Privacy and Health Research. Research to Make Effective Innovations


A prime example of innovation is the elaborate work of developing and improving the use of pharmaceuticals, medical devices, diagnostic instruments and tests, vaccines, and other "tools" of health care.53 After much preliminary screening, an experimental entity or procedure is subjected to a long series of clinical trials, perhaps on tens of thousands of volunteers in many countries, to evaluate its efficacy, risks, and other attributes. Refinements are made, and many evaluations are conducted. Eventually the sponsoring company or agency submits the data to government regulatory authorities—in the U.S., the Food and Drug Administration (FDA)—to be reviewed for licensing.

In this process huge quantities of personally identifiable data are amassed. The raw data are collected in clinical settings. Then the data are transferred by the physician–investigators to the sponsor, usually assigning a key-code pseudonym to the data first, which allows tracing-back to the subject via the physician. The sponsor analyzes and prepares the key-coded data for regulatory submission, and transfers the data, still (or re-) key-coded, to the regulatory agency for review. All of this is conducted under international guidelines of good clinical practice, and under the various national human-subjects regulations and regulatory statutes. In the U.S. the confidentiality of these data are covered by regulatory controls and protected by the Federal Privacy Act.

The FDA audits selected trials, usually ones that are considered pivotal to the regulatory decisions. In 1995, for instance, specially credentialed inspectors from its Center for Drug Evaluation and Research conducted over 400 inspections, in each audit reviewing all of the subjects' records including the consent forms and IRB records. If they must take photocopies of personal data away from the site, they first remove the identifiers. They conduct inspections of sites in other countries, through arrangements made by the product sponsors.

After an innovation becomes licensed for general use, research continues. In pharmacovigilance, the company and regulators watch for previously unknown effects of drugs, and respond quickly to spontaneous adverse-event reports communicated by doctors, patients, or others. These data usually are identified by the patient's initials and physician's name. To allow tracing-back to the patient, identifiability—at least key-coded, at least back to the physician— must be preserved, in case it becomes scientifically necessary to review the full medical record and circumstances. The FDA "MedWatch" program, which collects the adverse- event reports for drugs and medical devices, received around 170,000 reports last year. MedWatch shares the identity of the reporting physicians with the manufacturers unless a physician requests it not to. After extensive evaluation these data inform decisions about keeping the product on the market, or revising uses, formulations, dosing, route of administration, labels, or packaging.

Similarly, a "Vaccine Adverse Event Reporting System" (VAERS), administered jointly by the FDA and the Centers for Disease Control and Prevention, collects and analyzes reports on vaccines, again keeping the patients' identity confidential. A prime focus is vaccination of children—to provide feedback that helps improve the vaccines as preventive tools, and to guide public-health missions in ensuring high rates of vaccination. The data are made available for research, after all identifying information is removed. 54,55

Postmarketing surveillance may be carried out for a variety of purposes, to learn more about the innovation's medical effects, both beneficial and harmful, as it is tested by wider natural experience. Pharmacoepidemiology, "the study of the use of and the effects of drugs in large numbers of people," is a prime tool in postmarketing research on medicines.56 Similar techniques apply to surgery and other interventions.

(53) Bert Spilker, Guide to Clinical Trials (Raven Press, New York, 1991).

(54) Robert T. Chen, Suresh C. Rastogi, John R. Mullen, Scott W. Hayes, Stephen L. Cochi, Jerome A. Donlon, and Steven G. Wassilak, "The Vaccine Adverse Event Reporting System (VAERS)," Vaccine 12, 542–551 (1994). Information on VAERS is available on the Internet at < >.

(55) For general background on data needed for analyzing vaccine effects, see Institute of Medicine, Vaccine Safety Committee; Kathleen R. Stratton, Cynthia J. Howe, and Richard B. Johnston, Jr., editors, Adverse Events Associated with Childhood Vaccines: Evidence Bearing on Causality (National Academy Press, Washington, DC, 1993).

(56) Brian L. Strom, p. 3 of "What is pharmacoepidemiology?" pp. 1–13 of Strom, as cited in endnote (37).