The Competing Demands of Patient Privacy and Clinical Research

Abstract

Jane received a letter from a researcher who works in the same academic medical center as she does, inviting her to participate in a study "targeting" ways to improve early diagnosis of uterine cancer for individuals diagnosed with endometrial cancer. Jane recently had gynecological surgery at this academic medical center (and, as part of her preadmission testing, had a chest x-ray). As you might imagine, she did not disclose or release information related to her gynecological care and treatment at the hospital to her colleagues and expected it to remain private. What a surprise, then, to receive an invitational research letter at her home that identified her private health information, including her name and her cancer diagnosis, along with incidental lung nodule findings from the chest x-ray of which she was not aware. In the letter, the study team, some of whom she knows as colleagues, noted that they had already contacted her surgical oncologist to obtain through the electronic medical records system her personal medical history that they needed for the research. The institutional review board (IRB) had approved the study and the invitational letter. Jane subsequently spoke to the chair of the IRB, the hospital's privacy officer, and a colleague who is a bioethicist, asking how to note in her medical record to not allow researchers access to her personally identifiable information without her explicit permission. She was told that this was not possible given that this was an academic medical center and that, by agreeing to receive care within the system, she was agreeing to allow her records to be used for IRB-approved research. C onfidentiality of personal medical information is a cornerstone of ethical clinical care and ethical research. Indeed, codes of ethics published by professional societies, federal and local rules, hospital practices, and other guidance require clinicians and researchers to protect the confidentiality and privacy of their patients and research participants. Federal guidance defines private information as "information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording ABSTRACT Privacy and confidentiality of personal medical information are cornerstones of ethical clinical care and ethical research. But real-world research has challenged traditional ways of thinking about privacy and confidentiality of information. In today's world of "big data" and learning health care systems, researchers and others are combining multiple sources of information to address complex problems. We present a case study that highlights the ethical concerns that arise when a patient who is employed by an academic medical center learns through a research invitational letter that her private information was accessed at this center without her consent. We discuss the ethical challenges of balancing patient privacy with advancing clinical research and ask, what level of privacy and confidentiality can and should patients expect from their clinici...