Research using information from health records has the potential to benefit patients and the wider NHS, but to protect privacy strict controls are necessary.
In this article, Neil Walker, Chief Data Officer for Gut Reaction and Clinical Bioinformatics and Statistical Genomics Manager, NIHR BioResource, looks at how Gut Reaction works with patients, researchers and data experts to find a balance that supports vital research while ensuring information from individuals living with inflammatory bowel disease (IBD) is used safely, appropriately and transparently.
Any conversation between a doctor and patient, including treatment plans or test results, is confidential and this information is treated with great respect. Secure and accurate storage of medical records is vital to make sure that each patient receives the highest possible standard of care. However, when combined with health information from many other people, it can also provide an important resource for research. For medical studies involving patient records (known as ‘health data research’) to be acceptable and successful, a balance is needed between maintaining privacy and sharing information with trusted researchers to allow vital research to progress. To find an approach that meets everyone’s needs, discussions involving patients, researchers and specialists in data security are needed.
Gut Reaction enables much-needed progress in the management and understanding of inflammatory bowel disease (IBD) through secure and transparent use of patient health data. Building on the consented information held by the NIHR BioResource, by making it possible to link data from other sources, including the NHS and the IBD Registry, Gut Reaction is a unique resource aiming to improve treatment options for patients living with IBD, by allowing research that would not otherwise have been possible. You can find out more about how Gut Reaction works here.
What is consented data and who are the NIHR BioResource?
The NIHR BioResource supports cutting-edge healthcare studies by connecting researchers with suitable participants, samples or data. While patients with IBD are recruited at 125 participating hospitals, anyone can join the BioResource and participate by giving consent for their health records to be made available for approved medical studies, providing a biological sample (usually blood or spit), and consenting to be contacted about taking part in relevant research.
Every individual who joins the NIHR BioResource has consented to their data being used for approved research; this means that they have read, understood and signed a document explaining what their medical information will be used for and when. You can find more information about joining the BioResource here.
Gut Reaction works within the ‘5 safes’ framework developed by both the Office for National Statistics (ONS, a government group working on data, Figure 1), and by senior staff at the UK Data Archive, a repository of social science data and now adopted by HDR UK. We have turned this into an application process in consultation with our patient advisory committee (PAC), and data experts to ensure the privacy and safety of patients. Each study request is considered separately by our data experts and patient representatives to confirm that the appropriate controls are agreed before the study can start.
Figure 1: the five safes framework
Image from: https://www.ukdataservice.ac.uk/manage-data/legal-ethical/access-control/five-safes
The 5 safes framework provides a clear set of standards for how patient data should be stored and used. By combining five levels of checks: safe data, safe projects, safe people, safe settings and safe outputs, every step of the research pathway that health data supports can be carefully controlled and monitored in a way that is appropriate to the study type.
Safe data: patient records contain large amounts of personal information, and we know from speaking to our Patient Advisory Committee (PAC) that there are some details that should never be shared without explicit additional consent, including name, birth date and address. Removing these potentially identifiable sections from data is called ‘de-identification’; carefully undertaking this process makes it unlikely that an individual patient can be recognised within information used by researchers. There is a trade-off between use of de-identification, and the detail left in the data afterwards – this is called “data utility”, as without a certain level of detail some research is not possible (Figure 2). By partnering with data privacy experts Privitar, we ensure that our de-identification is performed consistently, and to the highest standard, whilst giving the greatest data utility.
Figure 2: the balance between privacy and how useful data is for research
A balance has to be found between protecting patient privacy and providing sufficient detail for research to proceed. Through active case-by-case discussions with researchers, data safety experts and patient representatives, Gut Reaction ensure that our datasets are acceptable for all parties
Safe projects: Gut Reaction only supports research designed to benefit patients living with IBD, or the wider NHS. Our PAC, and other patient representatives, are involved in reviewing any applications for data access, and will only approve requests that have a clear, specific, research aim and a high likelihood of benefiting patients.
Safe people: Through our rigorous applications processes, we only allow approved researchers from trusted organisations with a proven history in relevant research to apply for, and access, Gut Reaction data. This gives our patients confidence that anyone using the de-identified data has the skills and experience to use their information safely and appropriately.
Safe settings: Approved researchers view and analyse de-identified data using secure, on-line computer based systems, such as trustworthy research environments (TREs). Gut Reaction have partnered with data security specialists AIMES to protect patient data within our own TRE, ensuring that it cannot be copied, downloaded or shared, while allowing appropriate analysis to take place. If a researcher requests to use their own secure research environment, our PAC consider if this is an acceptable and appropriate use of Gut Reaction data, and our data experts also check that all our safety standards will be met. If both groups are satisfied with the application, a data access application can be approved.
Safe outputs: Anyone who is using Gut Reaction data must sign legally-binding contracts agreeing that they will only use our patient information to answer the research question approved in their application. If a researcher would like to answer a new question, they have to apply for access again. We are also able to check that any tables or graphs are safe for publication, with no details that could identify an individual shared.
We recognise that our patients, and the general public, might consider some types of research to need tighter security controls than others. Patient representatives are always involved when data access requests are discussed, and our data management team share any new or different requests with the PAC in order to decide what level of privacy measures may be appropriate. By taking a case-by-case approach, supported by the 5-safes framework and the input of our data experts and PAC, we are committed to finding the right balance between data safety and supporting essential research in IBD.
For a more detailed article by Neil on the challenges of de-identification and anonymity click here
