Low risk research using routinely collected identifiable health information without informed consent: encounters with the Patient Information Advisory Group

Abstract

Current UK legislation is impacting upon the feasibility and cost-effectiveness of medical record-based research aimed at benefiting the NHS and the public heath. Whereas previous commentators have focused on the Data Protection Act 1998, the Health and Social Care Act 2001 is the key legislation for public health researchers wishing to access medical records without written consent. The Act requires researchers to apply to the Patient Information Advisory Group (PIAG) for permission to access medical records without written permission. We present a case study of the work required to obtain the necessary permissions from PIAG in order to conduct a large scale public health research project. In our experience it took eight months to receive permission to access basic identifying information on individuals registered at general practices, and a decision on whether we could access clinical information in medical records without consent took 18 months. Such delays pose near insurmountable difficulties to grant funded research, and in our case £560 000 of public and charitable money was spent on research staff while a large part of their work was prohibited until the third year of a three year grant. We conclude by arguing that many of the current problems could be avoided by returning PIAG’s responsibilities to research ethics committees, and by allowing “opt-out” consent for many public health research projects.

Privacy laws have recently been introduced in many western countries^{1 2} including the United Kingdom.^3–6 The UK legislation has caused considerable confusion over the circumstances in which public health researchers are allowed information from medical records without written informed consent. Researchers have suggested that NHS data controllers are ignoring the conditions by which public health research satisfies the Data Protection Act, notably Section 33 which allows further processing of previously collected personal data for research purposes.^{7 8} However, NHS data controllers understand Section 33 as applying only to historical data, with written consent being required when medical records have been collected after the start of a research project.^{9 10} That conservative view is compatible with Section 60 of the Health and Social Care Act 2001.⁶ This Act requires researchers to apply to the Patient Information Advisory Group (PIAG; see box 1) for permission to access medical records without written consent and has become the key legislation in this area. We describe events over the 30 months spent by PIAG in considering our research project, demonstrating the damaging effect that the conservative interpretation of UK legislation is having on public health research.

Box 1.

Glossary

Contamination

Some patients in the control arm of a trial may receive the intervention under study; this is referred to as contamination. A man in the control arm of a study of PSA testing may request the test from his GP if, for example, he hears about it from a friend in the intervention arm.

Flagging

A list of the individuals in a research study is sent to a registry. The records for those individuals are identified in the registry, and those records are “flagged” with the name of the study. Whenever events (death, cancer diagnosis) are added to the registry, study staff can be informed when events are added to a record flagged as being in their study.

Misattribution bias

Where a man’s underlying cause of death is not clear, previous diagnoses may be influential. So if a man had received a diagnosis of localised prostate cancer, this may be assumed to be the primary tumour when there are doubts about this after death.

MREC

Multi-centre Research Ethics Committee

PIAG

Patient Information Advisory Group

OUR EXPERIENCE: THE CAP TRIAL OF POPULATION – BASED PSA TESTING

The Comparison Arm for ProtecT (CAP) study compares the risks and benefits of population-based prostate-specific antigen (PSA) testing, to those of current NHS care, for the management of prostate cancer. In the intervention arm 50–69 year old men at 400 randomly selected general practices are invited to undergo a PSA test. These men are compared with men of the same age at a further 400 control group practices (fig 1) following current NHS recommendations of conservative PSA test use. By January 2006, 130 000 men in the intervention arm practices had been invited for a PSA test and 50% had attended in the case-finding aspect of the ProtecT treatment trial.¹¹ Men recruited provide written informed consent to enter the trial, and also to follow-up through data collected at the NHS Central Registry, cancer registries, and in medical records. However, to evaluate the effect of a PSA testing programme on prostate cancer mortality, prostate cancer progression, and health service resource use, these data are required for all 50–69 year old men at the 800 general practices, three quarters of whom will not have given written consent.

Figure 1.

Design of the CAP study.

Application Number 1: Flagging

Cancer Research UK confirmed funding for the CAP study in July 2003. We applied to Trent Multi-Centre Research Ethics Committee (MREC) in August 2003 (see box 2 for an overview of events). Initially MREC approved the flagging activity (see box 1) in October 2003, subject to PIAG agreement. The first application to PIAG was made on 4 November 2003, further information on institutional policies was requested in December, and permission received on 7 April 2004. Hence permission to access basic routinely collected data without written consent took eight months to be granted. A recent national survey suggests that 72% of the British public does not consider the use of National Cancer Registry data in this way to be an invasion of privacy.¹² However, delays of this length are typical due to the requirement to firstly receive MREC approval, and then to apply one month prior to a meeting of PIAG which are only held quarterly.

Applications to PIAG must state how the proposed research is in the public interest, justify why anonymous data cannot be used, and justify why written consent cannot be obtained. Receiving anonymous data, which can be used without PIAG permission, was not an option in the CAP study because of the need to link with the medical records of men diagnosed with prostate cancer (see next section). We requested permission to receive identifiable information without informed consent because the European Randomised trial on Screening for Prostate Cancer had experienced a 50% consent rate,¹³ and a 20% contamination rate¹⁴ (see box 1). Similar rates would prevent the CAP study from achieving adequate statistical power due to small sample size and a reduced effect size. PIAG focused more on the consent issue (PIAG minutes, December 2003). In most cases where consent is not granted during the ProtecT case-finding, this is due to men not responding to the invitation to take part rather than explicitly refusing consent once they hear what the study involves.¹¹ PIAG accepted that a high non-response rate would prevent progress with the CAP study and that non-response represents passive dissent from the study in only a handful of cases.

Application Number 2: Medical records review

Initially MREC had stated that written consent for medical records review was required by the Data Protection Act,⁴ and that Section 60 support would not override this obligation. PIAG disagreed, and we were invited to re-apply for MREC approval of the medical records based activities in June 2004. Information on the diagnosis, disease progression and resource use was required from the medical records of men diagnosed with prostate cancer. We applied to do this without seeking consent as we anticipated that 50% of men would not respond to an invitation to provide informed consent, but that very few would actively object. 50% is mid-way between the 41% of patients with brain arteriovenous malformations¹⁵ and 62% of patients with angina¹⁶ who did not respond to similar invitations to consent to medical records review. Without information from medical records the study primary outcome would not be validated, and so subject to misattribution bias (see box 1), and the analysis of important secondary outcomes would be imprecise and possibly biased. MREC approved the application on 13 August 2004, conditional on PIAG agreement.

We applied to PIAG on 18 August 2004 and in September we were invited to clarify the aims of the study, and further justify why written consent could not be sought. In December 2004 PIAG arranged for two CAP study principal investigators to attend the meeting in March 2005, and following that discussion PIAG refused permission to proceed without informed consent. The rejection was received 18 months after the first application to MREC in August 2003.

In contrast to PIAG’s earlier decision, the likely low response rate when seeking written consent was now grounds for refusal. A more conservative interpretation of this non-response as a “decision by patients not to participate … by not responding to the request to participate” was behind this reversal (PIAG minutes, March 2005). PIAG also stated that the difficulties in seeking consent were due to the administrative and resources burden, and that Section 60 exemption could not be given on these grounds. We were advised to pilot a process for obtaining written consent, with the option of reapplying if the process was unsuccessful. We devised such a process which was approved by MREC in November 2005. Once the necessary NHS Trust Research Governance approvals and honorary contracts were received we were able to proceed in some areas in March 2006, nearly two years after the first application to MREC.

Application Number 3: Deceased men

Finally, in January 2006, we applied to the PIAG for Section 60 support of access to medical records without consent where men had died prior to us making contact. This application was approved in March 2006 but with the condition that, where practical, we ensure men had not objected to similar research while alive. We are currently engaged (October 2006) in seeking MREC agreement for a process by which we can meet this condition.

COMMENT: GENERAL IMPLICATIONS FOR LARGE SCALE MEDICAL RESEARCH

There are several broader issues to be considered, irrespective of whether the reader agrees with the decisions made about this particular study. PIAG was only intended to be an interim measure¹⁷ and in the future researchers will be required to either use anonymised data or to seek informed consent for every study. However, we agree with the Academy of Medical Sciences¹⁸ that a body with PIAG’s functions will be required for the foreseeable future. PIAG does not cover research in Scotland, and studies such as CAP requiring linkage between different databases during prospective follow-up are severely limited or prevented if only anonymous data can be provided. Motivating individuals to give written consent for the use of their information in medical studies which will cause them no direct benefit or harm will always be difficult, and it is unclear how technological developments will improve the situation.

Could decisions be made more rapidly? PIAG currently consists of a single committee and its quarterly schedule of meetings means that researchers expecting to apply for access to the most basic data should allow for an eight month delay before permission to proceed. More frequent meetings would help, but returning PIAG’s functions to the MRECs would improve matters further.¹⁹ MRECs have a broad range of members, meet more frequently, and are required to consider all applications before they are submitted to PIAG. Currently MRECs consider the ethical aspects, leaving PIAG to approve or reject the proposal on legal grounds. However, PIAG currently (October 2006) includes no legal experts,²⁰ and our experience was of a committee which changed its interpretation of the law over time. The current system where it can take eighteen months to decide whether a fully funded, scientifically peer-reviewed project will be able to proceed is unsustainable, and poses near-insurmountable difficulties to publicly or charitably funded research. In our case approximately £560 000 of charitable money has been spent on research staff while a significant aspect of their work was prohibited until the third year of a three year grant. Seeking consent will also consume resources, but PIAG will not allow access to medical records without written consent when the justification is on the grounds of prohibitive expense. Evidence of whether the public believes this is a good use of public and charitable monies is lacking.

We do not propose that researchers are allowed unfettered access to medical records. However, for non-commercial public health research requiring access to medical records with no direct impact upon the patients themselves, we suggest that MRECs have more time and resources to consider the appropriateness of access without written consent. In some cases it will be appropriate to contact the individuals involved, to provide information about the study and give the opportunity to opt-out of the research. We suggest that the 50% of individuals who do not respond to these contacts are not assumed to be passively refusing consent, and that researchers are required to exclude only those people who actively object to the research.²¹ Otherwise a situation is created where UK legislation allows fluoride to be introduced into the water supply without the written consent of every individual who will be drinking it, but does require such consent to investigate the long term impact upon health using routinely collected medical records. An inevitable consequence of this would be the introduction of inadequately evaluated and potentially ineffective healthcare programmes due to prohibition of the necessary public health research.²²

In conclusion, quicker decisions, and a realistic view of what constitutes an objection to research activity will ensure that public health and the NHS continue to benefit from cost-effective medical records based research.

Box 2

Timetable and brief description of encounters with the PIAG

Application Number 1: Flagging
August 2003	Application to MREC
October 2003	Approval received from MREC of flagging activities only subject to PIAG approval. MREC states that written consent must be obtained for medical records review under the Data Protection Act 1998, and that Section 60 would not override this obligation
November 2003	Application to PIAG for permission to flag men
December 2003*	PIAG requests further information on institutional policies, and states that PIAG can consider an application for medical records review without written consent
April 2004*	Approval received from PIAG for flagging men
Application Number 2: Medical records review
June 2004	Application to MREC, for medical records review
August 2004	Approval received from MREC subject to PIAG approval Application to PIAG, for medical records review
September 2004*	PIAG requests further justification for not seeking consent
December 2004*	PIAG invite principal investigators to attend next meeting
March 2005*	Principal investigators attend PIAG meeting PIAG reject application for medical records review
June 2005*	PIAG reject Cancer ResearchUK appeal for “opt-out” consent
September 2005	Application to MREC, medical records review with consent
October 2005	MREC request further information
November 2005	MREC approve medical records review with consent
Application Number 3: Deceased men
January 2006	Application to PIAG regarding men who die before consent can be sought
March 2006	PIAG approve access to medical records without consent when a man has died prior to being approached, but with conditions

MREC, Multi-centre Research Ethics Committee; PIAG, Patient Information Advisory Group

^*PIAG meeting minutes are available at (last accessed 30 October 2007): http://www.advisorybodies.doh.gov.uk/piag/Meetings.htm.