Confidentiality Issues in Epidemiology Studies

| Home | | Pharmacovigilance |

Chapter: Pharmacovigilance: Ethical Oversight, Consent and Confidentiality

For some of the epidemiologic challenges, such as anticipating the spread of new viral strains and drug-resistant bacteria, we are likely to face consent-based models that are scientifically inappropriate for the research questions being asked.


For some of the epidemiologic challenges, such as anticipating the spread of new viral strains and drug-resistant bacteria, we are likely to face consent-based models that are scientifically inappropriate for the research questions being asked. Validity depends on the characteristics of the sampling criteria used in compiling the database: if data subjects are self-selected, each epidemiologic analysis will likely require a separate analysis of the impact of the self-selection factors on the research findings. In some cases, this will mean that it is not possible to obtain a valid answer to an important research question.

Research using information collected for other purposes, such as health care delivery or health bene-fits administration, is critically important as we enter the century of discoveries based on genomic science. Pinpointing differences in health or health care qual-ity based on geography, demography, health history or co-morbidities will become ever more important for clinical research, for public health planning and for ensuring access to appropriate care. We do not have the luxury of time and resources to collect consents and obtain data from volunteers and evaluate the validity of the sample for testing every unique data hypothesis.

Public health surveillance is typically conducted under specific laws authorizing or requiring the collec-tion of certain types of data in the public interest (See, e.g. Chapter 1). The new medical privacy regu-lations, for example, have explicit exemptions from the prohibitions on disclosure where the data are being collected under various public health surveillance laws.8 In enacting the mandatory reporting laws, the state legislature has been persuaded that the individ-ual’s interest in privacy can be achieved in other ways that are not anathema to the public interest in phar-macovigilance and other public health surveillance. They have required public health authorities and regu-lated entities to simultaneously protect the privacy interests of individuals while making the requisite reports and appropriately using and safeguarding the collected data.

But most epidemiologic studies do not have the legislatively protected status of public health surveil-lance. With respect to follow-up studies of drug safety, many registries and outcomes research more gener-ally, confidentiality issues generally are subject to the informed consent and authorization laws, and not the spontaneous and/or mandatory reporting laws appli-cable to pharmacovigilance. The challenge in North America and the European Union is to create a system in which patient needs for confidentiality protec-tions can be achieved while also facilitating impor-tant public health research. If society moves too far in the direction of providing absolute protection to seal off access to health information from secondary uses, such as formal studies of drug safety, then we are at risk of eroding the information foundation that supports public health planning and health care qual-ity, including societal judgements on the benefits and risks of medications.

Follow-up studies of drug or medical device safety fall into the broad general category of ‘research’, which is defined in US laws regulating research (discussed below) as ‘a systematic investigation designed to develop or contribute to generalizable knowledge’.9 As noted above, instead of an exemption from the prohibitions on use or disclosure of patient data, the HIPAA medical privacy regulation subjects disclo-sure or use of information for research purposes to an additional, entirely new patient authorization process.10 The same attention to the public interest in both privacy and research results that is seen in event reporting laws is not evident in US laws regulating data access for epidemiologic and outcomes research.

Admittedly, the ‘worst case’ damage to a given individual from a security breach and misuse of personal information may be highly significant. Yet, the potential damage or risk from the non-research misuse of personal information is precisely the same risk that adheres to pharmacovigilance and public health reporting. Indeed, with respect to the types of conditions that often are the subject of mandatory public health reporting – sexually transmitted diseases (STDs), child abuse, substance abuse – the potential damage from stigmatization or prejudice arguably is at its greatest.

Arguably, what is required is some mechanism for evaluating (1) the researcher’s bona fides and (2) the arrangements for securing the data from unauthorized use by employees and/or contractors and from external security breaches. However, neither of these can be found in existing law.

Contact Us, Privacy Policy, Terms and Compliant, DMCA Policy and Compliant

TH 2019 - 2022; Developed by Therithal info.