Data protection, informed consent, and research
BMJ 2004; 328 doi: https://doi.org/10.1136/bmj.328.7447.1029 (Published 29 April 2004) Cite this as: BMJ 2004;328:1029All rapid responses
Rapid responses are electronic comments to the editor. They enable our users to debate issues raised in articles published on bmj.com. A rapid response is first posted online. If you need the URL (web address) of an individual response, simply click on the response headline and copy the URL from the browser window. A proportion of responses will, after editing, be published online and in the print journal as letters, which are indexed in PubMed. Rapid responses are not indexed in PubMed and they are not journal articles. The BMJ reserves the right to remove responses which are being wilfully misrepresented as published articles or when it is brought to our attention that a response spreads misinformation.
From March 2022, the word limit for rapid responses will be 600 words not including references and author details. We will no longer post responses that exceed this limit.
The word limit for letters selected from posted responses remains 300 words.
Data Protection, informed consent, and research
The Patient Information Advisory Group read the article, ‘Data
protection, informed consent, and research’ (BMJ 2004; 328: 1029-1030) by
Professor Julian Peto et al with great interest. However, we did not feel
that we could allow it to go unchallenged.
While we appreciate that there is a great deal of misunderstanding
within the NHS and other organisations about the Data Protection Act, it
would be excessive to deal with these concerns by granting clinical
researchers freer access to confidential patient information. The
Department of Health last year published a Code of Practice on Patient
Confidentiality that should ensure that the custodians of medical records
are aware of their responsibilities and the circumstances in which they
are able to share patient data with researchers.
Of greater concern to the PIAG was the writers’ apparent view that
obtaining informed consent from patients is a bad thing. Clearly the way
the common law around confidentiality and consent has evolved in recent
years has caused some confusion and inconvenience within the research
community, but surely we should have no objection to researchers being
required to obtain consent from patients to use their confidential
information if it is practicable to do so?
The PIAG was established in 2001 to oversee arrangements introduced
under Section 60 of the Health and Social Care Act 2001. We see it as our
responsibility to ensure that a wide range of essential NHS activities –
including research – are allowed to continue where there is no practicable
alternative to using patient identifiable information without consent.
However, it is only right that the organisations undertaking these
activities should be required to demonstrate that they are delivering
benefits to patients, that they have considered alternatives to using
patient identifiers without consent, that the information they obtain will
be used appropriately and will be stored securely, and that they will make
reasonable attempts to devise a means of either obtaining consent or
working with anonymised information in the future.
While there is no doubt that many patients and members of the public
support clinical research, it is clear that they would also like
clinicians to discuss with them how their data can be used to support this
important work. We have heard a great deal in recent weeks about how the
NHS intends to give patients choice; is it too much to ask that this
concept should be extended to allow patients to decide who can access
their records?
Professor Joan Higgins,
Chair of the Patient Information Advisory Group
Competing interests:
None declared
Competing interests: No competing interests
Sir,
Peto and colleagues1highlight the fine balance between making
progress in tackling ill health and safeguarding patient privacy. This
issue is not confined to health services in England as evidenced by recent
reports from a range of settings from Europe2, Canada3 and the United
States4. The Department of Health in England has lately issued a code of
practice on confidentiality.5 The starting position derives from paragraph
28:
“[T]he law [on disclosure of confidential patient information]
provides a minimum standard that does not always reflect the appropriate
ethical standards that the government and the professional regulatory
bodies require.”
By contrast the eminent epidemiologist Sir Richard Doll is reported
as saying that he would be prepared to go to prison over regulations that
he believes are suffocating medical research.6 The need for ethical
standards derives, in essence, from the proper wish to protect
individuals. Our recent experience suggests that prevention of disclosure
of data on ethical grounds may hamper acquisition of information that
could be of material benefit in improving the care of the very patients
whose data release is blocked.
Two recent examples, one from research and the other from clinical
audit, illustrate the problems.
Research
Funding was obtained by one author (ML) four years ago from the Wellcome
Trust to compare medication taken by individuals who die suddenly and
unexpectedly in the community and living controls, with the working
hypothesis that drugs that slow cardiac conduction might be causing sudden
deaths. The project depended solely on contrasting existing records of
those living and dying but was held up for over three years on ethical
grounds, despite the multicentre and local research ethical committee
approval being obtained prior to submission for funding. The core of the
problem lay in the need, if results were to be generally applicable, to
obtain data sets which were as complete as possible. Many of the drugs of
interest are prescribed for neuropsychiatric disease, and obtaining valid
individual consent to record examination seemed likely to pose problems.
The regional Ethics Committee was made aware of the difficulty, and agreed
that it was acceptable to proceed without individual consent. In the
subsequent three years we first met questions from clinical colleagues who
pointed out that the project might lie outside the provisions of the Data
Protection Act then coming into force. We then sought advice from a
senior member of the General Medical Council, but without benefit, and
from the Information Commissioner, which took six months to come. When,
later, the Health and Social Care Act was passed we obtained approval
under the so-called ‘Section 60 exemption’ [number 01/02 of their series]
from the Patient Information Advisory Group (PIAG) set up to consider
applications for data without obtaining patient consent. However access
was then denied to data on dead patients on the grounds that ethical
approval had lapsed in the intervening three years. This was despite the
fact that the Information Commissioner had agreed that there were no legal
problems over disclosure of information about those who are dead. A full
ethical resubmission was then asked for, but this request was rescinded
after we obtained support from the recently established Central Office for
Research Ethical Committees (COREC).
To some of those involved in assessing our application, the
likelihood the study had the potential to supply information that could
reduce the risk of sudden death seemed immaterial. Delays were
sequentially resolved but only after new advisory bodies (COREC and PIAG)
had been set up, and seemed mainly due to individual concern at the risk
of being castigated for giving permission to go ahead. The project is now
going forward smoothly.
Audit
Two major policy initiatives, the national service framework (NSF) for
coronary heart disease7 and the NHS Plan8, have encouraged delivery of
thrombolytic treatment, by paramedics, to patients with acute myocardial
infarction, there being compelling evidence that the sooner such treatment
is given the better the outcome.9 Subsequently, with national agreement
through the Committee on Safety of Medicines and Medicines Control Agency
(now Medicines and Health care products Regulatory Agency), to paramedics
administering thrombolysis, it has become essential to ensure that
treatment is being appropriately and effectively delivered. It has been
obvious that for this purpose in particular, and indeed to assess the
outcome of any treatment administered by ambulance staff there would have
to be the transfer of information from one NHS organisation to another,
typically in this instance bi-directional between ambulance and acute
trusts. This is occurring in haphazard fashion at present because the
guidance on whether or not data can be shared in this way is open to
interpretation, even in the context of a major national audit programme
developed to support the NSF.10 Indeed, the position is likely to get
worse, because the NHS Code of Practice does not recommend such
disclosure. Thus at paragraph 38:
“Patients understand that some information about them must be shared
in order to provide them with care and treatment, and clinical audit,
conducted locally within organisations” [our italics]. That wider transfer
of data is not to occur is made clear in a footnote “NB any “other”
organisational forms of audit i.e. across organisations and nationally
require explicit consent”.
The implication of this proscription, which could be read as
precluding all transfer of clinical information to or from ambulance
trusts to facilitate meaningful clinical audit does not seem to have been
appreciated. Explicit patient consent is unlikely to be obtained in
practice in the ambulance setting, the opportunity during a clinical
“stay” typically measured in minutes to obtain valid consent is unlikely
to exist. Moreover the validity of any such consent given the
circumstances of severe pain and distress compounded by possibly reduced
cardiac output and opiate analgesia is questionable. Is a ban on data
transfer in such circumstances in patients’ interests? It seems unlikely.
And how are health services to develop the ‘robust outcome measures’ (for
example on patients sustaining out of hospital cardiac arrest) recommended
in a recent report11 if data sharing cannot routinely, and uniformly,
occur?
Conclusion
Barriers to the transfer of clinical information for the purposes of
research and audit may have been raised too high, and should be subject to
review. If patients were told that transfer of clinical information for
the purposes of improving the quality of care in diseases from which they
are suffering was being prevented on “ethical” grounds without stating
what this means they could be justifiably concerned.
References
1. Peto J, Fletcher O, Gilham C Data protection, informed consent,
and research. BMJ 2004;328:1029-30
2. Sterz F, Singer E, Bottiger B, Chamberlain D et al A serious threat to
evidence based resuscitation within the European Union. Resuscitation
2002;53:237-8
3. Tu JV, Willison DJ, Silver FL, Fabg J et al Impracticability of
informed consent in the registry of the Canadian stroke network. N Engl J
Med 2004;350:14143-21
4. Mosesso VN, Brown LH, Greene HL, Schmidt TA et al Conducting research
using the emergency exception from informed consent: the public access
defibrillation (PAD) trial experience. Resuscitation 2004;61:29-36
5. Department of Health. Confidentiality: NHS Code of Practice November
2003 Department of Health, London.
6. Daily Telegraph February 26th 2004
7. Department of Health. National service framework for coronary heart
disease. London, March 2000
8. Department of Health. The NHS Plan. London, July 2000
9. Boersma E, Maas ACP, Deckers JW, Simoons ML Early thrombolytic
treatment in acute myocardial infarction: reappraisal of the golden hour.
Lancet 1996;348:771-75
10. Birkhead JS Responding to the requirements of the national service
framework for coronary disease: a core data set for myocardial infarction.
Heart 2000;84:116-7
11. Commission for Health Improvement. What CHI found in ambulance trusts.
Sector report. Commission for Health Improvement, London, 2003.
Tom Quinn
Professor of Cardiac Nursing, Coventry University
Michael Langman
Professor of Medicine, University of Birmingham
Competing interests:
None declared
Competing interests: No competing interests
At the same time as the Data Protection Act and the Human Tissue Bill
are making life difficult for doctors and researchers in a misguided and
unwanted effort to protect patients rights, the NHS is eroding the
confidentiality of medical records.
A process of linking hospital computerised record systems has been
going on for a few years. This involves a huge increase in the number of
people who are authorised to access sensitive medical data - most
obviously pathology data. This obviously reduces the security of the data.
However no consultation process has taken place about the wisdom of this.
Similarly, and much worse, the National programme for IT proposes
that all medical data including Gp records should be accessible by Doctors
across the whole of England, by linking all medical computer systems.
However careful the password etc system is- it will only need one corrupt
user to access any medical data for anyone on the system.
What seems to be lacking in the present NHS is common sense and
balanced judgement. We risk a situation in which the noone can be bothered
to do medical research apart from well financed pharmaceutical companies,
and at the same time patients ask us not to keep computer records for fear
they will be made public.
Competing interests:
None declared
Competing interests: No competing interests
Dear Sir:
I am really delighted to read the editorial by Peto and colleagues (2004)
who have very rightly and pursuingly defended the rights of medical
researchers for carrying out different types of research coupled with
tremendous, ultimate benefits to the public at large. I would like to
support their hands by emphasizing a couple of relevant points. First, I
posit a question, which is "Is medical research [MedR] a necessity and
hence also the mother of invention?" Obviously, the answer to this
question is straightforwardly "yes" and proponents and even opponents of
MedR will completely endorse this answer. We must collectively realize
innumerable, large scale advantages and substantial benefits of continuing
MedR, which have certainly enhanced the life expectancy, considerably
reduced mortality and morbidity and improved the overall quality of human
life globally. It would not be an exaggeration to put the whole
perspective of medical research into few words, "No MedR means medically
chaotic world". Therefore, MedR must be sustained and continued because
more to be done to realise the unexplored goals of medical sciences.
Second, simply speaking if there is no well documented medical data,
there is no sharp-edge MedR. Therefore, the data is indispensible and must
be stored and accordingly protected. The patients should give written
consent for using the data for future research. According to my
introspection, those patients or their families who refuse to give written
consent, they constitute the most important control group for revealing
highly important research findings. However, their rights not to give
written consent for using their data for research must not be infringed.
In research, moreover the patient privacy and confidentiality should not
be ignored at all. Research wisdom suggests that almost all the patients
and possibly their families give written consent for utilizing their data
in medical research if they are well anonymized. After all they are not
losers but definitely substantial contributors to the cause of alleviation
of human suffrings.
Third, the enactment of pertinent laws for protecting data, patient
privacy and confidentiality should strike a balance between patients
aforesaid rights and the rights of medical researchers. Medical
researchers should not be deprived of their research pursuits and likewise
patients rights including public opinions should not be infringed
blatantly. Unnecessary delay in having access to the relevant data for
research should be avoided by all means.
Fourth, all behaviours including research are guided by certain
motivations, which may also include self-vested interests and for that
matter all human beings have this trait in common. So this common
personality denominator should not be viewed as a stumbling block to the
research pursuits of the medical researchers. Clinically oriented medical
personnel would continue to show an envy against their research oriented
colleagues, whcih again should not discourage medical researchers.
Finally, we all are enjoying the taste of innovative, scientific
discoveries of our past and present medical research colleagues and we
would like to continue to do so and hence we support the continuation of
medical research around the world within the laws striken by law makers
considering on equal footing the patients rights and the medical
researchers rights.
Reference:
Julian Peto, Olivia Fletcher, and Clare Gilham. Data protection,
informed consent, and research. BMJ 2004; 328: 1029-1030.
Competing interests:
None declared
Competing interests: No competing interests
Rules are almost the same all over Europe. Problems described by the
Authors are encontered every day. This can become a real criminal problem
in some fields, for instance in Legal Medicine. It is however delightful
to read judicial verdicts where names, nicknames amd addresses of people
accused or convicted for a crime. Of course, a verdict must be public
according to the law. What about the privacy of these people?
In my opinion, the right level of privacy protection can be offered by the
actual rules of a penal code or by the common law, I do not see any
exigence of special laws or acts to protect the privacy of a citizes, as
penal and civil codes are sufficient to do this.
Competing interests:
None declared
Competing interests: No competing interests
As a group of medical students we have undertaken an epidemiological
study building on previous studies exploring patients views about
confidentiality with regard to general practice medical records1, 2. In
addition, we studied public knowledge and opinion about the use of medical
records for research purposes. Peto et al report the result of a vote at
a public meeting whose audience included general public, patient support
groups and cancer charities, doctors, nurses, and public health workers.
These individuals, excepting the general public, have a professional
interest in medical research. In contrast, our study has looked
exclusively at the views of patients.
The study was carried out between February and April 2004 at two
general practices in England (Birmingham and Blackburn). 200
questionnaires were given to consecutive patients at each centre. The
questionnaire was designed to elicit patients’ knowledge of who is able to
access their medical records, who they think should be able to, and
whether they would allow access to anonymised, or patient-identifiable
data, for research purposes or otherwise.
79% of individuals approached completed the questionnaire. An
overwhelming proportion of patients (~80%) felt that it was acceptable for
their medical records to be used for research to improve healthcare; but
only 8.5% held this view if the objective of the research was to make a
profit. In asking about access to medical records, more patients think
that access should be given for research purposes than they think is the
current practice. This was consistent across all groups included in the
study: doctors, practice nurses, health authorities, drug companies etc.
These results support Peto et al's statement that:
'the widespread belief ... that the public would no longer tolerate
access to their
records by bona fide medical researchers ... is not true.'
Our results suggest that that it is important to reassess the balance
between research requirements and patient confidentiality, to bring the
interpretation of legislation into line with patients’ views.
References
1 Carman D, Britten N. Confidentiality of medical records: the
patients perspective. Br
J Gen Pract. 1995 Sep; 45 (398): 485-8.
2 Bolton Research Group. Patients knowledge and expectations of
confidentiality in primary health care: a quantitative study. Br J Gen
Pract. 2000 Nov; 50 (460): 901-2.
Competing interests:
None declared
Competing interests: No competing interests
The Data Protection Act 1998 does not prohibit the processing of
personal information for medical research purposes. Indeed, it is clear
from section 33 of the Act that such processing is expressly permitted.
If it were otherwise, then the Act would be in direct conflict with the
core aims of the laws that underpin it, namely the Council of Europe
Convention of 1981 and the Europe Union Directive of 1995. These laws
seeks to faciliate data processing activities, primarily "free flows" of
information, rather than data processing supression. The law recognises
the obvious truth that data processing is good for society. Of course, the
processing of personal information is a privilege, not a right, and so the
law requires respect for privacy. This is the "price" paid for continued
enjoyment of what is, after all, a very powerful privilege.
The problems to which the authors of "Data protection, informed
consent, and research" refer are not Data Protection Act problems but,
rather, problems caused by ignorance and misunderstanding. These are the
very same problems revealed followed the verdicts in the Soham trials, as
the authors rightly point out. And it is about time that Data Controllers
(those who determine data processing manner and purpose) tackled the cause
of ignorance and misunderstanding within their organisations.
Sadly, all too many Data Controllers are guilty of failure of basic
good practice as far as data protection laws are concerned. The Data
Protection Act is not the worrying or fearful beast that many commentators
would like to make out. In fact, it is a piece of "common-sense"
legislation which should not trouble the medical profession. It certainly
should not stand in the way of medical research, the continuation of which
is so vital to all of our interests.
With basic training on the key mechanisms of the Data Protection Act
the problems of which the authors complain should be overcome. Training
need not be an expensive task either. In fact, most organisations
(including hospitals) should be able to achieve a high level of
understanding - thus legal compliance - at a very modest cost. If the
right steps are taken now, we can all continue to take benefit from
medical research.
There are two additional points of note. First, the Data Protection
Act regulates the processing of personal information relating to living
individuals. Thus, research following death is not DPA regulated.
Second, the Act and case law make clear that information will not be
"personal data" if it does not identify a living individual or if it does
not have the individual as its focus or is not significantly biographical.
So, if medical researchers do not actually need or seek identification
information the Act should not be engaged. Data can be anonymised.
Competing interests:
None declared
Competing interests: No competing interests
Researchers so often claim that their only interest in overriding the
rights of others is that of altruistic concern for populations. Very
rarely is any mention of additional factors expressed, eg their own
careers,world wide competition to compete for results, prestige and
funding forexample.Researchers hugely invest in their game but cannot
continue to exploit the goodwill of what has hitherto been a largely
uninformed public,which did not know the extent to which confidentiality
and their trust in the medical profession was being compromised
previously. It is mainly through the activities of self motivated groups,
the media and importantly the net that the 'secret' has been exposed - not
primarily the research community together with medical practitioners - who
have deliberately and sadly unnecessarily ,deceived the public.
Research studies consistently show that the public is overwhelmingly
altrusistic in the wish to participate in research activities which may
(or may not) benefit others. If they are treated with the sort of
disrespect which has led to so many scandals and individual distress, they
are indeed more likely to take defensive, including legal, action. The
Lord Falconers and top researchers of our society, have of course, plently
of means to protect their interests - the rest of society needs properly
policed laws to protect theirs' - which includes a body willing to take
quick action against those who practitioners who do breach trust, rather
than collude with them.
Although there is plently of complaint made about the cost of setting
up research, the only factor which is deemed to be dispensable is that of
requesting individual consent. There is no other area of life in which one
group of people are given the right to make such decisions on behalf of
other adults. It is an outdated and arrogant attitude, (however much it is
disguised by involvement by 'patient groups') which would deny
participation in the enterprise by all as equal partners.
History, shows that one group of people cannot be trusted to
safeguard the interests of the whole. These are not issues which can be
decided by committee or self appointed spokespeople, or groups with their
own interests at stake. Deliberate anxiety provoking messages can damage
the confidence of individuals to make their own decisions if they
disagree with views expressed in this publication. Is the new mantra of
partnership to be undermined by the interests of the few? How many more
exceptions to Data Protection and other laws will be claimed. How many
other projects could be set up without the knowledge of the public? (It
was groups of researchers and their medical colleagues who carried out
experiments on Jewish people or people with disabilities for example Their
names were collected from data bases.Some GPs now are releasing personal
records without the knowledge of consent of those who consult them.
Childrenhave been monitored without their parents' knowledge or consent in
areas of England)
Specialist in one field should realise the wider implications of their
demands for special priveledges as well as sincerely question their own
motives for treating others less than as equals.
It is not known how many people are unaware even now of the extent to
which research has extended into areas they would not have envisaged, for
example GP surgeries where obviously there will attimes be a conflict of
interest which compromises the relationship with individuals,unless there
is a relaxed attitude to being open and honest with the community about
the reasons for needing use of their information.
It does not cost a fraction of the other costs involved to put a
standard form on file to indicate whether a person will allow use of their
information, including caveats about the limits of consent. Very few would
refuse use of anonymised information but would be concerned if files has
been trawled through by researchers without consent or that a supposedly
trusted relatinship with a dctor has been breached.
The days of treating the NHS as a convenient pool to be dipped into
in secretive ways, to carry out research only a few in useful positions
are aware of, of treating the community as the 'masses' to be used in
disgracefully unethical ways should be over by now.
Competing interests:
None declared
Competing interests: No competing interests
The data collector knocks at the door. "I am authorised by the
University of Non-commercial Research to interrogate the families of women
with ovarian cancer. As your mother died of this disease, we need also to
enrol your daughters in a non-commercial study that will produce data that
has no value, none whatsoever, to pharmaceutical companies. It never will
have commercial value, never ever, we are absolutely certain of that. In
fact, this study is being funded by the Ovarian Cancer Support Group and
the Organisation for the Wellbeing of Families of People with Ovarian
Cancer. There's a free lunch in it for you."
"I didn't even know my mother was ill."
Competing interests:
None declared
Competing interests: No competing interests
Re: Response from the Patient Information Advisory Group
Anybody with a serious interest in Confidentiality/Privacy/Use of
information issues would find the updated website of PIAG very
informative. Crucially it strongly supports the right to informed consent
to use of personal information.
Competing interests:
None declared
Competing interests: No competing interests