Alternatives to Project-specific Consent for Access to Personal Information for Health Research: What Is the Opinion of the Canadian Public?

Abstract

Objectives

This study sought to determine public opinion on alternatives to project-specific consent for use of their personal information for health research.

Design

The authors conducted a fixed-response random-digit dialed telephone survey of 1,230 adults across Canada.

Measurements

We measured attitudes toward privacy and health research; trust in different institutions to keep information confidential; and consent choice for research use of one’s own health information involving medical record review, automated abstraction of information from the electronic medical record, and linking education or income with health data.

Results

Support was strong for both health research and privacy protection. Studying communicable diseases and quality of health care had greatest support (85% to 89%). Trust was highest for data institutes, university researchers, hospitals, and disease foundations (78% to 80%). Four percent of respondents thought information from their paper medical record should not be used at all for research, 32% thought permission should be obtained for each use, 29% supported broad consent, 24% supported notification and opt out, and 11% felt no need for notification or consent. Opinions were more polarized for automated abstraction of data from the electronic medical record. Respondents were more willing to link education with health data than income.

Conclusions

Most of the public supported alternatives to study-specific consent, but few supported use without any notification or consent. Consent choices for research use of one’s health information should be documented in the medical record. The challenge remains how best to elicit those choices and ensure that they are up-to-date.

Background

Historically, it was common for researchers to have access to administrative or clinical information from the medical record without consent. Generally, research ethics boards (REBs) have exempted this type of research from requiring consent on a case-by-case basis if the researcher can show that the research cannot be conducted without using personal information, it is not practicable to obtain consent, risk is minimal, and there will be no attempt to contact the patient.

In response to the next generation of privacy laws, some REBs may have initially tightened their requirements for exemption from consent requirement, sparking both concern by researchers that minimal risk observational research may be imperiled and a call for specific exemptions for minimal-risk observational research. ^1,2

Although medical record research is still common, there have been substantial developments in how this information is used in health research that challenge the old rules around consent. For example, single discrete studies are giving way to prospective disease-based or treatment-based registries that will serve as research platforms for which there is no single tightly defined research question. Quality improvement studies are becoming larger and increasingly sophisticated, often making them operationally indistinguishable from research, yet they are governed very differently.

In addition, it is anticipated that the scale of secondary use of information from the medical record will increase substantially as the electronic health record becomes more pervasive. For example, initiatives are underway in the United States to ensure that clinical research is designed into the planned nationwide health information network and that the electronic health record will be harnessed for use in postmarketing surveillance, population health surveillance, and recruiting participants for clinical trials. ³ Research to understand complex relationships between genetic and environmental contributions to common illnesses will increasingly rely on the linkage of clinical information with biological samples in large populations, mining terabytes of data from the electronic health record. ⁴

Some researchers have called for a blanket exemption for minimal-risk observational research. ^2,5 Recognizing that consent will still be required in many future research scenarios, other researchers have suggested that laws need to be changed to formally recognize the validity of a broad consent or authorization for a range of research uses of personal information. ^6,7 There are now several alternatives to conventional consent being promoted. ⁸

What do we know about the opinion of the public in this matter? A study of inner-city Baltimore patients found 30% of respondents agreed in the abstract that medical researchers should be able to access their medical records without permission. ⁹ When it was suggested an anonymous database could be created for conducting the research, support increased to 86%. In New Zealand, less than 20% of patients attending five primary care clinics indicated a willingness to share their personal health information with researchers without their permission. This increased to 55% if they were asked. If the data were nonidentifiable, willingness was approximately 45% without being asked and 85% if asked permission. ¹⁰ Through focus groups conducted in the United Kingdom, Robling et al. ¹¹ found support for medical record research but a general wish to be informed of the activities, even if the data were aggregated or anonymized. This was seen as a matter of courtesy and an opportunity to give them the option to be able to opt out. A similar theme of consent for use of one’s data as a matter of respect, regardless of whether the data were anonymous, emerged from a pilot Canadian study. ¹²

The most comprehensive evaluation to date was a study of U.S. veterans who participated in a day-long deliberation on the role of consent in the use of their information for research purposes. ¹³ At the end of the deliberations, 74% of participants preferred an opt-in mechanism (35% blanket authorization, 39% consent for each study) for use of information from their medical record for research purposes, whereas 26% preferred an opt-out mechanism. Consent choice was correlated with trust that researchers keep this information confidential.

We conducted an in-depth analysis of public opinion on this issue using a combination of telephone survey and cross-country public dialogues. This report presents the survey findings.

Research Questions

The survey addressed several research questions:

• • What is public opinion regarding privacy and access to personal information for health research?

• • Do opinions differ across different types of health research?

• • Does public trust vary across different types of institutions?

• • Do consent choices for use of one’s personal information for health research differ across data sources, specifically, from paper medical records, automated abstraction of data from an electronic medical record (EMR), and the linkage of education and income data with data from the EMR for research?

• • How comfortable is the public with the following people abstracting data from their medical records for research: a nurse employed by the data custodian, a clerical person employed by the data custodian, a research assistant from a university, a research assistant from a pharmaceutical company?

Methods

Between March and April 2005, we conducted a computer-aided telephone survey of a representative sample of 1,230 households across Canada using a two-stage probability selection process. ¹⁴ In Stage 1, household telephone numbers were randomly selected from CD-ROM versions of telephone directories proportional to the population size of each province. In Stage 2, in households with more than one adult, the person over age 18 with the next birthday was selected as the survey recipient. ¹⁵

The survey was developed after eight months of pilot testing. Although some questions were adopted or adapted from existing health privacy surveys, most questions were developed de novo because we found very few surveys that addressed research in more than a cursory fashion. Initially, we conducted semistructured one-on-one interviews. This progressed to face-to-face administration of the survey, during which people were also asked to voice any problems with clarity as the questions were asked and a summary de-briefing at the end regarding length, confusing questions, and any additional concerns.

Respondents were asked general questions about: (1) their attitudes toward privacy, health research, and the relative importance of the two; (2) the use of their personal health information for a variety of types of research from public health to market research; and (3) their trust in particular institutions that may hold their personal health information.

Three scenarios were presented: (1) use of data from their medical record, (2) automated abstraction of data from EMRs, and (3) linkage of education or income with information from the EMR. For each scenario we indicated that directly identifying information—their name, address, health insurance number—would not be collected and that this would make it difficult, although not impossible, to reidentify them. The questions for these scenarios were framed in terms of use of the respondent’s own personal information. (For the exact wording of the scenarios, see Appendix 1, available as a JAMIA online-only data supplement at www.jamia.org) We developed a six-point ordinal scale that reflected the following consent choices regarding use of one’s personal information for research:

• • This information should not be used (at all);

• • They should get your permission beforehand for each use;

• • They should get your general permission, with periodic re-contacting;

• • They should get your general permission once;

• • They should notify you of the use of the information;

• • There is no need to know. Just use it.

Analysis consisted of simple tabulation of response frequencies for survey questions.

The study followed established Canadian guidelines for medical research involving human subjects. ¹⁶ The research protocol was reviewed and approved by the Research Ethics Board of St. Joseph’s Healthcare, Hamilton. The survey was anonymous. Telephone numbers were generated using computer-aided random-digit dialing software. No directly identifying information was collected, and telephone numbers were not retained.

Results

We interviewed 1,230 residents across Canada (response rate 58%). ▶ summarizes the demographics of the respondents compared with the Canadian population. Survey respondents were younger, better educated, more likely to be women, and less likely to be single.

Table 1.

Table 1 Representativeness of Sample

Variable (%)	Survey Sample	General Population
Gender		∗
Female	55	50
Age
20–39 years	39†	37
40–59 years	41	39
≥60 years	20	23
Highest level of education		‡
High school or less	33	56
Some postsecondary	14	38§
Completed postsecondary	40
Postgraduate or professional degree	10	5
Annual income		¶
<$30,000	29	32
$30,000–$59,999	34	30
$60,000–$89,999	17	19
≥$90,000	20	20
Marital status		∗∗
Married/commonlaw	58	49
Separated/divorced	10	5
Widowed	7	5
Single/never married	20	42

^∗ Statistics Canada CANSIM tables. 2004. Available at: www40.statcan.ca/101/demo10a.htm. Accessed 2005-10-19.

^† Age category 18 to 39 years.

^‡ Statistics Canada CANSIM tables. 2001. Available at: www40.statcan.ca/101/cst01/educ42.htm. Accessed 2005-10-19.

^§ Combines “some postsecondary” and “completed postsecondary”.

^¶ Statistics Canada. Income in Canada. 2004. Minister of Industry, Ottawa, 2006. Available at: http://estat.statcan.ca/cgi-win/cnsmcgi.exe. Accessed 2006-08-11.

^∗∗ Statistics Canada CANSIM tables. 2004. Available at: www40.statcan.ca/101/cst01/famil01.htm. Accessed 2005-10-19. Marriage category includes separated. Value for separated/divorced is percent divorced.

Views on Privacy and Health Research Generally

Virtually all respondents felt protection of the privacy of their personal information was somewhat (23%) or very (74%) important (▶). Fifty-six percent expressed increased concern over their privacy in the past five years.

Table 2.

Table 2 General Views on Privacy and Health Research

Question	Response, n (%)
	Not at All Important	Somewhat Important	Very Important		Do Not Know
∗ This was not a response option offered by the interviewer but insisted upon by 9 interviewees.
How important is protecting the privacy of your personal information?	22 (2)	281 (23)	915 (74)		11 (1)

	More Concerned	No Change	Less Concerned		Do Not Know
In the past 5 years, have you become more concerned about protecting the privacy of your personal information, less concerned, or has there been no change?	694 (56)	487 (40)	24 (2)		32 (3)

	Very Concerned	Somewhat Concerned	Not at All Concerned	Can Have Both ∗	Do Not Know
How concerned would you be if allowing health research made it very difficulty to control how your health information was being used?	459 (37)	653 (53)	84 (7)		32 (3)
How concerned would you be if protecting your right to control access to your health information made it difficult or impossible to conduct health research?	392 (32)	695 (56)	95 (8)	9 (<1)	35 (3)

	Strongly Agree	Somewhat Agree	Somewhat Disagree	Strongly Disagree	Do Not Know
Research that could be beneficial to people’s health is more important than protecting people’s privacy.	377 (31)	452 (37)	211 (17)	122 (10)	61 (5)

Respondents were generally supportive of both research and privacy. Ninety percent of respondents were either somewhat or very concerned if allowing health research made it difficult to control how their information was being used. Almost as many were somewhat or very concerned if protecting people’s rights to control access to their information made it difficult or impossible to conduct health research. Sixty-eight percent agreed somewhat (37%) or strongly (31%) with the statement: “Research that could be beneficial to people’s health is more important than protecting people’s privacy.”

Variation with Research Purpose

Support was relatively high for uses such as improving quality of health care or for tracking of communicable diseases (▶). It was lower if research was used for commercial purposes.

Figure 1.

Variation in support for different types of research.

Variation in Trust of Organizations

There was relatively high trust in disease-based foundations, hospitals, university researchers, and data collection organizations such as Statistics Canada to keep any information they may have about them confidential (▶). Twenty-six to thirty-five percent trusted these organizations a great deal, and 76% to 81% trusted them either somewhat or a great deal. There was a relatively high distrust (low level of trust) of the insurance industry (42%), drug companies (28%), and government (27%).

Table 3.

Table 3 Trust in Different Organizations

	How much trust do you place in the following institutions to keep any health information they have about you confidential? (Percent of respondents)
	A Great Deal	Somewhat	A Little	Not at All	Don’t Know	Total
Disease-based foundation (Kidney, Heart & Stroke)	35.2	45.5	9.3	6.3	3.6	99.9
Hospitals	32.7	47.3	11.4	6.6	2.0	100.0
University researchers	28.5	50.0	12.4	6.6	2.5	100.0
Data collection organization (Stats Canada/CIHI)	26.1	50.0	12.6	8.4	2.9	100.0
Government in your province	12.7	41.7	16.8	26.8	2.0	100.0
Drug companies	10.1	40.7	17.8	28.0	3.2	99.8
Insurance industry	4.7	29.8	20.8	42.2	2.4	99.9

Consent Choice for Use of One’s Own Information

Scenario 1: Use of Data from Medical Records

Very few respondents (4%) were completely opposed to use of their health information for research (▶). Of the 60% of respondents who felt their permission should first be obtained, views were split almost equally between those who felt their permission should be sought each time before their information was used and those who felt that their general permission should be first obtained. Eighty percent of those willing to give general permission wished to have the opportunity to periodically review their consent choices. A further 36% preferred minimal or no involvement: 24% would be satisfied with a notification process and 12% felt that it was acceptable to use their information without permission or notification. Of those choosing notification process, 89% felt the opportunity to opt out was either very (43%) or somewhat (46%) important.

Table 4.

Table 4 Opinion Regarding Consent and Alternatives Across Scenarios

Scenario	Consent Choice
	Do Not Use	Ask Permission First, n (%)			Notification	Just Use It
	n(%)	Every Time	General Permission, Renewing	General Permission Once	n(%)	n(%)
Use of data from medical record (n = 1,207)	53 (4)	388 (32)	282 (23)	57 (5)	288 (24)	139 (12)
			727 (60)
Automated extraction of data from EMR (n = 941)	80 (9)		342 (36)		267 (28)	252 (27)
Addition of education to information from EMR (n = 858)	88 (10)		350 (41)		222 (26)	198 (23)
Addition of income to information from EMR (n = 853)	228 (27)		341 (40)		138 (16)	146 (17)

Respondents were most comfortable if a nurse from the doctor’s office or a research assistant from a university were to abstract data from the medical record and least comfortable if the doctor’s secretary were to do this (▶). However, even in this case, 20% were very concerned if the nurse or university research assistant were to access their medical records to abstract data. For the majority of respondents, confidentiality training and penalties for breach of confidentiality would reduce these concerns either somewhat or greatly.

Table 5.

Table 5 Who May Access the Medical Record for Data Abstraction?

	Question: If your medical record is on paper, someone has to go through the record and get the information needed for the research. How concerned would you be if the following people summarized information from your medical record for research purposes?
Person	Not at All (%)	Somewhat (%)	Very (%)	No Response (%)
Nurse in doctor’s office	41	37	20	2
Secretary in doctor’s office	24	33	41	2
Research assistant from university	31	47	20	2
Research assistant from pharmaceutical company	23	42	32	2

Person	Respondents who answered “somewhat concerned” or “very concerned” were asked if training in confidentiality or strong penalties for any breach of confidentiality would reduce their concern “a lot”, “somewhat”, or “not at all”.
	A Lot (%)		Somewhat (%)		Not at All (%)		No Response (%)
	Training	Penalties	Training	Penalties	Training	Penalties	Training	Penalties
Nurse in doctor’s office	21	3	49	44	28	19	2	3
Secretary in doctor’s office	18	29	51	48	30	21	<1	<1
Research assistant from university	22	34	60	50	17	14	<1	1
Research assistant from pharmaceutical company	14	27	53	46	33	27	<1	<1

Scenario 2: Automated Abstraction of Information from the EMR

In this scenario, respondents were advised it was possible to abstract the required information from the EMR without anyone actually going through the record. Respondents were initially asked whether they supported or opposed the development of a common EMR for keeping track of doctor and hospital visits, laboratory tests, and medication use. Opinion about permission needed for research use of information from the EMR was asked only of the 70% who supported the introduction of a common EMR and the 8% who were neutral or unsure (n = 941/1,196). In this subsample of respondents, opinions on the question of research use of information from the EMR were more polarized. Approximately twice as many respondents (9%) felt that their information should not be used at all, compared with their paper medical record (4%). At the same time, twice as many felt that it was acceptable to use that information without permission or notification (27% compared with 12% for paper record). As a sensitivity analysis, we examined the response profile of those who were opposed to the introduction of a common EMR (n = 255) and imputed their responses to this question, based on their consent choices to scenario 1. The overall response profile did not change substantively.

Scenario 3: Linkage of Education and Income with Information from the EMR

Opinion about permission for the linkage of information from the EMR with education was similar to that for research use of information from the EMR generally. However, respondents were more reluctant to allow linkage with income. One in four (27%) felt that this should not be done at all, whereas support for notification decreased to 16% and use without permission or notification to 17%.

Discussion

In general, we found the Canadian public to be supportive of use of their health information for research—particularly research that improves public health and quality of care. This is consistent with recent surveys in Canada and the United States. ^17,18 However, that support was qualified. Even in the best-case scenarios of research to track communicable diseases and to improve quality of care, a substantial portion of the population was only somewhat supportive of these types of research uses of their personal health information. Our findings and previous work suggest that this support is dependent on the intended uses and users of the data and on the safeguards applied. ^11,19

Although supportive of research uses of their information, the majority of respondents still wished to maintain some level of control over the use of their information. Most were willing to consider alternatives to conventional study-by-study consent. Few felt it was acceptable to use the information without prior permission or notification. These findings are consistent with most other studies examining research use of one’s personal information. 9-13,20-22 We note two exceptions. In his survey of the literature, Wendler ²³ concluded support for a one-time general consent for research on biological samples. In our study, most respondents supportive of a broad consent preferred the opportunity for periodic re-consenting. It may be that people regard samples differently from information in their health record. Also, our findings are in stark contrast with a recent study by Barrett et al., ²⁴ who found a high acceptance (72%) among U.K. residents of the practice of using personal information, including directly identifying information, without consent for a national cancer registry. In part, this may be due to the framing of Barrett’s question in which, given only one option—use of this information without consent—respondents were asked if they thought this was a breach of privacy. As well, the cancer registry may have been seen by respondents to be more like a public health service activity than research, which could affect perceptions of the acceptability of use of this information. Finally, cancer itself may hold a special status in the mind of the public, distinct from other health research.

An ongoing question in research involving medical record review is who may abstract information from the health record. Our findings here suggest that the public is almost as comfortable with an academically based research assistant performing this task as they are a nurse who works in the practice, and more comfortable than they are with a clerical person from within the practice doing this. Given the limited time of clinical staff, a common protocol should be established that would allow a properly trained research assistant limited access to health records for this purpose.

It is interesting to note that responses to automated abstraction of data from an EMR were more polarized. The doubling in proportion of respondents indicating “just use it” may reflect that this addresses concerns by some respondents over someone trolling through their entire record for information. On the other hand, the doubling in the proportion of people saying “this information should not be used at all” may reflect a recognition by others that information from the EMR could be used even more widely than the paper record for secondary purposes and concern over controlling this. Given that this will become the dominant model for gathering data in the future, greater study of attitudes in this area is warranted.

Study Limitations

We present a cross-sectional view of public opinion at one point in time. It provides no information on how firmly the opinions were held—whether, if challenged, people would change their views. Survey respondents were better educated than the general public. Although our data did not find differences in response by education, some other studies have noted that higher education is associated with increased privacy consciousness. ^25,26 Therefore, our findings may present a slightly more restrictive attitude toward consent than exists in the general public. Finally, although some may argue that our 58% response rate was low, this is consistent with trends in academic survey research generally. ²⁷

Policy Implications

People differ substantially in the amount of control they would like to exercise over research uses of their personal health information. There is no one approach that satisfies even a simple majority of the population. However, these findings do suggest insufficient public support for across-the-board assumed or deemed consent for research uses of one’s health information for research.

A logical conclusion would be to develop a system for documenting individuals’ consent choices for research and other secondary use of their information. However, there are several legal and technical challenges, including:

• • the need for legal recognition of the legitimacy of a broad authorization for future uses of one’s personal information for research purposes;

• • an appropriate repository to track consent choices throughout the health care system;

• • safeguards and governance structures that would ensure that the consent choices of individuals are honored; and

• • an appropriate method of eliciting those consent choices and keeping them up to date.

In Canada, the architecture for a common EMR for the recording of all treatments and diagnostics is being developed. ²⁸ Provision could be made for recording consent choices for different uses of one’s personal health information and for the linkage of that information with other health-related information such as income and education. Although technically it is already possible to restrict access to and uses of the data to reflect consent choices, the challenge comes with ensuring organizational compliance with those protocols. ^29,30 In addition, at present there is no good mechanism for eliciting the consent choices of individuals and for ensuring those choices are up to date. Physicians and other health care providers are too busy to take this on. Nor would this be appropriate because there are concerns over the potential for undue influence.

Currently, that leaves the status quo of ethics review of each research project to determine on a case-by-case basis whether that project may be exempted from the requirement for individual consent. In Canada, this decision-making responsibility falls on REBs, which function in similar fashion to American institutional review boards. ³¹ The onus is on the researcher to make the case for exemption. Concerns have been raised over inconsistencies in ethics board requirements for exemption and institutional hurdles that go beyond the requirements of the law. ^32-34 Recent guidance from the Canadian Institutes of Health Research should assist in harmonizing policies in this regard. ³⁵ Given the importance of the role of ethics review boards, ongoing efforts at harmonization of practices are warranted.

Conclusion

The Canadian public is supportive of health research and open to alternatives to a conventional project-by-project consent. However, they do not wish to completely relinquish control over use of their personal health information. Given the heterogeneity of consent choices, any long-run solution must take this into account to maintain public confidence in the confidentiality of the information they share with their physicians. Although the EMR may play a role here, the outstanding challenge is how best to elicit and keep up to date the individuals’ consent preferences. There are no easy solutions. Any solutions put forward should be vetted with the public.