Privacy and confidentiality in pragmatic clinical trials

Abstract

With pragmatic clinical trials, an opportunity exists to answer important questions about the relative risks, burdens, and benefits of therapeutic interventions. However, concerns about protecting the privacy of this information are significant and must be balanced with the imperative to learn from the data gathered in routine clinical practice. Traditional privacy protections for research uses of identifiable information rely disproportionately on informed consent or authorizations, based on a presumption that this is necessary to fulfill ethical principles of respect for persons. But frequently, the ideal of informed consent is not realized in its implementation. Moreover, the principle of respect for persons—which encompasses their interests in health information privacy—can be honored through other mechanisms. Data anonymization also plays a role in protecting privacy but is not suitable for all research, particularly pragmatic clinical trials. In this article, we explore both the ethical foundation and regulatory framework intended to protect privacy in pragmatic clinical trials. We then review examples of novel approaches to respecting persons in research that may have the added benefit of honoring patient privacy considerations.

Keywords

Privacy pragmatic clinical trials autonomy respect for persons fair information practice principles

Get full access to this article

View all access options for this article.

References

Tricoci

Allen

Kramer

. Scientific evidence underlying the ACC/AHA clinical practice guidelines. JAMA 2009; 301: 831–841.

Committee on the Learning Health Care System in America Institute of Medicine. Best care at lower cost: the path to continuously learning health care in America. Washington, DC: National Academies Press, 2013, http://www.ncbi.nlm.nih.gov/books/NBK207225/ (accessed 28 January 2015).

Executive Office of the President. Big data: seizing opportunities, preserving values, http://www.whitehouse.gov/sites/default/files/docs/big_data_privacy_report_may_1_2014.pdf (2014, accessed 20 January 2014).

Rathburn

Hennessy

Barlament

Another day, another cyberattack: Premera Blue Cross announces large data breach. In: Safe & Sound: a privacy and security blog from Quarles & Brady, 2015, http://safeandsound.quarles.com/2015/03/another-day-another-cyberattack-premera-blue-cross-announces-large-data-breach/

Barlament

Rathburn

Were you affected by the Anthem breach? Answers to these questions may help. In: Safe & Sound: a privacy and security blog from Quarles & Brady, 2015, http://safeandsound.quarles.com/2015/02/were-you-affected-by-the-anthem-breach-answers-to-these-questions-may-help/

Koenig

BA.

Have we asked too much of consent?

Hastings Cent Rep 2014; 44: 33–34.

Henderson

GE.

Is informed consent broken?

Am J Med Sci 2011; 342: 267–272.

Paasche-Orlow

Taylor

Brancati

FL.

Readability standards for informed-consent forms as compared with actual readability. N Engl J Med 2003; 348: 721–726.

McGraw

Dempsey

Harris

. Privacy as an enabler, not an impediment: building trust into health information exchange. Health Aff 2009; 28: 416–427.

10.

Westin

AF.

Privacy and freedom. London: Bodley Head, 1970.

11.

Allen

AL.

Uneasy access: privacy for women in a free society. Totowa, NJ: Rowman & Littlefield, 1988.

12.

Presidential Commission for the Study of Bioethical Issues. Privacy and progress in whole genome sequencing, http://bioethics.gov/sites/default/files/PrivacyProgress508.pdf (2012, accessed 15 January 2015).

13.

Nissenbaum

HF.

Privacy in context: technology, policy, and the integrity of social life. Stanford, CA: Stanford Law Books, 2010.

14.

Rubel

The particularized judgment account of privacy. Res Publica 2011; 17: 275–290.

15.

Blaauw

The epistemic account of privacy. Episteme 2013; 10: 167–177.

16.

Beauchamp

TL.

Principles of biomedical ethics. 7th ed. New York: Oxford University Press, 2013.

17.

The Belmont Report. HHS.gov, http://www.hhs.gov/ohrp/humansubjects/guidance/belmont.html (accessed 9 June 2014).

18.

Brock

DW.

A critique of three objections to physician-assisted suicide. Ethics 1999; 109: 519–547.

19.

Benn

SI.

Privacy, freedom, and respect for persons. In: Pennock

Chapman

(eds) Privacy: Nomos XIII. New York: Atherton Press, 1971, pp. 1–26.

20.

Rothstein

MA.

Is deidentification sufficient to protect health privacy in research?

Am J Bioeth 2010; 10: 3–11.

21.

Hall

Dugan

Zheng

. Trust in physicians and medical institutions: what is it, can it be measured, and does it matter? Milbank Q 2001; 79: 613–639, v.

22.

Agaku

Adisa

Ayo-Yusuf

. Concern about security and privacy, and perceived control over collection and use of health information are related to withholding of health information from healthcare providers. J Am Med Inform Assoc 2014; 21: 374–378.

23.

California Healthcare Foundation. Consumers and health information technology: a national survey, 2010, http://www.chcf.org/publications/2010/04/consumers-and-health-information-technology-a-national-survey

24.

Goldman

Protecting privacy to improve health care. Health Aff 1998; 17: 47–60.

25.

Rubel

Autonomy, surveillance, and privacy. In: Arras

Kukla

Fenton

(eds) The Routledge companion to bioethics. New York; London: Routledge, Taylor & Francis Group, 2014, pp. 312–324.

26.

Francis

JG.

Group compromise: perfect cases make problematic generalizations. Am J Bioeth 2010; 10: 25–27.

27.

Hausman

DM.

Group risks, risks to groups, and group engagement in genetics research. Kennedy Inst Ethics J 2007; 17: 351–369.

28.

Markle Foundation. The Markle connecting for health common framework for networked personal health information, http://www.markle.org/health/markle-common-framework/connecting-consumers/overview (2008, accessed 15 January 2015).

29.

Institute of Medicine (US) Committee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule. Beyond the HIPAA privacy rule: enhancing privacy, improving health through research. Washington, DC: National Academies Press, 2009, http://www.ncbi.nlm.nih.gov/books/NBK9578/ (accessed 15 December 2013).

30.

US Department of Health, Education & Welfare. Records, computers, and the rights of citizens. Report of the secretary’s advisory committee on automated personal data systems, 1973, http://www.justice.gov/opcl/docs/rec-com-rights.pdf (accessed 15 January 2015).

31.

Damschroder

Pritts

Neblo

. Patients, privacy and trust: patients’ willingness to allow researchers to access their medical records. Soc Sci Med 2007; 64: 223–235.

32.

Kass

Natowicz

Hull

. The use of medical records in research: what do patients want? J Law Med Ethics 2003; 31: 429–433.

33.

Truven Health Analytics National Public Radio (NPR). Data privacy health poll, 2014, http://truvenhealth.com/Portals/0/NPR-Truven-Health-Poll/NPRPulseDataPrivacy_Nov2014.pdf

34.

Grande

Mitra

Shah

. The importance of purpose: moving beyond consent in the societal use of personal health information. Ann Intern Med 2014; 161: 855–862.

35.

Department of Health and Human Services Office for Civil Rights. Summary of the HIPAA privacy rule, 2003, http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf

36.

Code of Federal Regulations. HHS.gov, http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.html (accessed 8 October 2014).

37.

US Department of Education. Family educational rights and privacy act (FERPA), http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html (accessed 16 January 2015).

38.

Department of Health and Human Services. 46 CFR 42: confidentiality of alcohol and drug abuse patient records, http://www.ecfr.gov/cgi-bin/text-idx?rgn=div5node=42%3A1.0.1.1.2 (accessed 26 January 2015).

39.

National Institutes of Health. HIPAA privacy rule and its impacts on research: how can covered entities use and disclose protected health information for research and comply with the privacy rule? http://privacyruleandresearch.nih.gov/pr_08.asp (2007, accessed 27 April 2015).

40.

US Food and Drug Administration. FDA regulations relating to good clinical practice and clinical trials, http://www.fda.gov/ScienceResearch/SpecialTopics/RunningClinicalTrials/ucm155713.htm (2015, accessed 16 June 2015).

41.

104th Congress. Health Insurance Portability and Accountability Act of 1996, http://www.hhs.gov/ocr/privacy/hipaa/administrative/statute/hipaastatutepdf.pdf (accessed 18 December 2013).

42.

Armitage

Souhami

Friedman

. The impact of privacy and confidentiality laws on the conduct of clinical trials. Clin Trials 2008; 5: 70–74.

43.

Department of Health and Human Services. Final privacy rule preamble. Part 160-subpart A—general provisions, http://aspe.hhs.gov/admnsimp/final/PvcPre02.htm (accessed 17 January 2015).

44.

US Department of Health & Human Services. Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) privacy rule, http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/De-identification/guidance.html (accessed 11 December 2014).

45.

McGraw

Building public trust in uses of Health Insurance Portability and Accountability Act de-identified data. J Am Med Inform Assoc 2013; 20: 29–34.

46.

Dunlop

Graham

Leroy

. The impact of HIPAA authorization on willingness to participate in clinical research. Ann Epidemiol 2007; 17: 899–905.

47.

O’Herrin

Fost

Kudsk

KA.

Health Insurance Portability Accountability Act (HIPAA) regulations: effect on medical record research. Ann Surg 2004; 239: 772–776; discussion 776–778.

48.

Goldstein

Pewen

WF.

The HIPAA Omnibus Rule: implications for public health policy and practice. Public Health Rep 2013; 128: 554–558.

49.

Department of Health and Human Services. Human subjects research protections: enhancing protections for research subjects and reducing burden, delay, and ambiguity for investigators. Fed Regist 2011; 76: 44512–44531.

50.

PCORI Methodology Committee. PCORI methodology standards, http://www.pcori.org/assets/PCORI-Methodology-Standards1.pdf (2012, accessed 8 October 2013).

51.

NIH Collaboratory. Stakeholder engagement webpage, https://www.nihcollaboratory.org/cores/Pages/stakeholder-engagement.aspx (accessed 28 April 2015).

52.

Goldstein

Rein

. Consumer consent options for electronic health information exchange: policy considerations and analysis, https://www.healthit.gov/sites/default/files/privacy-security/choice-model-final032610.pdf. (2010, accessed 21 July 2015).

53.

Coronado

Burdick

Petrik

. Using an automated data-driven, EHR-embedded program for mailing FIT kits: lessons from the STOP CRC pilot study. J Gen Pract 2014; 2: 1000141.

54.

Coronado

Vollmer

Petrik

. Strategies and opportunities to STOP Colon Cancer in Priority Populations: design of a cluster-randomized pragmatic trial. Contemp Clin Trials 2014; 38: 344–349.

55.

NIH Health Care Systems Research Collaboratory Website. Time to reduce mortality in end-stage renal disease (TiME), https://www.nihcollaboratory.org/demonstration-projects/Pages/TiME.aspx (2013, accessed 21 July 2015).