Privacy and the use of health data for research

The general privacy legislation currently in place in Australia is shown in Box 1.

• Definition of personal information. There are some minor inconsistencies between the definitions of personal information in the different Acts. The definitions are regularly tested in privacy complaints.9

• Definitions of use and disclosure. Within the privacy regulation framework, there are different provisions for use and disclosure, although it can be difficult to determine whether a given scenario involves use, disclosure or both.

• Consent for disclosure. There are considerable inconsistencies in federal and state privacy regulation surrounding consent for disclosure.10-12 Strict application of the consent provisions in some cases has forced researchers to seek alternative methods of access to data without triggering consent provisions.

• De-identification. Some privacy laws include specific provisions for de-identification and de-identified data, limited to certain types of research.

The main health-specific privacy laws are shown in Box 2. Health information is represented differently in different laws: it is included either in personal information or sensitive information, or is defined separately.

Enforceable guidelines provide an additional layer of privacy regulation for health research without consent. The key federal guidelines are those approved under section 95 (for Medical research) and section 95A (for national privacy principles about health information of the Privacy Act 1988).

An analysis conducted by the National Health and Medical Research Council (NHMRC) of the use of these guidelines in practice13 found:

• Among consumers, there was a low level of awareness of privacy legislation and people had difficulty distinguishing between “confidentiality” and “privacy”. Consumers were uncertain about providing consent for the use of their data.

• Health professionals tended to equate confidentiality with privacy and always maintained patient confidentiality.

• Researchers reported difficulty in accessing registries and inconsistencies in decisions made by human research ethics committees regarding access and disclosure.

• Data custodians believed that there was no need for researchers to have access to identified data and felt that they obtained the same benefit from de-identified information.

• Ethics committees believed that interpreting privacy legislation was complex, and they were most strongly opposed to researchers having access to health information without consent.

• The research community has had some difficulty in using the guidelines, and the initial test for compliance rests with ethics committees that appear to have applied the test inconsistently.

The final report of the Australian Law Reform Commission (ALRC) Review of the Privacy Act was delivered on 30 May 2008,14 and the government released the first stage of its response on 14 October 2009.15 Exposure draft legislation containing an important element of the first stage response, the proposed Australian privacy principles, was released on 24 June 2010.16

In response to the ALRC recommendations 6-1 to 6-7, there are likely to be revisions to definitions in the Privacy Act, including that in recommendation 6-1, to define “personal information” as “information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identifiable individual”. The Office of the Privacy Commissioner is likely to publish guidance on the meaning of terms such as identified and reasonably identifiable.

Regarding health research, recommendation 65-1 is likely to give rise to the replacement of the various existing guidelines on privacy and research by a formal set of research rules issued primarily by the NHMRC.

Other key accepted recommendations can be summarised as follows:

• Recommendations 65-2 and 65-3. “Research” should be extended to include human research more generally and the compilation or analysis of statistics.

• Recommendation 65-6. When a research proposal seeks to rely on the research exceptions in the Privacy Act, it must be reviewed and approved by a human research ethics committee.

• Recommendation 66-1. The research rules issued by the NHMRC should address the question of the collection, use or disclosure of personal information without consent for inclusion in a database or register for research purposes, and that approval to establish such a database does not extend to future unspecified uses.

• Recommendation 66-3. The research rules issued by the NHMRC should address the circumstances and conditions under which it is appropriate to collect, use or disclose personal information without consent in order to identify potential participants in research.

In reporting on Australian Government Department of Health and Ageing (DoHA) qualitative research, Taylor17 noted that “consumers are not familiar with the term ‘de-identified data’ and even when it’s explained to them, it’s a concept that they are not all that comfortable with”.

In a poll conducted by the Australian Medical Association (AMA) in 2005,18 60% of respondents reported that they were slightly or very concerned about the de-identification process.

Surveys by the Office of the Privacy Commissioner in 2001 and 2004 found that about 64% of respondents said consent should be sought for the use of de-identified data for research, while 33% said that use without consent was fine.19,20 In the 2007 survey, 51% said that consent should be sought, while 46% said that consent should not be sought.21

Similarly, the DoHA research17 found that consumers supported the use of data in research and registers, provided the data were de-identified and the purpose was legitimate and worthwhile. If identified data were to be used, consumers expected to be informed and their consent to be sought.

In the contrasting AMA poll,18 about 80% of respondents thought that their doctor should ask permission before allowing their de-identified data to be used for medical research, government purposes or commercial purposes. The comments provided suggest that some respondents may have overlooked the fact that the survey was only about de-identified data.

Comparative results can be seen in the United States National Consumer Health Privacy Survey 200522 and an Australian perspective is provided by the Australian Consumer Association.23

It is interesting to compare individuals’ preferences for consent to the use of de-identified data for research with the legislation which permits the use of de-identified and sometimes even identifiable health data for research without consent, under certain conditions.

The use of an individual’s health data for research can be viewed as participation by that individual in the research. An individual may have an objection to the purpose of the research on moral grounds even when there is no risk of identification or personal consequences.24

The AMA poll18 found that 67% of respondents would give permission for their de-identified data to be used for research, 45% would give permission for government purposes and 32% would give permission for commercial purposes, showing that some participation concerns existed for a significant number of respondents.25

De-identification is a complex issue surrounded by a lack of standard terminology and clarity. However, it is important because it underpins many health information privacy regulations.

First, it is often not clear what is meant when the term “de-identified” is used to refer to data. Sometimes it appears to mean simply that nominated identifiers such as name, address, date of birth and Medicare number have been removed from the data. At other times its use appears to imply that individuals represented in a dataset cannot be identified from the data, although it can also be unclear what this means. Simply removing nominated identifiers is often insufficient to ensure that individuals represented in a dataset cannot be identified. It can be straightforward to match some of the available data fields with the corresponding fields from external datasets, and thereby obtain enough information to determine individuals’ names either uniquely or with a low degree of uncertainty. This is particularly true of health information or of information which contains times and/or dates of events.

In Australia, the National statement on ethical conduct in human research26 avoided the term “de-identified data” because its meaning is unclear. Instead, it proposed that data may be collected, stored or disclosed in three mutually exclusive forms: individually identifiable, re-identifiable, and non-identifiable. One problem with this approach is the datasets that do not fit into any of the defined categories.

In contrast, the US Health Insurance Portability and Accountability Act 1996 (HIPAA) (http://www.hipaa.org) provides a useful legislative test for de-identification that provides certainty for the research community and for ethics committees.

Considering the issues surrounding the concept of de-identification in the Australian context would help to address some of the concerns highlighted by the NHMRC analysis,13 outlined under “Other legislative privacy requirements” above. The de-identification test contained in the HIPAA is a useful example of a legislative test that provides certainty for the research community. On the other hand, there may be a significant burden of compliance: if an organisation has many datasets then it would take a great deal of time for a person to perform the tasks outlined.

Bias refers to the distortion of study results due to flaws in design or analysis. There is concern and some evidence that selection effects from consent processes lead to bias in research results.

Some investigations have been done on the possibility that consent processes may lead to bias in the makeup of study groups, and that this in turn may jeopardise the quality and applicability of the results. Woolf and colleagues27 concluded that:

With regard to population health, Stanley28,29 has stated that:

The perception is that overheads resulting from privacy regulation hamper research efficiency in Australia.35,36 ALRC recommendations 65-3, 65-6 and 66-2 potentially exacerbate this situation.

The fear is that selection effects from privacy-related processes including consent will lead to results bias. ALRC recommendations 66-1 and 66-3 (that organisations developing systems “to allow the linkage of personal information for research purposes should conduct a Privacy Impact Assessment”) were accepted in principle and potentially exacerbate this situation.

Avoidable harm may be caused to research subjects if they are exposed to sensitive medical information during overt data collection. For example, a request for consent to link treatment records with cancer registries could cause anxiety.37

There is a perception that excessive privacy regulation denies the community the full potential benefits of health research based on more complete data. The moral dimension of this work has been addressed directly by Australian researchers as follows: