Introduction

Health research projects conducted in an international setting are increasingly attempting to bring together large data sets utilising patient’s computerised medical record data.1 Advances in secure computational methods make projects of this nature feasible and able to meet strict information governance standards that reduce the chances of any breach in privacy.

Privacy and ethical issues in real-life projects are complex and often project specific. Variations in published guidelines are influenced by the type of study participants, funding bodies, regional legislation, and so on.2 Despite these differences, privacy and ethics are fundamental principles in biomedical science. The privacy and ethical framework described in this paper provides a generic evidence-based approach, with a focus on linking principles to practical questions that inform the approvals required to enable health data access. It recognises that research must be in the public interest and have citizens’ trust.3^,4

Need for a pragmatic approach for dealing with privacy and ethical issues

Many projects deal with ethical, privacy and data access issues within the same work package or committee. However, while they might be grouped together at the project-level, ethical approvals (if any) required for surveillance, quality improvement (QI) and research projects are subject to layers of regulation different from those that ensure privacy standards. Approvals are generally made by separate bodies that deal with specific areas. In general research ethics approval, or exemption from it, is dealt with separately from data protection and information governance. Moreover, approvals for international studies are obtained from separate bodies in different countries. This paper proposes a pragmatic methodology for researchers who want to use health care data for research, surveillance and service evaluation projects spanning from a conceptual framework to actionable assessment techniques.

Building a privacy and ethical framework

The privacy and ethical framework consists of a set of privacy and ethical assessment principles derived by a review of the relevant ethics and privacy literature (Table 1). The associated questions were developed by translating principles to fit the context of the potential use cases that the principles will be applied to. We considered examples in the existing literature that highlighted implications of applying (or not applying) privacy and ethical principles within specific health research settings or scenarios.

The framework adopts controlled vocabularies and standard definitions to ensure consistent understanding of the privacy and ethical principles. The set of principles and questions are extensible and can evolve in a manner that can absorb new research in the area and to adapt to changing legislations. The principles and questions are referenced to their original source.

CONTROLLED VOCABULARIES FOR REPRESENTING PRIVACY AND ETHICS

Controlled vocabularies are important to ensure consistency of the concepts used across studies and in different countries.5 This approach is needed because the terminologies used for describing privacy, ethics and data access concepts are diverse. For example, the definitions of terms such as ‘data owner’, ‘data custodian’ and ‘data processor’ have overlapping meanings. Legal definitions, in the field of data protection, are often used very differently from how the same terms are used in research projects. We have built on a prior initiative for developing controlled vocabularies and ontologies in this domain.6 We have extended this work by enriching the controlled vocabularies with additional findings from our literature survey and by adopting standard definitions accepted within the domain (e.g. European Union Data Protection Directive,7 or other regionally appropriate definitions such as the Australian Privacy Principles8).

USE CASES

The framework can be represented as a number of use cases involving multiple stakeholders; they will vary according to the type of study. The overall use case diagram for the framework is illustrated in Figure 1. ‘Use cases’ are generally used to model systems and their interactions in software engineering. They describe a story of how a system and its actors (those who engage in various interactions with the system) collaborate to achieve a specific goal. These diagrams are frequently used while gathering technical requirements associated with health information systems.18^,19 We have followed Unified Modelling Language use case notation as given in the Rational Unified Process to create these diagrams.20

• Download figure
• Open in new tab
• Download powerpoint

Figure 1 Overall use case diagram for the privacy and ethical framework. The box indicates the system of interest and the oval within corresponds to the processes within the system that are inter-related. The actors who interact with the system (and its processes) are drawn around the box

1. Researchers and research ethics committees: The same principles and questions should apply to all involved in research. Privacy and ethics are included in the design of a study, and generally studies go on to receive ethical approval as the potential issues are considered from the initial stages. The actors in this use case will typically involve primary investigators who design the study, the ethics committee members who approve studies and data custodians who provide approval for data access. The ethics of research studies will have a higher degree of scrutiny as interventions might include new treatments.

2. QI: A narrower range of privacy and ethical considerations generally apply to QI initiatives. Protection of public from harm is generally not an issue as most parts of those studies usually have a high degree of patient safety in built. Treatment used in QI studies are already approved and whether to treat is decided by both the clinician and the patient according to clinical standards and patient’s preference. As data are generally handled at a local level, data sharing is less complicated in this use case.

3. Surveillance: Generally, using data for disease surveillance is part of a health system’s public health functions and therefore fewer ethical principles apply. However, a duty of privacy remains where data are further used to inform QI or research; in which case different principles pertain. Data are mostly reported as aggregated summaries and the unit used for reporting is generally regional or city level though sentinel surveillance networks report at the national level. The unit of reporting largely ensures that privacy of individuals is maintained despite reports are published at regular intervals. However, privacy concerns might arise when stratifying populations into narrow age-bands or localities and in the reporting of rare events. During epidemic outbreaks, personal data and samples may need to be collected for public health purposes. Whilst the privacy and ethical considerations applied in this use case are limited, patients should still be given the right to opt out of their data being used for surveillance.

The use cases also involve representatives from the public including patients, carers (generally parents in the case of children) and non-patient citizens. Present-day research studies should have a high level of patient and public engagement throughout the research process. Patient group representatives should get involved as early as the design stage of the study to ensure that studies are likely to be beneficial to patients and to help maintain wider public trust. We have drawn secondary-level use cases suggesting how the privacy and ethical framework will be utilised (Figures 2–4).

• Download figure
• Open in new tab
• Download powerpoint

Figure 2 The use case utilising the privacy and ethics framework in the context of research studies. Research requires the greatest level of scrutiny and involvement of actors – eight different actors are identified as important in this process. Citizens are important as research in the public interest must also be acceptable to citizens. Patients include consenting research participants and carers include parents and those with power of attorney

• Download figure
• Open in new tab
• Download powerpoint

Figure 3 The use case for utilising the privacy and ethics framework for QI studies. Generally, ethical approval is not required here in contrast to the research use case. Public interest is also important in this use case. QI studies requires a protocol just as research studies

• Download figure
• Open in new tab
• Download powerpoint

Figure 4 The use case for utilising the privacy and ethics framework for surveillance. Surveillance is conducted in the public interest, and although it does require clear reporting methods, it does not require a protocol or research ethical approval. However, individuals still have the right to expect that their privacy is protected. Only for a small number of specified diseases is legal compulsory information passed to public health specialists (e.g. Salmonella food poisoning)

Summary

This paper describes an extensible framework that can be used to explore the ethical and privacy principles related to research, QI and surveillance. The framework links to key questions that help ensure that important issues are identified. Further research is needed to test the reliability of this approach and the completeness and validity of the principles included in it. This is planned as an activity of the International Medical Informatics Association and European Federation for Medical Informatics Primary Health Care Working Groups.

The strength of this approach is the extensibility and adaptability to different research scenarios, as demonstrated in the example use cases. The coupling of ethical principles with the privacy and data protection requirements to access data represents a change from current practice, where they are often considered separately. The purpose of this integration is to help maintain the trust of citizens by ensuring that the use of routine health data is for ethical purposes and demonstrably in the public interest.