Privacy and Health Research. Data-Subject Consent


A universally endorsed ethical precept is that it is permissible to collect and use personally identifiable data, if the data-subject agrees to the conditions of data protection and use. The ideal is prior, informed, freely granted, specific consent. Researchers strive for this to varying degrees, and achieve it to varying degrees. 68,69

Informing for consent almost always must include telling the prospective subject "the extent, if any, to which confidentiality of records identifying the subject will be maintained." 70

For formal clinical trials and much other research, informed consent is routinely sought, Institutional Review Boards supervise the research protocols, and so on. But for many other kinds of research, for a variety of reasons notice is not routinely given nor explicit consent sought, and indeed may be practically impossible to seek. The policy and pragmatic questions are obvious. For example, retrospective studies, such as epidemiological reviews initiated years after the medical events, pose special problems. How should identifiability and consent be dealt with when such reviews are undertaken? And in general when data are collected, how broad consent should be sought for future studies that cannot be specifically anticipated? Important issues are the granting of consent for studies in large multipurpose databases, or retrospective secondary research (discussed in Chapter 7). How meaningful and sufficient is omnibus, indefinite consent?

Alas, as the ethicist Ruth Faden has rightly lamented:71

As a practical matter, how much moral weight the typical consent to access information can bear is dubious. The catchall phrases in the waivers and disclosure statements read and signed by patients and consumers—"Your records will be kept confidential and not be made available, except for statistical purposes," "except for research purposes," and "except for administrative purposes"—are doubtless not very meaningful to most people.

Unless we do a good job of soliciting genuine informed consent or conducting an extraordinarily public education and exchange to provide citizens with an understanding of who now has information and for what purposes, getting consent will not get us off the moral hook.

A real-world example just to indicate the complications is called for here. From the front- line of health social work, Jeanette Davidson and Tim Davidson have brought this sobering message, as relevant for research as for the provision of care:72

With managed care systems the reality is often that the name of the individual or organization receiving the disclosure may change without notice, the information to be disclosed may consist of a verbatim account of the client's most sensitive information given to persuade a gatekeeper to continue to authorize services, and the statement about the client's being able to revoke consent at any time is an illusory proposition given the virtual irretrievability of electronic transmissions of data that are stored in various locations.

(68) A classic source is Ruth R. Faden and Thomas L. Beauchamp, A History and Theory of Informed Consent (Oxford University Press, New York, 1986).

(69) A three-year grant program "to stimulate investigations into the informed consent process in scientific research" (RFA OD-97-001) was announced recently: NIH Guide to Grants and Contracts 25, No. 32 (September 27, 1996).

(70) 45 Code of Federal Regulations 46(a)(5), the Federal Common Rule's informed consent requirements.

(71) Ruth Faden, p. 12 of "Keynote speech," Proceedings, "Conference on Health Records: Social Needs and Personal Privacy," sponsored by the Department of Health and Human Services (U.S. Government Printing Office, Washington, DC, 1993).

(72) Jeanette R. Davidson and Tim Davidson, p. 212 of "Confidentiality and managed care: Ethical and legal concerns," Health Social Work 21, 208–215 (1996).