Ethical Issues Associated with Managing and Sharing Individual-Level Health Data

Abstract

The COVID-19 pandemic has resulted in the generation of an unprecedented and exponentially mounting volume of data, including individual-level health data, bringing into sharp focus the importance of thinking about what constitutes ethical use of data in a public health emergency. The timely and appropriate use of such data (e.g. data from public health surveillance, electronic health records and research projects) has great potential to contribute to successful public health policies, effective therapeutic interventions and enhanced public support for, and trust in, governmental responses to the pandemic. However, a number of ethical issues arise from the use of different kinds of data, and the ways in which they are collected, processed and shared in the context of research during a pandemic. Two broad principles are generally associated with managing and sharing health data in research: first, that researchers should ensure research is carried out in a way that is respectful of persons and communities; and second, that the research is carried out in a manner that is fair to stakeholders, i.e. that it promotes equity. These should also remain the foundational principles of data sharing during a public health emergency. The principle of respect for persons and communities requires careful attention to be paid to consent processes for data sharing, justifications for waiving consent and approaches to protecting privacy and confidentiality. The promotion of equity prompts consideration of how the needs of differing stakeholders in data sharing are recognised and balanced, including appropriate forms of recognition for data sharers, and fair benefit sharing with the individuals and communities data have been collected from. The cases in this chapter illustrate issues arising when populations contribute data to a symptom-checker app, when heightened concerns arise raised about privacy and confidentiality in the context of collecting data about individuals who are potentially easily identifiable by their demographic characteristics, when very sensitive data is collected, and when a waiver of consent to access survey data is requested to enable potential participants of a study to be identified and contacted.

7.1 Introduction

The COVID-19 pandemic has brought into sharp focus the importance of thinking about what constitutes ethical use of data in a public health emergency. This is because the pandemic has resulted in the generation of an unprecedented and exponentially mounting volume of data, including individual-level health data. The timely and appropriate use of such data (e.g. data from public health surveillance, electronic health records and research projects) has great potential to contribute to successful public health policies, effective therapeutic interventions and enhanced public support for, and trust in, governmental responses to the pandemic (Han et al. 2021; Rios et al. 2020). However, the collection and use of individual-level health data may also be problematic if not managed appropriately. Concerns have been raised about privacy and data protection (Ienca and Vayena 2020). These are particularly relevant in certain situations: first, in relation to the use of surveillance and registry data and the extent to which reporting individual-level health data may violate trust and create fear of stigmatization and discrimination (Bayer and Fairchild 2000); and second, in the context of the collection and curation of data (particularly when there are concerns about data being sensitive) by novel and remote platforms (Newlands et al. 2020). In both these instances, the apparent loss of individual control over the collection and use of personal health data is seen to strike at the heart of values such as autonomy, privacy and trust (Vayena and Blasimme 2017).

In the context of conducting research during the pandemic, issues relating to the use and sharing of individual-level health data have taken on increased urgency. There have been calls for greater use of transparent and open-science data-sharing options, and speedier sharing of data to inform COVID-19 patient management and response (Moorthy et al. 2020; Homolak et al. 2020). International research funders such as the Bill and Melinda Gates Foundation and Wellcome have mandated that their grantees share data from research related to COVID-19 as soon as the data collection is completed, regardless of publication status. International expert and working groups have been established to facilitate effective, equitable and ethical data-sharing (Fegan et al. 2021).

Most countries have laws that regulate the processing of personal information, which include the managing and sharing individual level health data. The European General Data Protection Regulation (GDPR) (2016) is an example of such a document. Researchers should be mindful of the legal duties imposed by such regulations. However, almost all of these legislative frameworks are likely to provide exemptions for the processing of data for special reasons or if they fall within special categories such as reasons of public interest relating to public health (for example, Article 9(2)(i) of the GDPR).

As demonstrated by the cases in this chapter, a number of ethical issues arise from the use of different kinds of data, and the ways in which they are collected, processed and shared in the context of research during a pandemic. Two broad principles are generally associated with managing and sharing health data in research: first, that researchers should ensure research is carried out in a way that is respectful of persons and communities; and second, that the research is carried out in a manner that is fair to stakeholders, i.e. that it promotes equity. Although the issues raised in these cases engage the same broad ethical principles as research in non-emergency settings, two observations can be made. First, the principles play out against a very different background during a pandemic, when the value of data may be perceived quite differently. The literature suggests that the value of collecting, processing and sharing data during a pandemic is most often linked to the utility of the data, which is commonly measured by assessing potential benefits in terms of (1) the reduction of suffering of current and future populations, (2) improvement of quality of life during and after the pandemic and (3) the reduction of the socio-economic impact of the pandemic (Bull et al. 2015b; Pratt and Bull 2021). Whether and in what way the approaches to maximizing the utility of data during a pandemic might be justified, or come into conflict with the traditional ethical principles noted above, will be considered by reference to the case studies in this chapter. Second, these cases highlight the importance of context and the need to recognize the salient considerations that should inform how the two broad ethical principles of specific relevance – respect for persons and communities, and promoting equity – should be taken into account during a pandemic.

7.2 Respect for Persons and Communities

It is important that researchers and other secondary users of data respect the persons and communities they engage with. The principle of respecting persons recognizes that individuals should be treated as autonomous agents, and that persons with diminished autonomy are entitled to protection (National Commission 1979). As autonomous agents, individuals and communities have the right to make their own decisions about how their information is collected and used. Respecting persons and communities means that individuals must provide consent to the use of their data, and that their privacy is assured. There are certain situations where waivers of consent are permitted provided that certain conditions are met (CIOMS 2016). But even in such situations, researchers are required to consider whether the consent process might be modified in order to preserve as much of the individual’s autonomy as possible.

7.2.1 The Consent Process

A properly executed consent process is a vital aspect of respecting individual research participants. As part of such a process, adequate information is provided to participants, and participants understand what is proposed, including the nature of any risks and benefits to them and how such risks are to be managed and minimized. Moreover, this consent should be voluntarily given and researchers should ensure that there is no undue influence or deception involved. Participants should also be aware that they may withdraw from the research at any time without the need to provide any explanation or justification, and without any penalty or prejudice to any treatment they may be receiving (CIOMS 2016).

Researchers engaged in collecting, processing and sharing health data should ensure that effectively designed consent processes are put into place. Participants should be provided with information that is explained in a way that allows them to have an appropriate level of understanding. This information should be sufficient and relevant. Participants should understand what health data will be collected and for what purposes, and how their data will be stored and shared. Researchers must carefully consider the risks to participants, and, where relevant, to their communities. In cases where potential participants may have low literacy levels, be unfamiliar with health research, and suffer from social vulnerability, extra measures may need to be taken to ensure that they are able to provide meaningful consent (Bhutta 2004; Cheah et al. 2018).

Given the complexity and abstract nature of data collection, use and processing, particularly in the context of mobile applications and novel platforms, and given most people’s unfamiliarity with it, providing accessible information about data-sharing can be challenging. Case 7.1 illustrates this with an example of a mobile application that collects both sensitive personal data and other personal data. The data collected and processed by the application are used and shared with different parties in accordance with the legal restrictions in place and on the privacy policy of the developers. The envisaged creation of a consortium and data pool for research purposes will mean that the application will be used both as a source of data for research and as a tool for individuals to assess their symptoms. The many different activities associated with the application, as well as the many different ways in which data may be processed and shared, prompt consideration of researchers’ obligations to design a consent process that ensures participants understand how their data may be used and shared in the context of research and what measures will be taken to protect their privacy.

Significantly, during a public health emergency, research takes on a new urgency, and the extensive collection, processing and sharing of data can be particularly valuable. In relation to the ethical principle of requiring meaningful consent from participants, this raises the challenge of whether and how the prioritization of research during a pandemic should be balanced against traditional consent mechanisms. In such situations, modifications of the consent process may be permitted if there is no other feasible or practicable option, the research has important social value and it poses no more than minimal risks to participants. This will be explored in Cases 7.1 and 7.2 in relation to two aspects of consent: consent for future use of data and approaches that involve waiving consent or opting out of sharing.

7.2.2 Consent for Use of Data in the Future

Case 7.1 envisions a variety of future uses and sharing of data, which then raises the issue of what sort of consent would be appropriate in such a case. There has been much debate about appropriate models of consent to allow sharing, storage and future use of data. There is a spectrum of approaches to consent for the future use of data. It ranges from “specific consent” (where the participant would be re-contacted for permission in connection with any future research study) to “blanket consent” (where any use is permissible, including uses unrelated to health) to no consent at all (Tindana et al. 2019). Between the two extremes, there has been increasing support for “broad consent”, which is consent for unspecified future use as long as the future use is within the scope of the broad consent, for example “health research” or “malaria research”, and with appropriate governance processes in place (CIOMS 2016). However, some authors have challenged the concept of “broad consent”, asking whether it can constitute informed consent (Sheehan 2011). If the project in Case 7.1 has not set a time limit on how long it will hold participants’ information and what sort of research might be carried out (given the value of the data in the time of COVID-19) the researchers may be requesting blanket consent.

In considering whether “blanket consent” for future use of health data in relation to Case 7.1 might be justified during a pandemic, it may be worth taking note of certain factors. The first is the utility of digital symptom trackers as a public health tool. The literature suggests that symptom trackers are very valuable tools for monitoring a public health threat and enabling a quick response. They also provide governments with information to assist them in allocating resources and generally minimizing or controlling outbreaks (Gasser et al. 2020). From a public health perspective, the use of blanket consent might be the most efficient way of maximizing the utility of such a tool, and careful consideration is required of how the interests of participants should be balanced with threats to public health and safety in a pandemic.

7.2.3 Waiving Consent and the Opt-Out Approach

Case 7.2 considers whether waivers of consent and opt-out approaches are appropriate in the context of a pregnancy outcomes registry. Waivers of consent must typically be approved by research ethics committees (CIOMS 2016) and are approved only when specific conditions are met, such as “the waiver or alteration will not affect the rights of the subjects, the research cannot be carried out without the waiver, and, when appropriate, subjects will be provided information after participation” (Berg et al. 2018). However, the commentary to Guideline 10 of the Council of International Organizations of Medical Sciences (CIOMS) guidelines provides special considerations for waiving informed consent in studies using data from health registries, citing the importance of having comprehensive and accurate information about an entire population, the avoidance of undetectable selection bias and the need to equitably distribute benefits and burdens across a population (CIOMS 2016).

Significantly, in relation to public health emergencies, the guidance seeks to balance the social value of such research against the risks of violating individual autonomy. First it recognises in the commentary that when such studies are conducted under public health mandates or by public health authorities, no ethical review of waiver of consent is needed as the research is mandated by law. However, consent cannot be waived by a public health authority if the research combines data in a registry with new activities that involve direct contact with participants. Moreover, even in such situations, it stipulates that when the use of such data no longer constitutes a public health activity, researchers must seek individual consent or obtain ethics review approval to waive consent under the conditions in Guideline 10 (CIOMS 2016). It is important to recognise that the ethical justification for a public health mandate is a separate question entirely. Whether or not any particular public health mandate is ethical will depend on a separate ethical analysis based on principles related to public health ethics such as the harm principle, least coercive or restrictive means, reciprocity principle and transparency principles (Upshur 2002). Second, in the absence of a legal mandate, when considering whether to waive individual consent, researchers and research ethics committees are required to consider whether there are any other modifications that can be made to the informed consent process that would allow for the greatest expression of individual autonomy (CIOMS 2016).

In this case, researchers chose an opt-out approach, which on the face of it appears appropriate and respectful of the rights of patients. According to CIOMS (2016), an opt-out procedure must fulfil the following conditions: (1) participants need to be aware of its existence; (2) sufficient information needs to be provided; (3) participants need to be told that they can withdraw their data; and (4) a genuine opportunity to object has to be offered. These requirements may be challenging to fulfil in research conducted with disadvantaged or marginalized groups (CIOMS 2016). Despite the fact that this registry was established in a high-income country, information was collected from staff providing maternity care across a range of health settings and would have very likely included data about women from disadvantaged and marginalized groups. Significantly, in Case 7.2, despite the fact that none of the women opted out of the research, fewer than 10 cases were added in the early months of the pandemic. Whether this was attributable to an effective national COVID-19 response or the reluctance of health providers to register women, it limits the social value of the research and the utility of the dataset. In the context of a public health emergency, researchers and ethics committees may need to give particular regard to whether maximizing the utility of a pregnancy outcomes registry may warrant a waiver of consent.

7.2.4 Privacy

Protecting the privacy and confidentiality of participants remains one of the main concerns of the storage, access to, management of and sharing of data in research (Bull et al. 2015a). Custodians of data are required to make arrangements to protect the confidentiality of the information linked to the data and to limit access to the material relating to third parties (CIOMS 2016). If there is a breach in confidentiality, participants may risk being blamed or stigmatized, and public trust in science and research may be undermined. In the context of COVID-19, for example, some COVID-19 patients have had to respond publicly to allegations about non-compliance with public health measures and defend themselves (Atan 2020). In such contexts people with symptoms of COVID-19 may not want to come forward and get tested. There are two important privacy-related issues that arise from the cases in this chapter: the issue of de-identification of data and the use of existing datasets.

7.2.5 Curation, De-identification and Anonymization

Careful curation and de-identification of data is frequently offered as a way of protecting individual anonymity, but some have argued that identifiability exists on a continuum (Rothstein 2010). Although personally identifying information, such as name, address and date of birth, are omitted when data are shared, the data may still have identifying characteristics. Low numbers of enrolled patients may also heighten the risks of identification, as noted in Case 7.2. In addition, data scientists have proved on multiple occasions that datasets that were thought to be anonymized could be linked with other public health data to identify the specific data subject (Sweeney 2000). With the advent of Big Data and an increasing move to link large databases and permit exploration with machine learning and artificial intelligence approaches, it may become increasingly difficult to ensure the anonymity of individuals, and researchers should be aware of the risks to both individuals and communities in the event of re-identification. This is a particular concern in relation to the sharing of health records, and the lack of consistency in the applications of anonymization remains an unresolved issue.

It is also important to bear in mind the possibility of harm to groups or communities in the form of stigma or discrimination. Although data are de-identified at the individual level before they are shared, the dataset might still be attributable to a certain community, and risks of stigmatization or discrimination should be taken into account. This could impact employment opportunities or lead to discrimination by insurance companies (Rothstein 2010).

Sharing qualitative data poses an additional set of challenges. This is especially true when the data collected are derived from individuals who are easily identifiable by their profession, location, idiolect or opinions (such as in Case 7.3) and/or address intimate aspects of people’s lives and are considered very sensitive (as in Case 7.4). It is generally agreed that the more potentially identifying information is removed from a dataset, the less useful such data may be. The ethics committees in Cases 7.3 and 7.4 flag this very issue, and are concerned about preserving the confidentiality of participants.

Cases 7.2–7.4 raise concerns about possible re-identification of participants, and it is worth exploring who these participants are in each case and whether in the context of a pandemic, it may be ethical to proceed with research despite the possible risk of identification. Researchers and ethics committees will need to identify and balance the potential risks to the specific group of participants against the anticipated utility of the data in relation to answering important questions related to the public health emergency.

7.2.6 Use of Existing Datasets

Challenges arise when researchers seek to use archived data from prior research, clinical care or other public health activities without having obtained informed consent from participants for their future use. An example of this type of study is a review of old hospital records, where participants have not been asked if they consent to their data being used for research purposes in the future. Another example is the use of previously collected datasets generated for another purpose, as in Case 7.4, where the proposal was to use health data from earlier surveys to identify potential participants for proposed research. In such cases, the CIOMS 2016 guidelines state that “the research ethics committee may waive the requirement of individual informed consent if: (1) the research would not be feasible or practicable to carry out without the waiver; (2) the research has important social value; and (3) the research poses no more than minimal risks to participants or to the group to which the participant belongs” (CIOMS 2016). In Case 7.5, researchers were proposing to contact some participants in the survey to invite them to participate in a new study, but participants had not provided consent to be contacted. The proposed study could directly address their health needs. In the context of Case 7.5, it seems that criteria 1 and 2 may be met. As for criterion 3, researchers should find ways to minimize any risks to participants, including when contacting them to invite them to take part in a study. It is important to bear in mind that some of these risks, such as being stigmatized, may not be obvious to the researcher.

7.3 Promoting Equity

It is important that primary and secondary users of data ensure that approaches to data processing and use are equitable (GLOPID-R 2018). They should recognize and balance the needs of the different communities involved. This includes those who collect and generate the data, secondary users of the data, the individuals and communities from which the data originate, and the funders of the collection effort (Vayena and Blasimme 2017). Sharing data widely or allowing completely open access to data, with minimal governance mechanisms and oversight, has previously generated significant concerns related to equity, such as lack of recognition of the efforts of data generators, inequitable access to data, and failure to ensure fair benefits to study participants and communities, especially when dealing with data collected from potentially vulnerable populations (Pratt and Bull 2021).

Researchers working in low-resource settings have raised the issue that data-sharing has the potential to exacerbate existing inequalities between health researchers working in low-resource and high-resource settings (Serwadda et al. 2018). They worry that they are reduced to data collectors in the service of highly skilled data analysts and statisticians from high-resource settings. Some approaches that can be taken to prevent this from happening include sharing credit for scientific outputs, ensuring that capacity-building measures are built into research proposals, and ensuring that collaborations are negotiated on the basis of mutually beneficial data-sharing arrangements. Unfortunately, time and resources are often scarce during a pandemic, when the research imperative takes on a new urgency and some of these approaches may not be feasible. For instance, the national research ethics committee in Case 7.3 is described as unable to function optimally, owing, among other things, to lack of resources and inadequate training. A pandemic may not be an ideal time to focus on building the capacity of existing ethics committees when research needs to be carried out in a timely fashion. In such situations, it is suggested that other organizations may need to provide assistance to local research ethics committees to help them overcome these challenges (Smith and Upshur 2019).

Participants and communities involved in research have a valid interest in experiencing the benefits of research arising from the use of their data. In the context of low- and middle-income countries and vulnerable populations, particular attention should be paid to research projects that rely on technologies that are not accessible by or available to certain populations. Fair access to the benefits of research should require that individuals or communities are not excluded from the potential benefit of participating in research because of a digital divide. These concerns may be relevant to Case 7.1, which involves the use of a mobile application developed and deployed in Europe and the Americas. Even in high-income countries, researchers should be aware of the need to ensure that vulnerable and marginalized communities are not excluded from research that could confer benefits to them. Pandemics have historically affected disadvantaged communities very differently, with higher rates of infection, mortality and morbidity (Bambra et al. 2020; Osterrieder et al. 2021; Schneiders et al. 2022), and depriving these communities the benefits of research is unethical.

However, it is not always clear what would constitute a benefit and who it should be shared with. Stakeholders have discussed the importance of both direct and indirect benefits (Bull et al. 2015a). Indirect benefits are particularly relevant in the context of secondary research, which may not address health issues of relevance to participants and communities.

It is also worth noting that the sharing of data for commercial purposes may be a sensitive issue, particularly in relation to a public health emergency (Pratt and Bull 2021; Tangcharoensathien et al. 2010; Ghafur et al. 2020). Community expectations and views may also vary considerably, depending on historical, political and cultural contexts, and researchers should be mindful of the interests of communities when sharing data in such contexts. The involvement of commercial interests in research is also seen as potentially problematic, as they may inhibit timely sharing of data and results as well as being reluctant to share negative data and results. Data-sharing procedures should be agreed in advance to ensure timely access to data and results (including negative ones) (GLOPID-R 2018).

7.4 Conclusion

The collection, processing and sharing of individual-level health data are a critical part of public health emergency responses. Timely and effective access to and analysis of data in health research can generate a “deeper understanding of an outbreak, its impact on patients, and effective methods of control – supporting more effective public health responses” (GLOPID-R 2018). However, the collection, processing and sharing of data must be done in an ethically appropriate manner. The broad ethical principles of respecting persons and communities, and promoting equity, which apply to the use of health data in non-emergency research should also remain the foundational principles of data sharing during a public health emergency. However, during a pandemic there are salient considerations that should inform how these broad principles should be applied on a case-by-case basis, as demonstrated above.

Appendices

Case 7.1: A Multinational COVID-19 Symptom Checker Application

This case study was written by members of the case study author group.

Keywords

Boundaries between research, surveillance and clinical care; Privacy and confidentiality; Data protection, access and sharing; Consent; Digital and remote healthcare and research; Citizen science

A growing number of technological initiatives have emerged to surveil, predict and control the spread of COVID-19. These include a class of tools known as symptom checkers, which have been an important part of the COVID-19 pandemic response. At their most basic level, symptom checkers prompt users to enter their symptoms (e.g. fever, cough, loss of smell, shortness of breath) to help identify possible causes and treatments. More sophisticated versions may also provide triage decisions, including recommending that patients seek medical attention and/or diagnostic testing (see Miller 2015; Berry 2018).

The COVID-19 symptom checker in this case was developed by a commercial health science company in collaboration with researchers at several hospitals and academic institutions. In addition to the above functions, this particular symptom checker asks users to provide health-related information (e.g. age, height, weight and sex at birth) and record relevant health information (e.g. symptoms, COVID-19 test results, treatments and pre-existing conditions) daily. The data are made available to the app developers and their partners, who intend to use it to advance scientific research, for instance through refining symptom recognition and identifying high-risk geographic areas and characteristics of individuals.

Available as a mobile application in app stores in Europe and the Americas, the symptom checker has been downloaded by several million individuals. It collects both sensitive personal data and other personal data. This self-reported information is combined with software algorithms to predict who has had the virus and to track COVID-19 infections. As outlined in the symptom checker’s privacy policy, the data are protected by the European Union’s General Data Protection Regulation (GDPR) and can only be utilized for medical science and to assist the government body responsible for the nation’s health-care system. As this is a not-for-profit initiative, data cannot be used for commercial purposes (i.e. sold).

According to this privacy policy, anonymized data may, however, be shared with research institutions beyond the project’s partners. These encompass hospitals, clinics, universities, health charities and government actors. Certain personal data are also shared with third-party processors, including analytics, hosting, communications, security and fraud prevention services (e.g. Google Analytics, Amazon Web Services or MailChimp). These parties process some of the users’ personal data on behalf of the company, but are unable to utilize the data for their own purposes. As some of these institutions and processors reside in North America, they are not as readily governed by the GDPR. The project has not set a time limit on how long it will hold participants’ information, which, the developers state, is due to the value of such data for researchers studying both COVID-19 and epidemic spread more generally.

The symptom checker team reached out to investigators of cohort and clinical studies to offer this tool (including the potential for customization) at no cost. As part of this outreach, the team publicized its intent to create a consortium and pool data for research purposes. If app users are already part of an existing research study or trial, they can request that their data from the app be shared with investigators on that study. Data collected via the app – including through lifestyle surveys – have been utilized in several preprints and published papers.

As stated in the project’s terms of use, the app does not offer medical advice and is not meant to diagnose or treat any conditions. The project’s website and communications emphasize the app’s potential to support collaborative COVID-19 research and contribute to the fight against this novel disease. As both a source of data for researchers and a tool through which individuals can monitor their symptoms, the project has been endorsed by a range of state actors, health-based charities and doctors’ membership bodies. Users can add multiple profiles and report symptoms on behalf of others. For example, parents can log their children’s health. The application offers a “daily insights” programme for registered schools, where students’ information is anonymized and aggregated. This programme aims not only to support decision-making by tracking how many children are unwell in a particular school network, but also to further general understanding of COVID-19 in children.

The project also runs a vaccine and trial registry and has communicated to app users its intentions to prioritize regular users of the symptom checker when providing information about vaccine trials and other preventive treatments. Individuals can join the project’s mailing list to learn more about future studies. The application is free and the project plans to use donations and grants to cover its costs.

Questions

• 1. Which of the above activities should be classified as research (or not research)? Why?

• 2. Should this app secure consent to data-sharing from users? Why? If so, what consent should be sought and what would be needed to achieve this?

• 3. What ethical considerations should guide (a) how data collected by the app should be used and (b) with whom it should be shared?

• 4. Should there be a time limit on how long these data can be held and/or used? What factors should determine this decision?

References

• Berry, A.C. 2018. Online symptom checker applications: Syndromic surveillance for international health. Ochsner Journal 18(4): 298–299.

• Miller, J. 2015. Checking up on symptom checkers. Harvard Medical School News and Research. Blog. https://hms.harvard.edu/news/checking-symptom-checkers.

Case 7.2: Issues of Consent and Privacy in Establishing a Pregnancy Outcomes Registry

This case study was written by members of the case study author group.

Keywords

Data protection, access and sharing; Privacy and confidentiality; Consent; Researcher roles and responsibilities

In the early months of the COVID-19 pandemic, maternal and foetal medicine specialists, obstetricians, midwives, general practitioners and pregnant women began to express concern about the impact that COVID-19 infection might have upon pregnancy outcomes and maternal health. Clinicians were limited by a lack of evidence in their ability to reassure women and support them to make informed decisions about their pregnancies and activities. Key questions included whether COVID-19 increased the risk of adverse outcomes such as miscarriage, stillbirth or premature labour; whether child development might be affected by COVID-19 infection at different points in a pregnancy; the relative safety of modes of delivery in the context of COVID-19 infection; whether it was safe to breastfeed when infected by COVID-19; and what impact courses of treatment might have upon foetal and maternal health.

Researchers and clinicians in a country in the global North established a registry to collect data about the outcomes of COVID-19 infection in pregnancy. Maternity carers across a range of health settings were asked to register and provide information on women suspected of having COVID-19 at any point during their pregnancy and up to 6 weeks post-partum. The original request to the national ethics committee for a waiver of consent was changed to a proposal for an opt-out approach. Clinicians registering women were asked to notify the women of their registration and provide them with details on how to be excluded from the registry if they wished. The plan was that data would be reported collectively and in a de-identified manner. In the early months of the registry, fewer than 10 cases were added, reflecting the effectiveness of the national COVID-19 response strategy. No women opted out, although it is possible that eligible women were not registered by their health provider. Without more cases, the researchers were concerned that analysing and reporting the data collected in the registry risked identifying the women involved.

In the context of the country’s public health response, public health agencies are reporting “de-identified” information about COVID-19 cases in the community, including their area of domicile, age and sex, and details about their movements. This information is widely reported upon in the media.

Questions

• 1. In a pandemic should the same standards of de-identification of individual-level data apply when publishing public health information and research designed to inform clinical practice? Why?

• 2. How should the context of a pandemic affect the arguments for ensuring that sources of data cannot be identified?

• 3. Given the need to understand the clinical implications of COVID-19 for pregnancy and neonatal care, is there a case for an ethics committee reviewing this registry to approve a waiver of consent? Why?

Case 7.3: Ethical Conduct and Review of Research

This case study was written by members of the case study author group.

Keywords

Ethical review; Privacy and confidentiality; Ethics committee remits and responsibilities; Consent; Qualitative research

Like some other Caribbean countries, little research is conducted in Country A. It is believed that this is due to the culture of the country, where executing research studies is considered atypical. Nonetheless, the importance of carrying out research studies has been recognized and is supported by local authorities. As a result, measures have been put into place to ensure that a national research ethics committee (NREC) exists to guide researchers and protect research participants. In addition, there is appreciation for the conduct of contextually relevant research studies whose findings can support decision-making as well as the development and reform of local policies. There are, however, some limitations, which make the use of an evidence-based approach challenging. Country A’s small population size and the relatively low priority it gives to research are exacerbated by insufficient funding opportunities, limited research skills, inadequate ethics training and confidentiality issues – all of which often make it difficult for the full benefits of research to be realized.

During the COVID-19 pandemic, the possibility of conducting research in Country A was further compromised by the inability of the NREC to function optimally. Its members played a significant role in serving on the COVID-19 task force and were thus occupied with other priorities. The challenge of limited resources, including human resources, made it particularly difficult for the NREC to function as expected.

An early-career researcher from Country A submitted a research protocol to the NREC for review and approve shortly after the first COVID-19 case was reported in the country. The aim of the study was to assess the knowledge about, attitudes towards and practices regarding hand hygiene among health-care professionals who work at the country’s main hospital. One of the objectives of this study was to obtain information on effective means of minimizing the spread of infectious diseases, like COVID-19. It was anticipated that the knowledge gained would guide the decision-makers, including the hospital administrator, to make recommendations that would promote more effective hand-hygiene practices, including more frequent hand-cleansing.

Although ethical review was expected to take a maximum of 6 weeks, as per the NREC’s website, it took 12 weeks for the NREC to provide feedback on the protocol, which was not approved. The committee requested a number of changes prior to resubmission. The NREC considered that the methodology, which proposed using face-to-face interviews to obtain data, was not appropriate in this setting, which had a small number of specialized doctors, whose privacy and confidentiality would be compromised. It was particularly concerned about protecting the doctors from being easily identified, as naming a specialism was considered to equate to revealing the doctors’ identities. The NREC also recommended that participants should not be asked to provide written consent, as this too would affect their privacy and compromise confidentiality. Its rationale was that this was minimal risk research so a formally documented signature was neither important nor required.

Questions

• 1. What kind of safeguards and methodological approaches are required to provide assurances that the confidentiality of a specific group of participants can be maintained? Does the COVID-19 pandemic make it harder than usual to adhere to these? Why?

• 2. Is it ethical to conduct research studies if the usual safeguards cannot be effectively implemented, especially during emergency situations like the COVID-19 pandemic? Why?

• 3. Given the significant pressures and workloads experienced by some members of ethics committees during the pandemic, what kind of support may be necessary and appropriate to enable effective and timely ethics review? How should capacity to conduct effective and timely ethical reviews be prioritized in pandemic responses?

Case 7.4: Informed Consent and Data Protection in the Context of Increased Use of Information and Communication Technologies

This case study was written by members of the case study author group.

Keywords

Consent; Privacy and confidentiality; Data protection, access and sharing; Ethical review; Vulnerability and inclusion; Digital and remote healthcare and research; Qualitative research

The COVID-19 pandemic has prompted widespread use of technological tools, such as social media, to contact people who potentially meet the inclusion criteria for quantitative and qualitative research (Ploug and Holm 2015). Consent processes have also been adapted and modified in response to the pandemic. Before the pandemic, some predominantly qualitative investigations had already introduced online informed consent forms. As social distancing and restrictions on population movements were imposed during the pandemic, the use of online consent forms became increasingly common in qualitative studies and were also introduced in quantitative research (Gilbert et al. 2017). In addition, online platforms have increasingly been used to collect research data. Research ethics committees have had to consider the epidemiological, clinical, social and ethical implications of these changes in practice in the context of the pandemic, and to think about how research can be conducted online ethically and safely.

A research ethics committee in a research institution in Latin America received an application for a qualitative research project which aimed to learn about romantic attachment between members of a couple and emotional regulation difficulties in each member during the COVID-19 outbreak. The research sought to directly address the widespread impact of COVID-19 on mental health in communities experiencing lockdowns. According to the protocol, the respondent would be invited by email to participate in a survey about their experience of being confined with their partner for a long time. A link would appear in the invitation, which, when clicked, would display an informed consent form. The research was sponsored by a reputable university in the city, and this sponsorship was expected to generate trust and confidence in participants that the information they provide will be kept confidential. After they have consented, a new instruction would appear, which enabled participants to access the survey itself. The system would also ask the respondent to enter their email address. This step would be mandatory and ensure that participants would be able to receive the results of the survey.

The research ethics committee considered that it was important to check that the research fulfilled the core requirements for it to be considered ethical: research participants should be selected equitably, participants’ privacy should be protected, and their data should be kept confidential. The committee noted that the use of an online consent form did not offer respondents the opportunity to have a conversation with the researcher in which they could ask any questions or voice any concerns about the research. In addition, the fact that only individuals who had access to information technologies could be surveyed would have an impact on the equitable selection of research participants.

The committee also considered that as this research dealt with intimate issues and collected very sensitive data through online platforms, it was crucial that participants could be guaranteed confidentiality. Online platforms for collecting research data from participants are potentially vulnerable to security breaches and have not proved to be absolutely reliable when protecting information. Participants’ consent to share their life experiences would be given on the condition that they were not going to be identified through their answers. Researchers consequently had a responsibility to ensure the sensitive data of the participants were appropriately safeguarded as the data were collected, analysed and reported.

Questions

• 1. What ethical issues are most pertinent when seeking online consent to research?

• 2. When an online survey is conducted that requests intimate information from participants, what specific ethical challenges do researchers have a responsibility to address?

• 3. When reviewing research proposals that collect data online, what should research ethics committees pay special attention to?

• 4. Is it appropriate for participants to be recruited via email and required to provide their email address to take part in this study? Why?

References

• Gilbert, M., A. Bonnell, J. Farrell, D. Haag, M. Bondyra, D. Unger, and E. Elliot. 2017. Click yes to consent: Acceptability of incorporating informed consent into an internet-based testing program for sexually transmitted and blood-borne infections. International Journal of Medical Informatics 105: 38–48. https://doi.org/10.1016/j.ijmedinf.2017.05.020.

• Ploug, T., and S. Holm (2015). Routinisation of informed consent in online health care systems. International Journal of Medical Informatics 84(4): 229–236. https://doi.org/10.1016/j.ijmedinf.2015.01.003.

Case 7.5: Research into COVID-19 and Cancer in Populous Low-Income Neighbourhoods

This case study was written by members of the case study author group.

Keywords

Vulnerability and inclusion; Data protection, access and sharing; Consent; Ethical review; Privacy and confidentiality; Boundaries between research, surveillance and clinical care; Non COVID-19 research

In early March 2020, the government in a Latin American country declared a health emergency because of the COVID-19 pandemic, and decreed a period of preventive and compulsory social isolation (PCSI) for the entire population. This meant the suspension of non-essential work and recreational activities and social gatherings of any kind. Remote education using online platforms was maintained, but participation was limited, especially in low-income populations, because of poor connectivity and poor access to the technology required.

The public health-care system was mainly focused on medical emergencies and caring for people with moderate to severe COVID-19. The Ministry of Health took steps to contain SARS-CoV-2 transmission in low-income populations, facilitating access to COVID-19 testing and care for COVID-19 patients. In coordination with university researchers, students and public health-care teams, door-to-door surveys were carried out in populous low-income neighbourhoods in order to find possible cases of COVID-19 and provide assistance with food and primary health care. In this context, valuable health and socio-economic data were collected about a wide range of people.

PCSI is an effective way of limiting infection, but people on low incomes have greater difficulties in complying with it. This is because of precarious and overcrowded housing, where strict isolation is not possible. Added to this, informal-sector work and poorly paid jobs, which in many cases were lost or suspended without financial compensation or support, generated worse economic conditions, which made it difficult for families to maintain proper hygiene and obtain the food and medicines they needed. All these social conditions generated a greater risk of infection by COVID-19 and neglect of pre-existing diseases in these populations.

Near the end of 2020, an institution conducting cancer research made a call for applications for funding aimed at investigations relating to cancer, COVID-19 and social vulnerability. Cancer is one of the main non-communicable chronic diseases in the country, resulting in high levels of mortality and morbidity. A research team with a background in cancer research and in conducting clinical studies submitted a proposal and was awarded a research grant. The clinical protocol for the study was presented to the ethics advisory committee of the university, which was the institution responsible for the study and for managing the grant.

A prevalence, observational and cross-sectional study of people with cancer and their eventual recovery from COVID-19 was proposed. The hypothesis of the study was that PCSI in contexts of socio-economic vulnerability causes people’s health to deteriorate, worsening the progression of cancer and its associated comorbidities, and also generating a greater risk of SARS-CoV-2 infection. The pandemic also had a negative impact on the public health system. Information about potential participants for the clinical study would be taken from the university’s databases, which contained the results of previous health surveys carried out by the research team. In those surveys, people had been asked if they had chronic diseases, including cancer.

The study proposal included an analysis of epidemiological and clinical data. Participants would be required to give written consent prior to inclusion in the study. The study would use blood and urine sampling to determine participants’ general state of health. It would evaluate routine oncological serum markers and identify potential new biomarkers, both for cancer and for COVID-19. The study also sought to promote clinical care, by linking people with the health system and obtaining data about the prevalence of cancer and associated comorbidities, and the epidemiology of COVID-19 in these populations. In this sense, one of its most important aims was to generate clinical and health-care recommendations for the health authorities, with the intention of improving the quality of life in these populations.

However, when the clinical protocol of the study was presented to the committee, they raised concerns about the proposed use of health data obtained from earlier surveys to identify potential study participants. The committee stated that in order to use the information from earlier surveys, people had to be informed about the existence of the proposed study and about the future use of the data at the time the earlier survey data were collected. Concerns were also raised about the recruitment process, which would involve initial contact by telephone, followed by a visit to the participant’s home. The committee pointed out that an independent witness was required for the consent process, as the surveyed candidates came from low-income neighbourhoods and were considered a vulnerable population.

The researchers responded to the committee, stating that when the earlier surveys were carried out, respondents were consulted about the possibility of using the information provided to generate clinical and health-care recommendations. They also noted that when the surveys were conducted, the current call for research applications had not been issued, and this use of the data had not been planned. In addition, the protocol had incorporated a proposal for an independent witness for the consent process, so as to preserve the rights of vulnerable populations.

Questions

• 1. Should archived survey data be used to identify potential participants for a study which seeks to identify and address their health needs in the context of the COVID-19 pandemic, even if survey respondents have not consented to such use? Why?

• 2. How should this study, which seeks to analyse clinical and epidemiological data from potentially vulnerable populations where COVID-19’s impact could exacerbate inequalities, be prioritized?

• 3. Should research with a direct therapeutic component be prioritized over non-therapeutic research in pandemics? Why?