[This article was originally published in Healthcare Policy, 8(4)]

Privacy legislation addresses concerns regarding the privacy of personal information; however, its interpretation by research ethics boards has resulted in significant challenges to the collection, management, use and disclosure of personal health information for multi-centre research studies. This paper describes the strategy used to develop the national Rick Hansen Spinal Cord Injury Registry (RHSCIR) in accordance with privacy statutes and benchmarked against best practices. An analysis of the regional and national privacy legislation was conducted to determine the requirements for each of the 31 local RHSCIR sites and the national RHSCIR office. A national privacy and security framework was created for RHSCIR that includes a governance structure, standard operating procedures, training processes, physical and technical security and privacy impact assessments. The framework meets a high-water mark in ensuring privacy and security of personal health information nationally and may assist in the development of other national or international research initiatives.

Data related to an individual's health is one of the most sensitive types of personal information. Broadly speaking, research that utilizes such personal health information can guide healthcare policies, advance medical practices, improve healthcare outcomes and provide a better understanding of disease etiology, progression and economic costs (Black 2003). Patient registries are repositories of personal health information and have been defined as "an organized system that uses observational study methods to collect uniform data (clinical and other) to evaluate specified outcomes for a population defined by a particular disease, condition, or exposure, that serves predetermined scientific, clinical, or policy purpose(s)" (Gliklich and Dreyer 2010). Registries that contain high-quality patient data can provide important information regarding the epidemiology of health conditions and the outcomes of treatment. In Canada, the publicly funded structure of the healthcare system enables the collection of uniform and detailed information for health conditions nationally.

There are a number of Canadian patient registries that collect health information and are used by researchers, clinicians, administrators and policy makers. Most registries are developed for disease surveillance and accumulate data passively; few have been developed to facilitate prospective clinical and patient-reported data for specific health conditions.

The purpose of this paper is to describe the challenges encountered during the development of a national privacy and security framework for a prospective longitudinal patient registry of traumatic spinal cord injury (SCI), the Rick Hansen Spinal Cord Injury Registry (RHSCIR). Privacy regarding personal health information is an important aspect of the public's trust and acceptance; disclosure of collected data can lead to discrimination and emotional distress. Impairment resulting from a SCI can be highly sensitive in nature, often affecting sexual health and bladder and bowel function. National registries are an important resource for health research, but unfortunately, logistical difficulties have hindered their development. Seven years into this registry, we are in a position to describe the challenges encountered in conducting a multi-centre project and the processes we took to overcome them. It is hoped that by sharing these experiences we will assist others who face similar challenges while seeking to implement patient registries in Canada.

The Rick Hansen Spinal Cord Injury Registry

RHSCIR is a national Canadian registry of persons who have sustained a traumatic SCI, with 31 participating sites in nine provinces (Figure 1). Launched in 2004, RHSCIR is sponsored by the Rick Hansen Institute and funded by Health Canada and the governments of Alberta, British Columbia, Newfoundland and Ontario. RHSCIR was initiated as a research study and was developed to facilitate the translation of research into clinical practice and promote evidence-based care (Noonan et al. 2012).

The inception of RHSCIR coincided with the enactment of federal privacy legislation governing personal health information and similar individual provincial legislation. The standardization of policies and procedures across all local RHSCIR sites has been challenging because of variation in the interpretation of legislative language. In response to these challenges, we created a national privacy and security framework to address personal privacy and security issues and operationalize the vision of RHSCIR.

Development of a Privacy and Security Framework

The development of a privacy and security framework at the Rick Hansen Institute initially required the commission of a national privacy analysis to be completed by legal experts in Canadian privacy practice. Because RHSCIR operates across several jurisdictions in Canada and in various types of facilities (e.g., rehabilitation, acute care), the privacy analysis identified multiple and overlapping requirements for RHSCIR (see Figure 2). The requirements for each local RHSCIR site were determined by the province and the facility-specific policies, procedures and ethical/research guidelines for the local handling, transmission and storage of health data.

Because the national RHSCIR site handles only de-identified patient data, it is not bound by specific privacy legislation. However, to meet a high privacy standard, the national RHSCIR site complies with the federal Personal Information Protection and Electronic Documents Act (Department of Justice 2011) and all provincial and territorial data protection legislation, including provincial privacy laws specific to the health sector. A close working relationship exists between the national and local RHSCIR sites to ensure that privacy obligations are met.

The RHSCIR also adheres to the following research guidelines: (a) Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (CIHR 2005), (b) Canadian Institutes for Health Research: Best Practices for Protecting Privacy in Health Research (CIHR 2005), (c) ICH Guidance E6: Good Clinical Practice: Consolidated Guideline (Health Canada 2004) and (d) standards issued by the International Organization for Standardization (ISO 2005, 2008). To ensure a gold standard of privacy compliance, the privacy requirements were benchmarked against the 10 elements of privacy best practices advocated by the Canadian Institutes for Health Research (CIHR 2005).

The Rick Hansen Institute developed a comprehensive framework in consultation with privacy experts that could be used by RHSCIR. The framework includes the formation of a privacy governance structure, the development of standard operating procedures, the establishment of training processes, the creation of physical and technical security, and a privacy impact assessment (see Figure 2). The framework is reviewed and updated bi-annually to ensure relevance to the current legislation, best practices and organizational structure at the Rick Hansen Institute.

Governance structure

The implementation and monitoring of privacy-related activities for RHSCIR required a chief privacy officer, reporting directly to the chief executive officer, and a Privacy Team that under the guidance of a legal expert enhanced accountability and oversight. The Privacy Team at the Rick Hansen Institute is composed of the chief privacy officer, compliance coordinator, RHSCIR project manager, director of information technology and the RHSCIR data management lead. The Privacy Team's responsibility is to foster awareness and implement, monitor and address current and potential privacy issues. Monitoring of the local RHSCIR sites is conducted regularly to ensure their compliance with all requirements, including the RHSCIR study protocol and privacy legislation.

In addition to the Privacy Team, the Rick Hansen Institute has established a Data Executive Scientific Committee and a Data Access Committee to oversee the use and disclosure of the national RHSCIR data (Noonan et al. 2012). The Data Executive Scientific Committee consists of three of the lead investigators whose local RHSCIR sites contributed data to the requested data holding. This committee is responsible for reviewing data requests for scientific merit and ensuring that the use of data aligns with the permitted purposes of RHSCIR. The Data Access Committee comprises custodians from each of the local RHSCIR sites (there are currently 31) and provides approval for disclosure of the site data for each request.

Standard operating procedures

A central feature of any privacy and security framework is the system of documented policies, procedures, records and agreements/contracts that govern and allow the traceability of data handling. The key documents developed by the Rick Hansen Institute and their scopes are described in Table 1. These standard operating procedures were created under the guidance of a lawyer with privacy expertise to comply with the 10 principles of fair information practices, as outlined in the Personal Information Protection and Electronic Documents Act and best practices. The documents are created and managed in a document control system that is maintained by the compliance coordinator.

Training processes

The Rick Hansen Institute has an extensive training program, focused on privacy and security, in place for staff and local RHSCIR coordinators. The Privacy Team ensures that all staff members receive mandatory training annually, consistent with current policies and procedures for data and information handling. The privacy obligations of all the local RHSCIR sites are contained in the RHSCIR study protocol, and all site coordinators receive mandatory annual privacy training at RHSCIR site coordinators' meetings. These meetings also provide a forum to discuss privacy issues that arise from RHSCIR, across all the sites.

Physical and technical security

In order to maintain the privacy of participants enrolled in RHSCIR, physical and technical safeguards have been incorporated in the collection, storage, transmission of and access to data (see Table 2). These security measures have been implemented at the local and national RHSCIR sites and undergo continuous review and revision.

Privacy impact assessments

A privacy impact assessment (PIA) is a formal risk management tool used to identify the actual or potential effects that an activity may have on individuals' privacy and provides solutions to eliminate or mitigate the risks. A PIA is desirable to assess the following types of risks in healthcare arising from:

• a new technology or the convergence of existing technologies;
• the deployment of existing information technology systems to new user groups;
• the use of a known privacy-intrusive technology in new circumstances; or
• a new project, or from changes to information handling practices with significant privacy effects (Cavoukian 2005).

The practice of conducting PIAs is becoming increasingly common, as it is an informative exercise that is mandatory for government agencies and public sector organizations (Treasury Board of Canada Secretariat 2010). Even when PIAs are not required under legislation, they are often required as a condition of funding. The Rick Hansen Institute is required by its primary funder, Health Canada, to undertake an annual PIA. Our PIAs have been performed by an external professional service company. The PIA process assesses how the RHSCIR data are collected, used, disclosed, stored and destroyed. It involves a risk analysis and mitigation strategy for impacts on privacy through the identification of threats and vulnerabilities, and procedural technical strategies to mitigate them.

As part of the privacy and security framework, a PIA is conducted to analyze the status of data collection, use, disclosure and retention via RHSCIR and the related technical, administrative and physical safeguards in place to protect such data. The PIA reflects the current state of the privacy and security framework, the data flow and how the information technology application is currently used. Additionally, the PIA identifies and quantifies the privacy risks associated with the use of RHSCIR data by the national and local RHSCIR sites. The PIAs help identify any gaps in the privacy framework and provide an indication of the areas requiring remediation.

Key Challenges

The development of a national prospective patient registry to translate research into clinical practice and promote evidence-based care was viewed as a necessary step to improve the care of SCI in Canada. However, the creation of such a research study proved to be a daunting task, complicated by multi-centre and interprovincial challenges with the feasibility of a national site and the complexity of consent, bias and data collection. There are few national registries that are not mandated by the government and that go beyond the collection of administrative data.

Multi-centre and national scope

To capture data throughout the healthcare continuum and have a sufficient volume of data for research, the registry was required to be multi-centred, including both acute and rehabilitation facilities. As a result of the multi-centred nature, the ethics approval process was completed on a site-by-site basis, dependent on the local research ethics board (REB). Since some REBs cover more than one site, the collection of data from all 31 local RHSCIR sites (see Figure 1) required approval from 19 individual REBs, each with distinct submission and review processes.

In a study that involves several REBs in multiple provinces, interpretation of the complex legislation landscape is a time-intensive process that leads to delays in research, increased costs and protocol inconsistencies (de Champlain and Patenaude 2006; Kotecha et al. 2011; Willison 2007; Willison et al. 2008). The legal structure governing research is suited for discrete research studies with distinct goals, data sets and endpoints, not for prospective longitudinal studies, such as registries, with multiple research goals and complex national data sets (Willison 2007). In the case of RHSCIR, the REB submissions increased cost, time and human resources, and ultimately resulted in decisions that varied within a single jurisdiction.

For the RHSCIR data to be useful for national studies, the collection should be standardized across all provinces and centres. Standardization was a challenge because of the differing decisions of several REBs and the feasibility of collection among sites that have differing standards and data collection methods. We attempted to standardize the sites as best we could to collect the same data elements; however, in some cases this was not possible, as described below.

Consent and bias

The requirement for individuals' explicit consent was intended to respect their right to privacy and control of their personal health information. However, it has been shown that consent for research purposes can reduce participation and create an ascertainment bias, such that the research sample is non-random and does not reflect the entire population for a specific health condition (El Emam et al. 2009; Harris et al. 2008; Ingelfinger and Drazen 2004; Kho et al. 2009; Tu et al. 2004). A review by El Emam and colleagues (2009) found that 32 of 37 studies reviewed reported lower recruitment rates as a result of consent and 27 found differences between consenters and non-consenters. The factors most often cited to differ were age, sex, race, socio-economic status, education and health status (El Emam et al. 2009; Kho et al. 2009). An example is the National Stroke Registry, where initial participation was 39.3% and consenting patients were younger and more likely to be mildly affected (Tu et al. 2004).

For RHSCIR, minimizing ascertainment bias was an important issue that was affected by the variability in the interpretation of provincial legislation. For consenting patients, there is a full data set of approximately 265 data elements (Noonan et al. 2012); however, to limit bias, a minimal data set is collected from individuals who have not consented or who were missed in the study. The collection of a minimal data set is permissible under privacy legislation in cases where REBs have requested a waiver of consent in research studies that utilize medical records and confer minimal or no risks. Therefore, the content of the minimal data set was decided on a site-by-site basis by the local REB. Not all REBs agreed to collect the same minimal data set; while some REBs permitted minimal data related to age, gender, details of injury, neurological assessment, diagnoses and clinical procedures, others limited collection to age, gender and date of injury. The collection of only three variables at certain sites makes determining bias beyond age and sex difficult. In theory, the idea of waiving consent is thought to reduce bias and loss of data; in practice, however, this was not the case for RHSCIR based on discrepancies between REB decisions.

Despite the efforts to reduce bias, it is still possible that the data are not entirely representative of the population of SCI in Canada. The local RHSCIR sites represent high-volume acute trauma facilities and specialized rehabilitation facilities. These sites were selected to be representative of Canadian provinces and have similar attributes whereby they provide grouping of patients with a traumatic SCI, acute and rehabilitation programs located within the same SCI centre and an in-patient SCI program. We recognize that the selection of such sites may influence the data collected, and studies are underway to compare our data to national administrative trauma data.

Data collection

A national registry required a national site to house the data and oversee operation of the RHSCIR network. The national site data do not contain identifiable patient information owing to the challenges with identifiable data crossing provincial borders. Identifiable information is required to link SCI patient data to other data sources (e.g., hospital administrative databases and the national trauma registry), a situation that is currently unachievable at the national level. To address this challenge, local RHSCIR sites collect data from chart review, patient interviews and local hospital databases. All data are entered into the local RHSCIR site database where they are linked to local databases, assigned a unique RHSCIR identification number, de-identified and electronically sent to the national RHSCIR site. Creating data linkages at each of the local RHSCIR sites was difficult and remains an ongoing challenge. By not having identifiable data at the national level, we are not able to coordinate additional data linkages – for example, linkages to national vital statistics for information on mortality are not currently possible.

Conclusion

Today's healthcare environment is changing from the use of paper-based medical records to the implementation of computer-based documentation systems. This networking of health information has created exciting research opportunities and different privacy challenges in safeguarding personal health data. In this environment, there is a need to develop privacy architectures to protect privacy and minimize risks (Diamond et al. 2008; Lane and Schur 2010). The use of electronic health records highlights the issues surrounding secondary use of health information for research purposes and patient consent (Kosseim and Brady 2008).

The development of RHSCIR has highlighted several challenges in the creation and maintenance of a multi-centre, national, prospective registry in Canada. Specifically, the interpretation of privacy legislation by the REBs resulted in variation across RHSCIR sites. There are several provincial initiatives (Hebert and Saginur 2009) and one national initiative (CIHR 2010) for streamlining the research ethics review of multi-centre clinical studies that have brought together diverse groups of stakeholders. Based on our experience in developing RHSCIR, we support initiatives that will improve the effectiveness and efficiency of the ethics review process to enable the development of registries that collect standardized data across Canada and protect patient privacy.

The challenges encountered in launching RHSCIR are neither unique nor specific to spinal cord injury, but are applicable to any national research study requiring access to personal health information. Given the rapid advances in information technology and the need for data sharing and integration, the creation of large-scale, national research registries that collect data on whole populations and serve as platforms for future research are becoming more common. Canadian jurisprudence recognizes that patients maintain a legitimate expectation of privacy in and control over their personal health information. For RHSCIR, the development of a privacy and security framework ensured compliance and accountability, and provided assurance to patients; however, the maintenance of such a framework is an ongoing challenge and a dynamic process that continues to evolve. The lessons learned regarding the process for approval of RHSCIR may aid in the development of and collaboration with similar national disease registries in Canada and other countries.

Satisfaire les exigences en matière de confidentialité pour la création d'un registre multicentrique de patients : le Registre Rick Hansen sur les lésions médullaires

Résumé

Les lois sur la protection de la vie privée prévoient la confidentialité des renseignements personnels; cependant, leur interprétation par les conseils de déontologie présente d'importants défis en matière de collecte, de gestion, d'utilisation et de divulgation d'informations personnelles sur la santé dans les études de recherche multicentriques. Cet article décrit la stratégie employée pour créer le Registre Rick Hansen sur les lésions médullaires (RHLM) conformément aux lois sur la protection de la vie privée et en tenant compte des pratiques exemplaires. Une analyse des lois régionales et nationales sur la protection de la vie privée a été menée afin de dégager les exigences de chacun des 31 sites du Registre RHLM ainsi que de son bureau national. Un cadre national de confidentialité et de sécurité a été créé pour le Registre RHLM. Ce cadre comprend une structure de gouvernance, des procédures d'exploitation normalisées, un processus de formation, des mesures de sécurité matérielle et technique ainsi que des évaluations d'impact sur la vie privée. Le cadre représente un important jalon pour garantir la confidentialité et la protection des informations personnelles sur la santé à l'échelle nationale et peut servir à la création d'autres initiatives de recherche nationales ou internationales.

Comments

Be the first to comment on this!