1 Norris Cotton Cancer Center/Dartmouth-Hitchcock Medical Center/Department of Community and Family Medicine, Dartmouth Medical School, Hanover/Lebanon, NH.
2 Office of Health Promotion Research, University of Vermont, College of Medicine, Burlington, VT.
3 Orr and Reno, Professional Association, Concord, NH.
4 Center for Health Studies, Group Health Cooperative of Puget Sound, Seattle, WA.
5 Office of Sponsored Programs, University of Vermont, Burlington, VT.
6 Department of Epidemiology and Biostatistics, University of California, San Francisco, CA.
7 Department of Radiology, University of North Carolina at Chapel Hill, Chapel Hill, NC.
8 Fred Hutchinson Cancer Research Center, Seattle, WA.
9 Department of Preventive Medicine, University of Iowa College of Medicine, Iowa City, IA.
10 Department of Radiology, University of New Mexico, Albuquerque, NM.
11 Cancer Prevention and Control Program, Colorado Department of Public Health and Environment, Denver, CO.
12 General Counsel, University of Vermont, Burlington, VT.
13 Applied Research Branch, Cancer Control Program, National Cancer Institute, Bethesda, MD.
![]() |
ABSTRACT |
---|
confidentiality; liability; legal; privacy
Abbreviations: IRB, institutional review board; NCI, National Cancer Institute; QA, quality assurance.
![]() |
INTRODUCTION |
---|
The current literature on confidentiality lacks an outline of approaches to address relevant medicolegal issues for large computerized databases to which professional providers either knowingly or unknowingly have submitted information. We outline the approaches investigators should take to address data security and confidentiality for all research participants. This analysis is based on work conducted in eight states by investigators from seven academic research institutions, one health maintenance organization, and one state public health department. We analyzed federal and state laws as well as institutional policies intended to protect data from forced disclosure or use in litigation. We summarize the application of federal and state laws; describe essential steps for appropriate data collection, storage, utilization, and sharing; and offer confidentiality and security guidelines for data transfers from member sites to a central data depository. Our intention is to provide a clear framework for locally developed systems to protect the confidentiality of all research participants and ensure the integrity of data involved in confidential and sensitive medical research. It is critical that researchers carefully balance data use for the good of the public with a respect for the privacy and anonymity of all individuals involved.
![]() |
BACKGROUND |
---|
Soon after the Consortium was formed, a working group of representatives from each site obtained copies of federal and state laws that create a privilege against disclosure in litigation and of institutional regulations that address confidentiality of data generally. Our analysis of these materials revealed remarkable variability in how states address confidentiality issues. On the basis of our findings, we outline a recommended approach that investigators participating in large, multisite research programs may take in applying a minimum set of standards for the protection of all research subjects and health care providers and the data they contribute. In presenting this information, we will address definitions of confidentiality, the responsibilities of member sites, state and federal protections, data access, and paper and computer data security.
![]() |
DEFINITIONS OF CONFIDENTIAL INFORMATION |
---|
|
![]() |
RESPONSIBILITIES OF MEMBER SITES |
---|
Adherence to applicable laws and regulations necessarily requires familiarity with the types of protections offered by federal and state governments and institutions. Table 2 outlines these types of protections, each of which is discussed more expansively in the next section. Table 3 outlines the types of protection available for each of the eight Breast Cancer Surveillance Consortium member sites.
|
|
![]() |
FEDERAL AND STATE LAWS AND REGULATIONS |
---|
![]() |
Federal Certificates of Confidentiality |
---|
A decision to obtain a Federal Certificate of Confidentiality should be based on the potential risk of loss of confidentiality and a legal analysis of the level of protection offered by state statutes, which, as mentioned, is quite variable. The coverage afforded by the Certificates provides an important layer of uniform federal protection in addition to the variable protection offered at the state level and allows for protection of confidentiality of data crossing state lines, which is critical for sending data electronically (or otherwise) across state lines.
It is not necessary for research to be federally funded to be eligible for a Certificate of Confidentiality. However, Certificates are available only for research of a sensitive nature, such as research relating to sexual attitudes, preferences, or practices; use of alcohol, drugs, or other addictive products; illegal conduct; a situation that could, if released, be reasonably damaging to an individual's financial standing, employability, or reputation within the community; matters that would normally be included in a patient's record, disclosure of which could lead to social stigmatization or discrimination; or an individual's psychologic well-being or mental health (13). Additionally, applicants for a Certificate of Confidentiality must show that they will be engaging in a systematic study "directed toward new or fuller knowledge and understanding of the subject studied" (13
, p. 729). Institutional Review Board (IRB) approval is required before an application for the Certificate is submitted. To cover professional participants, evidence of their status as research subjects must be provided, and the consequences of a breach of confidentiality must be specifically outlined. Information about the Certificate and application requirements can be obtained from either the NCI or the National Institute of Mental Health.
![]() |
State confidentiality laws |
---|
Category 1. Medical research statutes.
Not all states have medical research statutes. In those that do, the adequacy of protection afforded depends upon several factors. We are unaware of any statute that specifically authorizes confidentiality protection for providers who are research subjects by virtue of reports or outcome data provided to the study, although in some states, statutory language may be expansively interpreted to provide that protection. Otherwise, the factors include whether confidentiality protection is needed for professional participants, whether the jurisdiction in which the research is conducted permits disclosure of information that identifies the participant as necessary to "further a study," and how personally identifying information is defined. Some statutes also prohibit redisclosure of information, while others are silent on this subject.
Category 2. Registry statutes.
Some states have created programs for reporting incidences of disease to state registries. For research conducted pursuant to a state-authorized registry program, fairly strong confidentiality protection may be afforded by the applicable statute. These statutes often authorize disclosure of information collected by the registry to researchers, and researchers who work with such information may be entitled to confidentiality protection by the statute. Obviously, however, such laws are useful only for protecting the confidentiality of data collected in connection with a statutorily referenced registry.
Category 3. Peer-review or quality-assurance (QA) statutes.
QA statutes and the scope of protection they afford differ widely from state to state. Although many researchers assume that QA statutes provide solid confidentiality protection, in fact, they often apply only to data collected in very specific ways and for narrowly focused purposes. It may actually be possible to inadvertently waive the QA protection by using information collected for purposes that fall outside those authorized by the statute. Courts will likely find that QA statutes do not apply to protect the confidentiality of data if the following exist:
In summary and contrary to common perception, peer review or QA statutes may not confer substantial protection from discovery (15). The value of QA statutes in protecting the confidentiality of research databases is highly dependent upon how information is handled, by whom it is handled, and whether a legal precedent exists.
Category 4. Physician-patient privilege laws.
Most states, if not all, have laws that establish an evidentiary privilege for communications between a physician and a patient about the patient's care. When the privilege applies, it prevents use of such communications in litigation. However, there are many exceptions to the privilege in most states. It is important to note that the privilege is generally said to "belong to the patient," meaning that only the patient (and not the provider) can claim it. As a result, the patient is free to authorize disclosure of the otherwise protected information to whomever he or she chooses. Because waiver of the privilege for one purpose may be held to constitute a waiver for other purposes, it is possible for patients to unwittingly authorize much broader disclosure than intended. The privilege may also be subject to statutory exceptions. Many states provide that it is inapplicable in proceedings before professional conduct committees. In sum, the privilege does not afford any protection to professional subjects of research, and the protection it gives patients may be quite limited.
Category 5. Other laws generally applicable to the confidentiality of medical records.
Many states have adopted a Patient's Bill of Rights. These laws usually state that patients have the right to expect that communications and records pertaining to their care will be treated as confidential and not disclosed without their authorization. Privacy rights existing in the state and federal constitutions may also protect against disclosure of medical records in some instances. While these sources do not provide distinct protection for records collected by medical researchers, they may help bolster claims that medical information gathered by researchers is confidential. Because these laws change frequently, close surveillance is necessary by investigators who hope to access medical records for research purposes.
In addition to ensuring that the data are protected from legal discovery, researchers must be vigilant in protecting data from any use that might bring harm to the participants. This vigilance includes the establishment of both rules to prevent the misuse of data and systems to physically protect the data. These protections are discussed next.
![]() |
POLICIES AND PROCEDURES FOR HANDLING DATA |
---|
At member sites, investigators or public health officials may request access to confidential or aggregate data. All such persons given access to data should read the confidentiality policy and procedures manual and sign an agreement to adhere to the same confidentiality standards practiced by the site's staff members.
Confidential data should not be transmitted from sites by any means (mail, telephone, electronic mail, or facsimile) without explicit authority from the Principal Investigator or a staff member to whom such authority has been delegated. The specific types of data, such as variables and date range, and those to whom they would be transmitted must be clearly communicated in writing to the staff. Because researchers often contract with computer programmers, biostatisticians, or contractors and consultants who have access to restricted information, these individuals should read the confidentiality policy and procedures manual and sign a confidentiality agreement with assurances that they will safeguard such information from unauthorized access or further disclosure. Confidential data should not be available to businesses or industries that desire to market a product or service to patients, health care providers or employees for advertising or recruitment of new patients, or insurance companies that are attempting to determine the status of individuals for any reason.
All external requests for data to be used in research should be approved by respective IRBs before submission of the request to the member site. All requests should be made in writing, preferably on a formal data request form, and should clearly state the limits of data use. Data may be used only for the exact purpose for which they are requested, must be kept confidential, and must remain in the custody of the fewest individuals possible. Applicants should specify the exact time period during which they will require access to data and should agree to provide a copy of any proposed publication or other form of public disclosure to member sites at least 30 days before release. This period will ensure adequate time to review, comment, or decide to reanalyze and provide a response or alternate explanation, if necessary.
All requests should be approved by the Principal Investigator or an advisory body, such as a steering committee made up of community physicians and members of the site's research team. If an advisory committee is used, a description of how the committee members are chosen or elected, their length of term, and the procedures used to approve a request should be outlined, including voting criteria (majority, unanimous, quorum), time limits for responding to requests for approval, and notification and documentation requirements.
Requests requiring the use of personal identifiers should explain the necessary precautions to be taken to provide confidentiality in accordance with procedures approved by the project's IRB, such as reporting patient, practitioner, and practice site data in sufficient aggregate to minimize the risk of identifying individuals or individual practices. When data analyses are complete, data should either be destroyed or, if needed for later reference, maintained in locked storage in the custody of an applicant for a specified period until they are no longer needed. If a central data repository is used for pooled analyses, this repository should abide by the same standards of confidentiality as all member sites. In addition, a review process for requests of pooled data should be developed.
![]() |
DATA SECURITY |
---|
A site-developed mail-tracking system should be used to protect confidential data. The physical security of confidential data stored on paper documents, computer printouts, microfiche, and other media forms from member sites should be ensured. Confidential documents to be destroyed should be kept in a secure environment until they are shredded and disposed of properly.
If member sites produce QA reports for practitioners or other facilities at designated intervals, those receiving the reports should be informed about appropriate and inappropriate methods of handling them and should comply with applicable QA statutes. While legal protection from discovery is necessary to ensure that no harm comes to those contributing data to a database, the same individuals have an equal responsibility to protect the confidentiality of data they receive from member sites.
QA reports may contain identifying information about providers or patients. Any report that contains identifiable information must be treated as confidentially as any medical record. Encrypted codes may be generated when appropriate each time a report is created to protect the identity of a receiving practice location or radiologist. These codes should never link participant identifiers to actual study data. To provide extra protection when preparing report mailings, a two-step process may be used. Here, two individuals are responsible for report handling within a site, with one kept blind to the encrypted code and having access to the database for report production while the other, who applies the encrypted code for processing and ultimate mailing, is kept blind to the report content. Practitioner or patient data should be reported only in aggregate sufficient to minimize the risk of identifying individuals or individual practice groups. Thus, any cells that have a small number of cases (which may identify an individual or a practice location) should be suppressed in those reports. The purpose of the reports should be clearly printed on them or on accompanying information.
Computer systems
Computers should be located in a locked facility with no access to public traffic. Computer security safeguards are outlined below.
![]() |
DISCUSSION |
---|
Although state QA laws can both prevent the release of individual-level information and protect data from use in litigation (1719
), care must be taken to comply with these laws and protection may be threatened by misuse of data (20
, 21
). Institutions and individual practitioners have relied on the QA or peer-review statutes in their respective states to confer protection from discovery for a variety of review and clinical improvement activities. In many instances, the protection, in fact, never existed, due to the manner in which information was gathered and processed and the results were distributed. To maintain protection, sites must gather and handle the information in a manner specified by the applicable state statute. It may not be possible to bring multifacility or multistate research projects into compliance with the QA laws; thus, it may be necessary to look for other sources of protection, such as a Certificate of Confidentiality.
Most states have laws that provide varying degrees of confidentiality protection to different kinds of medical records. However, the differences in the applicability of these laws can be significant. This issue is becoming increasingly controversial (21, 22
), as the public has become more aware of occurrences of medical record misuse, including sales of medical records and release of medical information to federal program auditors and mortgage holders (20
). National legislative activity has increased significantly in this area. On the national level, a comprehensive federal policy on confidentiality of medical records can be expected in the year 2000. The United States Congress has considered at least two recent legislative proposals that deal directly with attempts to ensure privacy of identifiable health information, such as the medical record (20
). Issues concerning informed consent, disclosure, and physical security, as well as who would be the oversight body, are under consideration.
It is important for the public to understand and recognize the difference between utilizing medical information for the good of the public, such as is done in medical research, and medical record misuse that occurs outside the protection of the federal and state regulations discussed in this paper. For research studies to gain the participation needed by the public, the confidentiality of research data must be honored and protected. Otherwise, it will be impossible to conduct research such as that being done by our Consortium. It is equally important for researchers who intend to collect data for research purposes to rely on current laws and to monitor pending legislation that may affect their ability to conduct their research. The strongest legal mechanism of protection that currently exists is the Federal Certificate of Confidentiality. Its strength lies in the geographic coverage it affords, the relative paucity of exceptions to its coverage, and the legal precedent that already exists regarding its use to protect the confidentiality of research subjects. Notwithstanding this valuable mechanism, researchers should be familiar with the specific confidentiality and privacy protections that may exist within their own jurisdictions and apply them when appropriate. To maximize protection, researchers should obtain a Certificate of Confidentiality; research legal precedents in their state and take advantage of the protection available; and institute measures to minimize the chance of unauthorized or inadvertent disclosure of confidential information in databases, data reports, and research information. Through these actions, researchers can fulfill their ethical and legal obligations by protecting confidential information to the maximum extent possible under existing law, while continuing their research.
![]() |
NOTES |
---|
![]() |
REFERENCES |
---|