BMJ  2007;334:1330-1331 (30 June), doi:10.1136/bmj.39247.679329.80

Editorials

Ethics of collecting and using healthcare data

Primary responsibility lies with the organisations involved, not ethical review committees

Quality assurance is a broad concept that includes activities termed audit, quality improvement, and clinical governance. Both quality assurance and research require the systematic collection and analysis of data from all (relevant) patients. However, whereas research activities are generally required to undergo independent ethical review, audit activities are exempt from such review. How can we ensure that quality assurance activities are ethical?

Patients using any healthcare system have an ethical responsibility to help with quality assurance activities,^{1 2 3} and with epidemiological research based on population-wide databases, such as the United Kingdom's new National Health Service programme,⁴ because they will benefit from such activities. However, involvement in quality assurance and epidemiological research usually involves using patients' data without their consent. In return for this loss of autonomy and potential risk (of disclosing information that might harm), patients should expect quality assurance activities to be ethically sound, healthcare resources to be committed to quality assurance, and benefits to justify any risks and burdens.

Two national working parties, in the United States and Australia, have considered the ethics of quality assurance activities.^{2 3} The US Hastings Center report considers that research activities can be distinguished from quality assurance and suggests that organisations take responsibility for the ethics of their own quality assurance.^{2 5 6} In contrast, the Australian report agrees with many others that the distinction is not possible, and it suggests that research ethics committees should be approached when potential ethical problems exist. ^{3 6 7}

Data protection laws make the resolution of this problem urgent. Quality assurance may be stopped,^{2 8} unethical activities may occur,^{8 9} and research may be relabelled as quality assurance to avoid scrutiny, especially because the existing research ethics framework is becoming increasingly overwhelmed, often delaying or preventing research.¹⁰

The ethical problem associated with the collection and use of data for non-clinical purposes relates to the relationship between patients as a group and organisations (such as clinical teams, whole hospitals). It is assumed that most ethical issues will arise in the context of research, while other activities in healthcare organisations are automatically ethical. This assumption has led to attempts to categorise research separately from other activities.¹¹ However, these assumptions are invalid; healthcare organisations are no more or less likely than researchers to pursue ethically dubious activities. We should therefore ask ourselves how to ensure that the collection and analysis of data from patients within health care is carried out ethically.

Collecting and using patient generated data, beyond simply making an individual clinical decision, is ethically sound only if there is (or could reasonably arise) a question to be answered; the methodology (design, data collected, etc) will answer the question; and the costs, including both communal healthcare resources and any risks and burden imposed on the participants, justify the benefits to society. Asking the questions in the box will help to identify the nature and extent of any ethical concern.

Questions to ask of any systematic data collection process in health care Design Will the method answer the question being asked? Process How much will each participant be informed about the study? Will each participant be able to choose whether or not to participate? Will the method of recruiting participants be fair? Cost What organisational resources will the project use? What extra burden will be imposed upon the participant(s)? What additional risks will the participant(s) face? Benefit What benefit might accrue to the participant(s)? What benefit might accrue to society?

But who should ask the questions, and who should make the ethical judgment? The Hastings Center report argues convincingly that institutional review boards as a single external ethical "hurdle" are an inappropriate way of achieving ethical standards in quality assurance.²

Instead, the authors recommend that "the primary responsibility for the ethical conduct of quality improvement be lodged in individual organisations . . . [it] should be integrated into normal supervision and management, with the organisation's leaders [being] responsible for seeing that the integration occurs and is effective." There is no reason why this recommendation could not also apply to all activities within health care, including research.¹²

Ethically difficult situations that require independent help will still arise. Existing ethical review committees could provide independent advice,³ but only if their total workload is reduced. This could be achieved if ethical problems were considered in proportion to the importance of the ethical problem.^{3 6 7 12} We need an ethical ladder to lift us over problems, not an ethical hurdle to hinder people undertaking research. Organisations should have internal procedures for ensuring their activities are ethical, and they should seek external help only when it is needed.

Finally, we need to check that organisations are taking their ethical responsibilities seriously.² The professional, personal, and organisational responsibilities for ethical behaviour should be made explicit, and organisations need to incorporate ethical considerations into all management activities. Their performance of this duty should be reviewed by external monitoring and accrediting agencies.²

In summary, the ethical responsibility of systematic collection and analysis of patient data for any purpose is the responsibility of the people and organisations involved. Internal organisational arrangements should allow most problems to be resolved but when they are complex or difficult, external help should be sought from an accredited source, such as ethics review boards. External accrediting organisations should audit ethical review procedures as they audit other aspects of an organisation.

Oxford Centre for Enablement, Oxford OX3 7LD

---

Competing interests: None declared.

Provenance and peer review: Commissioned; not externally peer reviewed.

References

1. Hagger L, Woods S, Barrow P. Autonomy and audit—striking the balance. Med Law Int 2004;6:105-16.[Medline]
2. Baily MA, Bottrell M, Lynn J, Jennings B. The ethics of using QI methods to improve health care, quality and safety. Hastings Center Report 2006;36:S1-40.[CrossRef][ISI][Medline]
3. Australian Government. When does quality assurance in health care require independent ethical review? Australia: National Health and Medical Research Council, 2003. www.nhmrc.gov.au/publications/synopses/e46syn.htm
4. Mayor S. NHS IT system must use unique patient identifiers to achieve research potential. BMJ 2007 doi: 10.1136/bmj.39245.392523.DB[Free Full Text]
5. Lynn J, Baily MA, Bottrell M, Jennings B, Levine RJ, Davidoff F, et al. The ethics of using quality improvement methods in health care. Ann Intern Med 2007;146:666-73.[Abstract/Free Full Text]
6. Grady C. Quality improvement and ethical oversight. Ann Intern Med 2007;146:677-8.[Free Full Text]
7. Wade DT. Ethics, audit and research: all shades of grey. BMJ 2005;330:468-73.[Free Full Text]
8. Lynn J. When does quality improvement count as research? Human subject protection and theories of knowledge. Qual Saf Health Care 2004;13:67-70.[Abstract/Free Full Text]
9. Ashmore R. A study on how mental health practitioners address ethical issues in clinical audit. J Psychiatr Ment Health Nurs 2005;12:112-20.[CrossRef][Medline]
10. Warlow C. Clinical research under the cosh again. BMJ 2004;329:241-2.[Free Full Text]
11. Hughes R. Is audit research? The relationship between clinical audit and social research. Int J Health Care Qual Assur 2005;18:289-99.[CrossRef]
12. Jamrozik K. Research ethics paperwork: what is the plot we seem to have lost? BMJ 2004;329:286-7.[Free Full Text]

CiteULike    Complore    Connotea    Del.icio.us    Digg    Reddit    Technorati    What's this?

Relevant Articles

Security protection is needed when using USB sticks

Matthew Daunt
BMJ 2007 335: 112. [Extract] [Full Text] [PDF]

NHS IT system must use unique patient identifiers to achieve research potential

Susan Mayor
BMJ 2007 334: 1238. [Extract] [Full Text] [PDF]

Ethics, audit, and research: all shades of grey

Derick T Wade
BMJ 2005 330: 468-471. [Extract] [Full Text] [PDF]

Clinical research under the cosh again

Charles Warlow
BMJ 2004 329: 241-242. [Extract] [Full Text] [PDF]

This article has been cited by other articles:

• Morris, P. E., Dracup, K. (2007). Quality Improvement or Research? The Ethics of Hospital Project Oversight. Am J Crit Care 16: 424-426 [Full text]  
• Daunt, M. (2007). Security protection is needed when using USB sticks. BMJ 335: 112-112 [Full text]  

Rapid Responses:

Read all Rapid Responses

Caldicott principles should be sufficient for decisions about patient-identifiable information

D Graham Mackenzie, et al.
bmj.com, 3 Jul 2007 [Full text]

Ethics of collecting and using healthcare data

Michael J Lockwood
bmj.com, 4 Jul 2007 [Full text]

Use of electronic storage of patient data

Matthew W Daunt
bmj.com, 5 Jul 2007 [Full text]

Caldicott guardians are not involved

Derick T Wade
bmj.com, 6 Jul 2007 [Full text]

Identifiable patient information was not the subject of the editorial

Derick T Wade
bmj.com, 6 Jul 2007 [Full text]

Re: Use of electronic storage of patient data

Derick T Wade
bmj.com, 6 Jul 2007 [Full text]

Caldicott function has developed - and is central to the debate

D Graham Mackenzie, et al.
bmj.com, 10 Jul 2007 [Full text]

Re: Caldicott function has developed - and is central to the debate

Derick T Wade
bmj.com, 13 Jul 2007 [Full text]