Privacy and medical research

In many branches of health and medical research, sensitive information must be collected from patients to answer specific research questions, with the ultimate aim of improving human health. It therefore comes as little surprise that the recent introduction of legislation governing the way in which sensitive health information can be collected, stored or disclosed, should be of vital interest to the practitioners of medicine and research. Introduced in 1988, the Commonwealth Privacy Act (the Privacy Act) originally applied only to Commonwealth public sector agencies, but was extended to encompass the private sector through amendments passed in 2000. This legislation states that health information cannot be collected, used or disclosed without the consent of the data subject, except in limited circumstances addressed in sections 95 and 95A of the Privacy Act. Since that time, most state and territory parliaments have also passed new laws regulating the collection, use or disclosure of personal information, resulting in a complex web of privacy legislation across the jurisdictions. Concerns raised by various groups about the impact of these privacy laws on health and medical research prompted the National Health and Medical Research Council of Australia (NHMRC) to convene a Working Committee on Privacy in late 2003. The committee took a two-pronged approach to its task of reporting on privacy regulation and its impact on health care and research; first, by commissioning a legal analysis of privacy regulations in Australia; and second, by conducting a series of stakeholder surveys. An important conclusion arising from the legal analysis was that in comparison with other jurisdictions with similar types of privacy legislation (e.g. the European Union, Canada, United States and New Zealand), Australia has adopted a ‘more exacting standard of privacy regulation’. The legal analysis also highlighted an anomaly well recognized by clinical researchers: that while there is a legal mechanism (i.e. ethics committee review and approval) to collect and use sensitive health information without consent for research purposes, data custodians are free to refuse requests for such information, even when lawfully approved by an ethics committee. By way of example, a researcher may have sought and obtained approval to conduct research into adverse events associated with drug X. To complete this research successfully, the researcher requires access to pharmacy records for thousands, or even tens of thousands, of patients and then must link this information to pathology databases and discharge summaries. Under the provisions of the Act, release of such health data without consent is legal provided the research has been reviewed and approved by a properly constituted ethics committee. However, this ‘legal blessing’ does not extend to a legal right, and data custodians are free to withhold the information sought. (The full report is available at http://www.nhmrc.gov.au/publications/synopses/nh53syn.htm.) In parallel with the legal analysis, the NHMRC Working Committee on Privacy commissioned comprehensive surveys of health consumers, clinicians, researchers and the public. In addition, the views of data custodians, ethics committee members and peak bodies were canvassed. Arguably the group with the strongest views about the impact of privacy legislation were the health and medical researchers. In addition to complaints about increased administrative burden and costs of doing research, more than 20% of researchers reported that proposed studies had not been commenced or that ongoing studies had been terminated as a direct result of the new privacy regime. Further, almost one-third of researchers felt that changes in privacy legislation had compromised the scientific rigour of studies, due to an inability to access sensitive information without consent. For example, genetic epidemiologists reported difficulties in validating histories of diseases in family members of probands, an issue of fundamental importance for research into penetrance, aggregation and heritability. Numerous other hindrances and concerns were identified; among the most common were inconsistencies in application of the Privacy Act by ethics committees and fears that data linkage is now becoming so difficult that this powerful analytical tool may soon be lost. Thus, there is considerable evidence that health and medical research has been adversely affected by the change in the privacy landscape. But while complaints about the increased burden and costs of medical research appear justified, these can largely be overcome with perseverance and money, and of themselves are unlikely to persuade legislators to change the law. More worrying are the charges of loss of scientific rigour which cannot be lightly dismissed. Even worse, there are predictions that some avenues of medical research (such as data linkage) will become extinct in Australia. The consequences of flawed or abandoned medical research will be evident to this readership, but are perhaps less well appreciated in the wider community. These issues are clearly a cause for grave concern and ought to be publicly debated. Following this comprehensive consultation exercise, the NHMRC submitted a series of recommendations to the Federal Privacy Commissioner's Review of the Privacy Act. Recommendations included legislative changes to bring consistency and clarity across the patchwork of privacy laws in Australia, clear definitions on such issues as ‘impracticability of consent’ from the Federal Privacy Commissioner, and education targeted at the various stakeholder groups. The latter includes raising the level of public awareness as to the benefits of lawful research using sensitive information, and educating data custodians, researchers and ethics committees about the legal mechanisms for conducting ethical research on information gained without consent. It is to be hoped that these recommendations will be adopted; the health of Australia depends upon it.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.