knowledge 3 February 2021 |

Health Research Regulations Amended to Address Challenges Identified

The new Data Protection Act 2018 (Section 36(2)) (Health Research) (Amendment) Regulations 2021 (the “Amendment Regulations”) were prepared collaboratively by the Department of Health, the Secretariat to the Health Research Consent Declaration Committee (“HRCDC”) and the Health Service Executive in consultation with the Data Protection Commission.  The Amendment Regulations, which are available here and which are supported by guidance issued by the HRCDC available here, make a number of amendments, the most notable of which are:  

Quality of Explicit Consent

The Health Research Regulations made obtaining explicit consent from data subjects for the processing of their personal data for health research purposes prior to conducting health research the default rule.  The Amendment Regulations add further requirements on the nature of the explicit consent required.  Specifically, they require that explicit consent be obtained from the data subject as a ‘suitable and specific measure recorded and retained by the controller in accordance with international best practice on the ethical conduct of health research (which includes informed consent, transparency and independent ethical oversight)’ for the processing of personal data for the purpose of specified health research, either in relation to a particular area or more generally in that area or a related area of health research.  

Pre Screening Authorisation – further access permitted without explicit consent

To assess whether an individual is suitable or eligible for inclusion in a particular health research study (‘pre-screening’), the Health Research Regulations provided that only  healthcare staff involved in the care and treatment of the particular individual could access patient records for this purpose without the explicit consent of the individuals concerned.

The Amendment Regulations further facilitate the pre-screening process by broadening the scope of those persons permitted to access a patient’s records. They provide that certain identified persons can carry out pre-screening actions without explicit consent, and without Research Ethics Committee (“REC”) approval, subject to specific further safeguards and limitations. These identified persons include a healthcare practitioner employed by the controller, an employee of the controller, or an ‘authorised person’ (as defined in the Amendment Regulations, which now includes e.g. an employee of a higher education institute under the control of a health practitioner).  Where an ‘authorised person’ is engaged in pre-screening, in light of the transparency requirement, this must also be communicated to the data subjects in the form of appropriately located notices and posters.

Retrospective Chart Reviews – greater use permitted

A retrospective chart review is a type of research project in which previously recorded, patient-centred data is used to answer a new research question.  Chart review studies facilitate the rapid collection of clinical, safety and other data.   However, by their nature, they are problematic in this context as explicit content cannot be obtained for unknown, future research purposes.

Given the usefulness of retrospective chart review studies, the Amendment Regulations disapply, but only in the context of low-risk research studies, the requirement for explicit consent where this has been approved by an REC.  Before exercising its discretion to allow a retrospective chart review study to take place without the explicit consent of the concerned data subjects, the REC must be satisfied that the required data protection risk assessment carried out by the controller indicates a low risk to the rights and freedoms of the data subjects whose personal data will be used in the study.

Informed consent under the previous EU data protection regime

The Amendment Regulations also contain further amendments relevant to research that commenced prior to 8 August 2018 to allow for existing informed consents to continue to be valid (with certain limitations) and to disapply the Health Research Regulations’ requirement to obtain explicit consent in those circumstances.  This may be particularly useful to controllers involved in health research who are considering the issue of consents previously given under the EU data protection regime prior to the GDPR and the issue of ‘re-consenting’.

Conclusion

The Amendment Regulations also make changes in the area of deferred consent in the health research context and to the relevant appeals process. 

Overall, it is encouraging to see that certain challenges and practical situations identified by industry and other stakeholders have been addressed in these new Amendment Regulations.  While the changes may not address all of the causes of frustration for industry stakeholders with the Health Research Regulations, it is to be hoped that these will facilitate increased health research in Ireland in a way which continues to uphold public confidence in the use of health data for this purpose.

Also contributed by Aishwarya Jha.