Ethics and privacy issues of a practice-based surveillance system

Institutional research ethics boards

The IREBs approve and monitor safety, privacy, and confidentiality for research participants. In Canada the principles guiding the role of IREBs include the Tri-Council Policy Statement on research ethics (TCPS),² good clinical practice guidelines,³ the Health Information Protection Act,⁴ La loi sur les services de santé et les services sociaux,⁵ La loi sur l’accès aux documents des organismes publics et sur la protection des renseignements personnels,⁶ the Personal Information Protection and Electronic Documents Act,⁷ and the Personal Health Information Protection Act.⁸ In addition to participant protection legislation, IREBs interpret complex federal, provincial, and local regulations, acts, and policies that govern their role, and IREBs also define how or when personal health information can be used for health surveillance and research.

These regulations have become increasingly complex, and IREBs’ workload has increased. This increase has resulted in difficulty recruiting and retaining appropriately qualified members, in securing adequate resources and staff, and in responding to investigators quickly.^9–11 While important, these regulations, policies, acts, and guidelines (Figure 1) are nonspecific and produce substantial variations of interpretation by IREBs. These disparities create considerable challenges for researchers conducting health surveillance and research requiring participation at multiple sites.¹⁰ In the CPCSSN project, variation among IREBs demonstrated a lack of clarity about explicit informed consent for using pre-existing de-identified data for health surveillance and research.

• Download figure
• Open in new tab

Figure 1.

Map of regionally applicable privacy acts across Canada

ATIPPA—Access to Information and Protection Privacy Act, FIPPA—Freedom of Information and Protection of Privacy Act, FOIP—Local Freedom of Information and Protection of Privacy Act, HIA—Health Information Act, HIPA—Health Information Protection Act, PHIA—Personal Health Information Act, PHIPA—Personal Health Information Protection Act, PIPA—Personal Information Protection Act, MFIPPA—Municipal Freedom of Information and Protection of Privacy Act.

*Quebec acts: Respecting the Protection of Personal Information in the Private Sector, Respecting Access to documents Held by Public Bodies and the Protection of Personal Information, la loi sur services de santé et services sociaux due Québec.

Consent

Consent recognizes the individual’s autonomy, protects the public from duress or fraud, and informs decision making by health professionals. Ideally, consent should be provided after patients are fully informed about what they are consenting to.¹² Clinical research that involves interventions or collection of new information generally requires explicit and individual informed consent. However, for research collecting pre-existing de-identified data for health surveillance and population research, or for investigations that pose minimal risk, that offer no direct benefit or harm to patients, and in which validity requires a non-biased sample population,¹³ a waiver of explicit consent is recommended and is permissible once the IREB approves. The CPCSSN project uses the waiver of explicit patient consent because gaining individual consent would not be feasible (large geographic region) and because pre-existing de-identified aggregated data will be collected and analyzed. All primary care sentinel (PCS) practices display IREB-approved patient information to inform patients about the CPCSSN project and to explain that patients’ information will be included unless they request otherwise. All CPCSSN PCSs are themselves considered to be study participants because their demographic information is used for research purposes; hence explicit informed consent is obtained from each participating PCS.

Data collected

De-identified demographic information on participating PCS physicians is collected by CPCSSN, as is de-identified health information on their patient population as listed in Figure 2. Patients’ provincial health card numbers are not collected, and only the first 3 digits of their postal codes are collected as part of the database.

• Download figure
• Open in new tab

Figure 2.

The CPCSSN data elements

CPCSSN—Canadian Primary Care Sentinel Surveillance Network, DIN—drug identification number, EMR—electronic medical record, FSA—forward sortation area, ID—identification, MD—medical degree.

Privacy and confidentiality

Privacy and confidentiality are critical components in any health surveillance system; ideally it should be impossible for any individual in the database to be identified. However, this limits the amount of information that can be collected, making it impossible to conduct validated health surveillance. There is always a tradeoff between utility and security, therefore, and a small risk of identification. Many protections relate to formal contractual obligations within the surveillance work force and the threat of legal prosecution in the event of breaches, rather than to technological barriers. In CPCSSN, investigators and custodians of patients’ data sign research agreements outlining their individual roles, the nature of the project, how and what data are being collected, and how individual privacy is protected in accordance with provincial health information legislation.¹⁴ Additionally, CPCSSN staff, consultants, and stakeholders sign confidentiality agreements, and the researcher extracting data from any EMR uses a unique user identification and password.

Data security, extraction, and transfer to a central data repository

Data (Figure 2) are de-identified at the PCS’s office or remotely using a secure, encrypted connection. De-identified data are sent by secure electronic transfer to a regional virtual server where each patient’s data are assigned a unique CPCSSN number, cleaned, put into a standard format, and further de-identified using advanced de-identification algorithms.^14,15 These data are then transferred securely to the CPCSSN central server and are combined with data from other regional databases to create an aggregated national CPCSSN database. The central and regional servers are located in a secure centre housed at Queen’s University’s High Performance Computing Virtual Laboratory to ensure standardization of security practices.

The CPCSSN number is copied onto a “CPCSSN key” containing the patient’s residential postal code, date of birth, sex, provincial health number, and identity of the issuing province. This key resides in a secure location at the PCS’s office or on the local EMR server.

Challenges with IREB approval

Despite rigorous policies and procedures developed by CPCSSN, obtaining IREB approval from across participating provinces was challenging. Inclusion of approvals from other IREBs, as permitted by Article 1.2 of the TCPS,² to assist IREB approval had mixed success. Table 1 provides an overview of the IREB submissions and approval timelines.

It is possible to summarize these challenges as follows: clarification was frequently requested about specific data elements to be collected; about privacy, confidentiality, and security safeguards for data use and storage; about our justification for not using explicit consent; and about the level of specificity required for future linkage with other data sets. Another challenge was the effects of IREB caseloads and IREB meeting schedules, which affected approval timelines.

These challenges resulted from variations in IREB interpretations of applicable ethical and privacy guidelines, and are best illustrated by 2 networks from the same province, subject to the same Health Information Act and privacy laws. One network required far more interaction before IREB approval than the other did. For one of these networks, operational approval was required in addition to IREB approval, resulting in a repetition of ethical and privacy questions addressed through the IREB approval process. Operational approval resulted in a 6-month delay and limitations on types of data approved for collection. Approval to collect all required data elements was obtained 12 months after initial IREB submission. In contrast, the other network in the same province received full IREB approval without limitations within 3 months of initial IREB submission.

In another province initial IREB approval took approximately 8 months and was granted on the condition that individual patient consent was obtained. This resulted in a biased local sample data set not sufficiently representative for the purpose of health surveillance research. After clarifications over an additional 4 months, approval to waive explicit patient consent was provided; however, linkage to other data sets was prohibited.

The delays associated with IREBs’ approval can in most cases be attributed to IREBs’ desire to be diligent in performing their role. However, in many cases the delay is a direct result of the ever increasing burden that IREBs face trying to interpret complex sets of provincial and federal guidelines written with the aim of protecting patients who participate in clinical research. These guidelines rarely make it clear how these rules should apply in case of public health surveillance.

Conclusion

Adoption of EMRs has compounded the need for greater clarity on data protection laws, as it is easier to conduct health surveillance and clinical research over a larger geographic region with multicentre participation. For multicentre projects it is important to create clear IREB guidelines. For health surveillance and population health research, the acceptability of waiving explicit informed consent needs to be better understood. Clarification of roles and responsibilities, so that ethics and privacy issues addressed by IREBs are not revisited at the operational approval level, would assist in avoiding unnecessary delays.

The CPCSSN experience further highlights a need for Canada to develop a better process for researchers to obtain timely and consistent IREB approvals for multicentre research. We suggest developing a specialized, national, centralized IREB responsible for the approval of multisite studies related to population health research, similar to the OCREB model. This could provide more timely and consistent approvals and reduce costs associated with local IREB approval for similar studies, and better preserve the integrity of the ethics approval process.^22,23,25

Our EMRs provide a rich source of health information for the purpose of research and health care improvement. However, researchers and IREBs are not yet able to apply current privacy and confidentiality policies on the use of EMR data to ensure that security measures implemented meet the required standard. The development of security measure guidelines for the use of EMR health information would be beneficial to both researchers and IREBs.