Privacy and/or Health

From the Globe & Mail from June 29, 2001
Jack Siemiatycki

Privacy of personal health records has become an important public issue. There is a broad consensus in the public and in the medical community that such information should be kept confidential. It might therefore seem strange that many medical researchers are alarmed at the trend toward greater legislative restrictions on use of private health data. And the public should be concerned as well, because our ability to achieve research breakthroughs is inceasingly hampered and in some instances may be crippled by unnecessarily restrictive policies.

We are justifiably indignant at the idea that private information could fall into unscrupulous hands and that this could cause harm to our reputations or our pocketbooks. Over the past several years, governments have established laws and agencies devoted to minimizing the unwarranted collection and exploitation of private information. Each law leapfrogs over the previous ones in further restricting what is permissible. Supporting privacy legislation has become a "motherhood" issue. However, policy makers, and the public, need to take a sober look at the possible unintended consequences of such developments.

Many types of medical research, such as most basic research carried out in experimental labs, are not affected by privacy legislation. However, some types, particularly those that involve using information about people, but no medical intervention, are vulnerable to such legislation. When it is feasible for the patients themselves to be asked for permission to access their data, this is the prefered strategy. But, as will be illustrated with two examples, sometimes it is not feasible.

Example 1: Suppose we wish to investigate whether there is any risk of brain cancer related to prolonged use of cellular telephones. One way to study this question would be to contact cancer patients, as well as control group of healthy people, and ask them about their past use of cellular phones. To conduct such research properly, the researcher needs to know, in a given city or province, who has brain cancer, so that all eligible patients can be approached and offered the opportunity to participate. Some privacy regulations would make it illegal for hospitals or cancer registries to provide a list of patients to the researcher without the patients' authorisations to do so. However, this leads to a Catch-22 situation in which the researcher cannot gain access to the patient in order to request his consent. Privacy advocates claim that the way around this is for the patient's doctor or the hospital to be responsible for enrolling patients for research and obtaining their consent before researchers are given any information. This is fallacious on two grounds. Physicians and hospital personnel are not dependable gatekeepers for this type of research; they are overburdened with administrative and clinical responsibilities. From 25 years experience, I can attest that unless the patient's doctor has a personal stake in the research, it is hopeless for a researcher to sit passively while waiting for doctors and hospital personnel to notify them of patients for study. The second reason is that in order to monitor the validity of the research, the researcher has to know not only how many patients are willing to participate, but also how many are unwilling. For the integrity of the research, it is essential that the researcher be on top of the subject recruitment process. Obviously, patients who decline to participate should have their wishes respected.

Example 2: Suppose we wish to use data contained in data banks of provincial medicare agencies to estimate the trend in waiting times for cancer surgery between 1990 and 2000. The key information, which can be derived from computerised files held by provincial agencies, concerns the delay between the date of diagnosis and the date of surgery. In this example, no personal identifying information need pass to the researcher; we are talking about giving researchers access to completely anonymous records. The possibility of harm or prejudice to the individuals concerned is nil. Still, some privacy advocates argue, and some legislation reflects the view, that researchers should not be granted access to such information without express written permission from each patient whose data would be used. It would be impossibly costly to envisage contacting each of hundreds of thousands of patients, many of whom might be deceased by the time the contact can be made, just to ask if researchers can access and use for statistical purposes anonymous information that is contained in their records.

Under strict privacy regulations in force in some jurisdictions, the types of research described above would be so onerous as to be virtually prohibited.

The benefits of medical knowledge that we enjoy today are due to research that has been conducted using information about millions of people in the past, mostly without their being aware that such information has been used. The fact that asbestos can cause lung cancer, that hormonal factors affect breast cancer, that physical exercise may protect against heart disease, are but three among thousands of important medical discoveries that were made by investigators who had access to private information about hundreds or thousands of patients. Think what your life and that of your loved ones might have been like if these discoveries had never been made and the avenues for preventing these diseases had not been opened up by these findings. Does our generation have a right to benefit from the cumulative medical knowledge derived in the past, if it is not willing to allow future generations to benefit from our experience?

Draconian privacy laws can have disastrous unintended consequences. If the laws and regulations currently in force in some jurisdictions had been in force 50 years ago throughout the western world, it is quite possible that the research which proved the causal link between smoking and lung cancer would never have been done. That research, which used confidential information about cancer patients, with no apparent harm to any of them, opened the door to saving millions of lives. What privacy advocate would claim that such research should never have been done? And how could such a position be ethically justified?

There is a trade-off between different values in society. The right to privacy is a noble human right, but so is the right to health. If we want to see research to determine whether environmental agents may cause cancer or other diseases, if we want to see research to determine whether our health system is functioning properly and how it can be improved, then society has to balance these competing rights. Private information is not, and should not be, available just for the asking. Hospitals, universities, and government agencies already have specially constituted committees to evaluate each proposed research project to ensure that such usage conforms to acceptable ethical and security standards. These committees should should be given an unambiguous message that society values both privacy and health research, and that their task should be to maximise the opportunity to conduct legitimate, potentially useful research, while minimising any harm to human subjects.

Unless laws and regulations designed to protect privacy make specific and explicit allowances for health providers, hospitals and government agencies to share health data, with appropriate safeguards, with legitimate health researchers, we will forego important advances in knowledge.

Dr Jack Siemiatycki is a Professor and Canada Research Chair at l'Université de Montréal, and President of the Canadian Society for Epidemiology and Biostatistics.