Doctors of virtually all specialties have long used medical records for research. This practice has played a critical role in medical progress. Reviews of medical records and subsequent publication of these analyses are almost always done without revealing patients’ identities. However, there is little debate about the need to obtain informed consent from patients when their identities must be revealed.

This article refers to situations in which, although the patient’s identity is not revealed in the publication, the investigator (who may not be the patient’s treating physician), clinical research fellows and technical staff are privy to the patient’s personal data. Historically, such research has been exempt from an ethics review and researchers have not been required to obtain informed consent from patients before using their records. Recently, however, a number of countries have introduced policies to regulate the use of medical records in research, effectively restricting the manner in which this type of research is conducted around the world (1, 2, 3, 4, 5, 6, 7, 8). We suggest that the situation in India is different from the West and the international guidelines currently being formulated may prove deleterious to the Indian medical fraternity if applied here.

Overview

The use of medical records for research has conventionally taken two forms: systematic record review and record linkage (9, 10). Systematic record review may use the records of a consecutive series of patients with the same diagnosis to identify common clinical features, response to treatment, or factors influencing prognosis. This form of retrospective analysis constitutes the most common source of medical publication by physicians in India.

Record linkage entails collating medical information from separate sources on individual patients identified by name and date of birth to identify, among other things, any potential association between a drug and a disease. In such research the inclusion of personal identification in the records is essential for data collection. It entails a greater risk of loss of confidentiality. Such reviews seldom take place in India. This probably explains the public’s relative lack of concern about the use of medical records for research.

Two primary ethical concerns pertaining to research based on medical records are obtaining informed consent and maintaining the confidentiality of data (9, 10, 11). Ideally, patients should understand what their medical records will be used for, who will have access to their records, and how their confidentiality will be maintained, before they give explicit consent. Such consent has not been required so far and clinicians have taken the availability of this information for granted. Thus, record linkage has usually been carried out without patient consent and qualifies for exemption from review by most ethics review boards (ERBs) (8, 9).

Numerous surveys outside India have revealed that patients are willing to support and participate in research but first want to be consulted on the use of information from their medical records. They are worried that their data could be used for marketing and insurance purposes. They are also concerned that sensitive personal information could be widely distributed without their knowledge (12, 13, 14).

These concerns have led to international efforts to enhance the protection afforded to data from medical records. In the United States, the Health Insurance Portability and Accountability Act (HIPPA) (1, 2) directs the Secretary of Health and Human Services to establish safeguards for the privacy of individually identifiable health information. A variety of federal legislative proposals have also been developed to address the issue. The European Commission has proposed in its draft directive that explicit patient consent should be obtained before each record can be used– a rule so stringent that record-based research would probably stop altogether. Other guidelines, notably those recently proposed by the United Kingdom’s Department of Health and the British Medical Association, are less stringent but nonetheless restrictive (3, 4, 5, 15).

Current practice of medical records review and publication of data: the international scenario

Until recently, most international journals considered articles derived from retrospective analysis, even without ERB approval, if the patient’s identity was not revealed. Investigators needed to submit an application for retrospective analysis to the ERB, with a special request for exemption or expedited review, and this was normally granted. With the implementation of stringent guidelines, journals are becoming hesitant to consider articles reporting on studies that have not taken informed consent. ERBs in turn are becoming more reluctant to clear studies that involve medical records review that have not taken the informed consent of patients (16).

The Indian scenario

Until recently most Indian investigators could get retrospective analyses published without an ethics review, as most international journals did not insist on such clearance. Now that ERB clearance is mandatory, Indian scientists too must get their retrospective studies reviewed. The guidelines of the Indian Council of Medical Research (ICMR) do not provide for exemption or expedited review. They do provide for waiver of informed consent if the study is of minimal risk or conducted in an emergency. The Medical Council of India’s Code of Medical Ethics 17.17 (17) also permits such waivers if the patient’s identity is not revealed. However, all such proposals must be cleared by ERBs in a formal meeting. As there are very few well-run ERBs in the country, such research will definitely slow down (18).

Ethical and practical arguments against stringent regulations

At the most restrictive level, information given by a patient to a doctor can be divulged to no one else. In practice, the duty of confidentiality is interpreted as applying not only to the doctor directly involved in the patient’s care but also to those with whom he or she judges the information may be shared; there is, in effect, a professional duty of collective confidentiality. Once the sharing of personal medical information among doctors is accepted, it becomes somewhat irrelevant whether the activity is for research, teaching, or care. The only relevant issue is to ensure that the collective confidentiality is secure, and that no breach occurs that could adversely affect the individuals concerned.

Retrospective reviews of medical records are an inexpensive and efficient way of gaining a comprehensive view of the health system’s response to a particular medical problem. Although they use medical notes beyond the primary purpose for which they were created, systematic reviews of this kind are qualitatively different from other research in which participants are asked to undergo additional or novel tests or treatments. Provided that confidentiality is maintained, medical records review qualifies as an effective tool for scientific study. The challenge in retrospective studies is to strike a balance between the risks to privacy and confidentiality and the potential benefits to existing patients, future patients and the public in general.

The clinical detail available from the medical records provides many advantages. If, for example, patients who died could not be assessed and patients with bad outcomes refused to participate in follow-up, even dangerous treatments might appear beneficial. It is likely that patients with certain conditions (such as reproductive problems or psychiatric disorders) would be less willing to volunteer the use of their records than other patients. Although this is understandable, in practical terms, valid outcome studies may no longer be possible, thus slowing progress in the management of these conditions.

In many instances, obtaining consent from patients through either direct or indirect contact is problematic because such contact may introduce bias into the research process. It may also constitute a breach of privacy. Such contact may cause psychological, social or other harm to the former patient. Undue hardship may be imposed on an organisation when additional financial, material, human, or other resources are required.

How do these regulations affect Indian doctors?

Making it mandatory for researchers to obtain explicit consent from patients before accessing their medical records, as now proposed by the European Commission, would prevent most epidemiological and clinical studies that rely on personal records, with the exception of small case series. In the US, the HIPAA regulations appear to inhibit medical record and database research (1, 2, 7). Current HIPAA implementation strategies increase the workload for ERBs and researchers and increase the dropout rate for proposed studies when investigators are unable to meet the requirements (1, 2). Researchers also feel that public money from government agencies and charitable organisations is wasted by ERBs when innocuous retrospective studies are required to go through multiple ethical reviews (6, 16).

India has a high incidence and prevalence of both communicable diseases and "lifestyle related" diseases. Clinicians and medical practitioners from India may have limited access to modern research facilities, though they have extensive clinical experience. The majority of publications from Indian institutes are related to medical records review. Only a few major institutes have ERBs and most of this form of research is not subjected to ethics review (18). Until now, articles reporting medical record review findings were accepted by indexed foreign journals. However, with the introduction of new guidelines for ethics review clearance, the publications of Indian authors may no longer be accepted.

Suggestions and recommendations

No surveys have been done in India to study the views of patients about the use of personal data for research. However, issues of confidentiality are likely to gain importance with wider insurance coverage. The Indian investigator should anticipate this and plan for the future.

The ICMR guidelines allow ERBs to waive informed consent in appropriate cases where the study carries only minimal risk or in cases of emergency (19). However, the guidelines should also provide allowances for expedited review or exemption from the review process. Study proposals involving medical records review should be included under this category of review. The ICMR should resist the move to universalise the new set of stringent guidelines proposed by the European Commission. It would be ideal for India to adopt the guidelines of the working group of the Royal College of Physicians (12) where ERBs are responsible for assessing the potential importance of a research proposal and deciding whether or not to waive the requirement for informed consent. Circumstances under which ERBs may opt to do this include the following situations:

• Access to the clinical record is essential for completion of the research and consent is not practicable;
• The research is likely to yield information of sufficient merit;
• The research pertains to some future planning, preventive, or therapeutic initiative which may benefit the patients whose records are studied;
• Where possible, identifiers have been removed from the parts of the record to which researchers have access and where not possible patients are assured anonymity when the results are made public;
• It is not anticipated that contact will be made with the patients as a result of research findings;
• Researchers who are non-clinicians are formally instructed about their duty of confidentiality and they enlist a clinical supervisor who formally accepts professional responsibilityfor any breach of confidentiality, should it occur.

Excessive restrictions on access to medical data for research could harm large numbers of people and hamper progress in medical care. A consensus policy respecting the rights of individuals and the responsibilities of investigators is needed in India.