Article Text

Legal aspects of records based medical research
  1. S E Parkes
  1. Correspondence to:
    S E Parkes
    WMRCTR, Birmingham Children’s Hospital NHS Trust, Steelhouse Lane, Birmingham, B4 6NH, UK; sheila.parkes{at}

Statistics from

Request Permissions

If you wish to reuse any or all of this article please use the link below which will take you to the Copyright Clearance Center’s RightsLink service. You will be able to get a quick price and instant permission to reuse the content in many different ways.

Ethical medical research must continue despite the legal problems of records based medical research

All that may come to my knowledge in the exercise of my profession… which ought not to be spread abroad, I will keep secret and will never reveal (Hippocratic Oath)

Patient confidentiality is a fundamental component of medicine, but as late as 1994 the Royal College of Physicians determined that there was a duty to use available information for the general good where that could be done without detriment to individuals.1 The British Medical Association Ethical Committee in 1988 said that information could be used without consent as long as a local research ethics committee had approved the study.2 In 1997, Doyal3 proposed that epidemiological research, involving only access to medical records, should be an exception to the requirement for informed patient consent.


Data Protection Act 1998

The situation was radically modified in March 2000, when the Data Protection Act 1998 (DPA)4 came into force in the UK, thus curtailing the relative freedom which had previously been enjoyed by medical researchers. The DPA was designed to protect the rights of individuals with regard to the confidentiality of their information and its implication was that no identifiable data on living individuals should be handled or disclosed without the explicit consent of the subject. Although the Data Commissioner said that the DPA should not be seen as an obstacle to medical research, that is the present situation.

Subsequent legislation and the Patient Information Advisory Group

The cancer registration establishment was the first body to voice concerns over the implications of the DPA, after the General Medical Council (GMC) issued its own guidance in September 2000. Their interpretation effectively prohibited the automatic reporting of cancer cases to the local registry without the patient’s consent. The system had been in effect for over 50 years, with no adverse consequences and many benefits, but this ruling placed the whole process of cancer monitoring in the UK in jeopardy, implying that doctors who reported cases without consent might be prosecuted. However, after much criticism, the GMC agreed to modify its guidance, which it finally did in April 2004, reflecting the effects of subsequent legislation.5

In 2001, the Government passed the Health and Social Care Act 2001,6 giving the Secretary of State power to allow the use of identifiable data in specific circumstances.7 The Patient Information Advisory Group (PIAG) was then established to administer these powers and to consider applications for the use of identifiable patient data without consent, many of which have been turned down. It has however approved the continuation of cancer registration, the Public Health Laboratory Service, and four national databases, on a temporary basis and with conditions. Strobl et al8 hoped that PIAG might provide clear guidance for researchers, but it has only dealt with individual applications and has provided no general solutions, except to recommend that researchers and registries work towards data anonymisation or patient consent.9

The Human Rights Act 1998

The Human Rights Act 1998 has also contributed to the debate, as jurisprudence has decreed that medical records are covered by Article 8 which deals with the rights of the individual regarding home, family life, and privacy. The only exemption from obtaining consent for access to medical records is that this should be in the interests of the protection of health, but it must also be legitimate and necessary.


A cardinal rule of population based epidemiological disease research is that data ascertainment should be complete for the analysis to have statistical validity. However, under the new legislation, consent to data handling is the major issue. The Information Commissioner herself stated that “It is a major misconception that the Act always requires the consent of data subjects…”, but she also says that there is an implied requirement to obtain consent.10

The concept of patient consent is a familiar one—for diagnostic tests, treatment, recruitment into clinical trials—but how many clinicians would feel that it was necessary for historical research involving only inspection of case notes? Nowadays most consultants maintain databases of patients treated by them and their predecessors and regularly ask their juniors and non-medical personnel to undertake studies on past cases with whom they themselves have had no contact. Under the new legislation this represents disclosure of identifiable information and requires consent.

However, section 33 of the DPA is an important exemption clause in the area of records based research, providing specifically for historical research and allowing the disclosure of data from records previously collected for another purpose (that is, research use was not envisaged) as long as various conditions are met.11 These include “not supporting measures or decisions with regard to particular individuals”—the meaning of this in a medical context is unclear, since, particularly in rare diseases, past experience can direct current and future practice. The others are: not causing distress and not identifying individuals in results or publications. These have long been standards automatically adhered to, but now the integrity of the medical profession has been called into question and doubts raised as to the legality of research. Although section 33 appears to solve the problem of archival data, current records which will be used for research must be collected and processed “fairly and lawfully”, thus requiring patient consent and the giving of detailed information about collection and disclosure of the data.

What is consent?

The issue of consent, whilst apparently simple, is fraught with confusion. For years we have operated under the rule of implied consent but this is no longer enough and the DPA has introduced the term “explicit” consent for health information. However, no definition is given and even the GMC stated that this could be either written or verbal. Obtaining consent to the use of information from current and future patients could theoretically be introduced (although difficult enough to administer), but what of those who refuse, or past patients whose information is already recorded and used in old registries and databases?

The early advice of the Information Commissioner’s Office (personal communication, 2000) was that all identifiers should be removed, if consent could not be obtained because this would involve “disproportionate effort”. There is as yet no official definition of this, although it includes such reasons as cost, manpower, size of population, and untraceable patients. Proportionality is a very important issue and can be argued to justify large scale, retrospective studies of old records without consent. Confusingly, the Department of Health has recently stated12 that for research using identifiable data, explicit patient consent must “normally” be obtained. What do they regard as abnormal? Presumably, although they do not make this clear, this statement applies only to records currently being created.

Long term implications of consent

Let us assume we do start to ask for consent now—what do we ask for, where, when, how, and from whom? It is felt unlikely that a broad question such as “Do you consent to your [child’s] data being stored and used for research in the future?” would be legally acceptable, and yet it is obviously not feasible to go back to each family when a new research question arises (proportionality again). Another issue is that it would be the parents who would initially give consent for their child’s data and it would again not be practicable to approach all children when they reached the age of 18 to renew that consent. The likelihood that a proportion would refuse has obvious implications for the success of population based studies. Thus a more supportive and flexible official definition of consent in this context is required.


It is important to remember that the DPA makes no objection to the use of anonymised information and the Information Commissioner recommends that, in the absence of consent, all identifiers should be removed “so as not to act unfairly with regard to the individual”. But the problems with anonymisation are obvious. Where subsequent information is obtained from another source, which is common in the case of disease registers, how would the records be linked? The current proposal is to use the NHS number, but until this appears on all documents, for example, pathology reports and death certificates, this will not be possible. And what of patients from overseas, whom we often see in the arena of specialist paediatric disease, who do not have an NHS number? The biggest problem is that the Information Commissioner still regards the NHS number as an identifier,13 so until it can be legally deemed anonymous, can be transcribed totally accurately, and achieves 100% coverage, research could be statistically invalid and public health monitoring insecure. Where researchers need access to hospital case notes, anonymisation is impossible, even though they ultimately remove the identifiers from the recorded data.


The overriding advice from the Information Commissioner’s Office is that data should be obtained fairly. This means in effect that current patients should be given full details as to which information is being recorded, why, who will have access to it, what it will be used for, and what will happen to it once it has been used. Medical records are primarily created to provide an account of diagnosis and care. The fact that the information may subsequently be used for research must be explained to the patient in appropriate language at an appropriate time, most easily achieved in an information leaflet. Importantly, the patient must be given the opportunity to object. The Medical Research Council has laid out guidelines as to the information to be given.14 As for old records, those patients who can be contacted should be given the information, unless the disproportionate effort clause applies, in which case the data may be used under the terms of section 33.10


Despite all of the discussion, there is still no right answer. The three options which have been distilled from all the arguments put forward are: consent/assent, anonymisation, or use under a public interest mandate,15 but each is unsatisfactory and provides more problems than solutions. Most people would agree that health research is unquestionably in the public interest, but legal use of identifiable information under this mandate has previously only been decided in individual instances.

All of this illustrates the basic conflict between a doctor’s duty to keep patients’ information confidential and that to pursue research into the causes, treatment, and outcomes of disease. If there had been no research over the last few hundred years, we should still be living in an age of high infant and child mortality and premature adult deaths from preventable disease. The public want and, more importantly, expect advances in medicine and surely understand that these can only take place by studying past experience. Although the age of “Trust me, I’m a doctor” is gone and recent unfortunate circumstances in the paediatric domain have shaken public confidence, expectations of progress still exist. Experience has shown that the public, including parents, would agree to their and their children’s being involved in research if they had been told.

There is an extensive body of literature on this subject, which will no doubt increase. Coleman et al have presented a comprehensive summary16 of the developments, arguments, and opinions, illustrating in depth the confusion which still exists. They propose that further legislation to preserve vital public health monitoring and to protect medical research should be passed.

Until such time as there is more explicit, consistent Government and professional guidance as to when and what kind of consent is necessary, patient information is the key. We must be open with our patients, their families, and the wider public in order to restore their trust. Ethical medical research must be allowed to continue without impediment and with full professional backing and legal support. In the meantime, must we wait for a test case to clarify matters? Any volunteers?


  1. 1.
  2. 2.
  3. 3.
  4. 4.
  5. 5.
  6. 6.
  7. 7.
  8. 8.
  9. 9.
  10. 10.
  11. 11.
  12. 13.
  13. 12.
  14. 14.
  15. 15.
  16. 16.