this must be made clear to participants Data that carry a high risk of disclosing the identity of participants (or sensitive data) may need to be supplied to others in aggregated or other result based formats, or such data may need to be available only at the secure premises of the team responsible for the information Decisions about linking in data from other sources should also be made at the outset, as they have implications for consent, ethical approval, and data sharing

Cost per case
If we use an opt-in approach, the cost per case would be constant, though scaled up for the effect of a lower recruitment rate. If we use an opt-out approach, we will have to fund a public information campaign (so that potential objectors are aware of the study, their options, and how to opt out of the study) and a per case cost of managing the objections. If we use a social contract approach, whereby a general information campaign for research is used with some specific provision for each study, the costs of information provision are reduced but not the costs of handling objections.

A plot of reasonable but arbitrary cost and benefit figures on a log-log scale (figure) shows how costs and likely benefits vary with the size of a study. It shows that an opt-in approach is viable only for smaller studies; an opt-out process is only just viable for very large studies at the higher end of possible benefit; and the social contract approach is the only real alternative to express consent for population level studies. The next article in this series will discuss this issue in more detail.

View larger version (27K): [in this window] [in a new window]   Cost-benefit comparison for the different forms of consent according to study size

 

Credit: NICK CRONIN/EASTWING

 

Anonymisation seems to be suitable for all but the smallest studies (although the figures probably overestimate the cost of developing anonymisation procedures as these would be streamlined for smaller studies). However, as the recent report of the Academy of Medical Sciences highlights, anonymisation may not be possible for some studies, and it is not clear how much information must be removed to eliminate the need for any form of consent.^{6 7}

This model illustrates the need for medical research databases where benefits can be aggregated and cost contained but that still offer real choice to potential participants. This will not be possible if an opt-out or opt-in model is adopted as standard for all research projects regardless of size or risk assessment.

Practical issues

Discussion facilitated by the Medical Research Council provided practical advice on seeking consent for research using personal medical data. The advice concentrated on four main areas:

• The information that should be provided to patients to obtain consent
  
• Feedback of study findings to participants
  
• Data linkage and data sharing
  
• Establishment and maintenance of confidentiality and security.
  

Boxes 2-5 give the details of these recommendations, together with other recommendations developed when writing this paper.

Conclusion: simplify the process

The legal and ethical aspects of consent may be difficult to understand or may lack clarity, but some actions at the national level could simplify the process for researchers and the public, such as:

• Clear guidance on good practice in the management of research data; this guidance should cover what should be done in terms of information, the consent process, and data security to guide researchers, research ethics committees, and the public
  
• Clear legal definitions of anonymisation and consent that are practicable and recognise the need to balance the rights of individuals with the needs of the community for the future health of the population
  
• Ways to manage risks of confidentiality, where data controllers may be reluctant to authorise release of medical data to properly established and authorised research projects because of legal and other uncertainties
  
• Agreement about whether or not large scale medical research databases have a crucial part to play in future healthcare research and development; appropriate consent procedures must be established if they are to be viable
  
• Ways to harmonise how consent is gained for medical research, how data are gathered by researchers, and how such data may be archived or preserved if useful for the future.
  

Box 5: Confidentiality and security Policies and procedures for security and measures to enhance confidentiality should be decided at the outset because participants and ethical committees need to know Methods to preserve anonymity when data are held or used need to be considered from the beginning, as approval will be given only when risks are reduced to the minimum and are more than compensated for by the likely benefits from the study Data that carry a high risk of disclosing the identity of participants or sensitive data (or both) may need to be made especially secure All members of the research team should sign a confidentiality agreement, and compliance should be monitored strictly and sanctions carried out if a breach of security or confidentiality occurs Information on these controls should be available to participants—perhaps as supporting materials—to keep the primary materials accessible

Summary points Giving participants in research real choice is more important than simply getting their consent How we seek consent will alter participants' perceptions and choices without necessarily increasing validity Different consent processes have different cost implications, which may outweigh likely benefits for population scale studies or databases and make such research not feasible Secondary research information could be shared more efficiently by using models like those used by BioBank or the NHS secondary uses service (SUS)

This short article has required that we simplify the issues and gloss over difficulties. We have taken a utilitarian perspective, which may not suit all tastes, but ultimately there is a health service to run, and as recent headlines have shown, it needs to be cost-effective.

---

This article is the second in a four part series, building on a recent Medical Research Council initiative relating to the use of personal information in medical research

Extra text is on bmj.com

This series arose from discussions stimulated through participation in the MRC's data sharing and preservation initiative, which aims to extend new and secondary research using high-value research datasets collected with public funding for the public good. It will lead to a web based route map through current regulatory processes supported by guidance for good practice when using personal data for medical research (www.mrc.ac.uk/strategy-data_sharing_implementation.htm). We thank Peter Dukes and Allan Sudlow for support and advice. The opinions expressed are those of the authors.

Contributors and sources: PS is closely involved with the Clinical eScience Framework project funded by the Medical Research Council. The project seeks to develop a large scale repository for medical research, which takes routinely collected medical data and applies a range of de-identification, pseudonymisation, and security techniques to protect the confidentiality of patients. He also advises the NHS and other organisations on confidentiality and other health informatics issues. As an author of The Informed Patient reports, he also believes that patients and the public should be more fully involved in healthcare and the choices made on their behalf by professionals. MW is director of the MRC national survey of health and development and is closely involved with the development of the council's data sharing programme and projects on consent and confidentiality. PS is guarantor.

Competing interest: None declared.

References

1. Jick SS, Dean AD, Jick H. Antidepressants and suicide. BMJ 1995;310: 215-8.[Abstract/Free Full Text]
2. Barbone F, McMahon AD, Davey PG, Morris AD, Reid IC, McDevitt RG, et al. Association of road-traffic accidents with benzodiazepine use. Lancet 1998;352: 1331-6.[CrossRef][ISI][Medline]
3. Medical Research Council. Personal information in medical research. MRC, 2003. www.mrc.ac.uk/pdf-pimr.pdf (last accessed 6 Jan 2006).
4. Kalra D, Gertz R, Singleton P, Inskip HM. Confidentiality of personal health information used for research. BMJ 2006;333: 196-8.[Free Full Text]
5. Department of Health. NHS confidentiality code of practice, 2003, www.dh.gov.uk/assetRoot/04/06/92/54/04069254.pdf (last accessed 6 Jan 2006).
6. Academy of Medical Sciences. Personal data for public good: using health information in medical research. London: AMS, 2006.
7. Lowrance W. Learning from experience: privacy and the secondary use of data in health research. Nuffield Trust, 2003 www.nuffieldtrust.org.uk/ecomm/files/161202learning.pdf (last accessed 6 Jan 2006).

(Accepted 24 March 2006)

CiteULike    Complore    Connotea    Del.icio.us    Digg    Reddit    Technorati    What's this?

Related Articles

Governance of research that uses identifiable personal data

Robert Souhami
BMJ 2006 333: 315-316. [Extract] [Full Text] [PDF]

Confidentiality of personal health information used for research

Dipak Kalra, Renate Gertz, Peter Singleton, and Hazel M Inskip
BMJ 2006 333: 196-198. [Full Text] [PDF]

Antidepressants and suicide

Susan S Jick, Alan D Dean, and Hershel Jick
BMJ 1995 310: 215-218. [Abstract] [Full Text]

This article has been cited by other articles:

• Mladovsky, P., Mossialos, E., McKee, M. (2008). Improving access to research data in Europe. BMJ 336: 287-288 [Full text]  
• Metcalfe, C, Martin, R M, Noble, S, Lane, J A, Hamdy, F C, Neal, D E, Donovan, J L (2008). Low risk research using routinely collected identifiable health information without informed consent: encounters with the Patient Information Advisory Group. J. Med. Ethics 34: 37-40 [Abstract] [Full text]  
• Willison, D. J., Schwartz, L., Abelson, J., Charles, C., Swinton, M., Northrup, D., Thabane, L. (2007). Alternatives to Project-specific Consent for Access to Personal Information for Health Research: What Is the Opinion of the Canadian Public?. J. Am. Med. Inform. Assoc. 14: 706-712 [Abstract] [Full text]  
• Buckley, B., Murphy, A. W, Byrne, M., Glynn, L. (2007). Selection bias resulting from the requirement for prior consent in observational research: a community cohort of people with ischaemic heart disease. Heart 93: 1116-1120 [Abstract] [Full text]  
• Souhami, R. (2006). Governance of research that uses identifiable personal data. BMJ 333: 315-316 [Full text]