AVR

1
How Is Your Privacy Protected in Research?
2
November 15, 2007 University Health Network,
Toronto LMP1520 Course
Ethical principles Patient consent, chart
reviews, tissue procurement
Ronald J. Heslegrave, Ph.D., Chair, Research
Ethics Board UNIVERSITY HEALTH NETWORK
3
Overview of Presentation

• Origins of Human Research Ethics
• Current Requirements for the Protection of
  Patient and their Privacy and Confidentiality
• Ontarios Privacy Legislation (PHIPA)
• Case Studies to Illustrate Emerging Issues
• Class Participation through QA

4
Brief History of the Protection of Research
Subjects

• One of the first pieces of legislation to protect
  a species from cruelty came in 1822 in the UK
  with the introduction of legislation to protect
  animals from cruelty
• By 1876 the UK had enacted the protection for
  animals used in experimentation under provisions
  of the Cruelty to Animals Act based on the work
  by the Society for the Prevention of Cruelty to
  Animals
• It was for more than another 70 years that such a
  code was put into place for human subjects in
  research

5
Brief History of the Protection of Research
Subjects

• Not until 1947 did the Nuremberg Code offer
  protection to human subjects under the section of
  "Permissible Medical Experiments"

• Privacy Issues came much later

6
Nuremberg Code Principles

• Voluntary consent is absolutely essential
  (relevant to Privacy)
• Duty and responsibility for quality control rests
  upon each investigator (relevant to Privacy)
• The experiment should yield fruitful results
  (relevant to Privacy)
• The experiment should be so conducted as to avoid
  all unnecessary physical and mental suffering and
  terminated immediately if such conditions become
  known
• No experiment should be conducted where there is
  an a priori reason to believe that death or
  disabling injury will occur except, perhaps, in
  those experiments where the experimental
  physicians also serve as subjects

7
Modern Codes of Ethics continue to enshrine these
and other related principles as the underpinnings
of medical and social research
Since 1997 in Canada, the Tri-Council Policy
Statement serves as the Canadian Guideline for
the Ethical Conduct of Human Research
8
Six taken ill after drug trials
9
Integrated Human Subjects Protection Environment
Policy
REB
Legislation
Sponsors
Patients
Investigators
Clinical Care
10
Research Ethics Board Function

• Protect the safety of patients
• Ensure the autonomy of patients
• Goal is to inspire public confidence in
  biomedical research so that findings are accepted
  and the public will actively participate in the
  research enterprise
• Protect the investigator
• Protect the institution
• And Protect the Sponsor

11
REBs Balance Competing Interests

• Balance individual rights against societal needs
• Balance unknown risks against potential benefit
• Balance competing interests from researchers
• Balance industry interests and the need for
  improved therapies
• Balance the need for Consent against a waiver of
  Consent

12
Legislated Need for a Research Ethics Board

• ICH Good Clinical Practice (GCP)
• Department of Health and Human Services (DHHS)
  and FDA laws and requirements (US)
• Tri-Council Policy Statement (Canadian National
  Code - 1997)
• Health Canada Regulations for Clinical Trials
  (2001)
• PHIPA (Ontario Privacy Legislation - 2004)

13
Is it always easy for REBs to balance these
competing interests?
14
Not really
15
REB Chair and Henchmen
16
Confrontational REB Process
17
SOME RESEARCHERS HAVE DIFFERENT VIEWS ON HOW TO
HANDLE SUCH POTENTIAL CONFRONTATION
18
(No Transcript)
19
Reasonable Dialogue between Investigator
(Sponsor, Regulator) and REB
20
Current Model of REB Operation
21
Current Institutional Model for Protecting Human
Subjects in Investigational Studies
Sponsor Develops Protocol and Identifies
Investigators
Institutional REBs (Dozens)
Health Canada
Approval
Serious Adverse Events
Protocol Amendments
New Information
22
OCREB Model for Protecting Human Subjects in
Investigational Studies
Sponsor Develops Protocol and Identifies
Investigators
OCREB (13-20 Ontario Sites)
Health Canada
Approval
Serious Adverse Events
Protocol Amendments
New Information
OCREB - Integrated Review of SAEs,
Amendments and New Information - More rapid
distribution and action to affiliated Sites
23
New Model for Protecting Human Subjects in
Investigation Studies
Investigator/Sponsor Develops Protocol
Institutional REBs (Dozens)
Health Canada
Pandemic REB
Approval
Serious Adverse Events
Protocol Amendments
New Information
Pandemic DMSB
24
Current Legislation and Guidelines that Apply to
Privacy in Research

• ICH Good Clinical Practice (GCP)
• Department of Health and Human Services (DHHS)
  and FDA laws and requirements (US)
• Tri-Council Policy on Privacy and Confidentiality
  (Canadian National Code)
• PIPEDA (Canadian Federal Privacy Legislation)
• Bill 31 - PHIPA (Ontario Privacy Legislation)

25
T R I -C O U N C I L P O L I C Y S T A T E M E
N TEthical Conduct for Research Involving Humans
Medical Research Council of Canada Natural
Sciences and Engineering Research Council of
Canada Social Sciences and Humanities Research
Council of Canada
26
T R I -C O U N C I L P O L I C Y S T A T E M E N
T Ethical Conduct for Research Involving Humans
Section 3 Privacy and Confidentiality
Medical Research Council of Canada Natural
Sciences and Engineering Research Council of
Canada Social Sciences and Humanities Research
Council of Canada
27
Relationship of trust

• When a research subject confides personal
  information to a researcher, the researcher has a
  duty not to share the information with others
  without the subjects free and informed consent

28
Human Dignity

• Dignity and autonomy of human subjects is the
  ethical basis of respect for the privacy of
  research subjects
• Privacy is perceived to be an essential means of
  protecting and promoting human dignity

29
Conflict of Social Values

• Use of confidential information has contributed
  to more responsive and efficient service delivery
  in areas such as health, safety, and the
  environment.
• There is always a potential for conflict between
  the subjects good and the common good.
• Ethics review is an important process for
  addressing this conflict of societal values.

30
Whats left

• Legislative context
• PHIPA in Brief
• Case Studies
• Questions Discussion

31
PIPEDA

• Federal legislation Industry Canada Federal
  Privacy Commissioner of Canada
• Staged implementation
• Private sector confidence in e-commerce
• CSA Model Code for the Protection of Personal
  Information
• Establishes rules to govern the c/u/d of
  personal information by organizations in the
  course of commercial activities
• Came into effect in Ontario Jan 1 2004

32
PIPEDA - Fair Information Practices

• Accountability
• Identifying Purposes
• Consent
• Limit Collection
• Limit Use and Disclosure and Retention

• Accuracy
• Safeguards
• Openness
• Individual Access
• Challenge Compliance

33
PIPEDA - Research

• Exemptions ss. 7(2)(c) and 7(3)(f)
• If it is scholarly research AND
• If it is impractical to obtain consent AND
• If the Privacy Commissioner of Canada is
  informed prior to the use or disclosure of the
  information
• Is this reasonable and practical?
• How does one deal with commercialization?

34
PHIPA

• Based on CSA Model Code
• Tailored to the Health Care Sector
• Incorporates Rules for Research in the
  Legislation
• Proclaimed in November 1, 2004
• Deemed Substantially Similar to PIPEDA by the
  Governor General in Council on November 28, 2005

35
General Provisions of PHIPA

• Mandatory notification of patients when
  information is lost, stolen or accessed
  inappropriately
• Requirements for research REB structure,
  process and research plan requirements
• Oversight body Privacy Commissioner may
  investigate complaints and levy fines if
  appropriate
• Provisions for health care fundraising activities
  that allows patients the right to opt-out
• Lockbox provision Gives patients the right to
  limit disclosure of PHI for care
• Access Correction rights for patients

36
PHIPA Key Terms

• Personal health information
• Information about an individual that
• Relates to physical or mental health providing
  health care organ or tissue donation payments
  or eligibility for health care services
• Is a plan of service, or health number
• Identifies a substitute decision maker of the
  individual
• Is in a record where any of the above is
  contained
• information that identifies an individual or for
  which it is reasonably foreseeable in the
  circumstances that it could be utilized, either
  alone or with other information, to identify an
  individual
• Genes, Proteins, Pharmacogenomics, Proteomics,
  Biomarkers, Micro-array technology

37
Definitions

• Personal Health Care Information
• information that relates to the donation by the
  individual of any body part or bodily substance
  of the individual or is derived from the testing
  or examination of any body part or bodily
  substance
• GENES, PROTEINS, BIOMARKERS

38
PHIPA Key Terms

• Personal health information
• Information about an individual that
• Relates to physical or mental health providing
  health care organ or tissue donation payments
  or eligibility for health care services
• Is a plan of service, or health number
• Identifies a substitute decision maker of the
  individual
• Is in a record where any of the above is
  contained

• Names
• Location Reference smaller than province (i.e.
  postal code if less than 20,000)
• DOB (age okay if not over 90)
• Telephone/Fax Numbers
• SIN / MRN / OHIP / Insurance
• Identifying Characteristics / Codes

39
PHIPA Key Terms

• Health Information Custodians (HIC)
• Organizations whose primary purpose is the
  provision of health care
• Agent
• A person that acts for the HIC and not the
  agents own purposes, whether or not the agent is
  employed by the HIC and whether or not the agent
  is being paid
• Use Disclosure
• Internal (within HIC) - External (outside
  HIC)

40
Definitions

• Research
• a systematic investigation designed to develop or
  establish principles, facts or generalizable
  knowledge, or any combination of them, and
  includes the development, testing and evaluation
  of research
• Researcher
• means a person who conducts research

41
(No Transcript)
42
PHIPA Research

• REB must approve all use/disclosure of personal
  health information used for research purposes
• In review, REB must consider whether
• The research can be reasonably accomplished
  without the information
• There is public interest in conducting the
  research
• Obtaining consent directly is impracticable
• Adequate safeguards are in place to protect the
  privacy of individuals and confidentiality of
  their information

43
PHIPA Research

• When conducting research under the approved
  research plan, you must follow the research
  duties that are listed in the Act protocol.
• Before disclosing the information to a
  researcher, UHN must enter into a written
  agreement with the researcher to protect the
  information
• UHN must also receive from the researcher
• a written application,
• a written research plan and
• a copy of the research ethics boards approval of
  the research plan

44
Research Plan must include

• A description of the research to be conducted and
  the duration of the research
• What personal health information will be
  collected and from what potential sources?
• How the personal health information be used?
• How will information be safeguarded?
• Who will have access?
• What makes express consent impractical?
• And other specifics

45
Upcoming Changes from TAHSN

• New additions to application form to better
  assess and track
• What PHI is collected through duration of the
  project
• Who will have access to PHI
• How PHI will be stored and protected
• TAHSN Guidelines for Protecting PHI in Research

46
Case Studies for Discussion
47
Is this Research?

• Doctor is a surgeon who specializes in
  performing spinal fusion employing special
  technique
• Doctor hires student to review charts of her
  patients over the last 5 years to determine rates
  of infection
• Doctor also asks student to perform a literature
  search to determine average rates of infection
  for patients who underwent spinal fusion by
  traditional techniques
• Doctor asks student to organize data gleaned from
  charts by age, gender, ethnicity, family history
  etc.
• Doctor asks student to contact former patients
  who suffered post-surgical infection to determine
  if any residual problems related to infection

48
When is REB Approval Required when Identifying
Study Subjects?

• Investigator wishes to examine genetic cause
  behind early onset variety of chronic
  condition
• Investigator speaks with a physician who
  specializes in the condition to determine how
  many patients she sees
• Investigator asks to put posters up in that
  physicians office soliciting interest in
  participation
• Investigator asks same physician for a list of
  names of patients with the condition and those
  patients contact information.

49
When is REB Approval Required when Identifying
Study Subjects?

• Investigator wishes to examine genetic cause
  behind early onset variety of chronic
  condition
• Investigator is a family physician who wishes to
  search electronic records of own patients to
  identify potential subjects
• Investigator searches hospital electronic patient
  records to determine if sufficient numbers of
  patients within study parameters to form adequate
  study sample
• Investigator wants to review paper charts of
  patients she is already aware of has the
  condition to determine if these patients suffer
  from early onset variety.

50
When is REB Approval and/or Patient Consent
Required when Dealing with Databases?

• Physician wants to collect information on
  patients who suffer from certain disease
• Same physician wants to follow-up with patients
  over a three year period to track progress and
  input into database
• Nursing staff want to track readmission rates
  using database of information
• Same staff want to publish article detailing how
  certain initiatives decreased risk of readmission
• Clinician wants to start specimen bank
• Same clinician wants to link specimen bank with
  database of potential study participants

51
Clinical Trials what do you do when ?

• Clinical trial sponsor wants access to study
  participant information that is organized by OHIP
  Numbers only (no names)
• Clinical trial sponsor wants you to store study
  information on sponsor owned laptop
• Notebook of study participant blood types lost or
  stolen
• Clinical Trial Monitor wants access to Misys

52
Privacy Breaches Incidents

• If you become aware of a privacy breach (i.e.
  Personal Health Information is lost or stolen)
  take immediate action to limit the damage
• The hospital must notify the patient when their
  Personal Health Information is lost, stolen or
  inappropriately accessed

• Inform your supervisor, Privacy Office REB.
• Use the new eForm
• Identify the extent of the breach.
• What was the information?
• Where did it go?
• What patient did it relate to?
• Take steps to contain the breach.

53
Safeguarding Patient Information

• Wear ID badges at all times
• Protect your User ID Password
• Do not leave records unattended - especially in
  public areas
• Dont take identifiable information off-site
  (paper or electronic)
• Lock cabinets and secure removable devices such
  as laptops
• Question unescorted strangers or call security
• Dont save patient information on the hard drive
• If you lose it report it
• Use shredders to dispose of patient identifiers
• Do not send PHI externally through e-mail

54
Interested in hearing more?

• UHN Privacy An Overview
• 10-15 minute overview of the key points everyone
  needs to know about the privacy policies at UHN
• UHN Privacy PHIPA In-Depth
•  45-50 minutes in-depth discussion of your role
  and responsibilities under PHIPA