ACCESS TO CONFIDENTIAL DATA

CONSENT AND PERMISSION TO ACCESS CONFIDENTIAL FILES

In order to access confidential files, the researcher ordinarily must obtain the consent of the subject and the permission of the agency or institution holding the file. These are separable requirements.

1. Subject Consent: If the files are in the legal possession or property of the individual subjects, (For example medical records), the researcher must obtain from each subject consent to examine the files and to extract data from them.  In many instances, securing subject consent is not possible. For such cases, there are alternative procedures which appear below. However, if the individual subjects are accessible, regardless of inconvenience to the researcher, their individual consent is required.  Besides the regular provisions of written informed consent the document should detail for the subject exactly what items of data will be extracted from the files, whether the subject’s identity or identifying links will be part of the data extracted, and what uses will be made of the data. If the subject’s identity will be part of the data extracted, inform the subject whether and how his/her identity will be held confidential, tell the subject exactly what uses will be made of identifying data.  

2. Agency Permission: in addition to subject consent, the researcher must obtain permission from the individual, agency, or institution holding the file for access to it.  Any subject or agency that has ownership or guardianship responsibilities for confidential files may decline research investigation into such files with our reason, except as specifically provided by law or regulation. No researcher should attempt by any means to obtain improperly the contents of such files, even if the files appear to be accessible or if the agency or institutional safeguards do not accord with the requirements currently applicable to them.

As an example of the requirements for subject consent and institutional permission, federal regulations (34 CFR 99, Department of Education) guarantee the privacy of school records directly related to the student and maintained by an educational institution or agency.  Primary rights of access belong to parents or guardians and to students who have reached 18 years of age. Except for certain administrative, directory, scholarship,and similar purposes, schools must withhold access to personally identifiable information in student records except with the written consent of the student’s parents or emancipated student. Valid consent for the disclosure of educational records must include a specification of the records to disclosed, the purposes of the disclosure, and the name of the party or class of parties receiving the disclosure. Upon request, the school must supply the parents or students with a copy of the data disclosed. Moreover, the school must record in the student’s file all parties requesting and obtaining personally identifiable data, along with their legitimate interests in obtaining the information. 

ALTERNATIVE TO CONSENT PROCEDURES

There are cases in which a researcher may not be able to obtain the consent of the individual su objects of confidential files. For example, files ay include persons who do not live in the region where the files are held or persons who may have changed address without notice. In these cases, researchers may device with the agency or institution holding the file a means of extracting data from which all personal identifiers have been removed. Three models for data extraction generally meet requirements for preserving the privacy of the file subjects.

1. Agency Personnel: Agency personnel authorized to enter confidential files may extract the data requested by the investigator and approved by the agency. Researchers should understand that this service represents a burden upon agencies and institutions holding confidential files. As a result, agencies cannot always provide the service.

2. Researchers: Investigators may, with agency permission, extract data from confidential files if they have met all agency requirements for access. These requirements may include direct supervision by agency personnel, confidentiality oaths, and other provisions of agency policy or applicable law and regulation. In some instances, however the researcher may need to maintain a distance from the confidential files in order to avoid accessing data outside the scope of the research investigation. In other cases, agencies or institutions cannot permit direct access by researchers to their confidential files. 

3. Research Aides: if an agency cannot undertake the work of data extraction and if the researcher must avoid direct access to confidential files, the project may employ under certain conditions a research aid. With active participation by appropriate agency or institutional officials in the selection of a suitable individual and a subsequent written approval of that selection, a research aide may perform the task of data extraction. The aide should receive a full briefing on the requirements for maintaining stricter confidentiality regarding the contents of the files and should sign any applicable oaths. In general, research aids should have no other role in the project for which they perform data extraction services. These models of access confidential data in no way supersede the requirements for subject consent, but apply only in cases where subject consent is not obtainable. The two key principles are preserving the confidentiality of subject identities and providing safeguards for those legally responsible for maintaining confidential files.

THE RESEARCHER AND SERVICE PROVIDER

If the individual conduction research is a provider of service or therapy within an agency or institution holding confidential files, special considerations apply. Although an individual who provides professional services may have legitimate access to files in the course of these duties, this fact does not itself imply the propriety of further file access in the role of a researcher. Where the roles of providing services and research are quite distinct, as in the case of an active professional conducting thesis or dissertation research i pursuit of an advanced degree, research access to files ay be limited to tat applying to any other investigator.

The researching service-provider should provide both CRP and an appropriate agency official with a plan for accessing the files. The plan must include a list of the information desired and the  range of files to be opened. The agency official should approve this plan in writing, and the researcher should include a copy of the plan and the approval with his/her Form B. In no case should the approved plan violate any access restrictions  applicable to the files in question.

SUBMITTING ACCESS PLANS FOR REVIEW

Projects that propose to access confidential files always exceed the limit of research that is exempt from review. Therefore, submit all such proposals on Form B. Relative to the proposal to access confidential files, include the following items:

1. A list of the items to be extracted from the files, along with a justification for each one (or closely related group) in terms of the goals of the research;

2. A detailed description of the means of accessing the files, including the individuals who will perform the data extraction and any special provisions for preserving subject confidentiality;

3. The method of obtaining subject consent or a reasonable explanation of why consent cannot be obtained; and

4. A list of any restrictions or requirements imposed by the agency or institution holding the files.

The best place on Form B to include this information is either in Section IV. Methods or Procedures or ion Section V. Specific Risks and Protection Measures. In either case, be sure to assess the risks of your research to the subjects of the files if you will not obtain consent from each subject.

In addition, attach to Form B a copy of the agency or institutional permission, signed by an appropriate official, to carry out the plan of access. This letter should contain a list of restrictions or requirements imposed by the agency or institution holding the files.

RESEARCH CONDUCTED AT UNIVERSITY HOSPITALS

AND SIMILAR INSTITUTIONS

Researchers often propose projects that involve present and former patients. Yet hospitals are sensitive to maintaining, so far as possible, the anonymity of its patients with respect to non therapeutic contacts for research purposes. At the same hospitals understand and support research that may lead to better patient care. Researchers desiring access to present and former patients should consult with the chair of the Committee on Research Participation in order to ensure the sue of procedures that permit subject referrals and refusals within the normal physician patient relationship boundaries. A typical procedure would involve the medical records personnel contacting physicians with the names of potential subjects meeting criteria provided by the investigators. The physician would then refer, as appropriate in their judgment, patients or former patients to the researcher. In no case should a researcher expect medical records personnel to provide him/her directly with patient or potential subject identities.

Even though approved by CRP, a project that requires the use of the hospital must be approved by the Committee on Research Participation. Advance consultation with the Chair of the Committee will best ensure procedures that maintain patient anonymity and physician patient relations. 

This model applies, with procedural variations, to almost every other institution or agency maintaining sensitive files and providing important services to individuals. The research activities so important to investigators at the University assume a secondary role for the service-providers. Therefore, investigators should use great care and tact in approaching agencies and institutions for assistance and cooperation in conduction research. The confidentiality of files they maintain constitutes only one of many concerns such agencies and institutions have relative to their clients or patients. 

Many medical and education institutions may require reviews  of proposals similar to those conducted by CRP. To assure a proper approach to outside inceptions and agencies, consult with them early in the planning stages of your project. In addition, consult with the Chair of the CRP or other members of the Committee concerning various ways of meeting the requirements of your project. By These means, you may be able to obtain the data you require with minimal difficulty and maximal protection of subject rights and privacy.