Release of the Fifth Report by the Bioethics Advisory Committee – Personal Information in Biomedical Research

RELEASE OF A REPORT BY THE BIOETHICS ADVISORY COMMITTEE

The Bioethics Advisory Committee (BAC) announces the release of a Report entitled: “Personal Information in Biomedical Research”. This Report discusses the ethical issues relating to the use of personal information in biomedical research and makes recommendations on the appropriate use of such information through the provision of proper safeguards.

The use of personal information is essential for biomedical research. It has produced valuable medical knowledge which in turn has improved healthcare. However, with the wide use of such information and rapid advances in information technology, there is a need for proper rules governing the access to, and use of, personal information and a secure system of information protection. The Report calls for a framework to protect privacy and confidentiality and allow legitimate use and exchange of information for research. A statutory framework is essential if researchers in Singapore are to collaborate with researchers from other jurisdictions.

Eleven recommendations are made, based on the following ethical principles:

• Autonomy – where individuals are deemed to be entitled to decide, in general, their participation in research, and their informed consent needs to be sought;

• Proportionality – the protection to be offered and the information to be provided to research participants should be in proportion to any risk of harm;

• Reciprocity – the principle that in benefiting from past research, individuals should consider participating in future research if it poses little or no risk of harm to them; and

• Protection of privacy – the view that individuals are entitled to privacy, and that they can legitimately expect that their personal particulars and information will be treated with proper respect and kept confidential, should they participate in research or should their personal information be used in research.

Personal Information, which is considered to be any information about an individual can be divided into two main categories:

• Identified personal information: Information where identifying particulars are included, so that the identity of the individual is known, for example, in a medical record;

• De-identified personal information, comprising:

• Reversibly de-identified personal information, in which identifying particulars have been separated from the information, and a code or system of codes or encryption substituted, so that the identity of the person becomes unknown but could be restored using the codes or reversing the encryption; or

• Irreversibly de-identified personal information, which is information that has been permanently stripped of identifying details and thus cannot be used to identify an individual.

Researchers must prevent breaches of privacy and are encouraged to manage personal information, especially sensitive information, as de-identified information as far as possible. There are other security safeguards that may be employed to protect against loss, theft, unauthorized access, disclosure, copying, use and modification of data.

Generally the use of personal information in biomedical research requires the consent of the individual concerned and the approval of an IRB. Requesting consent is not just a matter of providing information. It is a matter of explaining what is proposed in a way and at a level appropriate to the intending participant and in proportion to any risk of harm in participating.

Public health research and disease registries collect patient information, analyse the data and report incidence, pattern and trends of diseases, work which is critical for the formulation of public health policies, programme planning and research in general. The Report recommends that medical information should be disclosed to national disease registries, without requiring the prior consent of patients, as is done in a number of other scientifically advanced countries, for example the UK (cancer registries) and Sweden. Care should be taken to keep such data confidential.

Similarly, the study of patients’ medical records has engendered much valuable medical knowledge. However, obtaining consent is not always practicable and there is minimal risk of harm to the patients concerned. Therefore, the BAC recommends that IRBs be legally empowered to waive patient consent requirement in situations where the research involves only the use of medical records, with no patient contact and privacy and confidentiality are not in any way compromised.

BAC Chairman, Professor Lim Pin says: “It is no secret that Singapore aims to be a world class hub for biomedical science. Research participation and use of personal information in biomedical research are necessary to achieve this aim. There are types of research that have important public health justification with minimal risk of harm. An example is research into factors affecting health and disease in populations (epidemiology). After careful consideration, the BAC felt that it is ethically acceptable for personal information to be used in such research without consent, provided that privacy and confidentiality safeguards are in place. The safeguards set out in this Report should assure the public that their privacy and the confidentiality of their personal information are adequately protected.”

The Report also considers concerns that arise in taking consent for research from vulnerable persons (such as children and adolescents, the mentally impaired or those, like National Service men, who might experience pressure to conform). When reviewing research proposals, IRBs should ensure that any concerns in regard to vulnerable persons are appropriately addressed, and data from such persons should enjoy the same privacy and confidentiality as for any other persons.

The Report also makes clear that research participants be informed of procedures for withdrawal and should be able to withdraw consent at any time without explanation or prejudice.

Lastly, the Report discusses the limits to the right of access to predictive genetic or other medical information by employers and insurers. In the case of insurers a general moratorium on such access is recommended, following the example of the UK, until issues of how such information could be used are sufficiently considered by both government and the insurance industry.

LIST OF RECOMMENDATIONS

The Legal Protection of Personal Protection

We recommend that the relevant authorities consider establishing a comprehensive statutory framework relating to the use and protection of personal information in biomedical research.

Privacy and Confidential

Personal information used for research should be de-identified as far and as early as possible and should be stored or transferred as de-identified information.

Researchers should take adequate measures to prevent inadvertent identification of individuals. Should an individual be identified inadvertently from de-identified information, the confidentiality and privacy rights of this individual are not abrogated by such identification, and steps should be taken to reinstate and secure them.

Irreversibly de-identified personal information need not be subject to privacy and confidentiality requirements.

Privacy and confidentiality safeguards should be commensurate with the potential risk of harm from disclosure, and should be proportional to the sensitivity of the information and the kind of research being carried out. When reversibly de-identified information is used for research, IRBs should consider the adequacy of the extent and means of the de-identification in proportion to the risk.

Consent and Proportionality

Specific consent should be obtained for sensitive research or when the research involves identified personal information or tissue samples. General consent should be a sufficient requirement for subsequent unspecified research involving the use of de-identified information or de-identified surplus or stored tissues. The information to be provided to the individual when taking consent should depend on and be proportional to the sensitivity of the research and the risk of harm.

Consent and Reciprocity

We recommend that the relevant authorities clarify the legal basis for the disclosure of medical information to national disease registries by physicians; and establish mechanisms enabling national registries and healthcare institutions to facilitate the use of personal information held or controlled by them for biomedical research that can significantly advance the public good, while safeguarding privacy.

We recommend that IRBs be legally empowered to waive the patient consent requirement for research involving only the use of medical records, while ensuring patient privacy and confidentiality of medical information.

Vulnerable Persons

We recommend that IRBs, when reviewing research proposals, ensure that any concerns in regard to vulnerable persons are appropriately addressed although researchers should always respect the nature of such data and treat it with sensitivity.

Withdrawal of Consent

Research participants should be allowed to withdraw their consent to participate in the research at any time without explanation and without prejudice, and should be informed of the procedure for withdrawal and its implications when consent is sought.

Access to Predictive Genetic Information by Employers and Insurers

We recommend that the government consider implementing a moratorium on the use of predictive genetic information for insurance purposes, consider the long-term implications of the accessibility of predictive genetic test results by employers and the insurance industry, and monitor developments in this area.

For media enquiries, please contact the BAC Secretariat:

Dr Sylvia Lim
DID: (65) 6826 6258
sylvia_lim@bioethics-singapore.gov.sg

Ms Vivien Goh
DID: (65) 6826 6292
Vivien_Goh@bioethics-singapore.gov.sg