Delivering proportionate governance in the era of eHealth: Making linkage and privacy work together

Medical Law International

Volumn 13, Issue 2-3, 2013, Pages 168-204

  Sethi, Nayha ^a   Laurie, Graeme T ^a  

^a UNIVERSITY OF EDINBURGH   (United Kingdom)

Author keywords

Data linkage; EHealth; Information governance; Principles; Proportionality; Research

Indexed keywords

ARTICLE; CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; GOVERNMENT; HEALTH CARE POLICY; INFORMATION PROCESSING; MEDICAL DECISION MAKING; PRIVACY;

EID: 84900838941     PISSN: 09685332     EISSN: 20479441     Source Type: Journal    
DOI: 10.1177/0968533213508974     Document Type: Article

References (131)

1. R. Thomas and T. Walport, Data Sharing Review Report (2008);
2. W. Lowrance, Learning from Experience: Privacy and the Secondary Use of Data in Health Research (London, UK: Nuffield Trust, 2002);
3. B. Miriovsky et al, 'Importance of Health Information Technology, Electronic Health Records, and Continuously Aggregating Data to Comparative Effectiveness Research and Learning Health Care', Journal of Clinical Oncology 15 (2012), pp. 4243-4248;
4. I. Kohane, 'Using Electronic Health Records to Drive Discovery in Disease Genomics', Nature Reviews Genetics 12 (2011), pp. 417-428;
5. C. Safran et al, 'Toward a National Framework for the Secondary Use of Health Data: An American Medical Informatics Association White Paper', Journal of the American Medical Informatics Association 14 (2007), pp. 1-9. (Pubitemid 44909487)
6. Such initiatives include: SHIP (Scottish Health Informatics Programme). Available at: http:// www.scot-ship.ac.uk (accessed 2 December 2012);
7. EHR4CR (Electronic Health Records for Clinical Research). Available at: http://www.ehr4cr.eu (accessed 2 December 2012);
8. The Secure Anonymised Information Linkage (SAIL) Databank. Available at: http://www. ehi2.swansea.ac.uk/en/sail-databank.htm (accessed 2 December 2012).
9. Data LinkageWA. Available at: http://www.datalinkage-wa.org (accessed 14 September 2012).
10. Manitoba Centre for Health Policy. Available at: http://umanitoba.ca/ faculties/medicine/ units/community-health-sciences/departmental-units/mchp (accessed 14 September 2012).
11. Medical Research Council, E-Health Informatics Research Centres Call. Available at: http:// www.mrc.ac.uk/Fundingopportunities/Calls/E- healthCentresCall/index.htm (accessed 29 August 2012).
12. G. Laurie and N. Sethi, 'Towards Principles-Based Approaches to Governance of Health-related Research using Personal Data', European Journal of Risk Regulation 1(2013), pp. 43-57.
13. See Scottish Health Informatics Programme, Electronic Health Records for Clinical Research and The Secure Anonymised Information Linkage (SAIL) Databank in addition to: A Scotland-wide Data Linkage Framework for Statistics and Research: Consultation Analysis. Available at: http://www.scotland.gov.uk/ Publications/2012/08/3287 (accessed 2 December 2012).
14. B. Rumbold et al., Understanding Information Governance: Access to Person-Level Data in Health Care (London: Nuffield Trust, 2011);
15. J. Peto et al., 'Data Protection, Informed Consent, and Research', British Medical Journal 328 (2004), pp. 1029-1030. (Pubitemid 38580823)
16. L. Govan et al., 'The Effect of Deprivation and HbA(1c) on Admission to Hospital for Diabetic Ketoacidosis in Type 1 Diabetes', Diabetologia 55 (2012), pp. 2356-2360;
17. J. Walker et al, 'Effect of Socioeconomic Status on Mortality Among People With Type 2 Diabetes: A study from the Scottish Diabetes Research Network Epidemiology Group', Diabetes Care 34 (2011), pp. 1127-1132.
18. R. Thomas and T. Walport, 'Data Sharing Review'.
19. W. Lowrance, Privacy, Confidentiality and Health Research (Cambridge: Cambridge University Press, 2012) and 'Learning from Experience: Privacy and the Secondary Use of Health Data in Research', Journal of Health Services Research and Policy 8 (2003), pp. 2-7;
20. D. Willison, 'Privacy and the Secondary Use of Data for Health Research: Experience in Canada and Suggested Directions Forward', Journal of Health Services Research and Policy 8 (2003), pp. 17-23;
21. M. Law, 'Reduce, Reuse, Recycle: Issues in the Secondary Use of Research Data', Spring IASSIST Quarterly (2005), pp. 5-10;
22. J. Brown and J. Semradek, 'Secondary Data on Health-Related Subjects: Major Sources, Uses and Limitations', Public Health Nursing 9 (1992), pp.162-171;
23. P. Lelliot, 'Secondary Uses of Patient Information', Advances in Psychiatric Treatment 9 (2003), pp. 221-228.
24. R. Thomas and T. Walport, 'Data Sharing Review';
25. G. Laurie and N. Sethi, 'Current Practices' and 'Towards Good Governance'.
26. House of Lords, Science and Technology Committee 2nd Report of Session 2008-09, 'Genomic Medicine' para 6.15. Available at: http://www.publications. parliament.uk/pa/ ld200809/ldselect/ldsctech/107/107i.pdf (accessed 2 December 2012).
27. C. Bennett and C. Raab, 'The Adequacy of Privacy: The European Union Data Protection Directive and the North American Response', The Information Society: An International Journal 13 (1997), pp. 245-264; (Pubitemid 127116998)
28. Y. Poullet, 'The Directive 95/46/EC: Ten years after', Computer Law and Security 22 (2006), pp. 206-217.
29. The UK Administrative Data Research Network, Improving Access for Research and Policy: Report from the Administrative Data Taskforce (2012), p. 16. Available at: http://www.esrc. ac.uk/-images/ADT-Improving-Access-for- Research-and-Policy-tcm8-24462.pdf (accessed 10 May 2013).
30. S. Harmon and K. Chen, 'Medical Research Data-sharing: The "Public Good" and Vulnerable Groups', Medical Law Review 20 (2012), pp. 516-539, at p. 522.
31. G. Laurie, 'Evidence of Support for Biobanking Practices', British Medical Journal 337 (2008), pp. 186-187;
32. G. Laurie and E. Postan, 'Rhetoric or Reality: What is the Legal Status of the Consent Form in Health-Related Research?' Medical Law Review (2012), pp. 1-44.
33. G. Laurie, Genetic Privacy: A Challenge to Medico-Legal Norms (New York, NY: Cambridge University Press, 2002), p. 335;
34. N. Manson and O. O'Neill, Rethinking Informed Consent in Bioethics (Cambridge/New York: Cambridge University Press, 2007) p. 212;
35. O. O'Neill, Autonomy and Trust in Bioethics, Gifford Lectures, University of Edinburgh (CUP, 2002).
36. R. Al-Shahi and C. Warlow, 'Using Patient-Identifiable Data for Observational Research and Audit' British Medical Journal 321 (2000), pp. 1031-1032.
37. National Health Service National Services for Scotland (NHS NSS) Caldicott Guardians, see: http://www.nhsnss.org/pages/corporate/caldicott- guardians.php (accessed 2 December 2012).
38. G. Laurie and N. Sethi, 'Towards Good Governance', p. 16.
39. The Health Research Authority Confidentiality Advisory Group. Available at: http://www. hra.nhs.uk/hra-confidentiality-advisory-group (accessed 7 May 2013).
40. Previously the Ethics and Confidentiality Committee - see National Information Governance Board for Health and Social Care, Ethics and Confidentiality Committee. Available at: http:// www.nigb.nhs.uk/ecc (accessed 3 December 2012).
41. NHS National Services Scotland, Privacy Advisory Committee. Available at: http://www. nhsnss.org/pages/corporate/privacy-advisory-committee.php (accessed 3 December 2012).
42. Law, 'Reduce Reuse Recycle', p. 644.
43. C. Kalman, 'Increasing the Accessibility of Data', British Medical Journal 309 (1994), p. 740.
44. G. Laurie, 'Reflexive Governance in Biobanking: On the Value of Policy Led Approaches and the Need to Recognise the Limits of Law', Human Genetics 130 (2011), pp. 347-356.
45. O. De Schutter and J. Lenoble (eds), Reflexive Governance: Redefining Public Interest in a Pluralistic World (Oxford, England/ Portland, Or: Hart Publishing, 2010).
46. See 'Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions Safeguarding Privacy in a Connected World A European Data Protection Framework for the 21st Century'. Available at: http://eurlex.europa.eu/ LexUriServ/LexUriServ.do? uri=CELEX:52012DC0009:en:NOT (accessed 19 September 2012).
47. Robinson et al., 'Review of the European Data Protection Directive' (2009) Prepared for the ICO. See: http:// www.ico.gov.uk/upload/documents/ library/data-protection/detailed-specialist-guides/review-of-eu-dp-directive. pdf (accessed 19 September 2012).
48. T. Beauchamp and J. Childress, Principles of Biomedical Ethics, 5th ed. (New York/Oxford: Oxford University Press, 2001), at p.13.
49. M. Selgelid, 'Universal Norms and Conflicting Values', Developing World Bioethics 5 (2005) pp. 267-273, at p. 269.
50. ICO, Information Commissioner's Office: Initial analysis of the European Commission's proposals for a revised data protection legislative framework (February 2012), p.2. See: http://www.ico.org.uk (accessed 15 June 2013).
51. R. Thomas and T. Walport, 'Data Sharing Review'.
52. Academy of Medical Sciences, 'New Pathways', p. 6.
53. Department of Health, Information Governance Review, at p. 62.
54. Now known as the ScottisH Informatics Programme; see further: http://www.scot-ship.ac.uk/ (accessed 15 June 2013).
55. G. Laurie, S. Harmon and F. Arzuaga, 'Foresighting Futures: Law, New Technologies and the Challenges of Regulating for Uncertainty', Law, Innovation and Technology 4 (2012), pp. 1-33.
56. J. Kaye and S. Gibbons, 'Mapping the Regulatory Space for Genetic Databases and Biobanks in England and Wales', Medical Law International 9 (2008), pp. 111-130; (Pubitemid 351969717)
57. W. Lowrance, 'Learning From Experience';
58. J. Black, Forms and Paradoxes of Principle Based Regulation, LSE Law, Society and Economics Working Papers 13/ 2008 and The 'Principles' Paradox, Duke Law School Legal Studies Paper No. 205 (2008);
59. S. Clark and A. Weale, Information Governance in Health: An Analysis of the Social Values Involved in Data Linkage Studies (London, UK: The Nuffield Trust, 2011)
60. T. Beauchamp and J. Childress, Principles of Biomedical Ethics, 6th ed. (New York: Oxford University Press, 2009).
61. G. Laurie and N. Sethi, 'Current Practices' and 'Towards Good Governance'.
62. J.K. Mason and G. Laurie, Law and Medical Ethics, 9th ed. (Oxford: OUP, 2013), chapter 6.
63. E. Singer and P. Endreny, Reporting on Risk: How the Mass Media Portray Accidents, Diseases, Disasters, and Other Hazards (New York, NY: Russell Sage Foundation, 1993);
64. C. Abou Zahr et al., 'From Data to Policy: Good Practices and Cautionary Tales', The Lancet 369 (2007), pp. 1039-1046. (Pubitemid 46436127)
65. L. Brown, M. Parker and M. Dixon-Woods, 'Whose Interest? BritishNewspaper Reporting of Use of Medical Records for Research', Journal of Health Services Research and Policy 13 (2008), pp. 140-145. (Pubitemid 352029755)
66. P. Ohm, 'Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization', UCLA Law Review 57 (2010), pp. 1701-1777.
67. L. Bygrave, 'The Place of Privacy in Data Protection Law', University of New South Wales Law Journal 24 (2001), pp. 277-283.
68. L. Nakanishi, The Difference Between Security and Privacy and Why We Must Better Communicate About Both, Data Security and Privacy Group (2011); available at: http:// datasecurity.edelman.com/the-difference-between-security- and-privacy-and-why-we-mustbetter-communicate-about-both/ (accessed 25 March 2013).
69. P. Thompson, 'Privacy, Secrecy and Security', Ethics and Information Technology 3 (2001), pp. 13-19.
70. H. Tavani and J. Moor, 'Privacy Protection, Control of Information, and Privacy Enhancing Technologies', Computers and Society 31 (2001), pp. 6-11.
71. M. da Silva et al., 'Informed Consent for Record Linkage: A Systematic Review', Journal of Medical Ethics 38 (2012), pp. 639-642.
72. M. Taylor, 'Health Research, Data Protection and the Public Interest in Notification', Medical Law Review 19 (2011), pp. 267-303 at p. 277.
73. M. Feintuck, The Public Interest in Regulation (Oxford, UK: OUP, 2005), and more particularly and recently, see 'Leveson Inquiry: Culture, Practice and Ethics of the Press'. Available at: http://www.levesoninquiry.org.uk/ (accessed 3 December 2012).
74. J.K. Mason and G. Laurie, Law and Medical Ethics, chapter 19.
75. J. Powell and I. Buchan, 'Electronic Records Should Support Clinical Research', Journal of Medical Internet Research 7 (2005).
76. B. Prainsack and A. Buyx, 'Solidarity in Contemporary Bioethics: Towards a New Approach', Bioethics 26 (2012), pp. 343-350
77. Solidarity: Reflections on an Emerging Concept in Bioethics' (London, UK: Nuffield Council on Bioethics, 2011).
78. J. Sheather, 'Confidentiality and Sharing Health Information', British Medical Journal 338 (2009), p. 1458.
79. G. Laurie, 'Evidence of Support' and 'Genetic Privacy';
80. G. Laurie and E. Postan, 'Rhetoric or Reality';
81. N. Manson and O. O'Neill, 'Rethinking Informed Consent'
82. and O. O'Neill, 'Autonomy and Trust in Bioethics'.
83. M. Otlowski, 'Tackling Legal Challenges Posed by Population Biobanks: Reconceptualising Consent Requirements', Medical Law Review 20 (2012), pp. 191-226.
84. A. MacLean, 'From Sidaway to Pearce and Beyond: Is the Legal Regulation of Consent Any Better Following a Quarter of a Century of Judicial Scrutiny?', Medical Law Review 20 (2012) pp. 108-129.
85. M. Otlowski, 'Tackling Legal Challenges', p. 191.
86. T. Caulfield and J. Kaye, 'Broad Consent in Biobanking: Reflections on Seemingly Insurmountable Dilemmas', Medical Law International 10 (2009), pp. 85-100.
87. T. Caulfield, 'Biobanks and Blanket Consent: The Proper Place of the Public Good and Public Perception Rationales', Kings Law Journal 1 (2007), pp. 209-226.
88. E. Regidor, 'The Use of Personal Data from Medical Records and Biological Materials: Ethical Perspectives and the Basis for Legal Restrictions in Health Research', Social Science and Medicine 54 (2004), pp. 1975-1894 at p.1976.
89. P. Furness and L. Nicholson, 'Obtaining Explicit Consent for the Use of Archival Tissue Samples: Practical Issues', Journal of Medical Ethics 20 (2004), pp. 561-564. (Pubitemid 40029062)
90. Article 29 Data Protection Working Party (2011) Opinion 15/2011 on the definition of consent; available at: http://ec.europa.eu/justice/policies/ privacy/docs/wpdocs/2011/ wp187-en.pdf (accessed 12 April 2013) 103.
91. M. Aitken, S. Cunningham-Burley and C. Pagliari, 'Public Responses To The Scottish Health Informatics Programme: Preferences And Concerns Around The Use Of Personal Medical Records', Research Journal of Epidemiology and Community Health 65 (2011): A27 and SHIP Public Engagement, 'Your data and health research: SHIP Public Workshops', 'What makes researchers trustworthy'. Available at: http://www.scot-ship.ac.uk/publications (accessed 10 May 2013).
92. B. Rumbold et al., 'Access to Person-Level Data', p. 7.
93. W. Lowrance, 'Learning from Experience', S1, p. 5.
94. Ohm, 'Broken Promises', p. 1710.
95. Homer et al., 'Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Micro Arrays', PLoS Genetics 4 (2008), pp. 1-11
96. and Ohm, 'Broken Promises', p. 1701.
97. Available at: http://www.csags.scot.nhs.uk/ppc/ppc.pdf (accessed 3 December 2012).
98. S. Shaw and G. Barrett, 'Research Governance: Regulating Risk and Reducing Harm?', Journal of the Royal Society of Medicine 99 (1994), pp. 14-19.
99. See Caldicott Guardians Forum. Available at: http://www.nhsnss.org/pages/ corporate/ caldicott-guardians.php (accessed 30 July 2013).
100. NHS National Services for Scotland, Privacy Advisory Committee for Scotland, 'Guiding Principles'. Available at: http://www.nhsnss.org/pages/ corporate/about-pac.php (accessed 30 July 2013).
101. Academy of Medical Sciences, 'New Pathways', p. 6.
102. S. Shaw and G. Barrett, 'Regulating Risk', p. 18.
103. Academy of Medical Sciences, 'New Pathways', p. 52.
104. MRC/DH/MHRA, 'Risk-adapted Approaches to the Management of Clinical Trials of Investigational Medicinal Products' (2011). Available at: http://www.mhra.gov.uk/home/ groups/l-ctu/documents/websiteresources/con111784. pdf (accessed 5 December 2012).
105. T. Harbo, 'The Function of the Proportionality Principle in EU Law', European Law Journal 16(2) (2010), pp. 158-185.
106. Mason and Laurie, 'Law and Medical Ethics', chapter 19.
107. ICO, Privacy Impact Assessment. Available at: http://www.ico.gov.uk/for- organisations/ data-protection/topic-guides/privacy-impact-assessment.aspx (accessed 5 December 2012).
108. B. Goold, 'Technologies of Surveillance and the Erosion of Institutional Trust', in K. Aas, ed. Technologies of in Security: The Surveillance of Everyday Life (Florida, FL, USA: Taylor & Francis, 2009) pp. 207-218 at p. 213.
109. UK Consumers Wake Up to Privacy. Available at: http://www.ico.gov.uk/ upload/ documents/library/data-protection/detailed-specialist-guides/icm- research-into-personal -information-feb08.pdf (accessed 3 December 2012).
110. K. Long, 'Opinion Article: Public Confidence in NHS Integrity is Under Threat from Staff Breaches of Confidential Patient Information' (2011). Available at: http://www.ehealthnews.eu/industry/2750-opinion-article-public- confidence-in-nhs-integrity-is-under-th reat-from-staff-breaches-of- confidential-patient-information (accessed 3 December 2012).
111. Scottish Executive Health Department, 'The use of personal health information in NHS Scotland to support patient care', NHS HDL 37 (2003), at p. 6.
112. See V. Armstrong et al., 'Public Attitudes to Research Governance: A Qualitative Study in a Deliberative Context', Wellcome Trust Report (London, UK: The Wellcome Trust, 2007).
113. P. Singleton et al., General Medical Council Public and Professional Attitudes to Privacy of Healthcare Data: A Survey of the Literature (Cambridge Health Informatics Limited, 2007). See: http://www.gmc-uk.org/GMC-Privacy- Attitudes-Final-Report-with-Addendum.pdf-34090707.pdf (accessed 10 May 2013).
114. http://www.ukanon.net (accessed 11 May 2013).
115. http://ico.org.uk/enforcement/fines (accessed 9 May 2013).
116. Banff Executive Leadership Inc., 'Improving Governance Performance: Rules-Based vs. Principles-based Performance', Leadership Acumen, 16 (2004), pp. 1-5; Black, Forms and Paradoxes.
117. On the guiding principles of good governance, see Independent Commission on Good Governance, The Good Governance Standard for Public Services (2004), at p.4.
118. G. Laurie and N. Sethi, 'Towards Principles-Based Approaches'.
119. T. Beauchamp and J. Childress, Principles of Biomedical Ethics, 6th ed. (New York: Oxford University Press, 2009);
120. Seligman et al, 'The Role of Values';
121. S. Arjoon, 'Striking a Balance Between Rules and Principles-Based Approaches for Effective Governance: A Risk-Based Approach', Journal of Business Ethics 68 (2006), pp. 53-82, at p. 55.
122. Further details and access to materials from this group can be available at: http://www.scotship. ac.uk/publications (accessed 10 May 2013).
123. G. Laurie and N. Sethi, 'Towards Good Governance', p.9.
124. See T Honderich (ed.), The Oxford Companion to Philosophy (Oxford, UK: Oxford University Press, 1995) at p. 719.
125. See SHIP Guiding Principles and Best Practice. Available at: http://www.scotship.ac.uk/sites/default/files/Reports/Guiding-Principles-and- Best-Practices-221010.pdf (accessed 10 May 2013).
126. N. Daniels, 'Accountability for Reasonableness, British Medical Journal 321 (2000), p. 1300.
127. J. Rawls, A Theory of Justice (Oxford: Clarendon Press, 1972).
128. http://www.scotland.gov.uk/Resource/0040/00407739.pdf (accessed 30 July 2013).
129. G. Laurie and N. Sethi, 'Towards Good Governance', p. 20.
130. For technical details on how SHIP operates, particularly the role of safe havens, consult the SHIP Blueprint. Available at: http://www.sco-ship.ac.uk/ publications (accessed 10 May 2013).
131. G. Laurie and N. Sethi, 'Towards Good Governance', p. 35.