Using EHRs to design drug repositioning trials: A devolved approach to data protection

Abstract

One area where the application of data protection law has proven complex is in relation to the secondary usage of health data in EHRs for medical research. Here the tension between the privacy interests of patients and the risk of harm if such sensitive data are compromised, and on the other side, the potential societal value of utilizing the data for the benefit of medical science, is especially striking. In this paper, we consider the applicable provisions of the EU Data Protection Directive, and outline a general approach to patient data handling for research, which we believe to be compatible with relevant legal and ethical requirements. We then illustrate and apply this by reference to a specific EU FP7 project, involving EHR data processing to select patients for clinical pharmaceutical trials. After introducing the project (PONTE), we explain the ‘devolved’ data protection architecture it employs and provide a legal evaluation.

Keywords:

• data protection
• medical research
• security architecture

Acknowledgement

This work is being supported by the PONTE project and has been partly funded by the European Commission's IST activity of the Seventh Framework Programme. The views expressed are those of the authors and not necessarily those of the Commission. The authors wish to record their thanks to each of the other PONTE partners, especially Dr Vassiliki Andronikou of ICCS/NTUA, Athens, for the fruitful cooperation in advancing the overall project vision. They are also grateful to the International Review's anonymous reviewers for their helpful comments on an earlier draft of this paper.

Notes

1. As discussed later, the PONTE project itself is a good example of such an application.

2. The proposed Regulation is available at http://ec.europa.eu/justice/data-protection/document/review2012/ com_2012_11_en.pdf.

3. See http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2007:303:0001:0016:EN:PDF.

4. See: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML.

5. On the meaning of ‘explicit consent’, see the opinion of the Article 29 Working Party (established under the Directive), on the definition of consent (Opinion 15/2011; WP187), at 25 ff, available at: http://ec.europa.eu/justice/policies/privacy/workinggroup/wpdocs/2011_en.htm.

6. Other bases in the Directive that legitimate the processing of sensitive personal data are inapplicable to medical research. The most borderline is Article 8(3), permitting processing of such data ‘for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services’. However, the Article 29 Working Party in its Working document on the processing of personal data relating to health in electronic health records, WP 131 adopted on 15 February 2007, opined, at p. 10, that this will not cover processing for research. See http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2007/wp131_ en.pdf.

7. See the Art 29 Working Party ‘Working document WP 131’ note 6, p. 9. See also, the Working Party Opinion on the definition of consent, WP 187 adopted on 13 July 2011, pp. 25 et seq. Available at http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinion-recommendation/files/2011/ wp187_en.pdf.

8. Under the new draft EU Regulation, it may become even harder for researchers to use consent to legitimate patient data use. In particular, article 7(4) as currently drafted would preclude reliance on it where there is a significant power imbalance between the parties.

9. Art 29 Working Party ‘Working Document WP 131’ note 6, p. 16.

10. Art 29 Working Party ‘Working Document WP 131’ note 6, pp. 13–14

11. Art 29 Working Party ‘Working Document WP 131’ note 6, p. 16.

12. In principle, the hospital department could pass the information directly to the patient's physician, and not reveal it to the SC at all (thereby ensuring the latter would never learn the identities of patients who are approached but decline to participate in a given trial). This is a decision for individual hospitals, but if such an arrangement is practical, it would be preferable from a data protection perspective.

13. In principle 11, the WMA notes the particular need for ethics committee approval if there are any doubts concerning patient consent to inclusion in the database.

14. Pursuant to the requirements of the Clinical Trials Directive 2001/20/EC (in particular, article 6).

15. Art 29 Working Party ‘Working Document WP 131’. See the discussion in the text at note 8.