Practices for Protecting Privacy in Health Research: Perspectives of the Public, Privacy Guidance Documents and REBs

Health research is the single vehicle for uncovering the varying causes of disease or illness, understanding the broader determinants of health, and discovering new or to validating traditional ways of treating the individuals who suffer from these conditions. Thus, health research activities are at the heart of medical, health and scientific developments. While health research activities exemplify some of the greatest hopes for improved health-care, they also highlight public concerns for the protection of personal health information (PHI). More specifically, advances in modern information technology and the increasing pace of international collaborative studies raise challenging issues regarding privacy protection in health research. The extensive quantities of data housed in general-use databases and electronic health records (EHRs) are two frequently cited examples of “electronic health information” that are now increasingly available to researchers globally . For example, individual discrete studies are expanding into long-term prospective disease or treatment databases without clear research questions and involving multiple research teams and jurisdictions. As well, EHRs are increasingly taking a prominent role in Western industrialized nations such as England, Australia, New Zealand, Germany, the Netherlands, the United States, as well as Canada. The expected large scale demand for the secondary uses of personal health information (PHI) from electronic health records represents another significant challenge to privacy. EHRs facilitate clinical and population-based health research not only in terms of secondary uses, such as retrospective observational studies, but also for prospective cohort studies. In Canada today, there are two documents that provide direction that is applicable at a national level to privacy protection practices in health research: The Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS 2) and the CIHR Best Practices for Protecting Privacy in Health Research (CIHR BPPP). The TCPS 2, a policy document, is the most influential Canadian policy applicable to the ethics of research with human participants and widely followed by Canadian researchers and institutions. Conversely, use of the CIHR BPPP is purely optional. Canadian REBs are responsible for much of the governance of privacy, confidentiality and security in health research. However, the extent to which they apply and utilize the privacy provisions from the TCPS 2 and CIHR BPPP in their protocol requirements is not known. This thesis provides a descriptive comparative study of the international and Canadian contexts for privacy protection in health research and produces a greater understanding of two Canadian stakeholder groups: the Canadian public, whose participation and trust is imperative for valid research; and Canadian Faculty of Medicine (FoM) university biomedical REBs with whom much responsibility for ensuring appropriate protection of privacy and confidentiality in health research rests