It's not (just) about privacy: a new perspective on health databases.

• Author: Schrecker, Ted

Introduction

Low-cost computing power has made possible the storage and analysis of large quantities of health data. Individual electronic health records (EHRs) offer the potential for major improvements both in patient care and in the extent and quality of data available for population health research. The Canadian government has committed more than $1 billion in infrastructure funds for the so-called Canada Health Infoway, with a specific mandate to accelerate the development of EHR systems across Canada. Several provincial governments are actively supporting complementary initiatives. (1) In addition to facilitating secondary uses of data that were gathered in the course of providing and financing health care, the 'information revolution' facilitates multiple, low-cost analyses of data gathered for research purposes. The proposed Canadian Lifelong Health Initiative (CLHI) relies on this capability. This longitudinal prospective research program would involve both an early birth cohort and an aging cohort. Health status information, information related to various social determinants of health, and biological materials would be collected and maintained as a "research platform" to support multiple individual research studies, over a period of decades. (2) A larger scale study in the UK (Biobank) will collect baseline data and blood samples from 500,000 people aged 45-69 years, who will be followed for at least 10 years. (3) Such projects offer unprecedented opportunities to study interactions between genetic variations and environmental variables, which can and should be defined in the broadest sense, and to provide an evidence base for policies and interventions to improve population health.

Somewhat belatedly, legislative and policy attention has focussed on the ethical and social implications of these new technological capabilities. In the United States, the main national response has been a health information privacy rule under the Health Insurance Portability and Accountability Act (HIPAA) of 1996. (4) In Canada, legislation governing commercial users of health information and federally regulated industries--the Protection of Personal Information and Electronic Documents Act (5)--which came fully into force in January 2004, complementing a variety of existing federal and provincial privacy statutes. (6) However, this article is concerned not with the content and implementation of these requirements, but rather with a key omission in the underlying ethical and public policy rationale.

Privacy, and Beyond

At least in the Anglo-American countries, ethical analysis of research involving health data is highly individualistic. It tends to focus on potential encroachments on individual privacy; on preventing unauthorized or inappropriate access to data related to the health status of a particular, identifiable individual; and (when data are gathered specifically for research purposes) on the nature of the process by which consent is obtained from research participants. (7) If confidentiality can be assured, then many ethical problems are considered solved, even if data were originally collected with no indication that they would subsequently be used for research purposes. For instance, the Tri-Council Policy Statement (TCPS) that provides guidelines for ethics review of federally funded research in Canada states that secondary use of data "becomes of concern only when data can be linked to individuals." (8) Commentators often presume that a legitimate tradeoff exists between individuals' wishes to control use of information they have provided and society-wide benefits in the form of improved health system performance or improved understanding of the determinants of health. (9) When data are gathered specifically for research, ethical debate tends to focus on the question of whether and how the process of obtaining consent can take into account uses of data that might not be envisioned at the time the participant is originally recruited, and the circumstances under which renewed or amended consent should be sought. (10) Somewhat paradoxically, this has the effect of setting a more demanding ethical standard when individuals are clearly informed that data are being gathered for research purposes than for research involving administrative and clinical data gathered in the course of providing health care or other services.

Ethics analysis of research uses of health data, whether or not they were gathered for research purposes, generally ignores harms or benefits that may result for individuals not because they are personally identified, but because of shared characteristics: they are part of a population whose interests and well-being are affected by the research or by its subsequent dissemination and use. A partial exception to this generalization involves literature on population genetics, where some authors acknowledge that potential harms to individuals, by virtue of their identification as members of a definable group or community (e.g., with high genetic vulnerability to a particular condition), should be considered when choices are made about such matters as how research is explained to participants and how consent is obtained. (11) The issue of "group consent", however, remains contentious. (12)

As important as they are, privacy and confidentiality are only part of the ethics equation. Justice is one of the canonical "four principles" of bioethics, at least in its North American version. (13) Crucially, justice includes distributive justice, and should (in the author's view) incorporate special concern for populations disadvantaged by one or more of the interacting gradients of power and powerlessness (class, gender, education, (dis)ability, stigmatization) that characterize contemporary society.

The central argument of this article is that ethical analysis and institutional approval of population health research must be explicitly concerned with avoiding harms to subordinated or marginalized populations. Terminology is important here: 'population' is preferable to 'community' or 'group,' since each of these implies an element of self-recognition and internal cohesion. (14) The descriptors 'subordinated' and 'marginalized,' although imperfect, are pre- ferable to 'vulnerable.' Vulnerability connotes lack of agency and a need for paternalistic protection, and references to vulnerable populations in bioethics often address individual inability to provide fully informed consent for legal or other reasons, which is not the issue here. Suggestions for improvement are invited.

The argument made here was, in fact, noted but not elaborated upon in a recent compilation of case studies on secondary use of personal information published by the Canadian Institutes of...