Ethics and privacy issues of a practice-based surveillance system

As a lawyer and long time member of a REB in Vancouver, I read with interest the article by Kotecha et al. (1) and Dr. Upshur's well thought out response (2). Based on my experience it may be helpful to researchers to at least know why proposals are questioned by REBs and why there can be delays before approval. This letter reflects my opinion only and not those of my REB. It is based on their article and not the original application and supporting material.

I sympathize with Kotecha et al.(1) in regard to delays based on infrequent meetings of a REB. Hours are spent by the responsible Board members in scrutinizing their assigned research proposals for reporting to the Board. Hours are spent in the time the Board spends discussing the research proposals. REBs are usually made up of volunteers (sometimes a modest honorarium is paid which when divided by the hours invested usually results in an amount per hour somewhat equivalent to the minimum wage). As Dr. Upshur points out, there is difficulty in getting experienced physicians involved in research to sit on REBs. If the expertise to review the proposed research cannot be found on the Board, then the study is normally referred out to an expert, which adds to the delay.

A starting point in research. as in clinical medicine, is that there must be respect for the subject. Mason and Laurie (3) said in talking about consent, "It must be remembered, however, that consent itself is a means to an end and that the real aim is to respect persons and their interests." The TCPS2 puts it as "respect for human dignity" as the "underlying value" of the TCPS "since its inception". (4) When the TCPS2 talks about "respect for persons" it includes those subjects whose data are "used in research" (4). This requirement of "respect" I find is sometimes forgotten or only paid lip service by researchers. The primary obligation of the REB in both law and ethics is to the subject. That obligation requires the proposed research be vetted from whether or not it is flawed in any way, to whether it satisfies the legal and ethical requirements of respect for the subject. Simply satisfying the legal requirements may not satisfy the ethical requirements.

I believe Kotecha et al. (1) have their quarrel with the REBs based on what they refer to as "inconsistent interpretations and application of privacy and ethical issues" (certainly in regard to the applicability of various privacy legislation there will be differences between provinces as the legislation will differ to some extent between each province). Let me take a few of their points in their article and explain my concerns which I expect reflect the same concerns of some of the other REBs and why researchers will have problems with many REBs if they fail to fairly address these issues before submitting their applications.

Kotecha et al. (1) take comfort in that the health information of the patient is "de-identified"1. TCPS2 says that there are risks of re- identification and both researchers and REBs "should be vigilant in their efforts to recognize and reduce these risks"4. REBs should not simply accept the "de-identified" information as enough to satisfy them but should look at all aspects of the same. Here the data base has the "first three digits of their postal codes together with the de-identified health information". TCPS2 expresses risk where a data site "contains information about a population of small geographical area or about individuals with unique characteristics" (4). So my concern on looking at what would have been the application on which the article is based is whether, given the particular disease the description of the patient's particular health information and the partial postal code, a researcher with that limited information could link it to a particular patient. If that were so I would want assurances and protection in place that that could not happen.

I note the assigned patient number "is copied on to a CPCSSN key" which contains all the patient's personal and identifying information (1). It would appear that CPCSSN at some point has that identifying information unless it is done by the physician who is dealing with the patient and the article does not say in that regard one way or the other, other than the reference to the key "resides" at the office of the physician or what is referred to as the "local EMR server". This would also give me concern and I would want assurances in regard to there being no access by the data base people or the researchers to the code and that they had no access to the "local EMR server" (I appreciate that some of my concerns may have been covered in the material submitted to the various REBs as I am relying solely on the article). TCPS2 in its definition of "Coded Information" recognizes that identifiers are removed from the information and replaced with a code, but depending on as they say "access to the code it may be possible to re-identify specific participants" (4). This is particularly so in regard to linkage to other data sets. I would want to know why (if in fact they do not) the physician looking after the patient could not put the identifying number on the information removing the patient's identifiers before it being sent to the data base.

When a researcher says, "There's always a trade off between utility and security, therefore, and a small risk of identification" (1) my antenna go up. Ethically, why should the subject's confidentiality ever be put at risk when the subject has not consented to the information being released? To me the quote does not show respect for the subject.

What would also concern me is that the physician dealing with the patient displays "information to inform patients about the CPCSSN project and to explain the patient's information will be included unless they request otherwise" (1). This tells me that the physicians can try to get informed consent from their patients. It is therefore up to the researcher to satisfy the REB that to do so will, as Kotecha et al put it, result "in a biased local sample data set not sufficiently representative for the purpose of health surveillance research"1 (as required by Article 3.7(c) of TCPS2) (4). A simple statement by the researcher that this happens is not sufficient. I would want details. Remember the basic requirement in research is respect for the subject. If my REB is satisfied that it is appropriate to waive the requirement of consent, I would also want assurances that the physician talks to each patient about the research and risks (and did not rely just on the printed material), answers any questions the patient might have and makes it clear that the patient can opt out without it adversely affecting the relationship between the patient and the physician. I expect that the REB who originally required informed consent based that requirement on the particular circumstances of what is disclosed in the first quote in this paragraph.

I agree with Dr. Upshur that researchers should serve on REBs. They would then better understand the mandate of the REB in the protection of the subject, and from that understanding would be better able to draw their proposed research proposals which will satisfy the REB. The concerns I have raised all go to respect for the subject and can be addressed by the researchers in preparing their research proposal. If these concerns are not addressed then there will be delays in the approval of that proposal.

Kotecha et al. want a "specialized national centralized IREB" for "multi-site studies relating to population health research"1 (which ignores the possible different legal requirements in different provinces). One must be careful about what one wishes for. Assuming that such a board was created and was truly independent (and met often enough to avoid undue delay) then based on the mandate required of the board by TCPS2, it may well want the same or more requirements and put the same questions as some of the local REBs did in regard to Kotecha et al.'s application.

References: 1. Kotecha, J.A., et al. Ethics and Privacy Issues of the Practice-Based Surveillance System, Canadian Family Physician, October 2011; 57:1165-1173

2. Upshur, REG. Commentary, Ask not what your REB can do for you; ask what you can do for your REB, Canadian Family Physician, October 2011; 57:1113-4.

3. Mason, J.K. and Laurie, G.T. Mason and McCall Smith's Law and Medical Ethics, 8th edition. Oxford: Oxford University Press 2011, 638

4. Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, and Social Sciences and Humanities Research Council of Canada. Tri-Council Policy Statement: ethical conduct for research involving humans. 2nd ed. Ottawa, ON: Her Majesty the Queen in Right of Canada; 2010

Conflict of Interest:

Member, UBC Clinical Research Ethics Board