Collection, Use and Disclosures of Personal Health Information for Research

The Rule: Collection, Use and Disclosure of Personal Health Information for Research

Purposes:

• Nothing in the Act prevents the hospital or researchers from collecting, using or disclosing personal health information for research purposes with the express consent of the patient. The hospital or researches may not rely on implied consent.
• The hospital or researchers may collect personal health information for research purposes without patient consent, providing the collection is in compliance with the Act.
• The hospital or researchers may use personal health information for research purposes without patient consent, providing the requirements concerning research plans and Research Ethics Board approval are met.
• The hospital may disclose personal health information to a researcher without patient consent, if a written agreement with the researcher to protect the information is in place. The researcher must also provide the hospital with the written application, the written research plan and a copy of the Research Ethics Board approval of the research plan.

Research Plan

The research plan must be in writing and set out the following:

• The affiliation of each person involved in the research.
• The objectives of the research and the anticipated public or scientific benefits.
• A description of the proposed research and the duration.
• A description of the personal health information required and potential sources.
• A description of how the personal health information will be used and if linked to other information – a description of the other information and how the linkages will be done.
• An explanation of why the personal health information is necessary and if linked to other information why it’s required.
• An explanation as to why “consent” of the individual to whom the information relates is not being sought.
• A description of the foreseeable harms and benefits that may arise from the “use” of the personal health information and how the researcher intends to address the harm.
• A description of all persons having access to the personal health information, why their access in necessary, their roles relative to the research and their qualifications.
• The safeguards to protect the confidentiality and security of the personal health information.
• An estimate of how long the information will be retained in an identifiable form and why.
• An explanation of how the personal health information will be disposed of or returned to the hospital.
• The funding source of the research.
• Whether the researcher has applied to another Research Ethics Board and if so the status of the application.
• Whether the researcher’s interest or performance of the research would result in an actual, perceived or potential conflict of interest with other duties of the researcher.

Research Ethics Board Composition

A research ethics board must be composed of at least five members including:

• An independent community member.
• A member with experience in research ethics.
• Two members with relevant expertise in research.
• A member with expertise in health privacy.

Research Ethics Board Duties

In order to approve a research plan, the Research Ethics Board must consider:

• Whether the objectives of the research can be accomplished without using personal health information.
• Whether there are adequate safeguards in place to protect the privacy of the individuals whose personal health information is being disclosed and the confidentiality of the information.
• The public interest in conducting the research and the public interest in protecting the personal health information.
• Whether obtaining the consent of the individual would be impractical.
• Whether all matters listed on the Research Approval Checklist have been met.

Research Ethics Board Decisions

The Research Ethics Board must:

• Notify the researcher of its’ decision in writing with reasons, setting out whether the Board approves the plan.
• Whether the approval is subject to any conditions.
• Specify the conditions, if any.

Researcher Duties

A researcher who receives personal health information about an individual from the hospital shall:

• Comply with the conditions specified by the Research Ethics Board regarding the plan.
• Use the personal health information only for the purposes set out in the plan as approved.
• Not publish the information in a form that could lead to the identify of the individual.
• Not disclose the information, unless required by law.
• Not make or attempt to contact the individual directly or indirectly unless the hospital. first obtains the individual’s consent to being contacted.
• Notify the hospital immediately in writing of any breach.
• Comply with the “agreement” between the hospital and the researcher.

Agreement between the Hospital and the Researcher

Before the hospital discloses personal health information to a researcher:

• The Researcher must enter into an agreement with the hospital and agree to comply with any conditions and restrictions that the hospital imposes relating to the use, security, disclosure, return or disposal of the information.

Transition

A hospital that “used” or disclosed personal health information for the purpose of conducting research in the three-year period before November 1, 2004 may continue to disclose personal health information to the researcher for the purposes of that research for a period of three years after November 1, 2004 ( i.e. November 1, 2007).

October 28, 2004