Secondary use of personal data for health and health services research: why identifiable data are essential

Public interest in health data research: laying out the conceptual groundwork

The future of health research will be characterised by three continuing trends: rising demand for health data; increasing impracticability of obtaining specific consent for secondary research; and decreasing capacity to effectively anonymise data. In this context, governments, clinicians and the research community must demonstrate that they can be responsible stewards of health data. IRBs and RECs sit at heart of this process because in many jurisdictions they have the capacity to grant consent waivers when research is judged to be of particular value. However, several different terms are used to refer to this value (including public interest, public benefit, public good and social value), indicating a lack of conceptual clarity regarding the appropriate test for access to health data for research without consent. In this paper we do three things. First we describe the current confusion and instability in terminology relating to public interest in the context of consent waivers. Second we argue for harmonisation of terminology on the grounds of clarity, transparency and consistency. Third we argue that the term 'public interest' best reflects the normative work required to justify consent waivers because it is the broadest of the competing terms. 'Public interest' contains within its scope positive and negative implications of a study, as well as welfare, justice and rights considerations. In making this argument, we explain the normative basis for consent waivers, and provide a starting place for further discussion about the precise conditions in which a given study can be said to advance the public interest. Ipsos MORI study found that: … the public would be broadly happy with administrative data linking for research projects provided (1) Those projects have social value, broadly defined. (2) Data are de-identified. (3) Data are kept secure. (4) Businesses are not able to access the data for profit.

Personal health data: A systematic mapping study

BACKGROUND

Personal health data (PHD) research has been intensified over the last years, attracting the attention of scientists from different fields, such as software engineers, computer scientists and medical professionals. The increasing interest of researchers can be attributed to the exponential growth of the available PHD due to the widespread adoption of ubiquitous technology in everyday life, as well as to the potential of the ongoing digital transformation in healthcare. This increasing interest requires that academia has an overview of the published scientific literature to plan future endeavors.

OBJECTIVE

The main objective of this study is to identify and address research gaps in literature regarding PHD.

METHOD

This paper conducts a systematic mapping study to summarize the existing PHD approaches in literature and to organize the selected studies according to six classification criteria: publication source, publication year, research types, empirical types, contribution types and research topic.

RESULTS

In total 79 papers have been included after fulfilling the inclusion criteria and have been classified accordingly. There is an increasing amount of attention that has been paid to PHD since 2014. The majority of papers is published in journals. The two main research types found were solution proposals and evaluation research. The majority of the selected papers were empirically evaluated. The main contribution types were methods and frameworks. Data privacy is the most frequently addressed topic in PHD literature, followed by data sharing.

CONCLUSIONS

The findings of this systematic mapping study have implications for both researchers who are planning new studies in PHD and for practitioners who are working in connected health and would like to have an overview on the existent studies on PHD research area.

Linking NHS data for pediatric pharmacovigilance: Results of a Delphi survey

BACKGROUND

Adverse drug events are a major cause of patient safety incidents. Current systems of pharmacovigilance under-report adverse drug reactions (ADRs), especially in children, leading to delays in their identification. This is of particular concern, as children especially have an increased vulnerability to ADRs.

OBJECTIVES

The objective was to seek consensus among healthcare professionals (HCPs) about barriers and facilitators to the linkage of routinely collected health data for pediatric pharmacovigilance in Scotland.

METHODS

A Delphi survey was conducted with a random sample of HCPs including nurses, pharmacists and doctors, working in primary or secondary care, in Scotland. Participants were identified from sampling frames of the target professionals such as an NHS workforce list for general practitioners and recruited by postal invitation. A total of 819 HCPs were invited to take part. Those agreeing to participate were given the option of completing the questionnaires online or as hard copy. Reminders were sent twice at a fortnightly interval. Questions content included description of professional role as well as testing for the willingness to support the proposed project and was informed by the Theoretical Domains Framework of Behavior Change (TDF) and earlier qualitative work. Three Delphi rounds were administered, including a first round for item generation.

RESULTS

121 of those invited agreed to take part (15%). The first round of the Delphi study included 21 open questions and generated over a 1000 individual statements from 61 participants that returned the questionnaires (50.4%). These were rationalized to 149 items for the second round in which participants rated their views on the importance (or not) of each item on a 9-point Likert scale (strongly disagree - strongly agree). After the third round, there was consensus on items that focused on professional standards, and practical requirements, overall there was support for data linkage and a multi-professional approach.

CONCLUSIONS

It would be acceptable to stakeholders to introduce a data linkage system for pharmacovigilance as long as identified concerns are addressed. Concerns included adherence to current professional, legal and ethical standards, as well resolving practical issues.

Evaluating bias due to data linkage error in electronic healthcare records

Background

Linkage of electronic healthcare records is becoming increasingly important for research purposes. However, linkage error due to mis-recorded or missing identifiers can lead to biased results. We evaluated the impact of linkage error on estimated infection rates using two different methods for classifying links: highest-weight (HW) classification using probabilistic match weights and prior-informed imputation (PII) using match probabilities.

Methods

A gold-standard dataset was created through deterministic linkage of unique identifiers in admission data from two hospitals and infection data recorded at the hospital laboratories (original data). Unique identifiers were then removed and data were re-linked by date of birth, sex and Soundex using two classification methods: i) HW classification - accepting the candidate record with the highest weight exceeding a threshold and ii) PII–imputing values from a match probability distribution. To evaluate methods for linking data with different error rates, non-random error and different match rates, we generated simulation data. Each set of simulated files was linked using both classification methods. Infection rates in the linked data were compared with those in the gold-standard data.

Results

In the original gold-standard data, 1496/20924 admissions linked to an infection. In the linked original data, PII provided least biased results: 1481 and 1457 infections (upper/lower thresholds) compared with 1316 and 1287 (HW upper/lower thresholds). In the simulated data, substantial bias (up to 112%) was introduced when linkage error varied by hospital. Bias was also greater when the match rate was low or the identifier error rate was high and in these cases, PII performed better than HW classification at reducing bias due to false-matches.

Conclusions

This study highlights the importance of evaluating the potential impact of linkage error on results. PII can help incorporate linkage uncertainty into analysis and reduce bias due to linkage error, without requiring identifiers.

Views of healthcare professionals to linkage of routinely collected healthcare data: a systematic literature review

Objective

To review the literature on the views of healthcare professionals to the linkage of healthcare data and to identify any potential barriers and/or facilitators to participation in a data linkage system.

Methods

Published papers describing the views of healthcare professionals (HCPs) to data sharing and linkage were identified by searches of Medline, EMBASE, SCOPUS, CINAHL, and PsychINFO. The searches were limited to papers published in the English language from 2001 to 2011.

Results

A total of 2917 titles were screened. From these, 18 papers describing the views of HCPs about data linkage or data sharing of routinely collected healthcare data at an individual patient level were included. Views were generally positive, and potential benefits were reported. Facilitators included having trust in the system including data governance, reliability, and feedback. Some negative views, identified as barriers were also expressed including costs, data governance, technical issues, and privacy concerns. Effects on the physician–patient relationship, and workload were also identified as deterrent.

Discussion

From the published literature included in this review, the views of HCPs were in general positive towards data sharing for public health purposes. The identification of barriers to contributing to a data linkage system allows these to be addressed in a planned data linkage project for pharmacovigilance. The main barriers identified were concerns about costs, governance and interference with the prescriber–patient relationship. These would have to be addressed if healthcare professionals are to support a data linkage system to improve patient safety.

Building the informatics infrastructure for comparative effectiveness research (CER): a review of the literature

BACKGROUND

Technological advances in clinical informatics have made large amounts of data accessible and potentially useful for research. As a result, a burgeoning literature addresses efforts to bridge the fields of health services research and biomedical informatics. The Electronic Data Methods Forum review examines peer-reviewed literature at the intersection of comparative effectiveness research and clinical informatics. The authors are specifically interested in characterizing this literature and identifying cross-cutting themes and gaps in the literature.

METHODS

A 3-step systematic literature search was conducted, including a structured search of PubMed, manual reviews of articles from selected publication lists, and manual reviews of research activities based on prospective electronic clinical data. Two thousand four hundred thirty-five citations were identified as potentially relevant. Ultimately, a full-text review was performed for 147 peer-reviewed papers.

RESULTS

One hundred thirty-two articles were selected for inclusion in the review. Of these, 88 articles are the focus of the discussion in this paper. Three types of articles were identified, including papers that: (1) provide historical context or frameworks for using clinical informatics for research, (2) describe platforms and projects, and (3) discuss issues, challenges, and applications of natural language processing. In addition, 2 cross-cutting themes emerged: the challenges of conducting research in the absence of standardized ontologies and data collection; and unique data governance concerns related to the transfer, storage, deidentification, and access to electronic clinical data. Finally, the authors identified several current gaps on important topics such as the use of clinical informatics for cohort identification, cloud computing, and single point access to research data.

Development of a relational database to capture and merge clinical history with the quantitative results of radionuclide renography

Our objective was to design and implement a clinical history database capable of linking to our database of quantitative results from (99m)Tc-mercaptoacetyltriglycine (MAG3) renal scans and export a data summary for physicians or our software decision support system.

METHODS

For database development, we used a commercial program. Additional software was developed in Interactive Data Language. MAG3 studies were processed using an in-house enhancement of a commercial program. The relational database has 3 parts: a list of all renal scans (the RENAL database), a set of patients with quantitative processing results (the Q2 database), and a subset of patients from Q2 containing clinical data manually transcribed from the hospital information system (the CLINICAL database). To test interobserver variability, a second physician transcriber reviewed 50 randomly selected patients in the hospital information system and tabulated 2 clinical data items: hydronephrosis and presence of a current stent. The CLINICAL database was developed in stages and contains 342 fields comprising demographic information, clinical history, and findings from up to 11 radiologic procedures. A scripted algorithm is used to reliably match records present in both Q2 and CLINICAL. An Interactive Data Language program then combines data from the 2 databases into an XML (extensible markup language) file for use by the decision support system. A text file is constructed and saved for review by physicians.

RESULTS

RENAL contains 2,222 records, Q2 contains 456 records, and CLINICAL contains 152 records. The interobserver variability testing found a 95% match between the 2 observers for presence or absence of ureteral stent (κ = 0.52), a 75% match for hydronephrosis based on narrative summaries of hospitalizations and clinical visits (κ = 0.41), and a 92% match for hydronephrosis based on the imaging report (κ = 0.84).

CONCLUSION

We have developed a relational database system to integrate the quantitative results of MAG3 image processing with clinical records obtained from the hospital information system. We also have developed a methodology for formatting clinical history for review by physicians and export to a decision support system. We identified several pitfalls, including the fact that important textual information extracted from the hospital information system by knowledgeable transcribers can show substantial interobserver variation, particularly when record retrieval is based on the narrative clinical records.

The use of routinely collected patient data for research: a critical review

Over recent years in the UK there has been growing interest in the potential for routinely collected NHS (National Health Service) patient data to be used for secondary purposes, facilitated by the potential of increasingly sophisticated electronic databases. This article is based on a critically reflective literature review which analyses the key debates pertaining to this issue. The work arose in the context of a programme of research concerning routine patient data use in neonatal care. The article includes analysis of commentary (opinion and ethical inquiry) as well as empirically derived claims. It aims to deconstruct the knowledge assumptions on which relevant research studies have been based or are proposed and it also incorporates ontological position and moral argument. Results are presented according to three predominant debates: the prevailing claim that all health research benefits civic society; the varieties of informed consent and choices open to patients regarding secondary uses of their data; and the 'rights and responsibilities' of patients when it comes to their data being used for research purposes. It examines the relevance of these themes specifically to the neonatal context and the implications for our own research, concluding that employing an alternative ethical model to the traditional professional one might be useful in order to provide a further perspective on the issue.

Multidimensional point transform for public health practice

BACKGROUND

With increases in spatial information and enabling technologies, location-privacy concerns have been on the rise. A commonly proposed solution in public health involves random perturbation, however consideration for individual dimensions (attributes) has been weak.

OBJECTIVES

The current study proposes a multidimensional point transform (MPT) that integrates the spatial dimension with other dimensions of interest to comprehensively anonymise data.

METHODS

The MPT relies on the availability of a base population, a subset patient dataset, and shared dimensions of interest. Perturbation distance and anonymity thresholds are defined, as are allowable dimensional perturbations. A preliminary implementation is presented using sex, age and location as the three dimensions of interest, with a maximum perturbation distance of 1 kilometre and an anonymity threshold of 20%. A synthesised New York county population is used for testing with 1000 iterations for each of 25, 50, 100, 200 and 400 patient dataset sizes.

RESULTS

The MPT consistently yielded a mean perturbation distance of 46 metres with no sex or age perturbation required. Displacement of the spatial mean decreased with patient dataset size and averaged 5.6 metres overall.

CONCLUSIONS

The MPT presents a flexible, customisable and adaptive algorithm for perturbing datasets for public health, allowing tweaking and optimisation of the trade-offs for different datasets and purposes. It is not, however, a substitute for secure and ethical conduct, and a public health framework for the appropriate disclosure, use and dissemination of data containing personal identifiable information is required. The MPT presents an important component of such a framework.

The SAIL databank: linking multiple health and social care datasets

BACKGROUND

Vast amounts of data are collected about patients and service users in the course of health and social care service delivery. Electronic data systems for patient records have the potential to revolutionise service delivery and research. But in order to achieve this, it is essential that the ability to link the data at the individual record level be retained whilst adhering to the principles of information governance. The SAIL (Secure Anonymised Information Linkage) databank has been established using disparate datasets, and over 500 million records from multiple health and social care service providers have been loaded to date, with further growth in progress.

METHODS

Having established the infrastructure of the databank, the aim of this work was to develop and implement an accurate matching process to enable the assignment of a unique Anonymous Linking Field (ALF) to person-based records to make the databank ready for record-linkage research studies. An SQL-based matching algorithm (MACRAL, Matching Algorithm for Consistent Results in Anonymised Linkage) was developed for this purpose. Firstly the suitability of using a valid NHS number as the basis of a unique identifier was assessed using MACRAL. Secondly, MACRAL was applied in turn to match primary care, secondary care and social services datasets to the NHS Administrative Register (NHSAR), to assess the efficacy of this process, and the optimum matching technique.

RESULTS

The validation of using the NHS number yielded specificity values > 99.8% and sensitivity values > 94.6% using probabilistic record linkage (PRL) at the 50% threshold, and error rates were < 0.2%. A range of techniques for matching datasets to the NHSAR were applied and the optimum technique resulted in sensitivity values of: 99.9% for a GP dataset from primary care, 99.3% for a PEDW dataset from secondary care and 95.2% for the PARIS database from social care.

CONCLUSION

With the infrastructure that has been put in place, the reliable matching process that has been developed enables an ALF to be consistently allocated to records in the databank. The SAIL databank represents a research-ready platform for record-linkage studies.

Regional and national health care data repositories

Efforts are underway to define a national framework for secondary analysis of health-related data. In the meantime, regional health databases have been constructed using insurance claims data, clinical data from single large health care providers, clinical data from multiple collaborating health care providers, and public health data. Large-scale survey data also are available in government databases. Clinical laboratory results are an important component of all these databases because they can provide validation for manually assigned diagnostic and procedure codes and can support inference of key information not provided by coding, such as severity of disease and prevalence of risk factors.

Research on medical records without informed consent

Observational research involving access to personally identifiable data in medical records has often been conducted without informed consent, owing to practical barriers to soliciting consent and concerns about selection bias. Nevertheless, medical records research without informed consent appears to conflict with basic ethical norms relating to clinical research and personal privacy. This article analyzes the scope of these norms and provides an ethical justification for research using personally identifiable medical information without consent.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rule: implications for clinical research

In the short time since it became effective for health care organizations, a privacy regulation issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) has had a significant adverse impact on the conduct of clinical research in the United States, without a substantial corresponding increase in privacy protection for research participants. Some of the problems associated with HIPAA have been resolved through revisions since the regulation's initial promulgation in December 2000, and other problems can be addressed by better educating health care providers and researchers about its requirements and available alternatives for compliance; however, considerable structural challenges remain. These constitute substantial barriers to research and resulting medical advances. Additional revisions to HIPAA based on the principles and trade-offs reflected in the Common Rule-which responsibly balances an individual's interest in privacy protection with the public interest in gaining knowledge through biomedical research-can go a long way to remedying remaining flaws in the system.

Confidentiality and confidence: is data aggregation a means to achieve both?

The recent adoption of electronic technologies for use in management of personal health data have been accompanied by a commensurate level of concern about privacy. Public health authorities have been able to continue their full access to personal information, while restricting the information given to academic health researchers through the practice of aggregation. Through this band-aid strategy, there is a very real potential that critical pieces of information are missing for the purposes of research. While this might be a logical sacrifice in order to preserve individual privacy, quantitative analysis of the privacy gained through this method of aggregation shows that little, if any, benefit is achieved. If aggregation were the sole available means to reach the aims of both privacy and research, then further analysis of the practice of aggregation would be unnecessary. Yet suitable privacy protection techniques abound, enabling academic research to progress while adding true protection to individual health information.

Cross sectional survey of multicentre clinical databases in the United Kingdom

OBJECTIVES

To describe the multicentre clinical databases that exist in the United Kingdom, to report on their quality, to explore which organisational and managerial features are associated with high quality, and to make recommendations for improvements.

DESIGN

Cross sectional survey, with interviews with database custodians and search of electronic bibliographic database (PubMed).

STUDIES REVIEWED

105 clinical databases across the United Kingdom.

RESULTS

Clinical databases existed in all areas of health care, but their distribution was uneven-cancer and surgery were better covered than mental health and obstetrics. They varied greatly in age, size, growth rate, and geographical areas covered. Their scope (and thus their potential uses) and the quality of the data collected also varied. The latter was not associated with any organisational characteristics. Despite impressive achievements, many faced substantial financial uncertainty. Considerable scope existed for improvements: greater use of nationally approved codes; more support from relevant professional organisations; greater involvement by nurses, allied health professionals, managers, and laypeople in database management teams; and more attention to data security and ensuring patient confidentiality. With some notable exceptions, the audit and research potential of most databases had not been realised: half the databases had each produced only four or fewer peer reviewed research articles.

CONCLUSIONS

At least one clinical database support unit is needed in the United Kingdom to provide assistance in organisation and management, information technology, epidemiology, and statistics. Without such an initiative, the variable picture of databases reported here is likely to persist and their potential not be realised.

Learning from experience: privacy and the secondary use of data in health research

Health services research must continually address the question: Under what conditions may data not collected specifically for research, such as primary medical data, be re-used for research without compromising the privacy of the data-subjects? For secondary use of data in research there are basically three options. Option A: Use personal data with consent or other assent from the data-subjects. To make this both fairer and more practical, in many circumstances broader construals of consent, or permission or approval, need to be explored and instituted. Option B: Anonymise the data, then use them. For many studies, this is the most practical and desirable option. The craft of anonymisation, including reversible anonymisation, or key-coding, needs to be developed and more fully supported under law. Option C: Use personal data without explicit consent, under a public interest mandate. Whether and how the data should be anonymised will depend on the situation. Public health mandates and protections deserve to be clarified, strengthened and extended for a variety of surveillance, registration, clinical audit, health services research and other types of investigation. Safeguards are an integral part of the research promise to the public, offer crucial reassurance and should be emphasised. For health services research, databases are core resources, and their stewardship must be cultivated.