The effect of privacy legislation on observational research

In 2000, the Canadian government passed the Personal Information Protection and Electronic Documents Act, which was designed in part to address important privacy and confidentiality issues in medical research. Since then, all provinces have either adopted this legislation or passed privacy acts of their own. When this legislation was initially passed, it was viewed with considerable concern by observational researchers who work with secondary personal health information such as data from disease registries, medical charts or administrative databases. They were concerned that an overly conservative interpretation of this legislation would limit the scope and quality of their research to the point that it would not be effective, accurate or worth the investment of scarce research dollars and that consequently society would suffer from the loss of an important source of medical progress. Now, almost 8 years later there is emerging evidence that this concern was warranted even though the ultimate impact of this and other privacy legislation in Canada remains to be determined.¹

It is important to protect privacy, and privacy legislation in Canada and other developed countries has been very successful at raising awareness and enforcing respect for privacy among medical researchers. Many governments have passed laws designed to protect people's privacy within the past decade based on similar privacy principles (Table 1), and these laws appear to have been effective. Although it has not been studied formally, there have been very few violations of privacy in medical research brought to the public's attention.² This is in contrast to privacy violations in other areas such as business and government.³ In addition, those violations revealed in medical research were clearly because of noncompliance with current privacy legislation.²

Table 1

Unfortunately, privacy legislation appears to have had a detrimental effect on some types of observational research, such as research for which a waiver of informed consent has been pursued. This is research in which, for various reasons, obtaining consent from study participants is not practical (Box 1).⁴ Therefore, to maintain the balance of harms and benefits crucial to all research, a waiver is permitted. Of course, in these cases, any risk of harm to participants must be minimal and other means of preserving privacy must be used. Although accepted by many as necessary, the use of such waivers is controversial to privacy advocates because it denies study participants the choice to accept or refuse the risks that may result from a privacy breach, however unlikely, and yet the participants are still exposed to those risks.⁵ A privacy breach (the intentional or nonintentional accessing of participants' personal information by an unauthorized person) could lead to problems such as psychological stress, embarrassment and insurance discrimination. Therefore, to ensure that waivers are not used indiscriminately, most privacy legislation specifically addresses in what situations they can be used. Unfortunately, conservative interpretation of this legislation has been cited as a primary reason why many research ethics boards and data custodians have refused to grant waivers. This has inhibited researchers' access to medical records or databases. In an increasing number of examples, such refusal has resulted in decreased participation, selection bias (Table 2), incomplete research and dismantled disease registries.^1,6–12 Fortunately, there are not many published examples from Canada; however, we are still in the relative early days following privacy legislation. Until this legislation is tested and precedents are set, the potential for further detrimental effects on observational research remains.

Box 1.

Table 2

The current situation may be improved in a couple of ways. The first is by recognizing that there is a potential problem and instituting standards or guidelines to clarify privacy legislation.¹³ These could be developed by representatives of research ethics boards, researchers, research organizations, ethicists, privacy advocates and members of the public. In addition, education of research ethics boards and data custodians would help them to understand and apply legislative rules. A second approach would be to educate research ethics boards, data custodians and the public about methods that preserve privacy other than traditional “opt-in” informed consent so that they might be considered acceptable alternatives. Some organizations, like the Institute of Clinical Evaluative Sciences in Toronto, Ontario, have been using such methods to safeguard data for many years (Box 2).¹⁴ Researchers should also be taught these methods so that data security breaches do not occur.² Security breaches are not only awful for the participants involved but also damage public trust in the research community and will invariably lead to tighter restrictions on data access. In addition, new ways of informing and gaining support from the public for observational research should be developed and evaluated. For example, some groups have adopted an informed “opt-out” policy in lieu of informed “opt-in” consent. This is where educational brochures, easily available in public spaces (e.g., hospital waiting rooms or nursing stations), describe observational research projects, and a contact name and telephone number are published so that patients can call for further information or to request exclusion; otherwise, their data are included by default.¹⁵

Box 2.

In summary, almost 8 years after its introduction, there is some evidence that conservative interpretation of privacy legislation has had detrimental effects on observational research in Canada. Luckily the published effects have been relatively small; however, problems in other countries suggest that the situation could become a lot worse. Observational research has led to numerous important advances in the field of medicine, and its methodology is considered the best approach to address many types of research questions. Preserving privacy is a very important societal objective but it can be done without sacrificing such research. We suggest that standards or guidelines that clarify privacy legislation and alternate methods of preserving privacy and confidentiality may improve the current situation and preserve this important source of medical progress.

Key points of the article

• Privacy legislation has been passed in many countries to protect the privacy and confidentiality of patient information in medical research.

• Conservative interpretation of such legislation may serve as a barrier to many types of observational research such as studies where it is not practical to get written informed consent from all people included.

• Privacy guidelines and education for researchers, research ethics boards and data custodians and exploration of alternative strategies to the traditional “opt-in” written informed consent model may help to preserve this important source of medical progress.