Research and the use of personal information

64.18 The conduct of health, medical and other human research frequently involves the collection and use of personal information about individuals. Generally, individuals who participate in research projects do so on the basis of consent and, in these circumstances, it is possible to handle participants’ personal information in compliance with the IPPs or the NPPs. The National Statement makes clear that:

Respect for human beings involves giving due scope to people’s capacity to make their own decisions. In the research context, this normally requires that participation be the result of a choice made by participants—commonly known as ‘the requirement for consent’. This requirement has the following conditions: consent should be a voluntary choice, and should be based on sufficient information and adequate understanding of both the proposed research and the implications of participation in it.[20]

64.19 The OPC Review noted that consumer research on attitudes in this area have produced mixed results. Research conducted by the OPC indicated that individuals were concerned about their personal information being used, even in a de-identified form, for research purposes. Almost two thirds (64%) of respondents felt that consent should be obtained before de-identified information derived from personal information was used for research purposes. One third (33%) of respondents felt that permission was not necessary.[21]

64.20 The Australian Consumers’ Association, in its submission to the OPC Review, expressed the view that when consumers go to the doctor, they provide health information on the basis that it will be used only for the purposes of their clinical care:

They don’t expect that third parties will be trawling through their health records; even if it is in de-identified form. In this sense third party access to data without the consumers’ knowledge is something of a breach of trust.[22]

64.21 On the other hand, DOHA research suggests that, although consumers express reservations about identified personal information being made available for purposes other than their own clinical care, generally they are very accepting of the notion of sharing de-identified health information amongst health planners and researchers.[23] Research conducted by the NHMRC indicated that there was considerable support among the general public (66%) and health consumers (64%) for approved researchers to match information from different databases. There was an even higher level of support for approved researchers to access health information from databases where health information was identified by a unique number rather than a name.[24]

64.22 A 2005 survey of patients attending the Medical Oncology Outpatient Clinic at the Royal Adelaide Hospital indicated that 93% would allow their health information to be used for research, so long as it was kept confidential and they couldn’t be identified. Where the health information could be identified, 32.8% would allow the information to be used without consent. A further 14.9% would allow the use of the information without consent if the project was approved by an HREC and a further 5.6% would allow the use of the information without consent if it was impracticable to obtain their consent.[25]

64.23 In their joint submission, the Cancer Council Australia and the Clinical Oncological Society of Australia suggested, in relation to these survey results, that the community would be even more supportive of the use of their health information if it had a better understanding of how such research could contribute to improvements in cancer prevention, detection and treatment. These results were also likely to improve if the community was better informed about the mechanisms available to protect privacy.[26] A number of submissions to the OPC Review noted that the issue of community support could be addressed by greater efforts to increase public awareness and acceptance of the use of personal information for research, and in particular, epidemiological research.[27]

64.24 Both the National Statement and the Privacy Act recognise that in some circumstances it is very difficult or impossible to conduct research that may be in the public interest—for example, epidemiological studies of the distribution and determinants of disease in large populations—in a way that complies with the IPPs and the NPPs. As the CSIRO has noted:

Informed consent and opt-in is a good model for clinical trials, for example, where the risk is normally predominantly to the participating individual. However, in the case of population health research, the findings will often be implemented for the whole population. In these cases informed consent and opt-in may not be good models because non-participation can introduce bias and therefore affect the applicability of the results.[28]

64.25 In a 2006 paper, the Academy of Medical Sciences in the United Kingdom canvassed the impact that consent requirements can have on research in some circumstances. Seeking consent to use personal information for research can lead to self-selection bias among research participants. The paper notes that non-response rates are high in ‘hard to reach’ populations—for example, certain ethnic groups and in areas of social disadvantage. This means that these groups are poorly represented in research results. On the other hand, one survey suggested that people from higher socio-economic groups, older adults and men tend to be more willing than other groups to give consent for researchers to use their health information. This can give rise to systemic errors in research results, through the introduction of bias in the study sample.[29]

64.26 The Academy’s paper also included the following case study:

Until 2001, there was a great deal of controversy about a potential link between the termination of pregnancy and an increased risk of breast cancer. Several studies gave conflicting results. Most studies until this point involved interviews with patients. A much discussed issue at the time was whether such studies were subject to reporting bias, ie that women with breast cancer might be more likely than control women (with no history of breast cancer) to tell the interviewer if they had had a termination. Such bias would greatly reduce the accuracy and validity of the results.

To circumvent potential reporting bias, researchers conducted a study based on linkage of independent records. Data were analysed from HNS hospital admissions and death certificates without consent. The analysis showed no increase in breast cancer risk after termination of pregnancy. This conclusive result ended the previous speculation and provided more accurate information for patients.[30]

64.27 The Privacy Act provides a mechanism to allow such research to go forward without consent, subject to guidelines issued by the NHMRC and approved by the Privacy Commissioner. The Act provides for two sets of binding guidelines in the area of health and medical research: one set of guidelines binding on public sector agencies made under s 95 of the Act, and one set of guidelines binding on private sector organisations made under s 95A. Sections 95 and 95A both require the Privacy Commissioner to be satisfied, before approving the guidelines, that the public interest in the relevant research outweighs to a substantial degree the public interest in maintaining the level of privacy protection provided by the IPPs and NPPs.

[20] National Health and Medical Research Council, Australian Research Council and Australian Vice Chancellors’ Committee, National Statement on Ethical Conduct in Human Research (2007), 19. The concept of consent under the Privacy Act is discussed in detail in Ch 19.

[21] Office of the Privacy Commissioner, Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988 (2005), 211.

[22] Australian Consumers Association, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 1 October 2004.

[23] Australian Government Department of Health and Ageing, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, December 2004.

[24] National Health and Medical Research Council, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 10 December 2004.

[25] C Beeke, I Olver and K McLaughlin, ‘A Survey of Patients’ Attitudes Towards the Use of Their Health Data’ (2007) 34(4) Journal of Registry Management 119.

[26] Cancer Council Australia and Clinical Oncological Society of Australia, Submission PR 544, 23 December 2007.

[27] Australasian Epidemiology Association, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 1 December 2004; Telethon Institute for Child Health Research, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, December 2004; National Health and Medical Research Council, Submission to the Office of the Privacy Commissioner Review of the Private Sector Provisions of the Privacy Act 1988, 10 December 2004.

[28] CSIRO, Submission PR 176, 6 February 2007.

[29] Academy of Medical Sciences, Personal Data for Public Good: Using Health Information in Medical Research (2006), 59–61.

[30] Ibid, 61.