BiodNa N- YoLll No.1

ORIGINAL ARTICLE

3

Privacy Protection & Medical Research ­Ethical & Legal Issues in Public Health

MARGARET J. lANE J.D.u.s. Fulbript sc:1lolar and legal resean:her at the Law Reform Commillioa of Victoria aDd the MODUli UDivenity Centrefor HUmaD Bioet1lic:a

INTRODUCTIONThe Privacy Commissioner approved final guidelines (the 'Guidelines') on

June 30, 1991 for the protection of privacy in medical research.' The Guidelinesconstitute a unique legal compromise, allowing medical research which wouldotherwise violate the Privacy Act 1988 (Cth) to proceed if certain conditions are met.This article will first examine the ethical and legal bases for privacy protection and askwhether the Guidelines can be supported on these grounds. It will then consider theimplications of the Guidelines for IECs and for public health research. The article willargue that while the Guidelines have ethical and legal support, their practical/publichealth implications also need 10 be addressed. Finally, it will propose that other legaloptions for privacy protection in medical research should be explored, as should publiceducation of the benefits and methodology of medical research and of our ethicalobligations in the area of privacyprotection.

I. ETIlICAL BASIS FOR PRIVACY PROTECTIONHow do we define privacy and why should we protect it?

The Australian Law Reform Commission (the 'ALRC') , in its lengthy 1983report on Privacy, noted that privacywas an 'elusive concept' and that attitudes towardit varied among people and across cultures," Philosophers have associated privacyclosely with the concepts of individual freedom and autonomy. Autonomy is associatedwith self-determination and freedom from coercion, as reflected in J.S. Mill's maximthat no one may legitimately be coerced into doing or refraining from doingsomething, except when it harms others.' Choosing and acting autonomously alsoexpresses the Aristotelian principle of personal integrity. Respecting a person's privacyhence shows respect for their autonomy and integrity.

People's need for privacy protection can be defended by the potential forinjustice if personal information is accessed and used unfairly. There are times,however, when there is a conflict between individual privacy and a broader 'socialjustice' that cannot be resolved. For example, doctors are required by law to reportcertain infectious diseases to health authorities. This is a violation of patients' privacywhere the value of personal autonomy is overriden to serve the interests of a greaternumber of people.

The nondisclosure of private information about patients underlies theprinciple of confidentiality. It supports the belief that assurance of confidentialityencourages people to seek medical advice and treatment without risking public

4

knowledge of their condition. The introduction of high-tech medicine and increasedpublic acceptance of the need for wide distribution of health information has,however, weakened patients' expectations of strict confidentiality and raised newconcerns over privacy,"

Privacy may perhaps be seen as important to achieve autonomy and as one ofthe interests protected by confidentiality. Privacy therefore has a value independent ofautonomy that can be justified on separate grounds.

Medical research: public benefits, conmct with privacy, and public sentimentIt has been argued that since the community readily accepts the benefits of

medical research, it should also be prepared to accept that degree of loss of privacynecessitated by disclosure of medical records for research purposes.S Medical researchhas facilitated the monitoring of diseases in communities, identification ofenvironmental problems and establishment of public health programs and hasanswered many specific questions about factors causing heart disease, birth defects,and cancer,"

Many research designs are based on the use of medical records. In otherinstances it is simply less costly and more efficient to use records to do medicalresearch. Medical researchers have stated why nonconsent and identifying informationof subjects is often a requisite for reputable scientific studies.' For example, patientnames on medical records may be necessary because of the need for 'linkage' betweendifferent sources of patient information.

There is little evidence that the community sees invasion of privacy by medicalresearchers as a substantial issue. In a recent study in Victoria, approximately 400people were contacted and asked whether they would object to their medical recordsbeing used for research without their consent. A total of 350 responded that theywould not object; half of this group gave unqualified agreement and half approvedunder certain conditions, of which guarantee of confidentiality was the main one ,"

Privacy concerns are also raised when researchers contact individuals who arenot currently seeking medical care. In a 1989 National Heart Foundation study offactors causing heart disease, 1500 people were contacted by letter in Victoria and11,400 nationally, inviting them to attend a screening center in order to obtaininformation on their health. Researchers reported they could recall only one subjectcomplaint in relation to privacy concerns," In a 1991 study of recruitment strategies inencouraging cervical cancer screening, a letter campaign was conducted invitingwomen to call the Anti-Cancer Council on a toll-free line for further informationabout local services. No privacy complaints were received from the four thousandwomen contacted by letter, and the twelve calls received related only to generalinquiries.10

By contrast, there has been much public criticism of the manipulation ofcomputerised data held by banks and government agencies. The ALRC stated in itsreport that nearly 60% of Australians expressed concern about threats to theirpersonal privacy; 64% believe that there should be laws to protect personal privacyand 87% agreed that persons should have access to information about themselves heldby others. 11

Biodhict N-. VaLlI No.1 5

D. LEGAL MODELS FOR PRIVACY PROTECfION

The lack of consistent public opinion in relation to privacy matters is reflectedin the lack of a clear legal - and ethically sound - solution to privacy protection inmedical research. Legal controls on medical confidentiality include the common law,legislation at federal and state levels, and regulations issued by statutory bodies.Administrative and professional guidelines also act as controls. There is no generalright to privacy recognised in Australia. Courts have made rulings in the area ofconfidentiality, based more narrowly on the existence of a professional andconfidential relationship between doctor and patient. The common law exceptions tothe doctrine of confidentiality do not recognise an exception for disclosure in theinterest of medical research.

A recent legal solution to privacy protection is the Privacy Act which appliesto the collection of personal information by Commonwealth Agencies and thedisclosure of personal information held by such Agencies. Such collection anddisclosure activities for research purposes may be banned under the InformationPrivacy Principles (IPPS) set out in the Act where consent of the individualsconcerned is not obtained.

State legislation in New South Wales, Queensland, and South Australiaauthorises disclosure of medical information about individuals for research 'into thecauses of morbidity and mortality', and requires approval by a governor or minister."Legislation in Victoria is broader in its scope, allowing disclosure for the purposes ofsocial as well as medical research and setting up approval by an Institutional EthicsCommittee." Western Australia is currently considering legislation similar to theVictorian model." The Privacy Act (Cth) generally favours the public interest inprivacy while state legislation, with the exception of the more balanced approach inVictoria, favours state interests in public health research.

Other controls on medical confidentiality include government guidelines,institutional guidelines and national and international professional codes. Governmentand institutional guidelines include those of the National Health and MedicalResearch Council (the NHMRC) and guidelines issued by hospitals or universityethics committees. The NHMRC's 1985 Statement on Ethics in EpidemiologicalResearch was adopted as Supplementary Note 6 (the 'Supplementary Note,)lS to theNHMRC's Statement on Human Experimentation." It recommends that allepidemiological research be conducted according to written protocols, when it isappropriate for an ethics committee to approve disclosure of information withoutconsent, and that the confidentiality of records used must be at least as secure as itwas in the sources from which the records were obtained. The focus of the NHMRCStatement is on the individual interests of the subjects involved in the research, whilethe Supplementary Note emphasises the public benefits of epidemiological research.

The numerous professional codes applying to medical research include theAustralian Medical Association Code of Ethics", the Declaration of Geneva" (themodem equivalent of the Hippocratic Oath) and the International Code of MedicalEthics19

• Such codes require health professionals to maintain confidentiality ofpersonal patient information. Administrative and professional standards generallyallow broader discretion than legal controls in relation to disclosure of medicalrecords for the purpose of medical research.

6

These protections against privacy intrusions all admit limits in the context ofmedical research. Yet the extent to which they recognise exceptions to privacyprotection varies widely, as does their focus on individual and public interests inprivacy, confidentiality and medical research." The Guidelines attempt to combinesome of these legal and administrative approaches. They give careful consideration tothe process of weighing the relevant ethical interests. The Guidelines are legallyenforceable like the common law/statutory provisions but also allow discretion in thejudgment of the professionals who sit on IECs. However, they raise other issues forIECs and researchers which may have serious implications for public health researchin Australia.

m. DISCUSSION OF THE NEW PRIVACY GUIDELINESSection 91 of the Privacy Act provides that an act violating an IPP will not be

regarded as breaching that IPP if it meets the criteria in the Guidelines. The finalGuidelines are very specific in their application. They are limited to medical researchinvolving data from government agencies. The Guidelines are balanced betweenindividual and public interests in privacy and the public interest in medical research.Their weakness is in their practical application in light of the current practices andresources of IECs.

The requirements that researchers must meet under the Guidelines contrastwith requirements for research projects involving privacy issues under the NHMRCrules and state law. State law provides little guidance in relation to the equirements ofwritten research protocols. Under the Guidelines researchers must provide veryspecific information in written protocols. The Guidelines state that such protocolsshall state 'the aims of the study, the data needed, the source of the data, the reasonswhy personal information is needed and the way in which the data will be collected,disclosed, used and protected'" This recommendation is more specific than the similarNHMRC statement set out in the Supplementary Note.22 The Guidelines then list tenadditional specific matters to be addressed in the protocol statement, including whohas access to the personal information and whether, and in what form, the final resultswill be published or made available to other researchers."

Specifically listing the information that researchers must provide in writtenprotocols should ensure that protocols are sufficiently descriptive to give IECs theinformation they need to make their decisions. In addition, it will be easier for IECsto fulfil their surveillance function to monitor whether the researcher has followed thespecific methods outlined in the protocol."

Weighing the public interestThe Guidelines list a number of concerns to address in weighing the public

interest in medical research against the public interest in privacy relating to: why theresearch must be conducted in the proposed manner; that data used will be as secureas they were in original sources; and that the study and any published results will notcause any embarrassment or disadvantage to an individual. Again, these statementsreflect existing NHMRC policy. The Guidelines add new criteria to these concernsincluding ways to evaluate 'benefit' to the community, e.g., contributions to scientificunderstanding relating to health or the improved delivery of health services, andwhether there is a benefit if not to the individual participants, at least to the class of

1IiodIIia 1ktw VoLll No.1 7

persons to which they belong. The IEC is also directed to consider the weight given bythe community to similar studies, the standards of propriety that have been observedin the conduct of similar previous studies, and the actual standards of conduct to beobserved in the study under consideration.2S

Where state law requires IEC approval, as in Victoria, IEC considerations aresubject to much less rigorous criteria. Victorian legislation permits a state hospital orrelated health institution to disclose patient-identifying information for the purpose ofmedical research if the use to which the information will be put and the researchmethodology have been approved by an ethics commlnee," By demanding that an IECbe as rigorous in its considerations as the researcher is in his or her proposal, it ismore likely that approved projects will be scrutinised to determine whether and inwhat form the public interest in medical research will be furthered . Similarly, byemphasising the different ways that individual participants must be protected fromembarrassment or harm, the Guidelines attempt to preserve as much individualautonomy as possible. While Guidelines hence may be ethically justified, it is not clearhow IECs will make specific determinations on matters such as scientific validity giventheir composition of non-medical as well as medical members.

Practical Issues for lEesThe publication and audit provisions in the Guidelines will impose significant

additional responsibilities for -IECs and for the NHMRC. The NHMRC will publishannually the number of research projects to which the Guidelines applied and thedecisions made as a result of the Guidelines." The recording and notification ofdecisions reached by IECs (and the reasons behind those decisions) will be audited bythe NHMRC and form the basis of an NHMRC report to show the consistency andextent of compliance that has been achieved in the application of the Guidelines.f

These audit and record-keeping provisions are not required for other researchprojects approved by IECs, including projects involving human subjects. IECs areresponsible for monitoring the progress of other research projects in a similarregister" to which the NHMRC has access but the NHMRC has no publication andaudit function in those cases. It is unclear whether IECs will be expected to maintain aseparate register for proposals considered under the Guidelines.

The Guidelines will only apply to the small percentage of medical research inAustralia involving data from Commonwealth Agencies. If the Guidelines are judgedto be ethically and legally sound, the inconsistencies between the Guidelines and othercontrols on privacy and medical research may suggest amendment of the NHMRCStatement and Supplementary Notes to conform to requirements in the Guidelines. Ifthis occurs all IECs reviewing research would need to devote substantial resources tomeeting the detailed requirements in relation to balancing interests, record-keeping,etc. As researchers are quick to point out, IEC members are usually volunteers actingoutside their usual duties and may have to devote additional time in order to meetthese requirements, possibly at a sacrifice of other IEC matters.

Bioditia New. VaLll No.1 8

IV. IMPLICATIONS OF PRIVACY LAWS AND OPTIONS FOR PUBLICHEALTH RESEARCHAccess to Electoral Rolls

Recent privacy laws have restricted the access of researchers to information infederal electoral rolls. Such information is used to do community-based case-controlstudies where a patient group with a particular disease is compared with a group ofsimilar age, gender and background. Prior to enactment of the Privacy Act,epidemiologists used electoral rolls to obtain a random control group of the same age,sex, and geographic locality as each affected case. In the past, this information waseasily accessible and the Electoral Commission was willing to provide it. As a result ofamendments to the federal electoral laws, however, researchers are now preventedfrom obtaining this information.

Provisions in the Electoral Act now prohibit providing 'any person with anyinformation which discloses particulars of the occupations, sex or dates of birth ofelectors'," Hence even where an IEC approves a research project involving data fromthe Electoral Commission (and such approval would be necessary because theElectoral Commission is a Commonwealth Agency), the information could not bedisclosed. An exception is made to provide a 'prescribed authority' with thatmformation.FPrescribed authorities are defined to include specified departments suchas the Department of Health, Housing, and Community Services ('DCHHS') theDepartment of Administrative Services, and the Department of Veterans' Affairs, andspecified authorities of the Commonwealth such as Australia Post and the AustralianCustoms Service,"

It is unclear precisely who has access under the exceptions to the law - is itonly the prescribed authorities or may they share information with researchers?Officers at the Electoral Commission have stated that medical research was not thereason given by such authorities to justify that access." Those reasons were related tolaw enforcement and the protection of the public revenue. The Electoral Commissionstates that a prescribed authority like DCHHS may not disclose information obtainedfrom the Commission without the Commission's agreement. DCHHS may hencerequest electoral roll information with gender/age information but may only obtain itand disclose it with the Commission's approval. The Electoral Commission maintainsthat to date it has not released such information to third parties."

The experience of researchers involved in the National Heart Foundation RiskPrevalance Studies illustrates the effect that these provisions may have on medicalresearch. The studies done in 1980 and 1983 used information from electoral rolls andwere not subject to any privacy restrictions. In 1989, the Heart Foundation met withthe Electoral Commission, DCHHS, and the Privacy Commissioner to decide whethergender/age information could be disclosed. It was decided that the Privacy Act wouldnot apply in that case; since the Act became effective on January 1, 1989, the PrivacyCommissioner decided that the researchers could have access to the rolls existingbefore December 31, 1988 without being subject to privacy laws. The amendments tothe Electoral laws were similarly not in force at that time.

Neither the Heart Foundation nor DCHHS knows what is likely to happen in1994 when the next study needs to be done. The Electoral Commission has stated thatthey will consider releasing the information to DCHHS again as long as they are

9

giving it to a prescribed authority and that the use of the information is consistentwith the Privacy Act and the Guidelines.

AlB ProposalThe Australian Institute of Health ('AIH') is a Commonwealth body

established to collect, study and report on health-related information in Australia. Inorder to fulfil its statutory function" the AIH needs access to health-relatedinformation and statistics. Researchers at the AlH have indicated their desire to bemade a prescribed authority under the Electoral Act.36 The AlH is also seeking toexpand its access to information collected under enactments administered in theportfolio of the Minister for Community Services, Housing, and Health. The AlHalready has statutory access to data collected under the Epidemiological Studies(Confidentiality) Act 1981; it is seeking access to infomation collected under the HealthInsurance Act 1973 and the National Health Act 1953.

Giving the AlH access to information collected under the relevant Acts wouldbe consistent with its legal statutory functions and ethically justifiable. The Actsaffected could be amended to give AlH this right to collect information. Use of theinformation collected under these Acts in AIH research projects would be subject toethical consideration by the IEC of the AlH. Any release of information to medicalresearchers by the AlH would require IEC approval under the Guidelines from theparty seeking the information. Further, the AlH is subject to its own statutoryrestrictions on confldentiality."

Use of the Medicare Register and Medical Record LinkageSome researchers rely on information in the Medicare Register, which is also

under the jurisdiction of the Privacy Commissioner, for individual subject data. Thismay be the best method for finding individuals who are appropriate for certainprograms such as screening services. Since Australian Medicare numbers are issued forentire families, however, it may be difficult to identify individuals using this source ofinformation. Individual identifying numbers would also make it easier to monitor newdrugs released for individual use. This is of particular importance in light of a recentreport recommending that the Australian drug review process should be streamltned."

Researchers point out that many other countries, including Britain, the U.S.,and Scandinavia, do use common identity numbers without privacy concerns becomingan issue," Some researchers favour the introduction of a computerised number card,(known as a 'smart card') in order to conduct research studies of a more complexnature in a more systemised, efficient way.40 Smart cards are currently being used on atrial basis in the UK to transfer patient medical data.

The difficulty experienced by researchers in identifying particular individuals isrelated to problems in conducting national automated searches of morbidity/mortalityrecords and in research involving medical record linkage. Such linkage might bedesired, e.g., to compare hospital data with police records when studying road accidentinjuries. This type of research is particularly difficult to carry out in a mannerconsistent with privacy concerns.

While it is important to consider a variety of medical research designs, it maybe difficult at present to justify proposals involving common identifying numbers andgreater medical record linkage. Given the recent negative reaction in Australia toward

Biodhia &wi VoI.II No.1 10

the Australia card, it is unlikely that the public would be willing to accept suchproposals. These cases represent areas where medical researchers may have to workharder to educate people about the need to conduct their research in this mannerbefore the public finds them ethically acceptable.

CONCLUSIONThe controls set up to protect privacy in the area of medical research are

varied and numerous. The Guidelines attempt to protect privacy interests whilefacilitating medical research recognised as valuable to society. I believe that they do soin a way that is ethical and legally sound. However, the Guidelines have implicationsbeyond the government agencies and departments that are directly covered by thePrivacy Act. The requirements set out for IECs to follow raise practical concerns overresources and procedures. These concerns should be clearly addressed by the NHMRCand the Privacy Commissioner. This is particularly important if other privacyprotection laws and guidelines adopt the Guidelines' approach to weighing of interestsand monitoring of projects.

The Guidelines themselves do not solve all problems related to obtaininginformation from Commonwealth Agencies, as seen in the example of researchprojects relying on electoral information barred under the federal electoral laws. Inorder to find workable alternative research designs it is necessary to continue toexamine new legal solutions, their ethical bases, including which interests are favoured,and their consistency with existing controls. Public education by medical researchers isalso necessary so that the public can make informed decisions and so that our legalproposals are compatible with public sentiment as well as ethical principles.

REFERENCES

1. The term 'medical research' will be used to refer to epidemiological researchand clinical research based on the use of previously collected medical records.

2. Australian Law Reform Commission, Report no. 22, Privacy, AGPS, Canberra,1983, v.l, p.l0 para.19. This report is later cited as ALRC, Privacy.

3. J.S. Mill, On Liberty, Norton, New York, 1975.4. C Berglund, 'Australian standards for privacy and confidentiality of health

records in research: implications of the Commonwealth Privacy Act' (June 18,1990) 152 The Medical Journal ofAustralia, 664.

5. The Law Reform Commission of Western Australia, Discussion Paper onConfidentiality of Medical Records, Project no.65, Pt II, p.4, para 1.5, March1989.

6. R Smallwood, 'Privacy laws and their effect on medical research' (Feb. 4,1991) 154 The Medical Journal ofAustralia, 740.

7. See endnote 5 at p.17-18, paras. 4.8-4.9.8. N. Gray, D. Hill and R. Lovell, 'Privacy and medical research: most people

support current practice' (Dec. 3/17, 1990) 153 The Medical Journal ofAustralia, 740.

9. Telephone conversation on July 25, 1991 with Dr. Paul Magnus, director ofthe National Heart Foundation Risk Prevalence Study and personal

11

conversations with Victorian researchers at the Alfred Hospital, Prahran,Melbourne.

10. H. Mitchell, 'Cervical cancer screening: a comparison of recruitment strategiesamong older women' (July 15, 1991) 155 The Medica; Journal ofAustralia, 79.State electoral rolls were used to provide names; state electoral offices are notsubject to the PrivacyAct or federal electoral law. Only two women wanted toknow how their names had been obtained, both accepted the explanationwithout further comment. Telephone conversation on study with Dr. DavidHill of the Victorian Anti-Cancer Council May 29, 1991.

11. ALRC, Privacy, at 65, para. 139.12. Health Administration Act 1982 (NSW) §23(1); Health Act (Qld) 1937 §154M;

Health Act 1976 (SA) §64d(1) (1987 Amendment).13. Health ServicesAct (Vic) 1988 §141.14. The Law Reform Commission of Western Australia, Report on Confidentiality

ofMedical Records, Project no.65, Pt II, August 1990.15. National Health and Medical Research Council, NHMRC Statement on

Human Erperimentation and Supplementary Notes, 1987, Supplementary Note 6(1985).

16. National Health and Medical Research Council, Statement on HumanErperimentation and SupplementaryNotes, Canberra, NHMRC rev. 1988.

17. The Australian Medical Association formally adopted the Declaration ofHelsinki 1964, as revised 35th World Medical Assembly, Venice 1983, forguidance in research.

18. As adopted by the World Medical Association in 1948, and amended in 1968and 1983. See Ethical Codes and Declarations Relevant to the MedicalProfession, Amnesty International compilation of selected ethical texts forhealth professionals, London, 1984, 2.

19. Adopted by the World Medical Association in 1949 and amended in 1968 and1983. See Id. at 5-6.

20. C. Berglund and P. McNeill, 'Guidelines for Research Practice in Australia:NHMRC Statement & Professional Codes' (Autumn 1989) 13 CommunityHealth Studies, 121.

21. Guidelines para 3.3.22. See endnote 15 at para 4.23. Guidelines, para. 3.3 (t), (h).24. Guidelines, para. 3.3 (t).25. Guidelines, para. 3.9 (vii), (viii), (xi).26. Health ServicesAct (Vic) 1988 §141.27. Guidelines para 3.15.28. Guidelines para. 3.16.29. See P. McNeill, C. Berglund and I. Webster, 'Reviewing the reviewers: a

survey of institutional ethics committees in Australia' (March 19, 1990) 152The Medical Journal of Australia 289. This survey found that out of the 101Australian IECs studied, less than half monitored research projects inprogress as a general practice.

30. Commonwealth ElectoralAct (1918) §91(9).31. Id. at §91(10).

Bioelhia He- VoUl No.1 12

32. Electoral and Referendum Regulations (Amendment), Statutory Rules 1990,no.334, SChedule 2.

33. Mr. Michael Maley, Director, Research, Legislative Projects & FOI,Australian Electoral Commission, personal correspondence, 29 July 1991.

34. Id.35. Australian Institute ofHealth Act 1987 (Cth), §5 (1) (h) and (j).36. Dr. John W. Donovan, Principal Medical Adviser, Australian Institute of

Health, personal correspondence, 26 July 1991.37. See endnote 35, §29.38. A Question of Balance, Report on the future of Drug Evaluation in Australia,

AGPS, Canberra, July 1991 [the Baume Report].39. 'The Protection of Personal Information in the Conduct of Medical

Research - Overseas Approaches' (April 1991) Human Rights and EqualOpportunity Commission, Privacy Branch, Sydney, NSW.

40. B. Regan, 'Computerised information exchange in health care' (Jan. 21, 1991)154 The Medical Journal ofAustralia, 140.