0A4F4F9BD490A749D5437F821CF06DF1
Best Practices for Protecting Privacy in Health Research
https://cihr-irsc.gc.ca/e/29072.html
http://leaux.net/URLS/ConvertAPI Text Files/2582CF78ECDCEA9BBA9072D6786F59C3.en.txt
Examining the file media/Synopses/2582CF78ECDCEA9BBA9072D6786F59C3.html:
This file was generated: 2020-07-14 06:02:33
| Indicators in focus are typically shown highlighted in yellow; |
Peer Indicators (that share the same Vulnerability association) are shown highlighted in pink; |
"Outside" Indicators (those that do NOT share the same Vulnerability association) are shown highlighted in green; |
Trigger Words/Phrases are shown highlighted in gray. |
Link to Orphaned Trigger Words (Appendix (Indicator List, Indicator Peers, Trigger Words, Type/Vulnerability/Indicator Overlay)
Applicable Type / Vulnerability / Indicator Overlay for this Input
Political / Illegal Activity
Searching for indicator illegal:
(return to top)
p.000002: Data identifiability can be characterized as being on a continuum, in which the division between degrees of "identifiability" are not always clear-cut. Even a
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
...
Political / criminal
Searching for indicator criminal:
(return to top)
p.000086: Good Clinical Practices: Consolidated Guidelines for clinical trials sponsored by industry, published by the International Conference on
p.000086: Harmonization.
p.000086:
p.000086: Researchers, Institutions and research ethics boards (REBs) should be aware of all applicable policies, regulations and guidelines. In some cases, it
p.000086: may be necessary for Institutions to have recourse to speci0c expertise to identify legal and other issues in the ethics review process..."
p.000086:
p.000086: Updates.
p.000086: References
p.000086: 1 Privacy Advisory Committee members are listed in Appendix A-1.
p.000086:
p.000086: 2 Under section 301(d) of the U.S. Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
p.000086: persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research.
p.000086: This authority has been delegated to the National Institutes of Health (NIH) and other Health and Human Services Agencies.
p.000086: Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for research
p.000086: participants, such as damage to their financial standing, employability, insurability, or reputation. A Certificate allows the investigator and others
p.000086: who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative,
p.000086: legislative, or other proceeding, whether at the federal, state, or local level. See U.S. Office of Human Subject Protection- Guidance .
p.000086:
p.000086: 3 The World Health Organization defines "health" as "a state of complete physical, mental and social well-being and not merely the absence of
p.000086: disease or infirmity".
p.000086: From Preamble to the Constitution of the World Health Organization as adopted by the International Health Conference, New York, 19-22 June,
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
...
Political / political affiliation
Searching for indicator party:
(return to top)
p.000002:
p.000002: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000002: as appropriate for the sensitivity and identifiability of the data.
p.000002:
p.000002: REBs should review and approve researchers' proposed measures for safeguarding any personal data to be collected.
p.000002:
p.000002:
p.000002: Element #8: Controlling access and disclosure of personal data
p.000002:
p.000002:
p.000002:
p.000002: Data sharing for research purposes - whether of linked or unlinked data sets - is an important way of enabling socially valuable research. It avoids
p.000002: unnecessary duplication of data collection, which reduces the burden on research participants and permits researchers to use limited or scarce resources
p.000002: more productively.
p.000002:
p.000002: However, once approved by an REB, there should be strict limits on access to data and secure procedures for data linkage, subject to data-sharing
p.000002: agreements.
p.000002:
p.000002: When personal data are essential to research objectives and questions, researchers need a plan for making public the results of research in ways that do
p.000002: not permit tracing back to individuals if they do not wish their identities to be known.
p.000002:
p.000002: The most secure way of conducting data linkages requested by external researchers is for the data holder to conduct the linkage and provide linked data
p.000002: sets to the researcher without direct identifiers and at the minimum level of identifiability necessary for the research purpose. If that is not practicable, a
p.000002: trusted third party may conduct the linkage or the researcher may conduct the linkage on the data holder's site. As a last option, a researcher may be
p.000002: permitted to conduct the linkage at a secure site but under strict controls, as specified in a data-sharing agreement. Following the linkage of datasets, the
p.000002: person doing the data linkage should reduce datasets to the lowest level of identifiability needed to accomplish the research objectives.
p.000002:
p.000002: Data-sharing agreements bind data providers and researchers to their respective responsibilities and obligations for protecting personal data. Data-sharing
p.000002: agreements should set out the terms and conditions under which data providers will allow researchers to access personal data for research purposes.
p.000002:
p.000002: In assessing the privacy aspects of research, researchers and REBs should also be aware of the possibility that in some instances individuals may want
p.000002: their identities to be known-for example, when individuals want their contribution to research as participants to be recognized, or where they want to help
p.000002: others afflicted with a similar condition. In some qualitative research, individual participants may understand and willingly accept the possibility that their
p.000002: identities may be revealed in the public reporting of research results.
p.000002:
p.000002:
p.000002: Element #9: Setting reasonable limits on retention of personal data
p.000002:
p.000002:
p.000002:
p.000002: Personal data should be retained as long as is necessary to fulfill the research purposes. Personal data may then be destroyed or returned to the data
p.000002: provider, if appropriate, as set out in the terms of the original collection, data-sharing agreement, institutional policies, and legal requirements.
p.000002:
...
p.000002:
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002:
p.000002: 2.4 Inductive data collection
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
p.000002: foreseeable in detail at the outset of the interview. In these cases, the ongoing negotiation of consent with research participants is the best way to ensure
p.000002: that the privacy of individuals and the community is being appropriately protected.
p.000002:
p.000002: Definition of terms: Individual identifiability of data
p.000002:
p.000002: Levels of data identifiability by capacity to identity or re-identify individuals
p.000002: In rank order from most to least identifiable
p.000002: 1) Directly identifiable: The data contains direct identifiers of an individual (e.g. name, address, health number).
p.000002:
p.000002: 2) Coded:
p.000002:
p.000002: i. Single coded: A participant's data are assigned a random code. Direct identifiers are removed from the dataset and held separately. The key
p.000002: linking the code back to direct identifiers is available only to a limited number (e.g. senior members) of the research team.
p.000002: ii. Double or multiple coded: Two or more codes are assigned to the same participant's data held in different datasets (e.g. health administrative
p.000002: data, clinical data, genetic samples and data). The key connecting the codes back to participants' direct identifiers is held by a third party (such as
p.000002: the data holder) and is not available to the researchers.
p.000002:
p.000002: 3) Not directly identifiable and not coded: Direct identifiers were never collected or have been deleted, and there is no code linking the data back to
p.000002: the individual's identity.
p.000002:
p.000002: 4) Non-identifiable: Any element or combination of elements that allows direct or indirect identification of an individual was never collected or has been
p.000002: removed, although some elements may indirectly identify a group or region. There is no code linking the data back to the individual's identity.
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: Summary guide: Levels of data identifiability needed for research-related purposes
p.000002:
p.000002: Research- Specific examples Data requested for these purposes when:
p.000002: related
p.000002: purposes
p.000002: Collecting data directly from Requesting data for secondary use:
p.000002: individuals:
p.000002:
p.000002:
p.000002: a) Contact Recruit individuals for a Direct identifiers Coded (Single coding is a more efficient mechanism for linking back
p.000002: individuals research project to individuals than double-coding. Linking back becomes
p.000002: increasingly difficult for investigators who receive double or multiple-
p.000002: Contact the participant coded data, and therefore do not have the key to the code.)
p.000002: for follow-up data
p.000002: collection
p.000002:
p.000002: Provide data, with
p.000002: consent, to health care
p.000002: provider for clinical
p.000002: monitoring of the
...
p.000029: require prospective subjects to have the capacity to make every kind of decision. It requires that they be competent to make an informed decision about
p.000029: participation in particular research.The law on competence varies between jurisdictions. Researchers must comply with all applicable legislative
p.000029: requirements. Ethical consideration around research involving those who are not competent to give a free and informed consent on their own behalf
p.000029: must seek to balance (1) the vulnerability that arises from their incompetence with (2) the injustice that would arise from their exclusion from the benefits
p.000029: of research..." (pg. 2.9)
p.000029:
p.000029: Article 2.5 "Subject to applicable legal requirements, individuals who are not legally competent shall be asked to become research subjects only when:
p.000029: (a) The research question can only be addressed using individuals within the identified group(s); and (b) Free and informed consent will be sought from
p.000029: their authorized representative(s); and (c) The research does not expose them to more than minimal risks without the potential for direct benefits for
p.000029: them." (pg 2.9)
p.000029:
p.000029: Article 2.6 "For research involving incompetent individuals, the REB shall ensure that, as a minimum, the following conditions are met: (a) The
p.000029: researcher shall show that free and informed consent will be sought from the authorized third party, and how the subjects' best interests will be
p.000029: protected. (b) The authorized third party may not be the researcher or any other member of the research team. (c) The continued free and informed
p.000029: consent of an appropriately authorized third party will be required to continue the participation of a legally incompetent subject in research, so long as
p.000029: the subject remains incompetent. (d) When a subject who was entered into a research project through third-party authorization becomes competent
p.000029: during the project, his or her informed consent shall be sought as a condition of continuing participation." (pg. 2.10)
p.000029:
p.000029: Article 2.7 "Where free and informed consent has been obtained from an authorized third party, and in those circumstances where the legally
p.000029: incompetent individual understands the nature and consequences of the research, the researcher shall seek to ascertain the wishes of the individual
p.000029: concerning participation. The potential subject's dissent will preclude his or her participation." (pg. 2.10)
p.000029:
p.000029: [Research with children]
p.000029:
p.000029: "..the notion of harm applied to children should be understood differently from harm in adults. Harm induced in children may have longer-term
p.000029: consequences to their growth and development. Furthermore, harms and benefits for children with chronic disabilities and terminal illnesses require
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
...
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
p.000029: [Evidence of consent]
p.000029:
p.000029: Article 2.1 "...(b) Evidence of free and informed consent by the subject or authorized third party should ordinarily be obtained in writing. Where written
p.000029: consent is culturally unacceptable, or where there are good reasons for not recording consent in writing, the procedures used to seek free and informed
p.000029: consent shall be documented..." Explanatory text: "Free and informed consent... encompasses a process that begins with the initial contact and carries
p.000029: through to the end of the involvement of research subjects in the project. As used in this Policy, the process of free and informed consent refers to the
p.000029: dialogue, information sharing and general process through which prospective subjects choose to participate in research that involves themselves. " (pg.
p.000029: 2.1)
p.000029:
p.000029: [Written and oral documentation]
p.000029:
p.000029: Article 2.1 Explanatory text: "Article 2.1 (b) states the preference for written evidence of free and informed consent. The article acknowledges that written
p.000029: consent is not always appropriate. For most people in our society, a signed statement is the normal evidence of consent. However, for some groups or
p.000029: individuals, a verbal agreement, perhaps with a handshake, is evidence of trust, and a request for a signature may imply distrust. Nonetheless, in most
...
p.000050:
p.000050:
p.000050:
p.000050: Example: Informing participants and presenting options for control of new uses of data
p.000050:
p.000050: The invitation to participate in the study is made by a dedicated nurse coordinator employed by, and accountable to, the participating hospital. The nurse
p.000050: coordinator arranges, at a convenient time for the patient (and his/her family), to explain the study and seek the patient's consent to participate. Patients
p.000050: can refuse or can agree to any or all of the following:
p.000050:
p.000050: Access to their current hospitalization records by the nurse coordinator to collect information relevant to their condition, for future research uses.
p.000050: A follow-up telephone call by the nurse coordinator 6 months after the onset of their health event to determine longer-term changes in their
p.000050: functional ability-this survey information is also intended for inclusion in the registry for future research purposes.
p.000050: Linkage of their data in the study database, with administrative files from the provincial Ministry of Health, and other sources such as laboratory
p.000050: and physician records, in order to collect information about physician and laboratory services, subsequent hospitalizations, and causes of death.
p.000050: The linked data will be used for research on the use of health care services and effects on health for patients with condition X; and
p.000050: Use of their non-identifiable records in future analyses performed at the independent not-for-profit research organization based in City Y. The
p.000050: results of these analyses are to be released in aggregate form to third-party private companies seeking to improve services and products related
p.000050: to condition X.
p.000050:
p.000050:
p.000050:
p.000050: 5.7.2 Promotion of openness and accountability 57
p.000050:
p.000050:
p.000050: Researchers should endeavour to keep participants informed of future data uses through continuing means (e.g. web site information), as part of an
p.000050: ongoing commitment to openness and to the maintenance of informed consent.
p.000050: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000050:
p.000050: [Information to be provided to research participants]
p.000050:
p.000050: Article 2.4 "Researchers shall provide, to prospective subjects or authorized third parties, full and frank disclosure of all information relevant to free and
p.000050: informed consent. Throughout the process of free and informed consent, the researchers must ensure that prospective subjects are given adequate
p.000050: opportunities to discuss and contemplate their participation. Subject to the exception in Article 2.1 (c), at the commencement of the process of free and
p.000050: informed consent, researchers or their qualified designated representatives shall provide prospective subjects with the following:
p.000050:
p.000050: (a) Information that the individual is being invited to participate in a research project;
p.000050:
p.000050: (b) A comprehensible statement of the research purpose, the identity of the researcher, the expected duration and nature of participation, and a
p.000050: description of research procedures;
p.000050:
p.000050: (c) A comprehensive description of reasonably foreseeable harms and benefits that may arisefrom research participation, as well as the likely
...
p.000063: double coded; or without codes) Collaborators at local sites of a Review by institution data privacy committees where
p.000063: multi-site study relevant
p.000063: External researchers, with Data-sharing agreement, including undertaking of
p.000063: limitations (see required confidentiality (see 8.3)
p.000063: safeguards). Disclosure of only enough data to answer the intended
p.000063: research question
p.000063:
p.000063:
p.000063: Non-identifiable data in public use files Scientific community There may be no restrictions on use, or there may be a
p.000063: (where data have been scrutinized and General public basic form of data sharing agreement, requiring an
p.000063: altered to protect against risks of Universities undertaking, for example, to not attempt to re-identify the
p.000063: inadvertent disclosure of individuals' records so as to relate the information on the file to a
p.000063: identities). 75 particular person. 76
p.000063:
p.000063:
p.000063:
p.000063: 8.2 Conducting data linkages
p.000063: The most secure way of conducting data linkages requested by external researchers is for the data holder to conduct the linkage and provide linked
p.000063: datasets to the researcher without identifiers, and at the minimum level of identifiability required for the research purpose. 77 If that is not practicable, a
p.000063: trusted third party may conduct the linkage or the researcher may conduct the linkage on the data holder's site. As a last option, a researcher may be
p.000063: permitted to conduct the linkage at a secure site but under strict controls, as specified in a data-sharing agreement. 78
p.000063:
p.000063: Ranked options for conducting data linkages
p.000063:
p.000063: Who should Conditions for REB consideration
p.000063: conduct the
p.000063: linkage
p.000063:
p.000063: A) Data The data holder performs the linkage(s) and subsequently removes all direct identifiers, or replaces direct identifiers with a code, prior to
p.000063: holder releasing the linked data set to the external researcher.
p.000063: (Preferred)
p.000063:
p.000063: B) A trusted When the original data holder does not have the technical capacity or resources to perform linkages in-house:
p.000063: third party
p.000063: a trusted third party acting as an information manager may conduct the linkage off site; or
p.000063: (e.g. a
p.000063: the researcher as a "deemed employee" (e.g. the Statistics Canada model) may conduct the linkage on the data holder's site.
p.000063: statistical
p.000063: agency) or The third party and the researchers should be bound by equivalent conditions of confidentiality and security as apply to the data holder
p.000063: and the data holder's employees.
p.000063: C) The
p.000063: researcher
p.000063: conducts the
p.000063: linkage on
p.000063: the data
p.000063: holder's site
p.000063:
p.000063:
p.000063: D) The If Options A, B or C are demonstrably impracticable, the researcher may conduct the linkage in compliance with a data-
p.000063: researcher sharing/confidentiality agreement with the data holder, setting out their respective and shared obligations, including restrictions on use
p.000063: conducts the and disclosure and appropriate security requirements (see 8.3 below). In this situation, any direct identifiers or other personal data not
p.000063: linkage off required to answer the research question should be destroyed or returned to the original data holder as soon as is practicable, and in
p.000063: site compliance with the terms of the data-sharing agreement.
p.000063:
p.000063:
p.000063: Following the linkage of datasets, the person doing the data linkage should reduce datasets to the lowest level of identifiability needed to accomplish the
p.000063: research objectives.
p.000063:
p.000063: For example, direct identifiers (e.g. name or personal health number) or potentially identifying elements when combined (e.g. a full date of birth or full
p.000063: postal code) may be needed for data linkage but may not be needed to answer the research questions. In such cases, these identifiers should be destroyed
p.000063: as soon as is reasonably practicable or returned to the data holder, as per the terms of the data-sharing agreement.
p.000063:
...
p.000086: Agencies require, as a minimum, that researchers and their institutions apply the ethical principles and the articles of this policy." (pg. i.2)
p.000086:
p.000086: Article 1.1 "(a) All research that involves living human subjects requires review and approval by an REB in accordance with their Policy Statement,
p.000086: before the research is started, except as stipulated.." (pg. 1.1)
p.000086:
p.000086: [Review procedures for ongoing research]
p.000086:
p.000086: Article 1.13 "(a) Ongoing research shall be subject to continuing ethics review. The rigour of the review should be in accordance with a proportionate
p.000086: approach to ethics assessment. (b) As part of each research proposal submitted for REB review, the researcher shall propose to the REB the continuing
p.000086: review process deemed appropriate for that project.(c) Normally, continuing review should consist of at least the submission of a succinct annual status
p.000086: report to the REB. The REB shall be promptly notified when the project concludes." (pg. 1.10)
p.000086:
p.000086: "In accordance with the principle of proportionate review, research that exposes subjects to minimal risk or less requires only a minimal review process.
p.000086: The continuing review of research exceeding the threshold of minimal risk that is referred to in Article 1.13(b), in addition to annual review (Article 1.13
p.000086: (c)) might include:
p.000086:
p.000086: formal review of the process of free and informed consent
p.000086: establishment of a safety monitoring committee
p.000086: periodic review by a third party of the documents generated by the study
p.000086: review of reports of adverse events
p.000086: review of patients' charts or
p.000086: a random audit of the process of free and informed consent.
p.000086:
p.000086: Other models of a continuing ethics review may be designed by researchers and REBs to fit particular circumstances.
p.000086:
p.000086: The process of a continuing ethics review should be understood as a collective responsibility, to be carried out with a common interest in maintaining the
p.000086: highest ethical and scientific standards. Research institutions should strive to educate researchers on the process of a continuing ethics review through
p.000086: workshops, seminars and other educational opportunities." (pg. 1.10- 1.11)
p.000086:
p.000086: [Review of multi-centered research]
p.000086:
p.000086: "Principles of institutional accountability require each local REB to be responsible for the ethical acceptability of research undertaken within its institution.
p.000086: However, in multi-centred research, when several REBs consider the same proposal from the perspectives of their respective institutions, they may
p.000086: reach different conclusions on one or more aspects of the proposed research. To facilitate coordination of ethics review, when submitting a proposal for
p.000086: multi-centered research, the researcher may wish to distinguish between core elements of the research-which cannot be altered without invalidating the
...
Searching for indicator political:
(return to top)
p.000029: requirement to obtain informed consent, provided that the REB finds and documents that: (i) The research involves no more than minimal risk to the
p.000029: subjects; (ii) The waiver or alteration is unlikely to adversely affect the rights and welfare of the subjects; (iii) The research could not practicably be
p.000029: carried out without the waiver or alteration; (iv) Whenever possible and appropriate, the subjects will be provided with additional pertinent information
p.000029: after participation; and (v) The waived or altered consent does not involve a therapeutic intervention." (pg. 2.1)
p.000029:
p.000029: [Randomized clinical trials]
p.000029:
p.000029: Article 2.1 "... (d) In studies including randomization and blinding in clinical trials, neither the research subjects nor those responsible for their care know
p.000029: which treatment the subjects are receiving before the project commences. Such research is not regarded as a waiver or alteration of the requirements
p.000029: for consent if subjects are informed of the probability of being randomly assigned to one arm of the study or another." (pg. 2.1)
p.000029:
p.000029: [Naturalistic observation]
p.000029:
p.000029: Article 2.3 "REB review is normally required for research involving naturalistic observation. However, research involving observation of participants in, for
p.000029: example, political rallies, demonstrations or public meetings should not require REB review since it can be expected that the participants are seeking
p.000029: public visibility." Explanatory text: "Naturalistic observation is used to study behaviour in a natural environment. Because knowledge of the research can
p.000029: be expected to infiuence behaviour, naturalistic observations generally implies that the subjects do not know that they are being observed, and hence
p.000029: cannot have given their free and informed consent...In considering research involving naturalistic observation, researchers and REBs should pay close
p.000029: attention to the ethical implications of such factors as: the nature of the activities to be observed; the environment in which the activities are to be
p.000029: observed (in particular, whether it is to be staged for the purposes of the research); and the means of recording the observations (in particular, if the
p.000029: records will allow subsequent identification of the subjects). Naturalistic observation that does not allow for the identification of the subjects, and that is
p.000029: not staged, should normally be regarded as of minimal risk..." (pg. 2.5)
p.000029:
p.000029: [Legal competence]
p.000029:
p.000029: "Competence refers to the ability of prospective subjects to give informed consent in accord with their own fundamental values. It involves the ability to
p.000029: understand the information presented, to appreciate the potential consequences of a decision, and to provide free and informed consent.It does not
...
Political / vulnerable
Searching for indicator vulnerable:
(return to top)
p.000002: valid opt-out mechanism means that individuals have the opportunity at some time during the research or data collection process to give a clear indication
p.000002: (in writing or orally) that they do not want to be participants in the research or to have their data used in the research. If individuals do not choose to opt-out
p.000002: of the research, their consent is presumed as long as they were given reasonable notice of the research and meaningful opportunity to opt-out.
p.000002: Collection of data without direct personal identifiers may be necessary or proposed when the research deals with highly sensitive conditions or activities. In
p.000002: such circumstances, consent should be documented but the identity of research participants should not be linkable to their data or to results of analyses.
p.000002:
p.000002: The researcher may need information on who does not want to participate in research or who withdraws from research , for example to document who is not
p.000002: to be included in follow-up research activities; and/or to take into consideration relevant characteristics of the population not included in the study, when
p.000002: reporting possible bias in research results. In these circumstances, researchers may obtain information about non-participants or those withdrawing
p.000002: consent only with individuals' consent or the approval of an REB to waive the consent requirement in the particular circumstances.
p.000002:
p.000002: Participants in qualitative studies are especially vulnerable to unintended identification. For example, in quoting interviewees, biographical details may be
p.000002: revealed that make protecting identities difficult. Therefore, paying attention to the trust relationship between researcher and participant, and obtaining
p.000002: ongoing consent, are very important.
p.000002:
p.000002:
p.000002: Element #5: Informing prospective research participants about the research
p.000002:
p.000002:
p.000002:
p.000002: Researchers should provide to prospective participants or to authorized third parties disclosure of all information relevant to voluntary and informed
p.000002: consent.
p.000002:
p.000002: Information should be communicated to prospective participants in plain language, in oral and/or written form, so that it is easily understood.
p.000002:
p.000002: The amount of time taken to communicate information to prospective participants should be appropriate to the need, not excessive nor too brief. For
p.000002: example, the information could be layered, with a one-page summary of the research, a short consent form, an appendix with more detailed information
p.000002: and instructions on how to obtain more information.
p.000002:
p.000002: During the consent process, the researcher should determine whether the participant wishes to be informed of any meaningful research results that
p.000002: specifically relate to them.
p.000002:
p.000002: Researchers, particularly those in the areas of health services, population and public health, and genetics/genomic research who study whole populations,
...
p.000002: involving Humans (TCPS), Canada's national ethics guidelines for research funded by the three main federal funding agencies, and internationally
p.000002: accepted fair information principles codified by the Canadian Standards Association.
p.000002:
p.000002: Tri-Council Policy Statement (TCPS)
p.000002:
p.000002: The Best Practices are firmly embedded in CIHR's ongoing commitment to support TCPS. 4 Compliance with TCPS is mandatory for all research
p.000002: funded through the three main federal research funding agencies: Canadian Institutes of Health Research (formerly Medical Research Council of Canada),
p.000002: Natural Sciences and Engineering Research Council of Canada (NSERC) and Social Sciences and Humanities Research Council of Canada (SSHRC).
p.000002: Research ethics boards (REBs) also use the TCPS as guidance in the review of research funded through other sources.
p.000002:
p.000002: The broad ethical framework of the TCPS is based on recognition of the need for and social value of research, along with moral imperatives to respect
p.000002: human dignity, ethical guiding principles and the law. 5 Ethical guiding principles for research include respect for privacy and confidentiality, among the
p.000002: following fundamental and interrelated ethical guiding principles in the TCPS:
p.000002:
p.000002:
p.000002: Respect for human dignity
p.000002: Respect for justice and inclusiveness
p.000002: Respect for free and informed consent
p.000002: Balancing harms and benefits
p.000002: Respect for vulnerable persons
p.000002: Respect for privacy and confidentiality
p.000002: Minimizing harm
p.000002: Maximizing benefit 6
p.000002:
p.000002:
p.000002: The TCPS acknowledges privacy as a fundamental value, and dignity and autonomy of individuals as the ethical basis of respect for the privacy of research
p.000002: subjects. These national research ethics guidelines also recognize that the right to privacy is not absolute and that compelling and specifically identified
p.000002: public interests may justify an infringement of that right, specifically the requirement to obtain consent before collecting, using or disclosing personal
p.000002: information. 7
p.000002:
p.000002: Fair information principles
p.000002:
p.000002: These Best Practices are also grounded in internationally recognized fair information principles, which are at the heart of Canadian privacy legislation and
p.000002: form the basis of the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information. 8 These ten core principles are:
p.000002:
p.000002: 1. Accountability - An organization is responsible for personal information under its control and shall designate an individual or individuals who are
p.000002: accountable for the organization's compliance with the following principles.
p.000002: 2. Identifying Purposes -The purposes for which personal information is collected shall be identified by the organization at or before the time the
p.000002: information is collected.
...
p.000029: the research could not be done.
p.000029:
p.000029:
p.000029: 3.3.4 Expectations of individuals In general, the expectations of a reasonable person in the circumstances should be taken into account
p.000029: (considering, for example, the nature of the research, the type of data to be collected and the context in
p.000029: which the data were originally collected). If individuals have previously objected to the secondary use of their
p.000029: data for research or to the use of their contact information, their directions should be respected.
p.000029:
p.000029: 3.3.5 Views of relevant groups Privacy concerns may extend beyond the individual to include well-defined groups or communities, e.g.
p.000029: remote communities and Aboriginal peoples. 31 Also, genetic information about individuals is more than
p.000029: personal information-it may also be intimate information about those who share a common genetic lineage-
p.000029: -family members, other relatives and, in some cases, well-defined communities. 32
p.000029:
p.000029: The REB may require that efforts be made to consult with family groups, Aboriginal peoples, community
p.000029: representatives, consumer associations, and/or special populations such as the homeless or under-housed,
p.000029: as appropriate, to address possible concerns of affected individuals and communities. These concerns may
p.000029: relate to the design and scope of the research, the recruitment of individuals, and the analysis and
p.000029: disseminations of results of research. This consultation process will be a high priority when dealing with
p.000029: controversial issues and/or individuals, groups or communities in vulnerable circumstances.
p.000029: 3.3.6 Legal requirements In addition to REB approval, access to personal data for research without consent will be subject to specific
p.000029: legal requirements in relevant jurisdictions. For example, some jurisdictions require some or all of the
p.000029: following:
p.000029:
p.000029: a data-sharing agreement between the data holder and the researcher; 33
p.000029: notification and/or approval by other relevant oversight bodies; 34 and/or
p.000029: agreement that personal data will not be used to contact individuals. 35
p.000029:
p.000029:
p.000029: 3.3.7 Openness: Informing the public In the spirit of openness, the researcher should have an appropriate strategy for informing the general public
p.000029: about the research. 36
p.000029:
p.000029:
p.000029:
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Requirements for consent]
p.000029:
p.000029: Article 2.1
p.000029:
p.000029: "(a) Research governed by this Policy... may begin only if (1) prospective subjects, or authorized third parties, have been given the opportunity to give
p.000029: free and informed consent about participation...
p.000029:
p.000029: (c) the REB may approve a consent procedure which does not include, or which alters, some of all of the elements of informed consent... or waive the
...
p.000029: still not responded. In addition, general reminders to return the questionnaires were also posted in designated work areas in an effort to increase
p.000029: response rates.
p.000029:
p.000029: To minimize the risk of linking questionnaire responses with the names provided on the response cards, the researcher picked up the cards regularly
p.000029: throughout the week and the questionnaires only once every week or two. Furthermore, no data were entered until the end of data collection to reduce
p.000029: the possibility of identifying late respondents. With this method, the researcher could not identify who had filled out each questionnaire, but she would
p.000029: know from the response cards who on the list had or had not returned a questionnaire.
p.000029:
p.000029: In this study sensitive information could be revealed about those staff who had suffered an injury at work but who had not reported it, contrary to
p.000029: mandatory hospital reporting policies. Some respondents may not have reported injuries because they did not want to appear careless; others may have
p.000029: wished to avoid the fairly lengthy follow-up procedures required of persons with certain injuries. The researchers had anticipated that this might be the
p.000029: case and understood that this information would be considered quite sensitive. It was for this reason that the survey was conducted with no ability to link
p.000029: the data collected to individuals' identities.
p.000029:
p.000029:
p.000029: 4.3 Qualitative research
p.000029: Participants in qualitative studies are especially vulnerable to unintended identification. For example, in quoting interviewees, biographical details may be
p.000029: revealed that make protecting identities difficult. Deleting all possible identifiers may rob the quote of its impact and research value. Changing names and
p.000029: places is not a guarantee that individuals' identities will be concealed.
p.000029:
p.000029: Therefore, paying attention to the trust relationship between researcher and participant, and obtaining ongoing consent, are very important in qualitative
p.000029: research. Constant sensitivity to participants' behaviour and reactions during data collection is essential. Unsolicited and unanticipated disclosures of
p.000029: information by participants can easily fall outside the original consent agreement.
p.000029:
p.000029: As the interaction between a researcher and participants progresses, there may be situations where the researcher will need to recognize that participants
p.000029: should be given the opportunity to reiterate their consent, to withdraw from the research, or to withdraw their particular comments. 39 Thus, obtaining
p.000029: informed consent should be an ongoing negotiation.
p.000029:
p.000029:
p.000029: 4.4 Documenting non-participation or withdrawal of consent
p.000029: The researcher may need information on who does not want to participate in research or who withdraws from research, for example to:
p.000029:
p.000029: document who is not to be included in follow-up research activities; and/or
p.000029: take into consideration relevant characteristics of the population not included in the study, when reporting possible bias in research results.
...
Searching for indicator vulnerability:
(return to top)
p.000029: attention to the ethical implications of such factors as: the nature of the activities to be observed; the environment in which the activities are to be
p.000029: observed (in particular, whether it is to be staged for the purposes of the research); and the means of recording the observations (in particular, if the
p.000029: records will allow subsequent identification of the subjects). Naturalistic observation that does not allow for the identification of the subjects, and that is
p.000029: not staged, should normally be regarded as of minimal risk..." (pg. 2.5)
p.000029:
p.000029: [Legal competence]
p.000029:
p.000029: "Competence refers to the ability of prospective subjects to give informed consent in accord with their own fundamental values. It involves the ability to
p.000029: understand the information presented, to appreciate the potential consequences of a decision, and to provide free and informed consent.It does not
p.000029: require prospective subjects to have the capacity to make every kind of decision. It requires that they be competent to make an informed decision about
p.000029: participation in particular research.The law on competence varies between jurisdictions. Researchers must comply with all applicable legislative
p.000029: requirements. Ethical consideration around research involving those who are not competent to give a free and informed consent on their own behalf
p.000029: must seek to balance (1) the vulnerability that arises from their incompetence with (2) the injustice that would arise from their exclusion from the benefits
p.000029: of research..." (pg. 2.9)
p.000029:
p.000029: Article 2.5 "Subject to applicable legal requirements, individuals who are not legally competent shall be asked to become research subjects only when:
p.000029: (a) The research question can only be addressed using individuals within the identified group(s); and (b) Free and informed consent will be sought from
p.000029: their authorized representative(s); and (c) The research does not expose them to more than minimal risks without the potential for direct benefits for
p.000029: them." (pg 2.9)
p.000029:
p.000029: Article 2.6 "For research involving incompetent individuals, the REB shall ensure that, as a minimum, the following conditions are met: (a) The
p.000029: researcher shall show that free and informed consent will be sought from the authorized third party, and how the subjects' best interests will be
p.000029: protected. (b) The authorized third party may not be the researcher or any other member of the research team. (c) The continued free and informed
p.000029: consent of an appropriately authorized third party will be required to continue the participation of a legally incompetent subject in research, so long as
p.000029: the subject remains incompetent. (d) When a subject who was entered into a research project through third-party authorization becomes competent
...
p.000063: harm underlines the importance for researchers to make all efforts to allow subjects the right to consent that their data and private information be part of
p.000063: a study." (pg. 3.6)
p.000063:
p.000063:
p.000063:
p.000063: Element #7: Safeguarding personal data
p.000063:
p.000063: General statement
p.000063: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
p.000063: safeguards should include organizational, technological and physical measures. 71
p.000063:
p.000063: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000063: as appropriate for the sensitivity and identifiability of the data. Formal privacy impact assessments (PIAs) are required in some institutions and under
p.000063: legislation or policy in some jurisdictions. 72
p.000063:
p.000063: REBs should review and approve researchers' proposed measures for safeguarding any personal data to be collected.
p.000063:
p.000063: The safeguards described in this Element are particularly relevant to research conducted within large institutions or other organizations. However, smaller
p.000063: scale projects should also demonstrate acceptable ways of protecting the confidentiality of data.
p.000063:
p.000063:
p.000063: 7.1 Threat-risk vulnerability assessment 73
p.000063:
p.000063: A vulnerability assessment assists researchers and institutions in determining an appropriate level of security for research data and the means by which
p.000063: the data should be received, used, stored, and managed. The following are the main steps in a vulnerability assessment:
p.000063:
p.000063: Assessment Examples
p.000063: a) Determine what assets need to be protected Databases and files of personal and other confidential data
p.000063: Database management software
p.000063: Computer hardware, fax machines
p.000063:
p.000063:
p.000063: b) Determine what to protect against Five main classes of threats are: disclosure, interruption, modification, destruction and
p.000063: removal or loss
p.000063:
p.000063:
p.000063: c) Assess the probability of the threat occurring Low, medium or high
p.000063:
p.000063:
p.000063: d) Assess the magnitude of the impact and Loss of public trust
p.000063: consequences of the threat if it occurs Harms to individuals (loss of privacy or trust; social stigmatization; social discrimination
p.000063: affecting financial, employment, insurance, or other status; loss of benefits)
p.000063: Loss of data or equipment.
p.000063:
p.000063:
p.000063: e) Assess existing safeguards and need for Direct identifiers are separated from personal records as soon as reasonably practicable.
p.000063: additional safeguards Highly identifiable and sensitive data are stored at the highest level of security, e.g. on stand-
p.000063: alone servers.
p.000063: Pledge of confidentiality signed by all research staff.
p.000063:
p.000063:
...
Health / Drug Dependence
Searching for indicator dependency:
(return to top)
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
p.000029: [Evidence of consent]
p.000029:
p.000029: Article 2.1 "...(b) Evidence of free and informed consent by the subject or authorized third party should ordinarily be obtained in writing. Where written
...
Health / Drug Usage
Searching for indicator drug:
(return to top)
p.000002: These Best Practices are organized into a series of elements that should be considered in the design, conduct and evaluation of health research to address
p.000002: privacy and confidentiality concerns. These elements are not meant to represent a step-by-step process, since many of the elements are interdependent.
p.000002:
p.000002: As noted in the Introduction, the TCPS and the laws of Canada are the minimum standard for protecting privacy and confidentiality in health research. To
p.000002: indicate the links between these Best Practices and the TCPS, and as another vehicle for promoting wider knowledge of that national Policy Statement,
p.000002: excerpts from TCPS are provided at the end of most Element sections. These are relatively short excerpts and do not include all text related to a particular
p.000002: topic. Readers are encouraged to use these excerpts merely as guides toward a more comprehensive review of the TCPS. 11
p.000002:
p.000002: In addition, concordance tables of selected privacy legislation are presented in the Appendix, organized by the corresponding Best Practice Element and by
p.000002: jurisdiction. These concordance tables are intended to supplement the Best Practices and should only be used as preliminary guidance. The application of
p.000002: the legal provisions in the tables to a particular research project must be determined in consultation with a legal advisor. In addition, any health professional
p.000002: belonging to a regulatory college has the responsibility of complying with that college's code of ethics.
p.000002:
p.000002: In addition to the TCPS and applicable laws, CIHR-funded researchers conducting clinical trials intended for use in seeking regulatory approval for
p.000002: pharmaceuticals must review and be in compliance with the Food and Drug Regulations- Division 5 Drugs for clinical trials involving human subjects, the
p.000002: ICH 12 Guidance E6: Good Clinical Practice: Consolidated Guideline (ICH GCP), and other Health Canada guidance. 13
p.000002:
p.000002: Please note the distinction made in these Elements between a "research participant" and "data subject". In the Best Practices, a research participant is an
p.000002: individual who consents to participation in research and who is the subject of personal data or information collected for research. A data subject is an
p.000002: individual who is the subject of personal data/information collected for research purposes, but who has not been directly approached to provide consent.
p.000002:
p.000002:
p.000002: Element #1: Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002:
p.000002: General statement
p.000002: At the outset of the research design process, and as thoroughly as possible given the proposed research method, researchers should:
p.000002:
p.000002: identify and document research objectives and questions as a basis for determining what data will be needed;
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002:
p.000002: 1.1 Research study
p.000002: For each research study, researchers should identify and document the specific research objectives and related research questions.
p.000002:
p.000002: Researchers should also describe and justify the data needed to fulfill the research objectives and to answer any related research questions.
p.000002:
p.000002: Example:
p.000002:
...
p.000029:
p.000029:
p.000029: 5.5 Providing information about privacy to prospective research participants
p.000029: The following categories of information relating to privacy matters should be included in the information provided to prospective research participants:
p.000029:
p.000029: Basic information Explanation
p.000029:
p.000029: 1) Research Specific research objectives and related questions.
p.000029: objectives 46
p.000029: and procedure
p.000029:
p.000029: 2) Data types and Types of data to be collected and why.
p.000029: uses 47 Any planned or foreseeable commercial uses of the data.
p.000029: If appropriate, a statement indicating whether test results are for research purposes only or if they can serve other non-
p.000029: research purposes (e.g. clinical care).
p.000029:
p.000029:
p.000029: 3) Voluntary basis Voluntary basis for participation, and ongoing meaningful opportunities to decide whether to continue.
p.000029: for participation Withdrawal, without any negative effect on a person's reasonable expectations of rights and benefits, being possible at any
p.000029: 48 time (but be clear that data which have already been made non-identifiable cannot be retrieved and destroyed).
p.000029: Option of contacting other family members to ask their willingness to be contacted by the researcher (e.g. in genetic
p.000029: research, participants should make first contact with related family members).
p.000029: Circumstances under which the researcher may terminate the participant's involvement in the research (e.g. in clinical drug
p.000029: trials).
p.000029: 4) Risks, benefits, Possible risks or discomforts to the research participant (including physical, emotional and psychological impacts, or
p.000029: compensation privacy intrusion).
p.000029: Benefits of the research in general and, if relevant, the benefits to the individual participant.
p.000029: Any compensation offered to participants should not constitute an undue influence to agree to participate. 49
p.000029:
p.000029:
p.000029: 5) Confidentiality Protection of data confidentiality (e.g. affirmation that genetic data will not be given to third parties)
p.000029: and safeguards General description of security measures (e.g. coding of data, 51 locked storage).
p.000050: 50
p.000050:
p.000050:
p.000050: 6) Data access and Who will have access to the data and for what purposes (include any legal requirements, such as mandatory public health
p.000050: legal disclosure reporting of certain diseases or obligation to produce evidence on court order; access required for scientific integrity such
p.000050: requirements 52 as auditing or verification of data; and any plans to archive or destroy the data).
p.000050:
p.000050:
p.000050: 7) Reporting of Explanation of the conditions, if any, under which personal results are to be reported back (e.g. results of genetic testing
p.000050: results 53 should normally be reported back to the participant through a physician and with provision of genetic counseling; conditions
...
p.000086: Article 1.14 "Research to be performed outside the jurisdiction or country of the institution that employs the researcher shall undergo prospective ethics
p.000086: review both (a) by the REB within the researcher's institution; and (b) by the REB, where such exists, with the legal responsibility and equivalent ethical
p.000086: and procedural safeguards in the country or jurisdiction where the research is to be done." (pg. 1.12)
p.000086:
p.000086: LINK TO: Memorandum of Understanding on the Roles and Responsibilities in the Management of Federal Grants and Awards (MOU).
p.000086: Schedule 2- Ethics Review of Research Involving Humans.
p.000086:
p.000086: 1.0 Policy "The Agencies developed, approved and implemented a joint policy statement topromote the ethical conduct of research involving human
p.000086: subjects - the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS). The Agencies will only fund researchers,
p.000086: Institutions or partnering organizations that comply with the ethical principles and articles of the TCPS. In addition CIHR will only fund human pluripotent
p.000086: stemXcells research that adheres to its recently published guidelines.
p.000086:
p.000086: In addition to the TCPS, the ethics review of research involving humans may, where appropriate, be subject to other legislation and policies, such as:
p.000086:
p.000086: the Institution's own policy on research involving human subjects;
p.000086: the Québec Civil Code;
p.000086: provincial and federal legislation on privacy, con0dentiality, intellectual property, competence and other areas;
p.000086: Canada Food and Drug Act and Regulations;
p.000086: guidelines and policies of the Therapeutic Products Directorate of Health Canada;
p.000086: relevant laws, regulations and/or policies of other countries, when research is to be conducted in those countries;
p.000086: Good Clinical Practices: Consolidated Guidelines for clinical trials sponsored by industry, published by the International Conference on
p.000086: Harmonization.
p.000086:
p.000086: Researchers, Institutions and research ethics boards (REBs) should be aware of all applicable policies, regulations and guidelines. In some cases, it
p.000086: may be necessary for Institutions to have recourse to speci0c expertise to identify legal and other issues in the ethics review process..."
p.000086:
p.000086: Updates.
p.000086: References
p.000086: 1 Privacy Advisory Committee members are listed in Appendix A-1.
p.000086:
p.000086: 2 Under section 301(d) of the U.S. Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
p.000086: persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research.
p.000086: This authority has been delegated to the National Institutes of Health (NIH) and other Health and Human Services Agencies.
p.000086: Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for research
p.000086: participants, such as damage to their financial standing, employability, insurability, or reputation. A Certificate allows the investigator and others
...
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
p.000086: 15 See the table of concordance for Element #2 in Appendix A-7 referring to the statutory provisions regarding the general requirement to collect a
p.000086: limited amount of personal information.
p.000086:
p.000086: 16 See TCPS excerpt (Article 3.3, explanatory note) at the end of Element #2.
p.000086:
p.000086: 17 See also Element #8, 8.2.
p.000086:
p.000086: 18 See the legal concordance table for Element #2 in Appendix A-7 regarding the collection of health numbers under Ontario's health privacy
p.000086: legislation.
p.000086:
p.000086: 19 See TCPS excerpts at the end of Element #3 regarding the definition of "competence" in the research context. See also the legal concordance
p.000086: table for Element #4-Part 2, Consent by Substitute Decision Makers, in Appendix A-7.
p.000086:
p.000086: 20 For a definition of minimal risk, the TCPS states: "if potential subjects can reasonably be expected to regard the probability and magnitude of
p.000086: possible harms implied by participation in the research to be no greater that those encountered by the subject in those aspects of his or her
p.000086: everyday life that relate to the research then the research can be regarded as within the range of minimal risk" (TCPS Section 1, C1, pg. 1.5).
p.000086: For secondary use of information, the researcher must, among other conditions, have appropriate measures "to minimize harms to subjects"
p.000086: (TCPS Article 3.3 (b)).
p.000086: 21 See the legal concordance table for Element #3 in Appendix A-7.
p.000086:
p.000086: 22 As required under the Food and Drug Regulations-Clinical Trials and ICH GCP.
p.000086:
p.000086: 23 For conditions in privacy legislation under which a waiver of the consent requirement may be permitted see the legal concordance table for
p.000086: Element #3 in Appendix A-7.
p.000086:
p.000086: 24 See Element #2, 2.1.
p.000086:
p.000086: 25 The REB should review and approve the researcher's proposed measures for safeguarding personal data.
p.000086: See also Element #7, Element #8, and Element #10, 10.2.3.
p.000086:
p.000086: 26 See Element #2, 2.2.
p.000086:
p.000086: 27 Note that the TCPS (Article 1.5 and explanatory text) states that REBs are normally to avoid duplicating previous professional peer-review
p.000086: assessments of the scientific merit of a research proposal unless there is a good and specified reason to do so.
p.000086: REBs may have specific criteria, set out in legislation, to take into account in assessing the potential benefits of research proposing to use health
p.000086: sector data without consent (e.g. the requirements set out in Alberta's Health Information Act, referenced in the legal concordance table for
p.000086: Element #3, in Appendix A-7.)
p.000086:
p.000086: 28 See real world examples summarized in Appendix A-3, from CIHR Secondary Use of Personal Information in Health Research: Case Studies
p.000086: (November 2002).
p.000086:
p.000086: 29 For legal prohibitions against contacting individuals see the legal concordance table for Element #6 in Appendix A-7.
p.000086: For an example of prohibitions against contact in policy, see CIHR Secondary Use of Personal Information in Health Research: Case studies
...
p.000086: with Statistics Canada, July 2004.
p.000086:
p.000086: 76 See, for example, the data acquisition and use agreement for Statistics Canada public use microdata files under the Data Liberation Initiative.
p.000086:
p.000086: 77 The linked dataset may have direct identifiers removed or coded, or be made non-identifiable, depending on the needs of the research. See
p.000086: Element #2, 2.2.2, 2.3, and Summary Guide in that section.
p.000086:
p.000086: 78 Refer to table of concordance for Element #8, Part 1, in Appendix A-7, for statutory cross-references to data matching/linking provisions.
p.000086:
p.000086: 79 Refer to the table of concordance for Element #8, Part 2, in Appendix A-7, for statutory provisions for research data-sharing agreements.
p.000086:
p.000086: 80 See also Element #1.
p.000086:
p.000086: 81 See also Element #2.
p.000086:
p.000086: 82 See also Element #4 and #5.
p.000086:
p.000086: 83 See also Element #3 (3.3) and #6; and the legal concordance table for Element #6 in Appendix A-7 for restrictions on contact.
p.000086:
p.000086: 84 See also Element #7.
p.000086:
p.000086: 85 See also Element #9.
p.000086:
p.000086: 86 See also Element #10.
p.000086:
p.000086: 87 See also Element #10.
p.000086:
p.000086: 88 See also Element #10.
p.000086:
p.000086: 89 For example, see CIHR's Procedure for Addressing Allegations of Non-compliance with Research Policies.
p.000086:
p.000086: 90 See Statistics Canada Quality Guidelines (4th Edition- Oct 2003), pg. 61-66, online. Also, see Statistics Canada's Guide for Researchers under
p.000086: Agreement with Statistics Canada (May, 2002), Appendix 2-More on Disclosure and Disclosure Risk.
p.000086:
p.000086: 91 Note that under the Food and Drug Regulations- Division 5- C.05.012 (4) records for clinical trials must be retained for 25 years. Universities may
p.000086: have specified retention periods for research data.
p.000086:
p.000086: 92 See Element #1.
p.000086:
p.000086: 93 See the legal concordance table for Element #9 in Appendix A-7 for general obligations in privacy legislation with respect to retention of personal
p.000086: information.
p.000086:
p.000086: 94 See the table of concordance for Element #10, Part 1, in Appendix A-7, for general statutory accountability and transparency obligations as well
p.000086: as Part 2 for statutory references to research ethics boards.
p.000086:
p.000086: 95 The TCPS ethical framework includes a general principle that the more potentially invasive or harmful the research, particularly from the
p.000086: individual participants' perspective, the greater should be the REB's care in assessing the research. This is the concept of proportionate review.
p.000086:
p.000086: 96 See the legal concordance table for Element #3 in Appendix A-7, in particular Quebec privacy laws.
p.000086:
p.000086:
p.000086:
p.000086: Date modified: 2009-05-07
...
Searching for indicator influence:
(return to top)
p.000002: drawn from key groups involved in developing or implementing research ethics policy/regulations, namely the Interagency Advisory Panel for Research
p.000002: Ethics, the National Council on Ethics in Human Research, Health Canada, and the Social Sciences and Humanities Research Council of Canada. The
p.000002: Natural Sciences and Engineering Research Council of Canada was invited to appoint a member on PAC but preferred to assume a consultative role. PAC
p.000002: members agreed by consensus to have the CIHR Ethics Office chair the Committee in the role of facilitator.
p.000002:
p.000002: An earlier version of the current document was the subject of public consultations through 2004. The current document was revised based on feedback
p.000002: received.
p.000002:
p.000002:
p.000002: Recommendations
p.000002: The following recommendations are intended to promote the effective implementation of these Privacy Best Practices in the health research community
p.000002: and to ensure that these best practices continue to respond to the evolving nature of health research and challenges of privacy protection.
p.000002:
p.000002:
p.000002: Continuous learning and evaluation
p.000002: These Privacy Best Practices must continue to evolve to reflect improved practices and innovative solutions over time, and to reflect and influence
p.000002: ongoing legislative developments. Recognizing that important issues have yet to be addressed (see Key Outstanding Issues), these should be
p.000002: tackled by developing supporting modules with the active engagement of the relevant communities and through targeted research.
p.000002: There should be an assessment of the impact that the Best Practices will have over time on research ethics board decision-making and researcher
p.000002: practice. Mechanisms should be put in place to enable this assessment. These mechanisms should include a formal process, such as a CIHR
p.000002: Standing Committee, to assess implementation and the need for improvement of the Best Practices over time. A web tool should be considered for
p.000002: channelling research findings and capturing practical experiences to inform the ongoing evolution of the Best Practices.
p.000002:
p.000002:
p.000002: Implementation strategy
p.000002: These Privacy Best Practices should be revised in two years. With ongoing feedback and evaluation, PAC expects that the Best Practices will be
p.000002: adapted, as necessary, for the purpose of becoming mandatory CIHR funding policy. These Best Practices should also be referred to the
p.000002: Interagency Advisory Panel on Research Ethics with a view to encouraging their eventual application, in revised form, as Tri-Agency funding policy.
p.000002: For this to happen, the social science perspective needs to be strengthened.
p.000002:
p.000002:
p.000002: Support for implementation
p.000002: Underpinning the implementation strategy for these Privacy Best Practices, there should be a strong emphasis on the importance of training and
p.000002: education support for institutions, research ethics boards and researchers. CIHR should consider developing a web-based document as an
p.000002: educational resource.
p.000002: In addition, institutions should be encouraged to provide adequate support for the infrastructure needed to implement and operationalize these Best
p.000002: Practices on a systematic basis. PAC recommends that there be a line item in the budget of researchers' grant applications to accurately reflect the
p.000002: increased cost involved in adhering to these Best Practices so as to enhance commitment and feasibility.
p.000002:
p.000002:
p.000002: Harmonization of oversight framework
p.000002: There should be continuing efforts by CIHR to support and influence the federal, provincial and territorial legislative harmonization agenda as well as
p.000002: the development of a national system of research ethics oversight.
p.000002:
p.000002:
p.000002: Key outstanding issues
p.000002: Privacy concerns related to the transnational flow of data need to be addressed. These could include clear interpretive provisions and the
p.000002: development of coherent and reciprocal minimum standards to be included in international data transfer agreements.
p.000002: A separate process or initiative should be undertaken to develop a policy framework for the physical collection, use and storage of human biological
p.000002: specimens (in contrast to the personal information that may be derived from those specimens) as these are critically important and complex areas of
p.000002: activity that are having increasing importance in research.
p.000002: As one important means of responding to public concerns over potential unauthorized uses of personal information gathered for research, CIHR
p.000002: should consider raising discussion among stakeholders and governments about the desirability and feasibility of introducing in Canada instruments
p.000002: such as the Certificates of Confidentiality issued in the United States to protect sensitive information on research participants from forced disclosure.
p.000002: 2
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: Privacy Best Practices - 10 elements in Summary Form
p.000002: These Privacy Best Practices are intended to provide guidance for the health research community in Canada on the application of fair information
...
p.000050: reviewing their records and contacting them to inform them of research for which they are eligible. If such a prior opt-in consent procedure is not a
p.000050: practicable option, a health care provider could inform patients through notices that their personal information may be reviewed from time to time for
p.000050: recruitment purposes, and that they have the opportunity to opt-out. If patients do not opt-out, their consent for the use of their personal information to
p.000050: assess their eligibility for research or to contact them about the research project would be presumed.
p.000050:
p.000050:
p.000050: 6.2 Initial contacting and informing prospective participants
p.000050: 6.2.1 Trust vs. undue influence
p.000050:
p.000050: Recruitment raises complex issues around who is the appropriate person to make initial contact and inform eligible individuals about the research. On the
p.000050: one hand, individuals may feel more comfortable if approached by a data holder, such as a clinic physician or nurse, whom they trust and accept as having
p.000050: access to their personal information. On the other hand, individuals may be unduly influenced to agree to participate in research if approached by someone
p.000050: on whom they are dependent, for example, their employer, health provider, community leader or program director.
p.000050:
p.000050: In some cases, someone who has a relationship of some influence over prospective research participants may be the preferred person to contact
p.000050: individuals and inform them of the research where this is considered the best way to ensure that prospective research participants fully understand the risks
p.000050: and the benefits of the research to themselves. For example, a health care provider or professional (who may or may not be involved in the research) may
p.000050: be the preferred person to contact individuals and inform them about the research because of a relationship of medical confidence, special expertise and/or
p.000050: in-depth knowledge of the patients' situations. It is critical in such cases that the participants are reassured that their reasonable expectations of care will be
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000050: eligible for participation in the research. For example, a health care provider may not yet have informed the patient of a diagnosis (e.g. cancer) that is in the
p.000050: patient health record and that is used to determine eligibility. The researcher should confirm with the data holder that individuals have been informed of
p.000050: relevant health-related information before initiating contact.
p.000050:
p.000050:
p.000050: 6.3 Selected scenarios and preferred recruitment practices
p.000050: Index to recruitment scenarios
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
...
p.000063: the initial research participant. In order to respect the privacy of the participant and his family, only the participant or his/her spouse or a designated family
p.000063: member should contact other family members to ask their willingness to be approached by the researcher. The principal researcher (or a member of the
p.000063: research team) should not directly contact the family. 64
p.000063:
p.000063:
p.000063: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000063: research on patients. * The researcher is the health care provider of eligible individuals.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is the data holder or is employed by the data holder. If permitted by law 65 and subject to REB approval, the data
p.000063: holder may assess the eligibility of individuals for the research.
p.000063:
p.000063: The data holder should have rules nevertheless to limit the number of people permitted access to data for this purpose. 66
p.000063:
p.000063:
p.000063: Preferred options for contacting individuals will depend on whether the REB considers that the researcher/data holder has undue influence over
p.000063: prospective research participants (see the Options table).
p.000063:
p.000063: Options for contacting individuals according to whether the researcher/data holder has influence over prospective research participants
p.000063:
p.000063: Option Contacting prospective research participants
p.000063:
p.000063: A) If the If the researcher/data holder is not in a position of undue influence over prospective participants with regard to the research, the
p.000063: researcher/data researcher should make the initial contact and inform prospective participants about the research, if permitted by law and subject to
p.000063: holder is not in REB approval.
p.000063: a position of
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the In some cases, the researcher/data holder is considered to potentially be in a position of undue influence over eligible individuals with
p.000063: researcher/data regard to the research or there is a potential conflict of interest. For example, an REB may decide that patients who will be recruited
p.000063: holder is in a for a clinical trial being conducted by their health care provider may not understand the difference between the research treatment and
p.000063: position of the standard treatment provided at the health centre.
p.000063: undue
p.000063: In such cases, initial contact with prospective research participants should be made by neutral means, so that there is no undue
p.000063: influence.
p.000063: influence exerted on individuals to participate. For example, a neutral person on the research team or in the data holder's agency who
p.000063: is not in a position of authority over prospective research participants, could contact eligible individuals. Alternatively, it may be
p.000063: possible to make initial contact with eligible individuals by advertising in newspapers or in public locations, and then having a neutral
p.000063: member of the research team or staff provide further information to interested individuals.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000063: employees or students of the organization.
p.000063:
p.000063:
p.000063:
p.000063: In this scenario, the researcher is not the data holder, and does not have undue influence over prospective research participants. If permitted by law, 67
p.000063: the preferred recruitment approach is for the data holder to assess eligibility for research and to make initial contact with eligible individuals, unless the REB
p.000063: considers that the preferred approach is impracticable or inappropriate (see the ranked Options table).
p.000063:
p.000063: Ranked options for assessing eligibility and contacting prospective participants, when the researcher is not the data holder and does not have
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
...
p.000063: while limiting the total number of patients who need to be contacted.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.6 Scenario: * A clinician/researcher at a health care facility wants to conduct research on patients being treated by another physician in the same
p.000063: facility. * An academic wants to conduct research on students in his or her university department or program, but not in a class that he or she is
p.000063: currently teaching.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is not the data holder, but does potentially have undue influence over prospective participants with regard to the
p.000063: research.
p.000063:
p.000063: Preferred approaches to assessing eligibility for research and contacting eligible individuals will depend on whether the REB considers the data holder to
p.000063: have undue influence over prospective research participants (see the Options table).
p.000063:
p.000063: Options for assessing eligibility and making contact with individuals when the researcher has undue influence over prospective individuals
p.000063:
p.000063: Option Assessing eligibility and contacting individuals
p.000063:
p.000063: A) If the data If the data holder is not in a position of undue influence over prospective research participants, the REB may permit the data holder to
p.000063: holder is not in assess eligibility and make the initial contact with these individuals, if the data holder is permitted to do so by law (see scenario 6.3.5,
p.000063: a position of option A).
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the data If the data holder is considered by an REB to have undue influence on prospective participants, the researcher could make initial
p.000063: holder is in a contact with eligible individuals by neutral means such as by putting up notices in public areas of the facility or institution with
p.000063: position of information on how to contact the research team, and a neutral member of the research team or staff could inform interested
p.000063: undue individuals about the research (see scenario 6.3.4, option B).
p.000063: influence.
p.000063:
p.000063:
p.000063:
p.000063: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000063:
p.000063: [Secondary use of data for prospective collection]
p.000063:
p.000063: Article 3.5 "Researchers who wish to contact individuals to whom data refer shall seek the authorization of the REB prior to contact." Explanatory text:
p.000063: "In certain cases, the research goal may only be achieved by follow-up contact and interviews with persons. It is evident that individuals or groups might
p.000063: be sensitive if they discover that research was conducted on their data without their knowledge; others may not want any further contact. This potential
p.000063: harm underlines the importance for researchers to make all efforts to allow subjects the right to consent that their data and private information be part of
p.000063: a study." (pg. 3.6)
p.000063:
p.000063:
p.000063:
p.000063: Element #7: Safeguarding personal data
p.000063:
p.000063: General statement
p.000063: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
p.000063: safeguards should include organizational, technological and physical measures. 71
p.000063:
p.000063: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000063: as appropriate for the sensitivity and identifiability of the data. Formal privacy impact assessments (PIAs) are required in some institutions and under
p.000063: legislation or policy in some jurisdictions. 72
p.000063:
...
Health / Mentally Disabled
Searching for indicator disability:
(return to top)
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
p.000002: If yes, the researcher will likely propose the collection of direct identifiers.
p.000002:
p.000002: If these are not requirements of the research, the researcher should not collect direct identifiers. However, other potentially identifying elements may be
p.000002: needed to answer the research questions and for other data management reasons, such as to check for duplicate records. The lowest level of identifiability
...
Health / Motherhood/Family
Searching for indicator family:
(return to top)
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
p.000002: Family and friends/Social activities: Needed to investigate the impact of family structure and interaction and environmental factors on measures of health
p.000002: and well-being.
p.000002:
p.000002:
p.000002:
p.000002: 1.2 Creation of a database for general research purposes
p.000002: Define the scope and purpose of the database in a way that will be meaningful for REBs and any prospective research participants, even if the boundaries
p.000002: are at a relatively general level.
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
p.000002: management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: Describe the general types of personal data that are necessary for these general research objectives (e.g. diagnoses, risk factors, outcomes). Include data
p.000002: that are expected to be collected over the lifespan of the database, particularly if there will be multiple data collection periods per participant, or data that will
p.000002: be requested from secondary sources. Be as specific as possible.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research database on disease X
p.000002:
p.000002: Research objectives:
p.000002:
p.000002: 1. Compiling statistics on population trends in disease X and in its risk factors.
p.000002: 2. Conducting health and epidemiological research to improve screening and treatment programs for disease X.
p.000002:
p.000002: Types of research questions (examples):
p.000002:
p.000002: 1. What is the association between disease X and risk factors such as diet, tobacco use, physical activity level, education, income or gender?
p.000002: 2. What is the risk of developing disease X after exposure to environmental risk factors, such as pollutants in the area of residence?
p.000002: 3. What is the cost-effectiveness and efficacy of screening programs for disease X?
p.000002: Types of personal data to be collected over multiple collection periods Research justification
p.000002:
p.000002:
p.000002: Name, address, telephone number Contact information to follow-up with participants for further data
p.000002: collection
p.000002:
p.000002: Demographic information Assess other variables by demographics of the population
p.000002:
p.000002: Family history Disease X is known to have an inherited basis
p.000002:
p.000002: Diet, reproductive factors, physical activity, anthropometric measures, Assess risk factors for disease X
p.000002: education, income, gender
p.000002:
p.000002: Medical conditions, medication use Assess impact of other existing conditions on disease X and
p.000002: effectiveness of medications.
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
p.000002: 1. Track and assess the factors that facilitate or hinder the development of family-centered provincial services for children with condition X and their
p.000002: family members.
p.000002: 2. Provide guidance to community organizations and provincial governments.
p.000002: 3. Validate questionnaire and interview methods for creating individualized family service plans.
p.000002: 4. Assess long term effectiveness and adverse effects of standard and emerging treatments for Condition X.
p.000002:
p.000002:
p.000002: Setting the scope of research
p.000002:
p.000002: Initial partnership between the research team and Provincial Ministry of Children's Services results in agreement on key objectives.
p.000002: A Local Advisory Committee is established to assist in setting out the scope and strategic priorities for the research program, to review research
p.000002: progress, to facilitate the achievement of study objectives, and to assist with the dissemination of results; with representatives from the Ministry,
p.000002: provincial clinic for childhood condition X, two community advocacy groups for persons with condition X, and parent representatives.
p.000002: A National Project Advisory Committee with representation from provinces actively interested in this initiative meets annually to advance services
p.000002: to young children with condition X, and to plan and disseminate research findings.
p.000002:
p.000002:
p.000002:
p.000002: 1.4 Qualitative research using inductive data collection and analysis
p.000002: It is important to recognize that all potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For
p.000002: example, researchers using inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration
p.000002: with research participants. In such research, the development of research questions and procedures is an ongoing process. For example, open-ended
p.000002: interviewing often goes down avenues not anticipated leading to new questions and new approaches.
p.000002:
...
p.000002:
p.000002:
p.000002: Full name Street address
p.000002: Partial name 6-character postal code (e.g. one side of a city street; average of 15 households)
p.000002: Initials first 3 characters of postal code/Forward Sortation Area (average of 7,000 households)
p.000002: Code first character of postal code (province or region; e.g. A = Nfld/Lab.; J = Que. West; K = Eastern Ont.)
p.000002: Blank
p.000002: Census area
p.000002: Age
p.000002:
p.000002: Block (an area equivalent to a city block bounded by intersecting streets; the smallest geographic area for
p.000002: Birth day/month/year which population and dwelling counts are disseminated)
p.000002: Birth month/year Census enumeration or dissemination area (small area composed of one or more neighbouring blcoks,
p.000002: Birth year; Age at a time of used by Statistics Canada for distributing questionnaires to households and dwellings for the census
p.000002: data collection collection)
p.000002: Age range (e.g. 5 or 10-year Census subdivision (e.g. municipality, village)
p.000002: age group) Census agglomeration (urban core: min. 10,000 pop.)
p.000002: Census metropolitan area (urgan core: min. 100,000 pop.)
p.000002: Facilities and service providers
p.000002:
p.000002:
p.000002: Name of institution/provider
p.000002: Specific type of facility,
p.000002: provider (university hospital,
p.000002: family physician)
p.000002: Generic class (hospital,
p.000002: medical doctor)
p.000002:
p.000002:
p.000002:
p.000002: 2.3 Secondary use
p.000002: 2.3.1 As in 2.2.1, consider whether aggregate data on groups of individuals would serve the research objective. If not, consider whether non-identifiable
p.000002: data relating to individuals would serve the purpose.
p.000002:
p.000002: 2.3.2. Removal or coding of direct identifiers
p.000002: If identifiable data are required for the research purpose, direct identifiers should be avoided or concealed to the extent that is reasonably practical (e.g. as
p.000002: soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002:
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002:
p.000002: 2.4 Inductive data collection
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
...
p.000029: program to maintain a complete and accurate record of changes in registrants' contact information
p.000029: over time);
p.000029:
p.000029: such that:
p.000029:
p.000029: a. there is a risk of introducing bias into the research because of the loss of data from segments of the
p.000029: population that cannot be contacted to seek their consent, thereby affecting the validity of results
p.000029: and/or defeating the purpose of the study; or
p.000029: b. the additional financial, material, human, organizational and other resources needed to obtain
p.000029: consent could impose a hardship or burden on the researchers or organization so burdensome that
p.000029: the research could not be done.
p.000029:
p.000029:
p.000029: 3.3.4 Expectations of individuals In general, the expectations of a reasonable person in the circumstances should be taken into account
p.000029: (considering, for example, the nature of the research, the type of data to be collected and the context in
p.000029: which the data were originally collected). If individuals have previously objected to the secondary use of their
p.000029: data for research or to the use of their contact information, their directions should be respected.
p.000029:
p.000029: 3.3.5 Views of relevant groups Privacy concerns may extend beyond the individual to include well-defined groups or communities, e.g.
p.000029: remote communities and Aboriginal peoples. 31 Also, genetic information about individuals is more than
p.000029: personal information-it may also be intimate information about those who share a common genetic lineage-
p.000029: -family members, other relatives and, in some cases, well-defined communities. 32
p.000029:
p.000029: The REB may require that efforts be made to consult with family groups, Aboriginal peoples, community
p.000029: representatives, consumer associations, and/or special populations such as the homeless or under-housed,
p.000029: as appropriate, to address possible concerns of affected individuals and communities. These concerns may
p.000029: relate to the design and scope of the research, the recruitment of individuals, and the analysis and
p.000029: disseminations of results of research. This consultation process will be a high priority when dealing with
p.000029: controversial issues and/or individuals, groups or communities in vulnerable circumstances.
p.000029: 3.3.6 Legal requirements In addition to REB approval, access to personal data for research without consent will be subject to specific
p.000029: legal requirements in relevant jurisdictions. For example, some jurisdictions require some or all of the
p.000029: following:
p.000029:
p.000029: a data-sharing agreement between the data holder and the researcher; 33
p.000029: notification and/or approval by other relevant oversight bodies; 34 and/or
p.000029: agreement that personal data will not be used to contact individuals. 35
p.000029:
p.000029:
p.000029: 3.3.7 Openness: Informing the public In the spirit of openness, the researcher should have an appropriate strategy for informing the general public
p.000029: about the research. 36
p.000029:
p.000029:
p.000029:
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Requirements for consent]
p.000029:
p.000029: Article 2.1
p.000029:
...
p.000029:
p.000029: to provide participants with the opportunity to look at transcripts and to delete or footnote what they consider to be inaccurate or sensitive information
p.000029: (known as member-checking);
p.000029: to ask participants if they wish to be publicly acknowledged in articles coming from the research; or
p.000029: to invite community leaders or representatives to help interpret the findings to their constituencies.
p.000029:
p.000029:
p.000029: 5.5 Providing information about privacy to prospective research participants
p.000029: The following categories of information relating to privacy matters should be included in the information provided to prospective research participants:
p.000029:
p.000029: Basic information Explanation
p.000029:
p.000029: 1) Research Specific research objectives and related questions.
p.000029: objectives 46
p.000029: and procedure
p.000029:
p.000029: 2) Data types and Types of data to be collected and why.
p.000029: uses 47 Any planned or foreseeable commercial uses of the data.
p.000029: If appropriate, a statement indicating whether test results are for research purposes only or if they can serve other non-
p.000029: research purposes (e.g. clinical care).
p.000029:
p.000029:
p.000029: 3) Voluntary basis Voluntary basis for participation, and ongoing meaningful opportunities to decide whether to continue.
p.000029: for participation Withdrawal, without any negative effect on a person's reasonable expectations of rights and benefits, being possible at any
p.000029: 48 time (but be clear that data which have already been made non-identifiable cannot be retrieved and destroyed).
p.000029: Option of contacting other family members to ask their willingness to be contacted by the researcher (e.g. in genetic
p.000029: research, participants should make first contact with related family members).
p.000029: Circumstances under which the researcher may terminate the participant's involvement in the research (e.g. in clinical drug
p.000029: trials).
p.000029: 4) Risks, benefits, Possible risks or discomforts to the research participant (including physical, emotional and psychological impacts, or
p.000029: compensation privacy intrusion).
p.000029: Benefits of the research in general and, if relevant, the benefits to the individual participant.
p.000029: Any compensation offered to participants should not constitute an undue influence to agree to participate. 49
p.000029:
p.000029:
p.000029: 5) Confidentiality Protection of data confidentiality (e.g. affirmation that genetic data will not be given to third parties)
p.000029: and safeguards General description of security measures (e.g. coding of data, 51 locked storage).
p.000050: 50
p.000050:
p.000050:
p.000050: 6) Data access and Who will have access to the data and for what purposes (include any legal requirements, such as mandatory public health
p.000050: legal disclosure reporting of certain diseases or obligation to produce evidence on court order; access required for scientific integrity such
p.000050: requirements 52 as auditing or verification of data; and any plans to archive or destroy the data).
p.000050:
p.000050:
p.000050: 7) Reporting of Explanation of the conditions, if any, under which personal results are to be reported back (e.g. results of genetic testing
p.000050: results 53 should normally be reported back to the participant through a physician and with provision of genetic counseling; conditions
p.000050: for informing implicated family members of research results should be clearly stated).
p.000050: A clear statement, if relevant, of conditions under which results will not be given to the participant (e.g. exploratory research
p.000050: for which results are not clinically meaningful or community-based research where results are applicable only to the
p.000050: community).
p.000050: Explanation of the impossibility for researchers to trace results from non-identifiable data back to individuals.
p.000050:
p.000050:
p.000050: 8) Data retention Time period that data will be retained (e.g. provide a specified time period or, if for an extended/indefinite period, provide a
p.000050: 54 specified time for REB review).
p.000050:
p.000050:
p.000050: 9) Inquiries and Who is available to answer questions about the research.
p.000050: complaints 55 Who to contact about the ethics of the research.
p.000050: Who to complain to about the research.
p.000050: Who to contact if the participant decides to withdraw consent.
p.000050:
p.000050:
p.000050:
p.000050: 5.6 Collection from individuals and secondary use (Hybrid model)
p.000050: For a hybrid project involving the direct collection of data from individuals and secondary use of data from other sources, the prospective research
p.000050: participant should also be informed of:
p.000050:
p.000050: all expected types and sources of personal data to be accessed and used;
p.000050: any expected linkages; and
p.000050: the expected purposes for which data will be used (e.g. health survey data to be collected and linked, with consent, to health records to investigate
p.000050: health care use in the population).
p.000050:
p.000050:
...
p.000050: uses, with or without re- the opportunity to withdraw consent (and any identifying information) in the future, and may also include the
p.000050: contact options:
p.000050: To be re-contacted on a regular (or as needed basis) to seek consent for new research uses of the data, if
p.000050: desired and practicable; and/or
p.000050: To not be re-contacted, but to authorize the researchers to use the data only in certain ways in the future,
p.000050: for example:
p.000050: only for certain research purposes (to be determined with the participant during the consent process);
p.000050: only for the original broad purposes for establishing the database;
p.000050: for any purposes as long as a research ethics board has approved the proposed research;
p.000050: at what level of identifiability (e.g. with or without direct identifiers, coded, or in non-identifiable form):
p.000050: 56 and
p.000050:
p.000050: with or without linkages to other data sources (e.g. with controls over what can be linked, and who
p.000050: can access the linked data).
p.000050:
p.000050:
p.000050:
p.000050: Example: Informing participants and presenting options for control of new uses of data
p.000050:
p.000050: The invitation to participate in the study is made by a dedicated nurse coordinator employed by, and accountable to, the participating hospital. The nurse
p.000050: coordinator arranges, at a convenient time for the patient (and his/her family), to explain the study and seek the patient's consent to participate. Patients
p.000050: can refuse or can agree to any or all of the following:
p.000050:
p.000050: Access to their current hospitalization records by the nurse coordinator to collect information relevant to their condition, for future research uses.
p.000050: A follow-up telephone call by the nurse coordinator 6 months after the onset of their health event to determine longer-term changes in their
p.000050: functional ability-this survey information is also intended for inclusion in the registry for future research purposes.
p.000050: Linkage of their data in the study database, with administrative files from the provincial Ministry of Health, and other sources such as laboratory
p.000050: and physician records, in order to collect information about physician and laboratory services, subsequent hospitalizations, and causes of death.
p.000050: The linked data will be used for research on the use of health care services and effects on health for patients with condition X; and
p.000050: Use of their non-identifiable records in future analyses performed at the independent not-for-profit research organization based in City Y. The
p.000050: results of these analyses are to be released in aggregate form to third-party private companies seeking to improve services and products related
p.000050: to condition X.
p.000050:
p.000050:
p.000050:
p.000050: 5.7.2 Promotion of openness and accountability 57
p.000050:
p.000050:
p.000050: Researchers should endeavour to keep participants informed of future data uses through continuing means (e.g. web site information), as part of an
...
p.000050: 4. An indication of who will have access to information collected on the identity of subjects, description of how confidentiality will be protected, and
p.000050: anticipated uses of data;
p.000050: 5. An explanation of the subject's responsibilities;
p.000050: 6. Information on the circumstances under which the researcher may terminate the subject's participation in the research;
p.000050: 7. Information on any costs, payments, reimbursement for expenses or compensation for injury;
p.000050: 8. In the case of randomized trials, the probability of assignment to each option;
p.000050: 9. For research on biomedical procedures, including health care interventions: information about
p.000050: (a) forgoing alternative procedures that might be advantageous to the subject; (b) whichaspects of the research involve the use of procedures that
p.000050: are not generally recognized or accepted; and (c) particularly in trials of therapeutic interventions, the care provided if the potential subject decides
p.000050: not to consent to participation in the study;
p.000050: 10. The ways in which the research results will be published, and how the subjects will be informed of the results of the research." (pg. 2.7)
p.000050:
p.000050: [Genetic counseling]
p.000050:
p.000050: Article 8.4 "Genetics researchers and the REB shall ensure that the research protocol makes provision for access to genetic counseling for the subjects,
p.000050: where appropriate." Explanatory note: "Genetic counselors who are formally trained to impart genetic information have two main roles in dealing with a
p.000050: family: The first is to educate regarding the condition in question, and the second is to counsel by presenting options or possible action scenarios in a
p.000050: non-directive manner. The complexity of genetic information along with its social implications usually requires that free and informed consent be
p.000050: supplemented with genetic counseling." (pg. 8.4)
p.000050:
p.000050: [Conditions for less than full disclosure]
p.000050:
p.000050: Article 2.1 Explanatory text: "... the REB should exercise judgment on whether the needs for research justify limited and/or temporary exception to the
p.000050: general requirements for full disclosure of information relevant for a research subject's meaningful exercise of free and informed consent. In such cases,
p.000050: subjects may be given only partial information or they may be temporarily led to believe that the research has some other purpose because full
p.000050: disclosure would likely colour the responses of the subjects and thus invalidate the research. For example, social science research that critically probes
p.000050: the inner workings of publicly accountable institutions might never be conducted without limited recourse to partial disclosure. Also some research in
p.000050: psychology seeks to learn about human responses to situations that have been created experimentally. Such research can only be carried out if the
p.000050: subjects do not know in advance about the true purpose of the research...Another scenario, in questionnaire research, embeds questions that are
p.000050: central to the researcher's hypotheses within distractor questions, decreasing the likelihood that subjects will adapt their responses to their perceptions
...
p.000050: individuals and inform them of the research where this is considered the best way to ensure that prospective research participants fully understand the risks
p.000050: and the benefits of the research to themselves. For example, a health care provider or professional (who may or may not be involved in the research) may
p.000050: be the preferred person to contact individuals and inform them about the research because of a relationship of medical confidence, special expertise and/or
p.000050: in-depth knowledge of the patients' situations. It is critical in such cases that the participants are reassured that their reasonable expectations of care will be
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000050: eligible for participation in the research. For example, a health care provider may not yet have informed the patient of a diagnosis (e.g. cancer) that is in the
p.000050: patient health record and that is used to determine eligibility. The researcher should confirm with the data holder that individuals have been informed of
p.000050: relevant health-related information before initiating contact.
p.000050:
p.000050:
p.000050: 6.3 Selected scenarios and preferred recruitment practices
p.000050: Index to recruitment scenarios
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050: 6.3.3 Scenario: *A genetics researcher proposes to recruit the family members of research participants.
p.000050: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000050: research on patients. * The researcher is the health care provider of eligible individuals.
p.000050: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000050: employees or students of the organization.
p.000050: 6.3.6 Scenario: * A clinician-researcher at a health care facility wants to conduct research on patients being treated by another physician in the same
p.000050: facility. * An academic wants to conduct research on students in his or her university department or program, but not in a class that he or she is
p.000050: currently teaching.
p.000050:
p.000050:
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050:
p.000050:
p.000050:
p.000050: When eligibility information and the means of notifying individuals about the research are publicly available, the researcher should normally be able to make
p.000050: the initial contact without needing an intermediary.
p.000050:
p.000050:
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050:
p.000050:
p.000050:
p.000050: As a general rule, researchers planning to work in a community should make contact with and inform community leaders and groups relevant to their
p.000050: research, prior to initiating the recruitment or informed consent process with members of that community.
p.000050:
p.000050: For many Aboriginal communities and groups, approval by local authorities may be required prior to beginning the recruitment of research participants.
p.000063: 63
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.3 Scenario: * A genetics researcher proposes to recruit the family members of research participants.
p.000063:
p.000063:
p.000063:
p.000063: For the purpose of recruiting relatives for genetic or genomic research, there should be no direct contact between the researcher and the family members of
p.000063: the initial research participant. In order to respect the privacy of the participant and his family, only the participant or his/her spouse or a designated family
p.000063: member should contact other family members to ask their willingness to be approached by the researcher. The principal researcher (or a member of the
p.000063: research team) should not directly contact the family. 64
p.000063:
p.000063:
p.000063: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000063: research on patients. * The researcher is the health care provider of eligible individuals.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is the data holder or is employed by the data holder. If permitted by law 65 and subject to REB approval, the data
p.000063: holder may assess the eligibility of individuals for the research.
p.000063:
p.000063: The data holder should have rules nevertheless to limit the number of people permitted access to data for this purpose. 66
p.000063:
p.000063:
p.000063: Preferred options for contacting individuals will depend on whether the REB considers that the researcher/data holder has undue influence over
p.000063: prospective research participants (see the Options table).
p.000063:
p.000063: Options for contacting individuals according to whether the researcher/data holder has influence over prospective research participants
p.000063:
p.000063: Option Contacting prospective research participants
p.000063:
p.000063: A) If the If the researcher/data holder is not in a position of undue influence over prospective participants with regard to the research, the
p.000063: researcher/data researcher should make the initial contact and inform prospective participants about the research, if permitted by law and subject to
p.000063: holder is not in REB approval.
p.000063: a position of
p.000063: undue
...
p.000086: Appropriate measures should be taken to avoid or minimize the identifiability of data in publications or public databases. Statistics Canada guidance in this
p.000086: area is available online. 90
p.000086:
p.000086: 8.4.1 Reporting qualitative research results when concealing individuals' identities is not desired
p.000086:
p.000086: In assessing the privacy aspects of research, researchers and REBs should also be aware of the possibility that in some instances individuals may want
p.000086: their identities to be known-for example, when individuals want their contribution to research as participants to be recognized, or where they want to help
p.000086: others afflicted with a similar condition. In some qualitative research, individual participants may understand and willingly accept the possibility that their
p.000086: identities may be revealed in the public reporting of research results.
p.000086: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000086:
p.000086: [Disclosure controls]
p.000086:
p.000086: "Data released should not contain names, initials or other identifying information. While it may be important to preserve certain types of identifiers (e.g.,
p.000086: region of residence), these should be masked as much as possible using a standardized protocol before the data are released for research purposes.
p.000086: However, legitimate circumstances may exist where such information is critical for the research project..." (pg. 3.4)
p.000086:
p.000086: [Human genetic research]
p.000086:
p.000086: Article 8.2 "The researchers and the REB shall ensure that the results of genetic testing and genetic counseling records are protected from access by
p.000086: third parties, unless free and informed consent is given by the subject. Family information in databanks shall be coded so as to remove the possibility of
p.000086: identification of subjects within the bank itself." (pg. 8.2)
p.000086:
p.000086: [Secondary uses]
p.000086:
p.000086: Article 3.3, 3.4 - See Element #3
p.000086:
p.000086: [Data linkage]
p.000086:
p.000086: Article 3.6 "The implications of approved data linkage in which research subjects may be identifiable shall be approved by the REB." Explanatory note:
p.000086: "...Only a restricted number of individuals should perform the function of merging databases; researchers should either destroy the merged file
p.000086: immediately after use, or use enhanced security measures to store it. Whether the data are to be used statistically or otherwise, confidentiality of the
p.000086: information must be maintained by all members of the research team." (pg. 3.6)
p.000086:
p.000086:
p.000086:
p.000086: Element #9: Setting reasonable limits on retention of personal data
p.000086:
p.000086: General statement
p.000086: Personal data should be retained as long as is necessary to fulfill the research purposes. 91 Personal data may then be destroyed or returned to the
p.000086: data provider, if appropriate, as set out in the terms of the original collection, data-sharing agreement, institutional policies and legal requirements.
p.000086:
p.000086: There is a tension between the privacy principle of limiting the retention of data and the scientific principle of preserving research data so that published
p.000086: research results can be replicated and verified, and opportunities for further investigation of valuable data are maximized. While this is a very complex area
p.000086: in need of further reflection and development, the default principle is to define retention periods for personal data, in writing. Researchers should be explicit
...
p.000086: identifiable data cannot be retrieved and withdrawn from the database.
p.000086:
p.000086: 39 See Element #5, 5.4.
p.000086:
p.000086: 40 See Element #3.
p.000086:
p.000086: 41 See table of concordance for Element #5 in Appendix A-7 for cross-reference to statutory provisions regarding notice/information requirements.
p.000086:
p.000086: 42 According to the results of the international Adult Literacy and Life Skills Survey (2003), a joint project of the Government of Canada, the U.S.
p.000086: National Center for Education Statistics and the Organization for Economic Cooperation and Development, some 15% of Canadians, about one
p.000086: out of every seven, have problems dealing with printed materials and score at the lowest performance level in reading prose.
p.000086: From Statistics Canada, The Daily, Wednesday, May 11, 2005, Learning a Living: First Results of the Adult Literacy and Life Skills Survey , 2003
p.000086: (89-603-XWE, free), available online.
p.000086:
p.000086: 43 When results of research tests are determined to be scientifically valid, have significant implications for the health of the participant, and
p.000086: prevention or treatment is available, these results should be communicated to the participant through his or her treating physician, unless the
p.000086: participant has chosen not to receive any results.
p.000086: In communicating results to the participant, particularly with respect to genetic research, the choices of each participant, the extent of available
p.000086: clinical services, the availability of counselling, and the implications for family members, should be taken into account (based on Quebec's
p.000086: Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000, part IV Professionalism, part 3
p.000086: Communication of Specific Results, pg. 12).
p.000086:
p.000086: Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles on the Ethical Conduct of Human Genetic Research
p.000086: 44 Involving Populations (2002), Section 6, Communication of Research Results, pg. 3.
p.000086:
p.000086: 45 As above.
p.000086:
p.000086: 46 See also Element #1.
p.000086:
p.000086: 47 See also Element #2. We recognize that certain types of research may not be compatible with full disclosure of data to be collected, for example
p.000086: in some psychology research. This is an area that requires further reflection, and CIHR welcomes suggestions from those for whom these
p.000086: exceptions may apply.
p.000086:
p.000086: 48 See also Element #4.
p.000086:
p.000086: 49 TCPS states that " undue influence may take the form of inducement, deprivation or the exercise of control or authority over prospective
p.000086: subjects." (TCPS Article 2.2, pg. 2.4)
p.000086:
p.000086: 50 See also Element #7.
p.000086:
p.000086: 51 See Element #2, 2.3.2 and Box- Definition of terms.
p.000086:
p.000086: 52 See also Element #8.
p.000086:
p.000086: 53 See also Element #8.
p.000086:
p.000086: 54 See also Element #9.
p.000086:
p.000086: 55 See also Element #10.
p.000086:
p.000086: 56 See Box- Definition of terms: Individual Identifiability of Data , in Element #2.
p.000086:
p.000086: 57 See Element #10, 10.2.1
p.000086:
...
Health / Physically Disabled
Searching for indicator illness:
(return to top)
p.000002:
p.000002: Example:
p.000002:
p.000002: Research study: Impact of ethnic group membership and age on health
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
p.000002: Family and friends/Social activities: Needed to investigate the impact of family structure and interaction and environmental factors on measures of health
p.000002: and well-being.
p.000002:
p.000002:
p.000002:
p.000002: 1.2 Creation of a database for general research purposes
p.000002: Define the scope and purpose of the database in a way that will be meaningful for REBs and any prospective research participants, even if the boundaries
p.000002: are at a relatively general level.
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
p.000002: management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: Describe the general types of personal data that are necessary for these general research objectives (e.g. diagnoses, risk factors, outcomes). Include data
p.000002: that are expected to be collected over the lifespan of the database, particularly if there will be multiple data collection periods per participant, or data that will
...
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
p.000002: If yes, the researcher will likely propose the collection of direct identifiers.
p.000002:
p.000002: If these are not requirements of the research, the researcher should not collect direct identifiers. However, other potentially identifying elements may be
...
Health / Terminally Ill
Searching for indicator terminal:
(return to top)
p.000029: the subject remains incompetent. (d) When a subject who was entered into a research project through third-party authorization becomes competent
p.000029: during the project, his or her informed consent shall be sought as a condition of continuing participation." (pg. 2.10)
p.000029:
p.000029: Article 2.7 "Where free and informed consent has been obtained from an authorized third party, and in those circumstances where the legally
p.000029: incompetent individual understands the nature and consequences of the research, the researcher shall seek to ascertain the wishes of the individual
p.000029: concerning participation. The potential subject's dissent will preclude his or her participation." (pg. 2.10)
p.000029:
p.000029: [Research with children]
p.000029:
p.000029: "..the notion of harm applied to children should be understood differently from harm in adults. Harm induced in children may have longer-term
p.000029: consequences to their growth and development. Furthermore, harms and benefits for children with chronic disabilities and terminal illnesses require
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
p.000029: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
...
Social / Access to Social Goods
Searching for indicator access:
(return to top)
p.000002: 
p.000002: Canadian Institutes
p.000002: of Health Research
p.000002: Home î‚’ Collaboration î‚’ Ethics
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: CIHR Best Practices for Protecting Privacy in Health
p.000002: Research (September 2005)
p.000002: Cat. No.: MR21-63/2005E-HTML
p.000002: ISBN: 0-662-41057-2
p.000002: Other format
p.000002:
p.000002: PDF version
p.000002:
p.000002: Table of contents (856 KB)
p.000002:
p.000002: Acronyms
p.000002: CIHR Privacy Advisory Committee: Recommendations
p.000002: Privacy Best Practices: 10 elements in summary form
p.000002: How to navigate the document: Areas of special interest
p.000002: Introduction
p.000002: CIHR's mandate
p.000002: Goals
p.000002: Statement of values
p.000002: Scope of application
p.000002: Commitment to continuous learning and review
p.000002: Privacy Best Practices: 10 elements
p.000002: Element #1 - Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002: Element #2 - Limiting the collection of personal data
p.000002: Element #3 - Determining if consent from individuals is required
p.000002: Element #4 - Managing and documenting consent
p.000002: Element #5 - Informing prospective research participants about the research
p.000002: Element #6 - Recruiting prospective research participants
p.000002: Element #7 - Safeguarding personal data
p.000002: Element #8 - Controlling access and disclosure of personal data
p.000002: Element #9 - Setting reasonable limits on retention of personal data
p.000002: Element #10 - Ensuring accountability and transparency in the management of personal data
p.000002: Appendices
p.000002: References
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: Acronyms
p.000002: CIHR Canadian Institutes of Health Research
p.000002:
p.000002: CSA Canadian Standards Association
p.000002:
p.000002: ICH GCP International Conference on Harmonization of Technical Requirements for Registration of Pharmaceuticals for Human
p.000002: Use- Good Clinical Practice: Consolidated Guideline
p.000002:
p.000002: NCEHR National Council on Ethics in Human Research
p.000002:
p.000002: NIH National Institutes of Health (United States of America)
p.000002:
p.000002: NSERC Natural Sciences and Engineering Research Council of Canada
p.000002:
p.000002: PAC CIHR Privacy Advisory Committee
p.000002:
p.000002: PRE Interagency Advisory Panel on Research Ethics
p.000002:
p.000002: REB Research Ethics Board
p.000002:
p.000002: RMGA Quebec Network of Applied Genetic Medicine
p.000002:
p.000002: SSHRC Social Sciences and Humanities Research Council of Canada
p.000002: TCPS Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, Social
...
p.000002: that the privacy of individuals and the community is being appropriately protected.
p.000002:
p.000002:
p.000002: Element #3 : Determining whether consent from individuals is required
p.000002:
p.000002:
p.000002:
p.000002: Voluntary and informed consent from legally competent individuals or authorized third parties is a fundamental principle in research involving humans, and
p.000002: specifically for the use of their personal data.
p.000002:
p.000002: Under specified circumstances, given a satisfactory rationale by the researcher, an REB may approve the waiver of a consent requirement, or a partial
p.000002: waiver of some elements of a consent requirement. According to TCPS Article 2.1(c), the REB must find and document that:
p.000002:
p.000002: "(i) The research involves no more than minimal risk to the subjects;
p.000002: (ii) The waiver or alteration is unlikely to adversely affect the rights and welfare of the subjects;
p.000002: (iii) The research could not practicably be carried out without the waiver or alteration;
p.000002: (iv) Whenever possible and appropriate, the subjects will be provided with additional pertinent information after participation; and
p.000002: (v) The waived or altered consent does not involve a therapeutic intervention."
p.000002:
p.000002: In addition to REB approval, access to personal data for research without consent will be subject to specific legal requirements in relevant jurisdictions.
p.000002:
p.000002: When a research objective requires the collection of personal information directly from individuals to whom the data belong and linking to other sources to
p.000002: form a combined file, consent should be sought for both types of data collection at the time of direct contact with prospective research participants.
p.000002:
p.000002: For secondary use of data for research, an REB should consider the following factors in determining whether a research proposal meets the requirements
p.000002: for waiver of consent:
p.000002:
p.000002: necessity of personal data for the research purposes;
p.000002: potential harms and benefits of the research;
p.000002: inappropriateness or impracticability of consent;
p.000002: expectations of individuals;
p.000002: views of relevant groups;
p.000002: legal requirements; and
p.000002: openness (informing the public).
p.000002:
p.000002: These factors, and the description in the Elements, expand on TCPS Article 2.1(c)(i)- (iii).
p.000002:
p.000002: An REB may determine that seeking consent from individuals is inappropriate because there is potential harm to individuals from direct contact, or contact
p.000002: with individuals is not permitted under a previous data-sharing agreement, law or policy.
p.000002:
...
p.000002: to not be re-contacted, but to authorize the researchers to use the data only in certain ways in the future (e.g. with or without direct identifiers, coded
p.000002: or in non-identifiable form; or for certain areas of research).
p.000002:
p.000002:
p.000002: Element #6: Recruiting prospective research participants
p.000002:
p.000002:
p.000002:
p.000002: The proposed recruitment procedure and materials should be included in the submission for REB approval. The procedure and materials should foster the
p.000002: conditions for voluntary consent, and not exert undue influence on prospective participants to agree to take part in research.
p.000002:
p.000002: Initial contact with individuals about a research project should be made by someone that individuals would expect to have relevant information about them,
p.000002: or in other ways that do not inappropriately intrude on their life or privacy.
p.000002:
p.000002: Wherever possible, the researcher should anticipate at the time of the original collection the future uses of personal information for further recruitment
p.000002: purposes, and seek consent from individuals for these purposes.
p.000002:
p.000002: The REB will need to determine if consent is required for the secondary use of personal information for recruitment purposes . Researchers and REBs
p.000002: should be aware of any legal restrictions on contacting individuals in these circumstances.
p.000002:
p.000002: When a researcher is making a request for access to data to recruit participants, the preferred option is for the data holder to determine eligibility of
p.000002: individuals for the research on the basis of criteria provided by the researchers, and to make the initial contact to:
p.000002:
p.000002: inform eligible individuals about the research so that they can contact the researcher, if interested, or
p.000002: to seek consent from individuals to release their nominal information to the researcher who will contact them to inform them about the research.
p.000002:
p.000002: When the preferred option is impracticable or inappropriate, an REB may consider whether a researcher should be permitted access to minimal personal
p.000002: data only for the purposes of determining eligibility for the research or contacting individuals to invite them to join the study. If it is legally permissible and
p.000002: the REB considers it appropriate, personal information may be released with appropriate confidentiality protection such as a signed confidentiality
p.000002: agreement with access restricted to the data holder's site and use limited to the stated purpose.
p.000002:
p.000002: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000002: eligible for participation in the research, such as a cancer diagnosis.
p.000002:
p.000002: Typical scenarios for recruiting participants, including community-based research and genetics research, and preferred approaches are briefly described.
p.000002:
p.000002:
p.000002: Element #7: Safeguarding personal data
p.000002:
p.000002:
p.000002:
p.000002: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
p.000002: safeguards should include organizational, technological and physical measures.
p.000002:
p.000002: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000002: as appropriate for the sensitivity and identifiability of the data.
p.000002:
p.000002: REBs should review and approve researchers' proposed measures for safeguarding any personal data to be collected.
p.000002:
p.000002:
p.000002: Element #8: Controlling access and disclosure of personal data
p.000002:
p.000002:
p.000002:
p.000002: Data sharing for research purposes - whether of linked or unlinked data sets - is an important way of enabling socially valuable research. It avoids
p.000002: unnecessary duplication of data collection, which reduces the burden on research participants and permits researchers to use limited or scarce resources
p.000002: more productively.
p.000002:
p.000002: However, once approved by an REB, there should be strict limits on access to data and secure procedures for data linkage, subject to data-sharing
p.000002: agreements.
p.000002:
p.000002: When personal data are essential to research objectives and questions, researchers need a plan for making public the results of research in ways that do
p.000002: not permit tracing back to individuals if they do not wish their identities to be known.
p.000002:
p.000002: The most secure way of conducting data linkages requested by external researchers is for the data holder to conduct the linkage and provide linked data
p.000002: sets to the researcher without direct identifiers and at the minimum level of identifiability necessary for the research purpose. If that is not practicable, a
p.000002: trusted third party may conduct the linkage or the researcher may conduct the linkage on the data holder's site. As a last option, a researcher may be
p.000002: permitted to conduct the linkage at a secure site but under strict controls, as specified in a data-sharing agreement. Following the linkage of datasets, the
p.000002: person doing the data linkage should reduce datasets to the lowest level of identifiability needed to accomplish the research objectives.
p.000002:
p.000002: Data-sharing agreements bind data providers and researchers to their respective responsibilities and obligations for protecting personal data. Data-sharing
p.000002: agreements should set out the terms and conditions under which data providers will allow researchers to access personal data for research purposes.
p.000002:
p.000002: In assessing the privacy aspects of research, researchers and REBs should also be aware of the possibility that in some instances individuals may want
p.000002: their identities to be known-for example, when individuals want their contribution to research as participants to be recognized, or where they want to help
p.000002: others afflicted with a similar condition. In some qualitative research, individual participants may understand and willingly accept the possibility that their
p.000002: identities may be revealed in the public reporting of research results.
p.000002:
p.000002:
p.000002: Element #9: Setting reasonable limits on retention of personal data
p.000002:
p.000002:
p.000002:
p.000002: Personal data should be retained as long as is necessary to fulfill the research purposes. Personal data may then be destroyed or returned to the data
p.000002: provider, if appropriate, as set out in the terms of the original collection, data-sharing agreement, institutional policies, and legal requirements.
p.000002:
p.000002: Retention periods for personal data should be defined in writing. Researchers should be explicit about what they plan to do with the data they collect and
p.000002: have storage, management and access policies in place.
p.000002:
p.000002: When personal data are collected in a database to support general health research purposes in the future, personal data may be retained for the general
p.000002: purposes originally consented to, subject to security safeguards proportionate to the identifiability and sensitivity of the data.
p.000002:
p.000002: Administrative databases such as hospital discharge records and vital statistics registries, which may be used to support health research, may retain
p.000002: personal data over the long-term, provided that this is permitted according to legislation or the mandate of a public body such as a government health
p.000002: department.
p.000002:
p.000002: Any long-term retention of personal data established for general health research purposes should be subject to periodic audits and effective oversight by
p.000002: independent third parties including REBs.
p.000002:
p.000002:
p.000002: Element #10: Ensuring accountability and transparency in the management of personal data
p.000002:
p.000002:
p.000002:
p.000002: Individuals and organizations engaged in health research involving personal data are accountable for the proper conduct of such research in accordance
p.000002: with applicable funding policies, privacy principles and/or legislation. Processes and practices must be clearly established and implemented in order to give
p.000002: meaningful effect to these policies, principles or laws. Proper accountability and transparency practices require adequate resources for such things as
p.000002: communication, education and training relating to privacy.
p.000002:
p.000002: Roles and responsibilities of all those involved in the conduct and evaluation of research should be clearly defined and understood, including those of
p.000002: researchers, their employing institutions, REBs, any data stewardship committees, Privacy Commissioners and other legally-designated privacy oversight
p.000002: agencies. Their concerted efforts should aim to provide a coherent governance structure for effective and efficient data stewardship.
p.000002:
p.000002: Recognizing that transparency may enhance public support for, and interest in, socially valuable research, individuals and organizations engaged in the
p.000002: conduct and evaluation of health research should:
p.000002:
p.000002: be open to the public with respect to the objectives of the research;
p.000002: be open about the policies and practices relating to the protection of personal data used in the research;
p.000002: promote ongoing dialogue between the research community and privacy oversight agencies; and
p.000002: promote ongoing dialogue between the research community and the community at large (the public).
p.000002:
p.000002: When a database is created for multiple research purposes, or across multiple sites or jurisdictions, researchers and institutional data holders should
p.000002: promote coordinated and streamlined approaches to the review of privacy and confidentiality concerns, and to data stewardship over the long term.
p.000002:
p.000002: A centralized data stewardship committee could be put in place to authorize future uses of the database in accordance with the research objectives and,
p.000002: where applicable, within the parameters set by the consent obtained from participants. The responsibilities of this committee could include the review of
p.000002: data access requests; long-term management of the database; coordination of reviews by local REBs (e.g. by means of agreements between REBs,
p.000002: institutions and researchers, as appropriate); and provision of information to the public (e.g. on a web site).
p.000002:
p.000002:
p.000002: How to navigate the document: Areas of special interest*
p.000002: Areas of special interest Element #. section #. subsection # TCPS excerpts at end of element #
p.000002:
p.000002: Type of project
p.000002:
p.000002: Single research project 1.1, 9.1.1
p.000002:
p.000002: Database created for long-term research use 1.2, 5.7, 9.1.2
p.000002:
p.000002: Qualitative (e.g. inductive analysis) 1.4, 2.4, 4.3, 5.4, 8.4.1 Element #3
p.000002:
p.000002: Genetics/Genomics 2.2, 3.5, 5.3, 6.3.3 Element #5, 8
p.000002:
p.000002: Data collection (sources)
p.000002:
p.000002: Individuals (legally competent) 2.2, 3.1, 4.1, 5.3.1, 5.5, 6.1.1, 6.2, 6.3 Element #5
p.000002:
p.000002: Individuals not legally competent Element #3
p.000002:
p.000002: Children Element #3
p.000002:
p.000002: From individuals and secondary use or disclosure 3.2, 5.6
p.000002:
p.000002: Communities 3.3.5, 5.3.2, 6.3.2
p.000002:
...
p.000002: 1. Accountability - An organization is responsible for personal information under its control and shall designate an individual or individuals who are
p.000002: accountable for the organization's compliance with the following principles.
p.000002: 2. Identifying Purposes -The purposes for which personal information is collected shall be identified by the organization at or before the time the
p.000002: information is collected.
p.000002: 3. Consent - The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where
p.000002: inappropriate.
p.000002: 4. Limiting Collection - The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.
p.000002: Information shall be collected by fair and lawful means.
p.000002: 5. Limiting Use, Disclosure, and Retention - Personal information shall not be used or disclosed for purposes other than those for which it was
p.000002: collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the
p.000002: fulfillment of those purposes.
p.000002: 6. Accuracy - Personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
p.000002: 7. Safeguards - Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
p.000002: 8. Openness - An organization shall make readily available to individuals specific information about its policies and practices relating to the
p.000002: management of personal information.
p.000002: 9. Individual Access - Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be
p.000002: given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as
p.000002: appropriate.
p.000002: 10. Challenging Compliance - An individual shall be able to address a challenge concerning compliance with the above principles to the designated
p.000002: individual or individuals accountable for the organization's compliance.
p.000002:
p.000002: The CSA Code was not designed specifically for the research context. Thus, these Best Practices are intended to provide guidance on the application of
p.000002: these fair information principles to health research.
p.000002:
p.000002:
p.000002: Scope of application
p.000002: Voluntary guidance in the Canadian context
p.000002:
p.000002: These Best Practices are intended as voluntary guidance for the health research community in Canada. They are based on and are consistent with the
p.000002: TCPS, and they are designed to assist in the interpretation of the TCPS by offering additional detail and practicality. In turn, as these Best Practices evolve
p.000002: in light of practice, they have the potential to inform the ongoing development of the TCPS and relevant laws and policy.
p.000002:
p.000002: Applicable legislation and policy
p.000002:
p.000002: These Privacy Best Practices do not replace existing laws, policies and professional codes of conduct that apply to certain types of personal
p.000002: information, designated organizations and/or specific kinds of activity. Researchers, REBs and institutions should be aware of, and continue to
p.000002: comply with, the relevant laws, policies and codes, including the TCPS, that govern research activities in their respective jurisdictions. In the case of multi-
p.000002: centre research crossing provincial, territorial or even national borders, several privacy laws and policies may have to be considered and complied with.
p.000002:
...
p.000002: 2. What is the risk of developing disease X after exposure to environmental risk factors, such as pollutants in the area of residence?
p.000002: 3. What is the cost-effectiveness and efficacy of screening programs for disease X?
p.000002: Types of personal data to be collected over multiple collection periods Research justification
p.000002:
p.000002:
p.000002: Name, address, telephone number Contact information to follow-up with participants for further data
p.000002: collection
p.000002:
p.000002: Demographic information Assess other variables by demographics of the population
p.000002:
p.000002: Family history Disease X is known to have an inherited basis
p.000002:
p.000002: Diet, reproductive factors, physical activity, anthropometric measures, Assess risk factors for disease X
p.000002: education, income, gender
p.000002:
p.000002: Medical conditions, medication use Assess impact of other existing conditions on disease X and
p.000002: effectiveness of medications.
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
p.000002: 1. Track and assess the factors that facilitate or hinder the development of family-centered provincial services for children with condition X and their
p.000002: family members.
p.000002: 2. Provide guidance to community organizations and provincial governments.
p.000002: 3. Validate questionnaire and interview methods for creating individualized family service plans.
p.000002: 4. Assess long term effectiveness and adverse effects of standard and emerging treatments for Condition X.
p.000002:
p.000002:
p.000002: Setting the scope of research
p.000002:
...
p.000002: research objectives.
p.000002: Conduct a data linkage Direct identifiers or potentially
p.000002: with a measurable identifying data items (e.g. date of
p.000002: degree of accuracy birth, initials, 3-character or full
p.000002: sufficient for the postal code, gender, specific health
p.000002: particular research data)
p.000002:
p.000002: c) Data Eliminate duplicate Direct identifiers or potentially Coded data so that the data holder (preferred) or researcher can
p.000002: accuracy records identifying data items use the key to check direct identifiers for duplication
p.000002: check
p.000002:
p.000002: d) No contact No direct identifiers need to be No direct identifiers. Data to be provided at the lowest level of
p.000002: with collected. identifiability needed, consistent with the research objectives.
p.000002: individuals
p.000002: and no data
p.000002: linkage
p.000002: needed
p.000002: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000002:
p.000002: [REB approval of type of data]
p.000002:
p.000002: Article 3.2 "..researchers shall secure REB approval for obtaining identifiable personal information about subjects. Approval for such research shall
p.000002: include such considerations as: (a) the type of data to be collected..." (pg. 3.3)
p.000002:
p.000002: [Secondary use of data]
p.000002:
p.000002: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000002: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research..." (pg. 3.5)
p.000002:
p.000002: Article 3.3 Explanatory text: "Databases can vary greatly in the degree to which personal information is identifiable. A proportionate approach should be
p.000002: applied by the REB to evaluate the sensitivity of the information in the database and to modulate its requirements accordingly. If it is impossible to
p.000002: identify individuals whose records exist within a database, then researchers should be allowed access to that database. The REB must carefully
p.000002: appraise the possibility of identification, in particular with regard to the extent of the harm of stigma that might be attached to identification. The REB and
p.000002: the researcher should also be aware of legal provisions that affect the database(s) to be used in the research.
p.000002:
p.000002: REBs and researchers should also be sensitive to the context in which the database was created, such as a confidential relationship, as well as to the
p.000002: expectations of the groups or individuals at the time of the collection of the data with regard to its use, retention and disclosure. When it is unclear as to
p.000002: whether information is to be regarded as personal, researchers should consult their REBs. Confidential information collected in this manner should
p.000002: normally not be transmitted to authorities, unless required by law, the courts or similar legally constituted bodies." (pg. 3.5)
p.000002:
p.000002:
p.000002:
p.000002: Element #3 : Determining whether consent from individuals is required
p.000002:
p.000002: General statement
p.000002: Voluntary and informed consent from legally competent individuals or authorized third parties is a fundamental principle in research involving humans, and
p.000002: specifically for the use of their personal data. 19
p.000002:
p.000002: Under specified circumstances, given a satisfactory rationale by the researcher, an REB may approve the waiver of a consent requirement, or a partial
...
p.000029: (considering, for example, the nature of the research, the type of data to be collected and the context in
p.000029: which the data were originally collected). If individuals have previously objected to the secondary use of their
p.000029: data for research or to the use of their contact information, their directions should be respected.
p.000029:
p.000029: 3.3.5 Views of relevant groups Privacy concerns may extend beyond the individual to include well-defined groups or communities, e.g.
p.000029: remote communities and Aboriginal peoples. 31 Also, genetic information about individuals is more than
p.000029: personal information-it may also be intimate information about those who share a common genetic lineage-
p.000029: -family members, other relatives and, in some cases, well-defined communities. 32
p.000029:
p.000029: The REB may require that efforts be made to consult with family groups, Aboriginal peoples, community
p.000029: representatives, consumer associations, and/or special populations such as the homeless or under-housed,
p.000029: as appropriate, to address possible concerns of affected individuals and communities. These concerns may
p.000029: relate to the design and scope of the research, the recruitment of individuals, and the analysis and
p.000029: disseminations of results of research. This consultation process will be a high priority when dealing with
p.000029: controversial issues and/or individuals, groups or communities in vulnerable circumstances.
p.000029: 3.3.6 Legal requirements In addition to REB approval, access to personal data for research without consent will be subject to specific
p.000029: legal requirements in relevant jurisdictions. For example, some jurisdictions require some or all of the
p.000029: following:
p.000029:
p.000029: a data-sharing agreement between the data holder and the researcher; 33
p.000029: notification and/or approval by other relevant oversight bodies; 34 and/or
p.000029: agreement that personal data will not be used to contact individuals. 35
p.000029:
p.000029:
p.000029: 3.3.7 Openness: Informing the public In the spirit of openness, the researcher should have an appropriate strategy for informing the general public
p.000029: about the research. 36
p.000029:
p.000029:
p.000029:
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Requirements for consent]
p.000029:
p.000029: Article 2.1
p.000029:
p.000029: "(a) Research governed by this Policy... may begin only if (1) prospective subjects, or authorized third parties, have been given the opportunity to give
p.000029: free and informed consent about participation...
p.000029:
p.000029: (c) the REB may approve a consent procedure which does not include, or which alters, some of all of the elements of informed consent... or waive the
p.000029: requirement to obtain informed consent, provided that the REB finds and documents that: (i) The research involves no more than minimal risk to the
...
p.000029: concerning participation. The potential subject's dissent will preclude his or her participation." (pg. 2.10)
p.000029:
p.000029: [Research with children]
p.000029:
p.000029: "..the notion of harm applied to children should be understood differently from harm in adults. Harm induced in children may have longer-term
p.000029: consequences to their growth and development. Furthermore, harms and benefits for children with chronic disabilities and terminal illnesses require
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
p.000029: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
p.000029: Consultation with representatives of those who contributed data." (pg. 3.5)
p.000029:
p.000029:
p.000029:
p.000029: Element #4: Managing and documenting consent
p.000029:
p.000029: General statement
p.000029: Consent is an ongoing process that begins upon first contact with prospective participants or authorized third parties, and ends only with the conclusion of
p.000029: their participation in the research or the use of their information. Participants should understand that their consent is voluntary, to be obtained without
p.000029: manipulation, undue influence or coercion, and can be withdrawn at any time. 37
p.000029:
p.000029: Evidence of initial and ongoing consent and the withdrawal of consent should be documented as appropriate for audit and legal purposes.
p.000029:
p.000029:
p.000029: 4.1 Forms of consent
p.000029: 4.1.1 Opt-in consent
p.000029:
...
p.000029: for participation Withdrawal, without any negative effect on a person's reasonable expectations of rights and benefits, being possible at any
p.000029: 48 time (but be clear that data which have already been made non-identifiable cannot be retrieved and destroyed).
p.000029: Option of contacting other family members to ask their willingness to be contacted by the researcher (e.g. in genetic
p.000029: research, participants should make first contact with related family members).
p.000029: Circumstances under which the researcher may terminate the participant's involvement in the research (e.g. in clinical drug
p.000029: trials).
p.000029: 4) Risks, benefits, Possible risks or discomforts to the research participant (including physical, emotional and psychological impacts, or
p.000029: compensation privacy intrusion).
p.000029: Benefits of the research in general and, if relevant, the benefits to the individual participant.
p.000029: Any compensation offered to participants should not constitute an undue influence to agree to participate. 49
p.000029:
p.000029:
p.000029: 5) Confidentiality Protection of data confidentiality (e.g. affirmation that genetic data will not be given to third parties)
p.000029: and safeguards General description of security measures (e.g. coding of data, 51 locked storage).
p.000050: 50
p.000050:
p.000050:
p.000050: 6) Data access and Who will have access to the data and for what purposes (include any legal requirements, such as mandatory public health
p.000050: legal disclosure reporting of certain diseases or obligation to produce evidence on court order; access required for scientific integrity such
p.000050: requirements 52 as auditing or verification of data; and any plans to archive or destroy the data).
p.000050:
p.000050:
p.000050: 7) Reporting of Explanation of the conditions, if any, under which personal results are to be reported back (e.g. results of genetic testing
p.000050: results 53 should normally be reported back to the participant through a physician and with provision of genetic counseling; conditions
p.000050: for informing implicated family members of research results should be clearly stated).
p.000050: A clear statement, if relevant, of conditions under which results will not be given to the participant (e.g. exploratory research
p.000050: for which results are not clinically meaningful or community-based research where results are applicable only to the
p.000050: community).
p.000050: Explanation of the impossibility for researchers to trace results from non-identifiable data back to individuals.
p.000050:
p.000050:
p.000050: 8) Data retention Time period that data will be retained (e.g. provide a specified time period or, if for an extended/indefinite period, provide a
p.000050: 54 specified time for REB review).
p.000050:
p.000050:
p.000050: 9) Inquiries and Who is available to answer questions about the research.
p.000050: complaints 55 Who to contact about the ethics of the research.
p.000050: Who to complain to about the research.
p.000050: Who to contact if the participant decides to withdraw consent.
p.000050:
p.000050:
p.000050:
p.000050: 5.6 Collection from individuals and secondary use (Hybrid model)
...
p.000050: all expected types and sources of personal data to be accessed and used;
p.000050: any expected linkages; and
p.000050: the expected purposes for which data will be used (e.g. health survey data to be collected and linked, with consent, to health records to investigate
p.000050: health care use in the population).
p.000050:
p.000050:
p.000050: 5.7 Creation of a database for general research purposes
p.000050: 5.7.1 Information to be provided at time of collection
p.000050:
p.000050: When personal data are to be entered into a database for multiple research uses over an extended period, research participants should also be informed, at
p.000050: the time of collection, of the following:
p.000050:
p.000050: Basic information Explanation
p.000050:
p.000050: 1) Expected types of studies The type of studies that might be conducted, with possible examples (e.g. research on cardio-vascular disease).
p.000050:
p.000050:
p.000050: 2) Expected data types and The types of data to be collected from all sources including data linkages, and for what research purposes.
p.000050: purposes
p.000050:
p.000050: 3) Expected commercial Any anticipated commercial uses.
p.000050: uses
p.000050:
p.000050: 4) Data retention period For how long the data will be retained (if for an extended/indefinite period, provide a specified time for REB
p.000050: review).
p.000050:
p.000050:
p.000050: 5) The process for The process being implemented to ensure proper data stewardship and data security, including:
p.000050: overseeing the use and the main rules governing future uses of the database;
p.000050: security of data the process by which requests for data access will be reviewed and monitored; and
p.000050: the organization or persons to whom the researcher is accountable for the proper management of the data.
p.000050: 6) Authorization for future Options for the participant to control future uses of personal data in the database. These options should include
p.000050: uses, with or without re- the opportunity to withdraw consent (and any identifying information) in the future, and may also include the
p.000050: contact options:
p.000050: To be re-contacted on a regular (or as needed basis) to seek consent for new research uses of the data, if
p.000050: desired and practicable; and/or
p.000050: To not be re-contacted, but to authorize the researchers to use the data only in certain ways in the future,
p.000050: for example:
p.000050: only for certain research purposes (to be determined with the participant during the consent process);
p.000050: only for the original broad purposes for establishing the database;
p.000050: for any purposes as long as a research ethics board has approved the proposed research;
p.000050: at what level of identifiability (e.g. with or without direct identifiers, coded, or in non-identifiable form):
p.000050: 56 and
p.000050:
p.000050: with or without linkages to other data sources (e.g. with controls over what can be linked, and who
p.000050: can access the linked data).
p.000050:
p.000050:
p.000050:
p.000050: Example: Informing participants and presenting options for control of new uses of data
p.000050:
p.000050: The invitation to participate in the study is made by a dedicated nurse coordinator employed by, and accountable to, the participating hospital. The nurse
p.000050: coordinator arranges, at a convenient time for the patient (and his/her family), to explain the study and seek the patient's consent to participate. Patients
p.000050: can refuse or can agree to any or all of the following:
p.000050:
p.000050: Access to their current hospitalization records by the nurse coordinator to collect information relevant to their condition, for future research uses.
p.000050: A follow-up telephone call by the nurse coordinator 6 months after the onset of their health event to determine longer-term changes in their
p.000050: functional ability-this survey information is also intended for inclusion in the registry for future research purposes.
p.000050: Linkage of their data in the study database, with administrative files from the provincial Ministry of Health, and other sources such as laboratory
p.000050: and physician records, in order to collect information about physician and laboratory services, subsequent hospitalizations, and causes of death.
p.000050: The linked data will be used for research on the use of health care services and effects on health for patients with condition X; and
p.000050: Use of their non-identifiable records in future analyses performed at the independent not-for-profit research organization based in City Y. The
p.000050: results of these analyses are to be released in aggregate form to third-party private companies seeking to improve services and products related
p.000050: to condition X.
p.000050:
p.000050:
p.000050:
p.000050: 5.7.2 Promotion of openness and accountability 57
p.000050:
p.000050:
p.000050: Researchers should endeavour to keep participants informed of future data uses through continuing means (e.g. web site information), as part of an
p.000050: ongoing commitment to openness and to the maintenance of informed consent.
p.000050: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000050:
p.000050: [Information to be provided to research participants]
p.000050:
...
p.000050: decision to continue or withdraw from participation;
p.000050: 2. The identity of the qualified designated representative who can explain scientific or scholarly aspects of the research;
p.000050: 3. Information on the appropriate resources outside the research team to contact regarding possible ethical issues in the research;
p.000050: 4. An indication of who will have access to information collected on the identity of subjects, description of how confidentiality will be protected, and
p.000050: anticipated uses of data;
p.000050: 5. An explanation of the subject's responsibilities;
p.000050: 6. Information on the circumstances under which the researcher may terminate the subject's participation in the research;
p.000050: 7. Information on any costs, payments, reimbursement for expenses or compensation for injury;
p.000050: 8. In the case of randomized trials, the probability of assignment to each option;
p.000050: 9. For research on biomedical procedures, including health care interventions: information about
p.000050: (a) forgoing alternative procedures that might be advantageous to the subject; (b) whichaspects of the research involve the use of procedures that
p.000050: are not generally recognized or accepted; and (c) particularly in trials of therapeutic interventions, the care provided if the potential subject decides
p.000050: not to consent to participation in the study;
p.000050: 10. The ways in which the research results will be published, and how the subjects will be informed of the results of the research." (pg. 2.7)
p.000050:
p.000050: [Genetic counseling]
p.000050:
p.000050: Article 8.4 "Genetics researchers and the REB shall ensure that the research protocol makes provision for access to genetic counseling for the subjects,
p.000050: where appropriate." Explanatory note: "Genetic counselors who are formally trained to impart genetic information have two main roles in dealing with a
p.000050: family: The first is to educate regarding the condition in question, and the second is to counsel by presenting options or possible action scenarios in a
p.000050: non-directive manner. The complexity of genetic information along with its social implications usually requires that free and informed consent be
p.000050: supplemented with genetic counseling." (pg. 8.4)
p.000050:
p.000050: [Conditions for less than full disclosure]
p.000050:
p.000050: Article 2.1 Explanatory text: "... the REB should exercise judgment on whether the needs for research justify limited and/or temporary exception to the
p.000050: general requirements for full disclosure of information relevant for a research subject's meaningful exercise of free and informed consent. In such cases,
p.000050: subjects may be given only partial information or they may be temporarily led to believe that the research has some other purpose because full
p.000050: disclosure would likely colour the responses of the subjects and thus invalidate the research. For example, social science research that critically probes
p.000050: the inner workings of publicly accountable institutions might never be conducted without limited recourse to partial disclosure. Also some research in
p.000050: psychology seeks to learn about human responses to situations that have been created experimentally. Such research can only be carried out if the
p.000050: subjects do not know in advance about the true purpose of the research...Another scenario, in questionnaire research, embeds questions that are
p.000050: central to the researcher's hypotheses within distractor questions, decreasing the likelihood that subjects will adapt their responses to their perceptions
p.000050: of the true objective of the research. For such techniques to fall within the exception to the general requirements of full disclosure for free and informed
p.000050: consent, the research must meet the requirements of Article 2.1 (c)..." (pg. 2.2- 2.3)
p.000050:
p.000050: [Secondary uses]
p.000050:
p.000050: Article 3.2 Explanatory text: "It is essential that subsequent uses of data be specified in sufficient detail that prospective subjects may give free and
p.000050: informed consent; it is inappropriate to seek blanket permission for "research in general". (pg. 3.4)
p.000050:
p.000050:
p.000050:
p.000050:
p.000050: Element #6: Recruiting prospective research participants
p.000050:
p.000050: General statement
p.000050: To recruit research participants, the researcher will typically need to complete the following steps, each of which involves the researcher or another more
p.000050: appropriate person having access to personal information:
p.000050:
p.000050:
p.000050: Step A: Assess eligibility criteria for the research and assemble a list of eligible individuals.
p.000050:
p.000050: Step B: Establish initial contact with eligible individuals.
p.000050:
p.000050: Step C: Inform eligible individuals about the research, as part of the informed consent process.
p.000050:
p.000050:
p.000050: The proposed recruitment procedure and materials should be included in the submission for REB approval.
p.000050:
p.000050: The procedure and materials should foster conditions for voluntary consent, and not exert undue influence on prospective participants to agree to take part
p.000050: in the research. 58
p.000050:
p.000050: Initial contact with individuals about a research project should be made by someone that individuals would expect to have relevant information about them,
p.000050: or in other ways that do not inappropriately intrude on their life or privacy.
p.000050:
p.000050: If permitted by law 59 and subject to REB approval, the data holder who would normally have access to the required personal information is the
p.000050: preferred person to access that information to assess eligibility of individuals for the research (Step A) and to make initial contact with those individuals
p.000050: (Step B), unless the REB considers this approach to be impracticable or inappropriate.
p.000050:
p.000050: Typical scenarios for recruiting participants and preferred approaches are described under 6.3.
p.000050:
p.000050:
p.000050: 6.1 Consent and secondary use of personal information to assess eligibility and contact individuals
p.000050: The REB will need to determine if consent from individuals is required for the secondary use of their personal information for assembling a list of eligible
p.000050: individuals for research or contacting these individuals to seek their consent for participation. 60 Researchers and REBs should be aware of any legal
p.000050: restrictions on contacting individuals in these circumstances. 61
p.000050:
p.000050: 6.1.1 Anticipating future uses of personal information at the time of the original collection
p.000050:
p.000050: Wherever possible at the time of the original collection of personal information from individuals, the researcher and/or data custodian should anticipate the
p.000050: future uses of this information to assemble eligibility lists for research or to contact eligible individuals, and should seek consent for these future uses at that
p.000050: time.
p.000050:
p.000050: For example, patients could be asked at the time of the original collection of their personal information whether they consent to the health care provider
p.000050: reviewing their records and contacting them to inform them of research for which they are eligible. If such a prior opt-in consent procedure is not a
p.000050: practicable option, a health care provider could inform patients through notices that their personal information may be reviewed from time to time for
p.000050: recruitment purposes, and that they have the opportunity to opt-out. If patients do not opt-out, their consent for the use of their personal information to
p.000050: assess their eligibility for research or to contact them about the research project would be presumed.
p.000050:
p.000050:
p.000050: 6.2 Initial contacting and informing prospective participants
p.000050: 6.2.1 Trust vs. undue influence
p.000050:
p.000050: Recruitment raises complex issues around who is the appropriate person to make initial contact and inform eligible individuals about the research. On the
p.000050: one hand, individuals may feel more comfortable if approached by a data holder, such as a clinic physician or nurse, whom they trust and accept as having
p.000050: access to their personal information. On the other hand, individuals may be unduly influenced to agree to participate in research if approached by someone
p.000050: on whom they are dependent, for example, their employer, health provider, community leader or program director.
p.000050:
p.000050: In some cases, someone who has a relationship of some influence over prospective research participants may be the preferred person to contact
p.000050: individuals and inform them of the research where this is considered the best way to ensure that prospective research participants fully understand the risks
p.000050: and the benefits of the research to themselves. For example, a health care provider or professional (who may or may not be involved in the research) may
p.000050: be the preferred person to contact individuals and inform them about the research because of a relationship of medical confidence, special expertise and/or
p.000050: in-depth knowledge of the patients' situations. It is critical in such cases that the participants are reassured that their reasonable expectations of care will be
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000050: eligible for participation in the research. For example, a health care provider may not yet have informed the patient of a diagnosis (e.g. cancer) that is in the
p.000050: patient health record and that is used to determine eligibility. The researcher should confirm with the data holder that individuals have been informed of
p.000050: relevant health-related information before initiating contact.
p.000050:
p.000050:
p.000050: 6.3 Selected scenarios and preferred recruitment practices
p.000050: Index to recruitment scenarios
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050: 6.3.3 Scenario: *A genetics researcher proposes to recruit the family members of research participants.
p.000050: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000050: research on patients. * The researcher is the health care provider of eligible individuals.
p.000050: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000050: employees or students of the organization.
p.000050: 6.3.6 Scenario: * A clinician-researcher at a health care facility wants to conduct research on patients being treated by another physician in the same
p.000050: facility. * An academic wants to conduct research on students in his or her university department or program, but not in a class that he or she is
p.000050: currently teaching.
p.000050:
p.000050:
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050:
p.000050:
p.000050:
p.000050: When eligibility information and the means of notifying individuals about the research are publicly available, the researcher should normally be able to make
p.000050: the initial contact without needing an intermediary.
p.000050:
p.000050:
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050:
p.000050:
p.000050:
p.000050: As a general rule, researchers planning to work in a community should make contact with and inform community leaders and groups relevant to their
p.000050: research, prior to initiating the recruitment or informed consent process with members of that community.
p.000050:
p.000050: For many Aboriginal communities and groups, approval by local authorities may be required prior to beginning the recruitment of research participants.
p.000063: 63
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.3 Scenario: * A genetics researcher proposes to recruit the family members of research participants.
p.000063:
p.000063:
p.000063:
p.000063: For the purpose of recruiting relatives for genetic or genomic research, there should be no direct contact between the researcher and the family members of
p.000063: the initial research participant. In order to respect the privacy of the participant and his family, only the participant or his/her spouse or a designated family
p.000063: member should contact other family members to ask their willingness to be approached by the researcher. The principal researcher (or a member of the
p.000063: research team) should not directly contact the family. 64
p.000063:
p.000063:
p.000063: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000063: research on patients. * The researcher is the health care provider of eligible individuals.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is the data holder or is employed by the data holder. If permitted by law 65 and subject to REB approval, the data
p.000063: holder may assess the eligibility of individuals for the research.
p.000063:
p.000063: The data holder should have rules nevertheless to limit the number of people permitted access to data for this purpose. 66
p.000063:
p.000063:
p.000063: Preferred options for contacting individuals will depend on whether the REB considers that the researcher/data holder has undue influence over
p.000063: prospective research participants (see the Options table).
p.000063:
p.000063: Options for contacting individuals according to whether the researcher/data holder has influence over prospective research participants
p.000063:
p.000063: Option Contacting prospective research participants
p.000063:
p.000063: A) If the If the researcher/data holder is not in a position of undue influence over prospective participants with regard to the research, the
p.000063: researcher/data researcher should make the initial contact and inform prospective participants about the research, if permitted by law and subject to
p.000063: holder is not in REB approval.
p.000063: a position of
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the In some cases, the researcher/data holder is considered to potentially be in a position of undue influence over eligible individuals with
p.000063: researcher/data regard to the research or there is a potential conflict of interest. For example, an REB may decide that patients who will be recruited
p.000063: holder is in a for a clinical trial being conducted by their health care provider may not understand the difference between the research treatment and
p.000063: position of the standard treatment provided at the health centre.
p.000063: undue
...
p.000063: the preferred recruitment approach is for the data holder to assess eligibility for research and to make initial contact with eligible individuals, unless the REB
p.000063: considers that the preferred approach is impracticable or inappropriate (see the ranked Options table).
p.000063:
p.000063: Ranked options for assessing eligibility and contacting prospective participants, when the researcher is not the data holder and does not have
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
p.000063: A) The data holder assesses eligibility and makes If permitted by law and subject to REB approval, the data holder should determine eligibility of
p.000063: initial contact. (Preferred) individuals for the research on the basis of criteria provided by the researcher. The data holder
p.000063: should make the initial contact to: (i) inform eligible individuals about the research so that they can
p.000063: contact the researcher, if interested, or (ii) to seek consent from individuals to release their nominal
p.000063: information to the researcher who will contact them to inform them about the research.
p.000063:
p.000063: B) If the REB considers option A impracticable or In some cases, the preferred option above may be considered impracticable or inappropriate. For
p.000063: inappropriate, the REB may permit the researcher example, the preferred option may be impracticable if:
p.000063: to access minimal personal information for
p.000063: the data holder does not, despite funding from the researcher, have the resources to assess
p.000063: assessing eligibility and/or making contact with
p.000063: eligibility and make initial contact, and therefore the research could not proceed unless an
p.000063: eligible individuals, if permitted by law and under
p.000063: alternative recruitment procedure is used; or
p.000063: strict controls (e.g. access restricted to data
p.000063: the data holder does not have an ongoing relationship with eligible individuals to make
p.000063: holder's site).
p.000063: contact (e.g. as may the case for a registrar of a population records database, or a
p.000063: government agency holding health insurance registration and billing information).
p.000063:
p.000063: The preferred option may be considered inappropriate where the data holder has undue influence
p.000063: over eligible individuals; professional or other legal requirements makes the data custodian's
p.000063: involvement in the recruitment process inappropriate; or the data holder's contacting of eligible
p.000063: individuals would defeat the purpose of the research. 68
p.000063:
p.000063: When the preferred option is impracticable or inappropriate, an REB may consider whether a
p.000063: researcher should be permitted access to minimal personal data only for the purposes of
p.000063: determining eligibility for the research or contacting individuals to invite them to join the study 69
p.000063: . If it is legally permissible and the REB gives approval, the researcher may be given access to
p.000063: personal information with appropriate confidentiality protections such as a signed confidentiality
p.000063: agreement with access restricted to the data holder's site, and use limited to the stated purpose.
p.000063:
p.000063: Minimal personal data provided to the researcher should normally contain only contact information
p.000063: and no other personal information related to health status. However, if health-related data are
p.000063: inherent in the eligibility criteria used to assemble the list of individuals to be contacted, an REB
p.000063: may determine that camouflage sampling or other masking techniques should be used to enable
p.000063: researchers to contact individuals while preventing researchers from viewing any identifiable
p.000063: health-related information of eligible individuals prior to gaining consent. 70
p.000063:
p.000063:
p.000063:
p.000063: Option A: Examples of recruitment methods:
p.000063:
p.000063: Health professional society makes contact with members
p.000063:
p.000063: Prospective research participants are members of a health professional society. The Society mails out a letter (drafted by the researcher) to its
p.000063: members, which explains how to contact the researcher to learn more about the research.
p.000063:
p.000063:
p.000063:
p.000063: Health professionals assess eligibility and make contact
p.000063:
p.000063: Given the criteria provided by the researchers, pharmacists are automatically notified by a computer flag in a centralized database, at the time of filling a
p.000063: prescription, of any patient eligible for the research study (e.g. receiving a certain number of concurrent medications). This automatic flag of eligible
p.000063: individuals for the study is visible only to pharmacists in participating pharmacies. Once the eligible persons are identified, the pharmacists seek consent
...
p.000063: affecting financial, employment, insurance, or other status; loss of benefits)
p.000063: Loss of data or equipment.
p.000063:
p.000063:
p.000063: e) Assess existing safeguards and need for Direct identifiers are separated from personal records as soon as reasonably practicable.
p.000063: additional safeguards Highly identifiable and sensitive data are stored at the highest level of security, e.g. on stand-
p.000063: alone servers.
p.000063: Pledge of confidentiality signed by all research staff.
p.000063:
p.000063:
p.000063: f) Recommend the appropriate security See security measures proposed in 7.2 below
p.000063: safeguards to protect the assets from threats
p.000063:
p.000063: g) Update and regularly review these safeguards Respond to changes in:
p.000063: (at least annually) the internal technological environment (including improvements in security strategies),
p.000063: the research project and the institution,
p.000063: technologies available to threat agents and
p.000063: the profile of potential threats.
p.000063:
p.000063:
p.000063:
p.000063: 7.2 Security measures
p.000063: 7.2.1 Organizational safeguards
p.000063:
p.000063: There should be ongoing commitment to privacy and continued emphasis of its importance by all involved in the research and the
p.000063: institutional/organizational management.
p.000063: All involved in the research project should be subject to a pledge of confidentiality.
p.000063: Access to personal information should be strictly limited in terms of numbers of persons, for legitimate purposes, and strictly on a realistic need-to-
p.000063: know basis.
p.000063: Data-sharing agreements between the researcher/institution and all involved should be signed prior to providing any access to data.
p.000063: Consequences for breach of confidentiality, including dismissal and/or loss of institutional privileges, should be clearly stipulated.
p.000063: Institutions and organizations housing research projects and archived data should, with ongoing commitment of adequate resources:
p.000063: develop, monitor and enforce privacy and security policies and procedures;
p.000063: appoint privacy officers and create data stewardship committees as needed; and
p.000063: implement internal and external privacy reviews and audits.
p.000063:
p.000063: 7.2.2 Technological measures
p.000063:
p.000063: Encryption, scrambling of data and other methods of reducing the identifiability of data should be used to eliminate unique profiles of potentially
p.000063: identifying information.
p.000063: Direct identifiers should be removed or destroyed at the earliest possible opportunity.
p.000063: If direct identifiers must be retained, they should be isolated on a separate dedicated server/network without external access.
p.000063: Camouflage sampling 74 or other techniques should be used, when appropriate, to prevent researchers from viewing health-related information
p.000063: of eligible individuals prior to gaining their consent.
p.000063: Authentication measures (such as computer password protection, unique log-on identification, etc.) should be implemented to ensure only
p.000063: authorized personnel can access data.
p.000063: Special protection for remote electronic access to data should be installed.
p.000063: Virus-checking programs and disaster recovery safeguards such as regular back-ups should be implemented.
p.000063: Where possible, a detailed audit trail monitoring system should be instituted to document the person, time, and nature of data access, with flags for
p.000063: aberrant use and "abort" algorithms to end questionable or inappropriate access.
p.000063:
p.000063: 7.2.3 Physical security
p.000063:
p.000063: Computers and files that hold personal information should be housed in secure settings in rooms protected by such methods as combination lock
p.000063: doors or smart card door entry, with paper files stored in locked storage cabinets.
p.000063: The number of locations in which personal information is stored should be minimized.
p.000063: Architectural space should be designed to preclude public access to areas where sensitive data are held.
p.000063: Routine surveillance should be conducted.
p.000063: Physical security measures should be in place to protect data from hazards such as floods or fire.
p.000063: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000063:
p.000063: Article 3.2 Explanatory Text: "Researchers should ensure that the data obtained are stored with all the precautions appropriate to the sensitivity of the
p.000063: data. Accordingly, information that identifies individuals or groups should be kept in different databases with unique identifiers. Researchers should take
p.000063: reasonable measures to ensure against inadvertent identification of individuals or groups, and must address this issue to the satisfaction of the REB."
p.000063: (pg. 3.4)
p.000063:
p.000063:
p.000063:
p.000063: Element #8: Controlling access and disclosure of personal data
p.000063:
p.000063: General statement
p.000063: Data sharing for research purposes - whether of linked or unlinked data sets - is an important way of enabling socially valuable research. It avoids
p.000063: unnecessary duplication of data collection, which reduces the burden on research participants and permits researchers to use limited or scarce resources
p.000063: more productively.
p.000063:
p.000063: However, there should be strict limits on access to data and secure procedures for data linkage, subject to REB approval and data-sharing agreements.
p.000063:
p.000063: When personal data are essential to research objectives and questions, researchers need a plan for making public the results of research in ways that do
p.000063: not permit tracing back to individuals if they do not wish their identities to be known.
p.000063:
p.000063:
p.000063: 8.1 Controlled levels of data access within research team and for secondary use
p.000063: Researchers and institutions should protect against unauthorized disclosure and use of sensitive data or data subjects' identities, by controlling access to
p.000063: personal data.
p.000063:
p.000063: Controlling access to data for research purposes means, under most circumstances, that:
p.000063:
p.000063: sensitive and/or highly identifiable data are accessible to the minimum number of persons necessary on the research team on a need-to-know basis
p.000063: (e.g. for cleaning data, conducting data linkages, and verifying the accuracy of data matches);
p.000063: team members have appropriate training in, and comply with, security safeguards;
p.000063: access to coded data, or to data where the direct identifiers are removed but potentially identifying elements remain in the dataset, may be permitted
p.000063: for researchers outside the research team only under strictly controlled conditions described in a written agreement and following REB approval; and
p.000063: non-identifiable data about individuals and aggregated data are made available to the general scientific community and for public use after
p.000063: appropriate scrutiny to minimize or avoid risks of inadvertent disclosure of individuals' identities.
p.000063:
p.000063: Controlled access to personal data for research purposes
p.000063:
p.000063: Access to: Who should be permitted access: Required safeguards to include:
p.000063: (examples)
p.000063:
p.000063: Direct identifiers Selected members of the REB review and approval
p.000063: research team Review by institution data privacy committees where
p.000063: Selected institution employees relevant
p.000063: "Deemed employees" or Access on need-to-know basis
p.000063: trusted third parties, subject to Appropriate training
p.000063: the same undertaking of Undertaking of confidentiality by employees or research
p.000063: confidentiality as the data team
p.000063: holder (e.g. institution No direct access for researchers external to the research
p.000063: employees) team, except for linkage purposes in exceptional
p.000063: circumstances (see 8.2)
p.000063: Audit trails on access (where possible)
p.000063:
p.000063:
p.000063: Not directly identifiable data (single or Research team REB-approved projects
p.000063: double coded; or without codes) Collaborators at local sites of a Review by institution data privacy committees where
p.000063: multi-site study relevant
p.000063: External researchers, with Data-sharing agreement, including undertaking of
p.000063: limitations (see required confidentiality (see 8.3)
p.000063: safeguards). Disclosure of only enough data to answer the intended
p.000063: research question
p.000063:
p.000063:
p.000063: Non-identifiable data in public use files Scientific community There may be no restrictions on use, or there may be a
p.000063: (where data have been scrutinized and General public basic form of data sharing agreement, requiring an
p.000063: altered to protect against risks of Universities undertaking, for example, to not attempt to re-identify the
p.000063: inadvertent disclosure of individuals' records so as to relate the information on the file to a
p.000063: identities). 75 particular person. 76
p.000063:
p.000063:
p.000063:
p.000063: 8.2 Conducting data linkages
p.000063: The most secure way of conducting data linkages requested by external researchers is for the data holder to conduct the linkage and provide linked
...
p.000063: linkage off required to answer the research question should be destroyed or returned to the original data holder as soon as is practicable, and in
p.000063: site compliance with the terms of the data-sharing agreement.
p.000063:
p.000063:
p.000063: Following the linkage of datasets, the person doing the data linkage should reduce datasets to the lowest level of identifiability needed to accomplish the
p.000063: research objectives.
p.000063:
p.000063: For example, direct identifiers (e.g. name or personal health number) or potentially identifying elements when combined (e.g. a full date of birth or full
p.000063: postal code) may be needed for data linkage but may not be needed to answer the research questions. In such cases, these identifiers should be destroyed
p.000063: as soon as is reasonably practicable or returned to the data holder, as per the terms of the data-sharing agreement.
p.000063:
p.000063: Universities may have specified retention periods for research data. Researchers should either destroy the new linked dataset at the end of the specified
p.000063: period, or use enhanced security measures to store it as per the terms of the data-sharing agreement. Within some research or statistical agencies it may
p.000063: not be practicable to unlink datasets after each use. However these institutions should document a process to ensure that the linked datasets are used only
p.000063: for authorized purposes (e.g. for REB-approved projects).
p.000063:
p.000063:
p.000063: 8.3 Data-sharing agreements
p.000063: Data-sharing agreements bind data providers and researchers to their respective responsibilities and obligations for protecting personal data.
p.000063:
p.000063: Data-sharing agreements should set out the terms and conditions under which data providers will allow researchers to access personal data for research
p.000063: purposes. 79
p.000063:
p.000063: Data-sharing agreements typically include the following information related to privacy concerns:
p.000063:
p.000063: Basic Explanation
p.000063: information
p.000063:
p.000063: 1) Research A meaningful description of the research objectives and methods.
p.000063: purposes
p.000080: 80
p.000080:
p.000080:
p.000080: 2) Data A meaningful explanation of why the research objectives cannot reasonably be accomplished without access to these personal
p.000080: elements and data.
p.000080: uses 81 Identification of data sources for the project and any linkages to be conducted.
p.000080: A statement that the researcher will not use the data for any other purpose without prior authorization by the data provider.
p.000080:
p.000080:
p.000080: 3) Informed Copies of the explanatory material and consent form to be provided to prospective participants, if appropriate (see #4 below).
p.000080: consent
p.000080: materials and
p.000080: form 82
p.000080: 4) Contact Statement that the researcher will not attempt to contact data subjects without prior authorization by the data provider, if
p.000080: 83 appropriate.
p.000080:
p.000080:
p.000080: 5) Data A listing of who will have access to personal data within the research team or the institution, and a requirement that each of these
p.000080: access and individuals have signed an undertaking of confidentiality.
p.000080: disclosure A statement that the researcher will not disclose the data to other parties without prior authorization by the data provider.
p.000080:
p.000080:
p.000080: 6) Reporting A requirement that results and data not be released in a form that identifies individuals to whom the information relates.
p.000080: results
p.000080:
p.000080: 7) Security A description of the physical, organizational and technological security measures in place to safeguard against risks of
p.000080: 84 unauthorized use, disclosure, corruption or destruction.
p.000080:
p.000080:
p.000080: 8) Retention/ The time period for data retention and conditions for the return or the destruction of direct identifiers at the earliest reasonable
p.000080: destruction of time consistent with the research objectives.
p.000080: data 85 The possibility for the data provider to authorize an extended retention period.
p.000080: Statement that the researcher will not attempt to re-identify the data subjects without prior authorization by the data provider, if
p.000080: appropriate.
p.000080:
p.000080:
p.000080: 9) Required The requirement to have obtained REB approval and other relevant authorizations.
p.000080: approvals/ The duration of the agreement or a date designated for the parties to review the agreement.
p.000080: authorizations
p.000086: 86
p.000086:
p.000086:
p.000086: 10) Obligation of recipients to comply with applicable laws and any of the data holder's policies and procedures relating to the
p.000086: Compliance confidentiality of personal information.
p.000086: with laws and
p.000086: policies 87
p.000086:
...
p.000086: breach of the data-sharing agreement also amounts to a breach of the TCPS). 89
p.000086:
p.000086:
p.000086:
p.000086: 8.4 Controls over disclosure in public reports of research findings
p.000086: Appropriate measures should be taken to avoid or minimize the identifiability of data in publications or public databases. Statistics Canada guidance in this
p.000086: area is available online. 90
p.000086:
p.000086: 8.4.1 Reporting qualitative research results when concealing individuals' identities is not desired
p.000086:
p.000086: In assessing the privacy aspects of research, researchers and REBs should also be aware of the possibility that in some instances individuals may want
p.000086: their identities to be known-for example, when individuals want their contribution to research as participants to be recognized, or where they want to help
p.000086: others afflicted with a similar condition. In some qualitative research, individual participants may understand and willingly accept the possibility that their
p.000086: identities may be revealed in the public reporting of research results.
p.000086: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000086:
p.000086: [Disclosure controls]
p.000086:
p.000086: "Data released should not contain names, initials or other identifying information. While it may be important to preserve certain types of identifiers (e.g.,
p.000086: region of residence), these should be masked as much as possible using a standardized protocol before the data are released for research purposes.
p.000086: However, legitimate circumstances may exist where such information is critical for the research project..." (pg. 3.4)
p.000086:
p.000086: [Human genetic research]
p.000086:
p.000086: Article 8.2 "The researchers and the REB shall ensure that the results of genetic testing and genetic counseling records are protected from access by
p.000086: third parties, unless free and informed consent is given by the subject. Family information in databanks shall be coded so as to remove the possibility of
p.000086: identification of subjects within the bank itself." (pg. 8.2)
p.000086:
p.000086: [Secondary uses]
p.000086:
p.000086: Article 3.3, 3.4 - See Element #3
p.000086:
p.000086: [Data linkage]
p.000086:
p.000086: Article 3.6 "The implications of approved data linkage in which research subjects may be identifiable shall be approved by the REB." Explanatory note:
p.000086: "...Only a restricted number of individuals should perform the function of merging databases; researchers should either destroy the merged file
p.000086: immediately after use, or use enhanced security measures to store it. Whether the data are to be used statistically or otherwise, confidentiality of the
p.000086: information must be maintained by all members of the research team." (pg. 3.6)
p.000086:
p.000086:
p.000086:
p.000086: Element #9: Setting reasonable limits on retention of personal data
p.000086:
p.000086: General statement
p.000086: Personal data should be retained as long as is necessary to fulfill the research purposes. 91 Personal data may then be destroyed or returned to the
p.000086: data provider, if appropriate, as set out in the terms of the original collection, data-sharing agreement, institutional policies and legal requirements.
p.000086:
p.000086: There is a tension between the privacy principle of limiting the retention of data and the scientific principle of preserving research data so that published
p.000086: research results can be replicated and verified, and opportunities for further investigation of valuable data are maximized. While this is a very complex area
p.000086: in need of further reflection and development, the default principle is to define retention periods for personal data, in writing. Researchers should be explicit
p.000086: about what they plan to do with the data they collect and have storage, management and access policies in place.
p.000086:
p.000086:
p.000086: 9.1 Retention of personal data
p.000086: 9.1.1 Specific research project
p.000086:
p.000086: Where personal data are collected and used in the context of a specific research project, identifying personal data should be retained by the researcher as
p.000086: long as necessary to fulfill the original research objectives, 92 including related purposes such as tracing, validating or auditing research results as may
p.000086: be required by regulators, study sponsors and/or publishers. 93
p.000086:
p.000086: 9.1.2 Database for general health research purposes
p.000086:
p.000086: When personal data are collected in a database to support general health research purposes in the future, personal data may be retained for the general
p.000086: purposes originally consented to, subject to security safeguards proportionate to the identifiability, sensitivity and amount of the data, as well as its format
p.000086: and method of storage.
p.000086:
p.000086: Administrative databases such as hospital discharge records and vital statistics registries, which may be used to support health research, may retain
p.000086: personal data over the long term, provided that this is permitted according to legislation or the mandate of a public body such as a government health
p.000086: department.
p.000086:
p.000086: Any long-term retention of personal data established for general health research purposes should be subject to periodic audits and effective oversight by
p.000086: independent third parties including REBs.
p.000086:
p.000086:
p.000086: Element #10: Ensuring accountability and transparency in the management of personal data
p.000086:
p.000086: General statement
p.000086: Individuals and organizations engaged in health research involving personal data are accountable for the proper conduct of such research in accordance
...
p.000086: relevant laws, regulations, policies and/or research contexts of other countries, when research is to be conducted in those countries;
p.000086: serving as a consultative body to the research community and thus contributing to education in research ethics;
p.000086: fostering coordinated and consistent REB review processes, particularly with respect to multi-jurisdictional and multi-site research; and
p.000086: undertaking regular monitoring of research and coordinating reviews of multi-centre research to ensure equivalencies in standards across
p.000086: jurisdictions, by conducting:
p.000086: an annual review of the research (required under TCPS);
p.000086: an audit of critical aspects of the research protocol including the consent process, safeguards and, where relevant, methods of reducing the
p.000086: identifiability of data prior to disclosure; and
p.000086: other effective monitoring mechanisms, as appropriate.
p.000086:
p.000086: 10.2.4 Independent data stewardship committees
p.000086: When a database is created for multiple research purposes, or across multiple sites or jurisdictions, researchers and institutional data holders should
p.000086: promote coordinated and streamlined approaches to data stewardship over the long term. A centralized data stewardship committee could be put in place
p.000086: to authorize future uses of the database in accordance with the research objectives, REB approval and, where applicable, within the parameters set by the
p.000086: consent obtained from participants.
p.000086:
p.000086: The responsibilities of this advisory committee could include:
p.000086:
p.000086: the review of data access requests;
p.000086: long-term management of the database;
p.000086: coordination of reviews by local REBs, for example, by means of agreements between REBs, institutions and researchers, as appropriate; and
p.000086: provision of information to the public (e.g. on a web site).
p.000086:
p.000086: The composition of the committee should include scientific experts in the field and representatives from the population being studied.
p.000086:
p.000086:
p.000086: 10.3 Legally-designated privacy oversight agencies
p.000086: As specified in legislation, the responsibilities of privacy oversight agencies, such as the Office of the Privacy Commissioner or Ombudsman in each
p.000086: jurisdiction, may include all or any of the following:
p.000086:
p.000086: monitoring and investigating compliance with legal requirements;
p.000086: issuing findings and recommendations and/or adjudicating complaints from the public with regard to non-compliance;
p.000086: initiating and/or participating in court action for breach of legal requirements for privacy protection;
p.000086: conducting audits of organizations' information management practices;
p.000086: reviewing privacy impact assessments for proposed research;
p.000086: reviewing and/or approving the collection of personal information without consent; 96
p.000086: reporting publicly on matters of privacy compliance;
p.000086: reviewing and providing comments or approvals on proposed laws or policies; and
p.000086: promoting public education with respect to privacy issues.
p.000086: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000086:
p.000086: [Mandate of the three federal research granting agencies: CIHR, SSHRC and NSERC]
p.000086:
...
p.000086: guidelines and policies of the Therapeutic Products Directorate of Health Canada;
p.000086: relevant laws, regulations and/or policies of other countries, when research is to be conducted in those countries;
p.000086: Good Clinical Practices: Consolidated Guidelines for clinical trials sponsored by industry, published by the International Conference on
p.000086: Harmonization.
p.000086:
p.000086: Researchers, Institutions and research ethics boards (REBs) should be aware of all applicable policies, regulations and guidelines. In some cases, it
p.000086: may be necessary for Institutions to have recourse to speci0c expertise to identify legal and other issues in the ethics review process..."
p.000086:
p.000086: Updates.
p.000086: References
p.000086: 1 Privacy Advisory Committee members are listed in Appendix A-1.
p.000086:
p.000086: 2 Under section 301(d) of the U.S. Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
p.000086: persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research.
p.000086: This authority has been delegated to the National Institutes of Health (NIH) and other Health and Human Services Agencies.
p.000086: Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for research
p.000086: participants, such as damage to their financial standing, employability, insurability, or reputation. A Certificate allows the investigator and others
p.000086: who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative,
p.000086: legislative, or other proceeding, whether at the federal, state, or local level. See U.S. Office of Human Subject Protection- Guidance .
p.000086:
p.000086: 3 The World Health Organization defines "health" as "a state of complete physical, mental and social well-being and not merely the absence of
p.000086: disease or infirmity".
p.000086: From Preamble to the Constitution of the World Health Organization as adopted by the International Health Conference, New York, 19-22 June,
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
p.000086: 15 See the table of concordance for Element #2 in Appendix A-7 referring to the statutory provisions regarding the general requirement to collect a
p.000086: limited amount of personal information.
p.000086:
p.000086: 16 See TCPS excerpt (Article 3.3, explanatory note) at the end of Element #2.
p.000086:
p.000086: 17 See also Element #8, 8.2.
p.000086:
p.000086: 18 See the legal concordance table for Element #2 in Appendix A-7 regarding the collection of health numbers under Ontario's health privacy
p.000086: legislation.
p.000086:
p.000086: 19 See TCPS excerpts at the end of Element #3 regarding the definition of "competence" in the research context. See also the legal concordance
p.000086: table for Element #4-Part 2, Consent by Substitute Decision Makers, in Appendix A-7.
p.000086:
p.000086: 20 For a definition of minimal risk, the TCPS states: "if potential subjects can reasonably be expected to regard the probability and magnitude of
p.000086: possible harms implied by participation in the research to be no greater that those encountered by the subject in those aspects of his or her
...
p.000086: subjects." (TCPS Article 2.2, pg. 2.4)
p.000086:
p.000086: 50 See also Element #7.
p.000086:
p.000086: 51 See Element #2, 2.3.2 and Box- Definition of terms.
p.000086:
p.000086: 52 See also Element #8.
p.000086:
p.000086: 53 See also Element #8.
p.000086:
p.000086: 54 See also Element #9.
p.000086:
p.000086: 55 See also Element #10.
p.000086:
p.000086: 56 See Box- Definition of terms: Individual Identifiability of Data , in Element #2.
p.000086:
p.000086: 57 See Element #10, 10.2.1
p.000086:
p.000086: 58 See also Element #4 regarding managing and documenting the consent process.
p.000086:
p.000086: 59 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 60 See Element #3 regarding determining if consent is required.
p.000086:
p.000086: 61 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 62 See also TCPS Article 4.1 and Section 4-A Conflicts of Interest Involving Researchers (pg. 4.1); TCPS Section 7-Clinical Trials; and TCPS
p.000086: Articles 7.1, 7.2 and explanatory text regarding recruitment and informed consent (pg. 7.2).
p.000086:
p.000086: 63 TCPS Section 6 (Research Involving Aboriginal Peoples) is currently under review, coordinated by the Interagency Advisory Panel on Research
p.000086: Ethics and including CIHR Aboriginal health research guidelines (in development).
p.000086: See also the articulation of First Nations' principles: Ownership, Control, Access and Possession (OCAP) or Self‑determination Applied to
p.000086: Research.
p.000086:
p.000086: 64 Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000-Section 3
p.000086: (pg. 7).
p.000086:
p.000086: 65 Where this access would be a secondary use of data, see 6.1.
p.000086: The data holder's access to data for recruitment purposes must be in accordance with applicable legislation.
p.000086: See the legal concordance table for Element #6, Appendix A-7.
p.000086:
p.000086: 66 See also Element #8.
p.000086:
p.000086: 67 See the legal concordance table for Element #6, Appendix A-7.
p.000086:
p.000086: 68 For example, see Case Study #10 in CIHR's Secondary Use of Personal Information in Health Research: Case Studies , November 2002 in
p.000086: which initial contact by physicians of "hard-to-reach" patients would have confounded the results of the study which was investigating effective
p.000086: strategies for contacting patients.
p.000086: Also, because this study involved contacting patients about visiting their physicians for cancer screening services, physicians' involvement in the
p.000086: research was limited by a policy that existed at that time which prevented them from soliciting patients to come in for services.
p.000086:
p.000086: 69 The REB should weigh the benefits of the research and the potential for a perceived invasion of privacy and any legal prohibitions against
p.000086: researchers' contacting individuals. See Element #3, 3.3.2 (b).
p.000086: See also the legal concordance table for Element #6, in Appendix A-7.
p.000086:
p.000086: 70 See references to Camouflage techniques in the following: Scenario 6.3.5 (b); Element #7, 7.2.2 4th bullet; and the Glossary, Appendix A-6.
p.000086:
p.000086: 71 See the table of concordance for Element #7, Part 1, in Appendix A-7, for statutory references to general safeguarding obligations.
p.000086: 72 See the legal concordance table for Element #7, Part 2, in Appendix A-7.
p.000086:
...
Searching for indicator access to information:
(return to top)
p.000050: description of research procedures;
p.000050:
p.000050: (c) A comprehensive description of reasonably foreseeable harms and benefits that may arisefrom research participation, as well as the likely
p.000050: consequences of non-action, particularly in research related to treatment, or where invasive methodologies are involved, or where there is a potential for
p.000050: physical or psychological harm;
p.000050:
p.000050: (d) An assurance that prospective subjects are free not to participate, have the right to withdrawat any time without prejudice to pre-existing entitlements,
p.000050: and will be given continuing and meaningful opportunities for deciding whether to continue to participate; and
p.000050:
p.000050: (e) The possibility of commercialization of research findings, and the presence of any apparent oractual or potential conflict of interest on the part of
p.000050: researchers, their institutions or sponsors." (pg. 2.5, 2.6)
p.000050:
p.000050: "..REBs may require researchers to provide prospective subjects with additional information, such as that detailed in Table 1..." (pg. 2.6)
p.000050:
p.000050: "Table 1: Additional Information that may be required for some projects
p.000050:
p.000050: 1. An assurance that new information will be provided to the subjects in a timely manner whenever such information is relevant to a subject's
p.000050: decision to continue or withdraw from participation;
p.000050: 2. The identity of the qualified designated representative who can explain scientific or scholarly aspects of the research;
p.000050: 3. Information on the appropriate resources outside the research team to contact regarding possible ethical issues in the research;
p.000050: 4. An indication of who will have access to information collected on the identity of subjects, description of how confidentiality will be protected, and
p.000050: anticipated uses of data;
p.000050: 5. An explanation of the subject's responsibilities;
p.000050: 6. Information on the circumstances under which the researcher may terminate the subject's participation in the research;
p.000050: 7. Information on any costs, payments, reimbursement for expenses or compensation for injury;
p.000050: 8. In the case of randomized trials, the probability of assignment to each option;
p.000050: 9. For research on biomedical procedures, including health care interventions: information about
p.000050: (a) forgoing alternative procedures that might be advantageous to the subject; (b) whichaspects of the research involve the use of procedures that
p.000050: are not generally recognized or accepted; and (c) particularly in trials of therapeutic interventions, the care provided if the potential subject decides
p.000050: not to consent to participation in the study;
p.000050: 10. The ways in which the research results will be published, and how the subjects will be informed of the results of the research." (pg. 2.7)
p.000050:
p.000050: [Genetic counseling]
p.000050:
p.000050: Article 8.4 "Genetics researchers and the REB shall ensure that the research protocol makes provision for access to genetic counseling for the subjects,
p.000050: where appropriate." Explanatory note: "Genetic counselors who are formally trained to impart genetic information have two main roles in dealing with a
p.000050: family: The first is to educate regarding the condition in question, and the second is to counsel by presenting options or possible action scenarios in a
...
Social / Age
Searching for indicator age:
(return to top)
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: All potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For example, researchers using
p.000002: inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration with research participants. In
p.000002: such research, the development of research questions and procedures is an ongoing process. While planning their research, researchers should attempt to
p.000002: foresee both obvious and emerging issues related to privacy. These should be included in the submission to an REB. Researchers should also document
p.000002: for an REB any amendments to the protocol and consequent privacy protection strategies emerging over the course of the study.
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002:
p.000002:
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives.
p.000002:
p.000002: Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research objectives (e.g.
p.000002: data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: For research involving secondary use of data for research, if identifiable data are required for the research, direct identifiers should be avoided or
p.000002: concealed, to the extent that is reasonably practical (e.g. as soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
p.000002: foreseeable in detail at the outset of the interview. In these cases, the ongoing negotiation of consent with research participants is the best way to ensure
p.000002: that the privacy of individuals and the community is being appropriately protected.
p.000002:
p.000002:
...
p.000002:
p.000002: Please note the distinction made in these Elements between a "research participant" and "data subject". In the Best Practices, a research participant is an
p.000002: individual who consents to participation in research and who is the subject of personal data or information collected for research. A data subject is an
p.000002: individual who is the subject of personal data/information collected for research purposes, but who has not been directly approached to provide consent.
p.000002:
p.000002:
p.000002: Element #1: Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002:
p.000002: General statement
p.000002: At the outset of the research design process, and as thoroughly as possible given the proposed research method, researchers should:
p.000002:
p.000002: identify and document research objectives and questions as a basis for determining what data will be needed;
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002:
p.000002: 1.1 Research study
p.000002: For each research study, researchers should identify and document the specific research objectives and related research questions.
p.000002:
p.000002: Researchers should also describe and justify the data needed to fulfill the research objectives and to answer any related research questions.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research study: Impact of ethnic group membership and age on health
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
...
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
p.000002: If yes, the researcher will likely propose the collection of direct identifiers.
p.000002:
p.000002: If these are not requirements of the research, the researcher should not collect direct identifiers. However, other potentially identifying elements may be
p.000002: needed to answer the research questions and for other data management reasons, such as to check for duplicate records. The lowest level of identifiability
p.000002: of these other data items should be used, consistent with the research objectives.
p.000002: Examples of reducing personal detail in specific data items collected:
p.000002:
p.000002: Personal Details Most Identifiable
p.000002:
p.000002:
p.000002: Least identifiable
p.000002:
p.000002:
p.000002: Subject name Location of residence
p.000002:
p.000002:
p.000002: Full name Street address
p.000002: Partial name 6-character postal code (e.g. one side of a city street; average of 15 households)
p.000002: Initials first 3 characters of postal code/Forward Sortation Area (average of 7,000 households)
p.000002: Code first character of postal code (province or region; e.g. A = Nfld/Lab.; J = Que. West; K = Eastern Ont.)
p.000002: Blank
p.000002: Census area
p.000002: Age
p.000002:
p.000002: Block (an area equivalent to a city block bounded by intersecting streets; the smallest geographic area for
p.000002: Birth day/month/year which population and dwelling counts are disseminated)
p.000002: Birth month/year Census enumeration or dissemination area (small area composed of one or more neighbouring blcoks,
p.000002: Birth year; Age at a time of used by Statistics Canada for distributing questionnaires to households and dwellings for the census
p.000002: data collection collection)
p.000002: Age range (e.g. 5 or 10-year Census subdivision (e.g. municipality, village)
p.000002: age group) Census agglomeration (urban core: min. 10,000 pop.)
p.000002: Census metropolitan area (urgan core: min. 100,000 pop.)
p.000002: Facilities and service providers
p.000002:
p.000002:
p.000002: Name of institution/provider
p.000002: Specific type of facility,
p.000002: provider (university hospital,
p.000002: family physician)
p.000002: Generic class (hospital,
p.000002: medical doctor)
p.000002:
p.000002:
p.000002:
p.000002: 2.3 Secondary use
p.000002: 2.3.1 As in 2.2.1, consider whether aggregate data on groups of individuals would serve the research objective. If not, consider whether non-identifiable
p.000002: data relating to individuals would serve the purpose.
p.000002:
p.000002: 2.3.2. Removal or coding of direct identifiers
p.000002: If identifiable data are required for the research purpose, direct identifiers should be avoided or concealed to the extent that is reasonably practical (e.g. as
p.000002: soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002:
...
p.000086: disease or infirmity".
p.000086: From Preamble to the Constitution of the World Health Organization as adopted by the International Health Conference, New York, 19-22 June,
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
...
Social / Child
Searching for indicator child:
(return to top)
p.000029: during the project, his or her informed consent shall be sought as a condition of continuing participation." (pg. 2.10)
p.000029:
p.000029: Article 2.7 "Where free and informed consent has been obtained from an authorized third party, and in those circumstances where the legally
p.000029: incompetent individual understands the nature and consequences of the research, the researcher shall seek to ascertain the wishes of the individual
p.000029: concerning participation. The potential subject's dissent will preclude his or her participation." (pg. 2.10)
p.000029:
p.000029: [Research with children]
p.000029:
p.000029: "..the notion of harm applied to children should be understood differently from harm in adults. Harm induced in children may have longer-term
p.000029: consequences to their growth and development. Furthermore, harms and benefits for children with chronic disabilities and terminal illnesses require
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
p.000029: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
p.000029: Consultation with representatives of those who contributed data." (pg. 3.5)
p.000029:
p.000029:
p.000029:
p.000029: Element #4: Managing and documenting consent
p.000029:
p.000029: General statement
p.000029: Consent is an ongoing process that begins upon first contact with prospective participants or authorized third parties, and ends only with the conclusion of
...
Searching for indicator children:
(return to top)
p.000002: where applicable, within the parameters set by the consent obtained from participants. The responsibilities of this committee could include the review of
p.000002: data access requests; long-term management of the database; coordination of reviews by local REBs (e.g. by means of agreements between REBs,
p.000002: institutions and researchers, as appropriate); and provision of information to the public (e.g. on a web site).
p.000002:
p.000002:
p.000002: How to navigate the document: Areas of special interest*
p.000002: Areas of special interest Element #. section #. subsection # TCPS excerpts at end of element #
p.000002:
p.000002: Type of project
p.000002:
p.000002: Single research project 1.1, 9.1.1
p.000002:
p.000002: Database created for long-term research use 1.2, 5.7, 9.1.2
p.000002:
p.000002: Qualitative (e.g. inductive analysis) 1.4, 2.4, 4.3, 5.4, 8.4.1 Element #3
p.000002:
p.000002: Genetics/Genomics 2.2, 3.5, 5.3, 6.3.3 Element #5, 8
p.000002:
p.000002: Data collection (sources)
p.000002:
p.000002: Individuals (legally competent) 2.2, 3.1, 4.1, 5.3.1, 5.5, 6.1.1, 6.2, 6.3 Element #5
p.000002:
p.000002: Individuals not legally competent Element #3
p.000002:
p.000002: Children Element #3
p.000002:
p.000002: From individuals and secondary use or disclosure 3.2, 5.6
p.000002:
p.000002: Communities 3.3.5, 5.3.2, 6.3.2
p.000002:
p.000002: Secondary use or disclosure 2.3, 3.3, 6.1, 8.1 Element #2, 3, 5, 6
p.000002:
p.000002: Data linkage 2-Summary guide (b), 8.2 Element #8
p.000002:
p.000002: Real world case studies Appendix A-3
p.000002:
p.000002: Examples of studies recruiting individuals or communities Appendix A-4 Table 1
p.000002:
p.000002: Examples of databases with research potential, in diverse settings Appendix A-4 Table 2
p.000002:
p.000002: Additional stewardship, oversight
p.000002:
p.000002: Advisory committee on research priorities 1.3
p.000002:
p.000002: Data stewardship committee 10.2.4
p.000002:
p.000002: Legal requirements
p.000002:
p.000002: Tables of concordance with privacy legislation Appendix A-7
p.000002:
p.000002:
p.000002: * based on feedback during 2004 consultations on draft CIHR privacy best practice guidelines.
p.000002:
p.000002:
p.000002: Introduction
p.000002:
p.000002: CIHR's Mandate
p.000002: The Canadian Institutes of Health Research (CIHR) is Canada's main federal funding agency for health research. CIHR's mandate is to invest in research
p.000002: that has the potential to lead to improved health 3 for Canadians, more effective health services and products, and a strengthened Canadian health care
...
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
p.000002: 1. Track and assess the factors that facilitate or hinder the development of family-centered provincial services for children with condition X and their
p.000002: family members.
p.000002: 2. Provide guidance to community organizations and provincial governments.
p.000002: 3. Validate questionnaire and interview methods for creating individualized family service plans.
p.000002: 4. Assess long term effectiveness and adverse effects of standard and emerging treatments for Condition X.
p.000002:
p.000002:
p.000002: Setting the scope of research
p.000002:
p.000002: Initial partnership between the research team and Provincial Ministry of Children's Services results in agreement on key objectives.
p.000002: A Local Advisory Committee is established to assist in setting out the scope and strategic priorities for the research program, to review research
p.000002: progress, to facilitate the achievement of study objectives, and to assist with the dissemination of results; with representatives from the Ministry,
p.000002: provincial clinic for childhood condition X, two community advocacy groups for persons with condition X, and parent representatives.
p.000002: A National Project Advisory Committee with representation from provinces actively interested in this initiative meets annually to advance services
p.000002: to young children with condition X, and to plan and disseminate research findings.
p.000002:
p.000002:
p.000002:
p.000002: 1.4 Qualitative research using inductive data collection and analysis
p.000002: It is important to recognize that all potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For
p.000002: example, researchers using inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration
p.000002: with research participants. In such research, the development of research questions and procedures is an ongoing process. For example, open-ended
p.000002: interviewing often goes down avenues not anticipated leading to new questions and new approaches.
p.000002:
p.000002: The wide range of methods in inductive approaches makes it difficult to document detailed and specific strategies for protection of privacy. Therefore, while
p.000002: planning their research, researchers should attempt to foresee both obvious and emerging issues related to privacy. These should be included in the
p.000002: submission to a research ethics board.
p.000002:
p.000002: Researchers should also document for a research ethics board any amendments to the protocol and consequent privacy protection strategies emerging
p.000002: over the course of the study. For relatively junior researchers, mentorship can be especially helpful for ensuring adherence to REB requirements.
p.000002: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000002:
p.000002: [Informing prospective participants of purposes]
p.000002:
...
p.000029: Article 2.6 "For research involving incompetent individuals, the REB shall ensure that, as a minimum, the following conditions are met: (a) The
p.000029: researcher shall show that free and informed consent will be sought from the authorized third party, and how the subjects' best interests will be
p.000029: protected. (b) The authorized third party may not be the researcher or any other member of the research team. (c) The continued free and informed
p.000029: consent of an appropriately authorized third party will be required to continue the participation of a legally incompetent subject in research, so long as
p.000029: the subject remains incompetent. (d) When a subject who was entered into a research project through third-party authorization becomes competent
p.000029: during the project, his or her informed consent shall be sought as a condition of continuing participation." (pg. 2.10)
p.000029:
p.000029: Article 2.7 "Where free and informed consent has been obtained from an authorized third party, and in those circumstances where the legally
p.000029: incompetent individual understands the nature and consequences of the research, the researcher shall seek to ascertain the wishes of the individual
p.000029: concerning participation. The potential subject's dissent will preclude his or her participation." (pg. 2.10)
p.000029:
p.000029: [Research with children]
p.000029:
p.000029: "..the notion of harm applied to children should be understood differently from harm in adults. Harm induced in children may have longer-term
p.000029: consequences to their growth and development. Furthermore, harms and benefits for children with chronic disabilities and terminal illnesses require
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
p.000029: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
p.000029: Consultation with representatives of those who contributed data." (pg. 3.5)
p.000029:
p.000029:
p.000029:
...
Social / Ethnicity
Searching for indicator ethnic:
(return to top)
p.000002:
p.000002: Please note the distinction made in these Elements between a "research participant" and "data subject". In the Best Practices, a research participant is an
p.000002: individual who consents to participation in research and who is the subject of personal data or information collected for research. A data subject is an
p.000002: individual who is the subject of personal data/information collected for research purposes, but who has not been directly approached to provide consent.
p.000002:
p.000002:
p.000002: Element #1: Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002:
p.000002: General statement
p.000002: At the outset of the research design process, and as thoroughly as possible given the proposed research method, researchers should:
p.000002:
p.000002: identify and document research objectives and questions as a basis for determining what data will be needed;
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002:
p.000002: 1.1 Research study
p.000002: For each research study, researchers should identify and document the specific research objectives and related research questions.
p.000002:
p.000002: Researchers should also describe and justify the data needed to fulfill the research objectives and to answer any related research questions.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research study: Impact of ethnic group membership and age on health
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
p.000002: Family and friends/Social activities: Needed to investigate the impact of family structure and interaction and environmental factors on measures of health
p.000002: and well-being.
p.000002:
p.000002:
p.000002:
p.000002: 1.2 Creation of a database for general research purposes
p.000002: Define the scope and purpose of the database in a way that will be meaningful for REBs and any prospective research participants, even if the boundaries
p.000002: are at a relatively general level.
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
p.000002: management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: Describe the general types of personal data that are necessary for these general research objectives (e.g. diagnoses, risk factors, outcomes). Include data
p.000002: that are expected to be collected over the lifespan of the database, particularly if there will be multiple data collection periods per participant, or data that will
p.000002: be requested from secondary sources. Be as specific as possible.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research database on disease X
p.000002:
...
Searching for indicator ethnicity:
(return to top)
p.000002: centre research crossing provincial, territorial or even national borders, several privacy laws and policies may have to be considered and complied with.
p.000002:
p.000002: To help health researchers, REBs and others navigate the sea of privacy laws and policies, a series of tables are included in the Appendix highlighting
p.000002: existing requirements relating to privacy in selected legislation.
p.000002:
p.000002: Health research
p.000002:
p.000002: Consistent with CIHR's mandate, these Privacy Best Practices are intended to be a resource primarily for the health research community, and are relevant
p.000002: to health research that requires ethics review under the TCPS. 9
p.000002:
p.000002: Health research is interdependent on a range of knowledge-generating activities that are generally perceived to be outside the boundaries of research, but
p.000002: which are related to the improvement of health and health services. These "non-research" activities, such as public health surveillance, health service
p.000002: management, and program quality assurance and improvement, are beyond the manageable scope of the present document. In the future, however, these
p.000002: Best Practices could potentially serve as models for best practices in these related areas, with the necessary adaptations.
p.000002:
p.000002: Personal information
p.000002:
p.000002: These Best Practices cover identifiable personal information. Identifiable personal information may contain a direct link to a specific individual (e.g. name
p.000002: and street address, personal health number, etc.) or any element or a combination of elements that allows indirect identification of an individual (e.g. if birth
p.000002: date combined with postal code and other personal information on the record such as ethnicity could lead to the identification of an individual).
p.000002:
p.000002: The TCPS definition of identifiable personal information covers a wide range of personal information that may be used in the conduct of research. 10
p.000002: For example, health researchers may need information about such things as a person's clinical history and use of health care services, but also about
p.000002: broad determinants of health, such as a person's education, employment, and income level.
p.000002:
p.000002: The scope of personal information covered in these Privacy Best Practices includes personal information derived from blood and other human biological
p.000002: materials (e.g. information such as blood type, DNA code and the presence or absence of disease), but not the materials themselves. The privacy issues
p.000002: related to the banking, storage and use of those biological materials are beyond the scope of this document.
p.000002:
p.000002:
p.000002: Commitment to continuous learning and review
p.000002: These Privacy Best Practices are expected to evolve over time in response to changes in the circumstances of research and as new best practices
p.000002: emerge. One of the valuable ways in which researchers, REBs and institutions can assist the evolution of this document is by bringing to the attention of
p.000002: the CIHR Ethics Office lessons learned through the application of these Best Practices and suggesting areas for further development.
p.000002:
p.000002: Emailed feedback can be sent to the CIHR Ethics Office at ethics-ethique@cihr-irsc.gc.ca.
p.000002:
p.000002:
p.000002: Privacy Best Practices: 10 Elements
p.000002:
p.000002: How to read these elements
...
p.000002:
p.000002: General statement
p.000002: At the outset of the research design process, and as thoroughly as possible given the proposed research method, researchers should:
p.000002:
p.000002: identify and document research objectives and questions as a basis for determining what data will be needed;
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002:
p.000002: 1.1 Research study
p.000002: For each research study, researchers should identify and document the specific research objectives and related research questions.
p.000002:
p.000002: Researchers should also describe and justify the data needed to fulfill the research objectives and to answer any related research questions.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research study: Impact of ethnic group membership and age on health
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
p.000002: Family and friends/Social activities: Needed to investigate the impact of family structure and interaction and environmental factors on measures of health
p.000002: and well-being.
p.000002:
p.000002:
p.000002:
p.000002: 1.2 Creation of a database for general research purposes
p.000002: Define the scope and purpose of the database in a way that will be meaningful for REBs and any prospective research participants, even if the boundaries
p.000002: are at a relatively general level.
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
...
p.000002:
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002: General statement
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives. 15
p.000002:
p.000002:
p.000002: 2.1. Personal data: Identifiability and sensitivity
p.000002: 2.1.1 Identifiability
p.000002:
p.000002: Limiting data identifiability means minimizing as much as possible, the collection of:
p.000002:
p.000002: direct identifiers (e.g. name, street address) and
p.000002: other data items that could potentially be used to identify an individual.
p.000002:
p.000002: Data identifiability can be characterized as being on a continuum, in which the division between degrees of "identifiability" are not always clear-cut. Even a
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
...
Social / Homeless Persons
Searching for indicator homeless:
(return to top)
p.000029: population that cannot be contacted to seek their consent, thereby affecting the validity of results
p.000029: and/or defeating the purpose of the study; or
p.000029: b. the additional financial, material, human, organizational and other resources needed to obtain
p.000029: consent could impose a hardship or burden on the researchers or organization so burdensome that
p.000029: the research could not be done.
p.000029:
p.000029:
p.000029: 3.3.4 Expectations of individuals In general, the expectations of a reasonable person in the circumstances should be taken into account
p.000029: (considering, for example, the nature of the research, the type of data to be collected and the context in
p.000029: which the data were originally collected). If individuals have previously objected to the secondary use of their
p.000029: data for research or to the use of their contact information, their directions should be respected.
p.000029:
p.000029: 3.3.5 Views of relevant groups Privacy concerns may extend beyond the individual to include well-defined groups or communities, e.g.
p.000029: remote communities and Aboriginal peoples. 31 Also, genetic information about individuals is more than
p.000029: personal information-it may also be intimate information about those who share a common genetic lineage-
p.000029: -family members, other relatives and, in some cases, well-defined communities. 32
p.000029:
p.000029: The REB may require that efforts be made to consult with family groups, Aboriginal peoples, community
p.000029: representatives, consumer associations, and/or special populations such as the homeless or under-housed,
p.000029: as appropriate, to address possible concerns of affected individuals and communities. These concerns may
p.000029: relate to the design and scope of the research, the recruitment of individuals, and the analysis and
p.000029: disseminations of results of research. This consultation process will be a high priority when dealing with
p.000029: controversial issues and/or individuals, groups or communities in vulnerable circumstances.
p.000029: 3.3.6 Legal requirements In addition to REB approval, access to personal data for research without consent will be subject to specific
p.000029: legal requirements in relevant jurisdictions. For example, some jurisdictions require some or all of the
p.000029: following:
p.000029:
p.000029: a data-sharing agreement between the data holder and the researcher; 33
p.000029: notification and/or approval by other relevant oversight bodies; 34 and/or
p.000029: agreement that personal data will not be used to contact individuals. 35
p.000029:
p.000029:
p.000029: 3.3.7 Openness: Informing the public In the spirit of openness, the researcher should have an appropriate strategy for informing the general public
p.000029: about the research. 36
p.000029:
p.000029:
p.000029:
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Requirements for consent]
p.000029:
p.000029: Article 2.1
p.000029:
p.000029: "(a) Research governed by this Policy... may begin only if (1) prospective subjects, or authorized third parties, have been given the opportunity to give
p.000029: free and informed consent about participation...
p.000029:
...
Social / Incarcerated
Searching for indicator restricted:
(return to top)
p.000002: purposes are not specified in detail, data management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: All potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For example, researchers using
p.000002: inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration with research participants. In
p.000002: such research, the development of research questions and procedures is an ongoing process. While planning their research, researchers should attempt to
p.000002: foresee both obvious and emerging issues related to privacy. These should be included in the submission to an REB. Researchers should also document
p.000002: for an REB any amendments to the protocol and consequent privacy protection strategies emerging over the course of the study.
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002:
p.000002:
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives.
p.000002:
p.000002: Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research objectives (e.g.
p.000002: data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: For research involving secondary use of data for research, if identifiable data are required for the research, direct identifiers should be avoided or
p.000002: concealed, to the extent that is reasonably practical (e.g. as soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
...
p.000002: purposes, and seek consent from individuals for these purposes.
p.000002:
p.000002: The REB will need to determine if consent is required for the secondary use of personal information for recruitment purposes . Researchers and REBs
p.000002: should be aware of any legal restrictions on contacting individuals in these circumstances.
p.000002:
p.000002: When a researcher is making a request for access to data to recruit participants, the preferred option is for the data holder to determine eligibility of
p.000002: individuals for the research on the basis of criteria provided by the researchers, and to make the initial contact to:
p.000002:
p.000002: inform eligible individuals about the research so that they can contact the researcher, if interested, or
p.000002: to seek consent from individuals to release their nominal information to the researcher who will contact them to inform them about the research.
p.000002:
p.000002: When the preferred option is impracticable or inappropriate, an REB may consider whether a researcher should be permitted access to minimal personal
p.000002: data only for the purposes of determining eligibility for the research or contacting individuals to invite them to join the study. If it is legally permissible and
p.000002: the REB considers it appropriate, personal information may be released with appropriate confidentiality protection such as a signed confidentiality
p.000002: agreement with access restricted to the data holder's site and use limited to the stated purpose.
p.000002:
p.000002: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000002: eligible for participation in the research, such as a cancer diagnosis.
p.000002:
p.000002: Typical scenarios for recruiting participants, including community-based research and genetics research, and preferred approaches are briefly described.
p.000002:
p.000002:
p.000002: Element #7: Safeguarding personal data
p.000002:
p.000002:
p.000002:
p.000002: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
p.000002: safeguards should include organizational, technological and physical measures.
p.000002:
p.000002: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000002: as appropriate for the sensitivity and identifiability of the data.
p.000002:
p.000002: REBs should review and approve researchers' proposed measures for safeguarding any personal data to be collected.
p.000002:
p.000002:
p.000002: Element #8: Controlling access and disclosure of personal data
p.000002:
p.000002:
p.000002:
p.000002: Data sharing for research purposes - whether of linked or unlinked data sets - is an important way of enabling socially valuable research. It avoids
p.000002: unnecessary duplication of data collection, which reduces the burden on research participants and permits researchers to use limited or scarce resources
p.000002: more productively.
p.000002:
...
p.000002: 2. What is the risk of developing disease X after exposure to environmental risk factors, such as pollutants in the area of residence?
p.000002: 3. What is the cost-effectiveness and efficacy of screening programs for disease X?
p.000002: Types of personal data to be collected over multiple collection periods Research justification
p.000002:
p.000002:
p.000002: Name, address, telephone number Contact information to follow-up with participants for further data
p.000002: collection
p.000002:
p.000002: Demographic information Assess other variables by demographics of the population
p.000002:
p.000002: Family history Disease X is known to have an inherited basis
p.000002:
p.000002: Diet, reproductive factors, physical activity, anthropometric measures, Assess risk factors for disease X
p.000002: education, income, gender
p.000002:
p.000002: Medical conditions, medication use Assess impact of other existing conditions on disease X and
p.000002: effectiveness of medications.
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
p.000002: 1. Track and assess the factors that facilitate or hinder the development of family-centered provincial services for children with condition X and their
p.000002: family members.
p.000002: 2. Provide guidance to community organizations and provincial governments.
...
p.000002: planning their research, researchers should attempt to foresee both obvious and emerging issues related to privacy. These should be included in the
p.000002: submission to a research ethics board.
p.000002:
p.000002: Researchers should also document for a research ethics board any amendments to the protocol and consequent privacy protection strategies emerging
p.000002: over the course of the study. For relatively junior researchers, mentorship can be especially helpful for ensuring adherence to REB requirements.
p.000002: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000002:
p.000002: [Informing prospective participants of purposes]
p.000002:
p.000002: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following: ... (b) ..."A comprehensible
p.000002: statement of the research purpose..." (pg. 2.5)
p.000002:
p.000002: [Informing REBs of purposes]
p.000002:
p.000002: Article 3.2 "...researchers shall secure REB approval for obtaining identifiable personal information about subjects. Approval for such research shall
p.000002: include such considerations as: (a) The type of data to be collected; (b) The purpose for which the data will be used;..." (pg. 3.3)
p.000002:
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002: General statement
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives. 15
p.000002:
p.000002:
p.000002: 2.1. Personal data: Identifiability and sensitivity
p.000002: 2.1.1 Identifiability
p.000002:
p.000002: Limiting data identifiability means minimizing as much as possible, the collection of:
p.000002:
p.000002: direct identifiers (e.g. name, street address) and
p.000002: other data items that could potentially be used to identify an individual.
p.000002:
p.000002: Data identifiability can be characterized as being on a continuum, in which the division between degrees of "identifiability" are not always clear-cut. Even a
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
...
p.000029:
p.000029:
p.000029: 4.4 Documenting non-participation or withdrawal of consent
p.000029: The researcher may need information on who does not want to participate in research or who withdraws from research, for example to:
p.000029:
p.000029: document who is not to be included in follow-up research activities; and/or
p.000029: take into consideration relevant characteristics of the population not included in the study, when reporting possible bias in research results.
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
...
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
p.000063: A) The data holder assesses eligibility and makes If permitted by law and subject to REB approval, the data holder should determine eligibility of
p.000063: initial contact. (Preferred) individuals for the research on the basis of criteria provided by the researcher. The data holder
p.000063: should make the initial contact to: (i) inform eligible individuals about the research so that they can
p.000063: contact the researcher, if interested, or (ii) to seek consent from individuals to release their nominal
p.000063: information to the researcher who will contact them to inform them about the research.
p.000063:
p.000063: B) If the REB considers option A impracticable or In some cases, the preferred option above may be considered impracticable or inappropriate. For
p.000063: inappropriate, the REB may permit the researcher example, the preferred option may be impracticable if:
p.000063: to access minimal personal information for
p.000063: the data holder does not, despite funding from the researcher, have the resources to assess
p.000063: assessing eligibility and/or making contact with
p.000063: eligibility and make initial contact, and therefore the research could not proceed unless an
p.000063: eligible individuals, if permitted by law and under
p.000063: alternative recruitment procedure is used; or
p.000063: strict controls (e.g. access restricted to data
p.000063: the data holder does not have an ongoing relationship with eligible individuals to make
p.000063: holder's site).
p.000063: contact (e.g. as may the case for a registrar of a population records database, or a
p.000063: government agency holding health insurance registration and billing information).
p.000063:
p.000063: The preferred option may be considered inappropriate where the data holder has undue influence
p.000063: over eligible individuals; professional or other legal requirements makes the data custodian's
p.000063: involvement in the recruitment process inappropriate; or the data holder's contacting of eligible
p.000063: individuals would defeat the purpose of the research. 68
p.000063:
p.000063: When the preferred option is impracticable or inappropriate, an REB may consider whether a
p.000063: researcher should be permitted access to minimal personal data only for the purposes of
p.000063: determining eligibility for the research or contacting individuals to invite them to join the study 69
p.000063: . If it is legally permissible and the REB gives approval, the researcher may be given access to
p.000063: personal information with appropriate confidentiality protections such as a signed confidentiality
p.000063: agreement with access restricted to the data holder's site, and use limited to the stated purpose.
p.000063:
p.000063: Minimal personal data provided to the researcher should normally contain only contact information
p.000063: and no other personal information related to health status. However, if health-related data are
p.000063: inherent in the eligibility criteria used to assemble the list of individuals to be contacted, an REB
p.000063: may determine that camouflage sampling or other masking techniques should be used to enable
p.000063: researchers to contact individuals while preventing researchers from viewing any identifiable
p.000063: health-related information of eligible individuals prior to gaining consent. 70
p.000063:
p.000063:
p.000063:
p.000063: Option A: Examples of recruitment methods:
p.000063:
p.000063: Health professional society makes contact with members
p.000063:
p.000063: Prospective research participants are members of a health professional society. The Society mails out a letter (drafted by the researcher) to its
p.000063: members, which explains how to contact the researcher to learn more about the research.
p.000063:
p.000063:
p.000063:
p.000063: Health professionals assess eligibility and make contact
p.000063:
p.000063: Given the criteria provided by the researchers, pharmacists are automatically notified by a computer flag in a centralized database, at the time of filling a
p.000063: prescription, of any patient eligible for the research study (e.g. receiving a certain number of concurrent medications). This automatic flag of eligible
p.000063: individuals for the study is visible only to pharmacists in participating pharmacies. Once the eligible persons are identified, the pharmacists seek consent
p.000063: from these individuals to release their contact information to the researcher.
...
p.000086: others afflicted with a similar condition. In some qualitative research, individual participants may understand and willingly accept the possibility that their
p.000086: identities may be revealed in the public reporting of research results.
p.000086: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000086:
p.000086: [Disclosure controls]
p.000086:
p.000086: "Data released should not contain names, initials or other identifying information. While it may be important to preserve certain types of identifiers (e.g.,
p.000086: region of residence), these should be masked as much as possible using a standardized protocol before the data are released for research purposes.
p.000086: However, legitimate circumstances may exist where such information is critical for the research project..." (pg. 3.4)
p.000086:
p.000086: [Human genetic research]
p.000086:
p.000086: Article 8.2 "The researchers and the REB shall ensure that the results of genetic testing and genetic counseling records are protected from access by
p.000086: third parties, unless free and informed consent is given by the subject. Family information in databanks shall be coded so as to remove the possibility of
p.000086: identification of subjects within the bank itself." (pg. 8.2)
p.000086:
p.000086: [Secondary uses]
p.000086:
p.000086: Article 3.3, 3.4 - See Element #3
p.000086:
p.000086: [Data linkage]
p.000086:
p.000086: Article 3.6 "The implications of approved data linkage in which research subjects may be identifiable shall be approved by the REB." Explanatory note:
p.000086: "...Only a restricted number of individuals should perform the function of merging databases; researchers should either destroy the merged file
p.000086: immediately after use, or use enhanced security measures to store it. Whether the data are to be used statistically or otherwise, confidentiality of the
p.000086: information must be maintained by all members of the research team." (pg. 3.6)
p.000086:
p.000086:
p.000086:
p.000086: Element #9: Setting reasonable limits on retention of personal data
p.000086:
p.000086: General statement
p.000086: Personal data should be retained as long as is necessary to fulfill the research purposes. 91 Personal data may then be destroyed or returned to the
p.000086: data provider, if appropriate, as set out in the terms of the original collection, data-sharing agreement, institutional policies and legal requirements.
p.000086:
p.000086: There is a tension between the privacy principle of limiting the retention of data and the scientific principle of preserving research data so that published
p.000086: research results can be replicated and verified, and opportunities for further investigation of valuable data are maximized. While this is a very complex area
p.000086: in need of further reflection and development, the default principle is to define retention periods for personal data, in writing. Researchers should be explicit
p.000086: about what they plan to do with the data they collect and have storage, management and access policies in place.
p.000086:
p.000086:
p.000086: 9.1 Retention of personal data
p.000086: 9.1.1 Specific research project
p.000086:
p.000086: Where personal data are collected and used in the context of a specific research project, identifying personal data should be retained by the researcher as
...
Social / Laboratory Staff
Searching for indicator laboratory staff:
(return to top)
p.000029: have a blood test.
p.000029:
p.000029: Women who were scheduled for therapeutic abortions were approached in a hospital clinic about their willingness to participate in the study on Disease
p.000029: X. Those who gave oral consent to participate in this study agreed to fill out questionnaires (without providing their names) about certain risk factors for
p.000029: disease X, and to permit the testing of leftover blood from the blood test for the presence of disease X.
p.000029:
p.000029: For each participant, the computer generated a specific scrambled code linking the blood sample for the disease test and the answers to the
p.000029: questionnaire. Once the results of the disease tests were linked to the corresponding questionnaire, the computer-generated code was removed. In this
p.000029: way, it was not possible to identify the research participants, even if one had used the same computer program to try to retrace the scrambled codes.
p.000029:
p.000029: The linked information for each person was thus non-identifiable so that the researchers could look at risk factors and determine the incidence of
p.000029: disease X but could not identify any of the research participants.
p.000029:
p.000029:
p.000029:
p.000029: Example: Documented consent and non-identifiable data and results
p.000029:
p.000029: From a study on workplace injuries in nursing and laboratory staff
p.000029: ...The study questionnaire had no name or code number on it and participants were asked not to write their name on it. The cover letter from the
p.000029: researcher asked participants to fill out the questionnaire, put it in the provided envelope and return it through internal [staff] mail. The letter also asked
p.000029: participants to then sign a response card that had their name on it, put it in a separate envelope that was also provided and deposit it into slotted drop
p.000029: boxes located in each work area.
p.000029:
p.000029: The researcher did not need to know the names of persons who had responded; it was the content of the responses that was of interest. The only
p.000029: identifying information required was on the response card in order to allow the researcher to send targeted reminder letters to those persons who had
p.000029: still not responded. In addition, general reminders to return the questionnaires were also posted in designated work areas in an effort to increase
p.000029: response rates.
p.000029:
p.000029: To minimize the risk of linking questionnaire responses with the names provided on the response cards, the researcher picked up the cards regularly
p.000029: throughout the week and the questionnaires only once every week or two. Furthermore, no data were entered until the end of data collection to reduce
p.000029: the possibility of identifying late respondents. With this method, the researcher could not identify who had filled out each questionnaire, but she would
p.000029: know from the response cards who on the list had or had not returned a questionnaire.
p.000029:
p.000029: In this study sensitive information could be revealed about those staff who had suffered an injury at work but who had not reported it, contrary to
...
Searching for indicator research staff:
(return to top)
p.000063:
p.000063: Assessment Examples
p.000063: a) Determine what assets need to be protected Databases and files of personal and other confidential data
p.000063: Database management software
p.000063: Computer hardware, fax machines
p.000063:
p.000063:
p.000063: b) Determine what to protect against Five main classes of threats are: disclosure, interruption, modification, destruction and
p.000063: removal or loss
p.000063:
p.000063:
p.000063: c) Assess the probability of the threat occurring Low, medium or high
p.000063:
p.000063:
p.000063: d) Assess the magnitude of the impact and Loss of public trust
p.000063: consequences of the threat if it occurs Harms to individuals (loss of privacy or trust; social stigmatization; social discrimination
p.000063: affecting financial, employment, insurance, or other status; loss of benefits)
p.000063: Loss of data or equipment.
p.000063:
p.000063:
p.000063: e) Assess existing safeguards and need for Direct identifiers are separated from personal records as soon as reasonably practicable.
p.000063: additional safeguards Highly identifiable and sensitive data are stored at the highest level of security, e.g. on stand-
p.000063: alone servers.
p.000063: Pledge of confidentiality signed by all research staff.
p.000063:
p.000063:
p.000063: f) Recommend the appropriate security See security measures proposed in 7.2 below
p.000063: safeguards to protect the assets from threats
p.000063:
p.000063: g) Update and regularly review these safeguards Respond to changes in:
p.000063: (at least annually) the internal technological environment (including improvements in security strategies),
p.000063: the research project and the institution,
p.000063: technologies available to threat agents and
p.000063: the profile of potential threats.
p.000063:
p.000063:
p.000063:
p.000063: 7.2 Security measures
p.000063: 7.2.1 Organizational safeguards
p.000063:
p.000063: There should be ongoing commitment to privacy and continued emphasis of its importance by all involved in the research and the
p.000063: institutional/organizational management.
p.000063: All involved in the research project should be subject to a pledge of confidentiality.
p.000063: Access to personal information should be strictly limited in terms of numbers of persons, for legitimate purposes, and strictly on a realistic need-to-
p.000063: know basis.
p.000063: Data-sharing agreements between the researcher/institution and all involved should be signed prior to providing any access to data.
p.000063: Consequences for breach of confidentiality, including dismissal and/or loss of institutional privileges, should be clearly stipulated.
p.000063: Institutions and organizations housing research projects and archived data should, with ongoing commitment of adequate resources:
p.000063: develop, monitor and enforce privacy and security policies and procedures;
...
Social / Linguistic Proficiency
Searching for indicator language:
(return to top)
p.000002:
p.000002: The researcher may need information on who does not want to participate in research or who withdraws from research , for example to document who is not
p.000002: to be included in follow-up research activities; and/or to take into consideration relevant characteristics of the population not included in the study, when
p.000002: reporting possible bias in research results. In these circumstances, researchers may obtain information about non-participants or those withdrawing
p.000002: consent only with individuals' consent or the approval of an REB to waive the consent requirement in the particular circumstances.
p.000002:
p.000002: Participants in qualitative studies are especially vulnerable to unintended identification. For example, in quoting interviewees, biographical details may be
p.000002: revealed that make protecting identities difficult. Therefore, paying attention to the trust relationship between researcher and participant, and obtaining
p.000002: ongoing consent, are very important.
p.000002:
p.000002:
p.000002: Element #5: Informing prospective research participants about the research
p.000002:
p.000002:
p.000002:
p.000002: Researchers should provide to prospective participants or to authorized third parties disclosure of all information relevant to voluntary and informed
p.000002: consent.
p.000002:
p.000002: Information should be communicated to prospective participants in plain language, in oral and/or written form, so that it is easily understood.
p.000002:
p.000002: The amount of time taken to communicate information to prospective participants should be appropriate to the need, not excessive nor too brief. For
p.000002: example, the information could be layered, with a one-page summary of the research, a short consent form, an appendix with more detailed information
p.000002: and instructions on how to obtain more information.
p.000002:
p.000002: During the consent process, the researcher should determine whether the participant wishes to be informed of any meaningful research results that
p.000002: specifically relate to them.
p.000002:
p.000002: Researchers, particularly those in the areas of health services, population and public health, and genetics/genomic research who study whole populations,
p.000002: should strive to communicate with the relevant population and governmental authorities regarding results that are pertinent to the improvement of health
p.000002: and/or the prevention of disease. The population studied should be made aware of possible socio-economic discrimination or group stigmatization as a
p.000002: result of the research results, such as because of perceptions of genetic risks. In the context of genetic research, the population should also be informed of
p.000002: the means taken to minimize the risks.
p.000002:
p.000002: In the consent process and discussion, researchers using qualitative methods may consider involving participants in the writing and reporting process,
p.000002: depending on the circumstances.
p.000002:
...
p.000029: free and informed consent, researchers should consult their REB." (pg. 2.2)
p.000029:
p.000029: [Witness of signatures]
p.000029:
p.000029: Article 2.4 Explanatory Text: "In some circumstances, having a witness to the signatures on the consent form may be felt to be appropriate. In law, the
p.000029: role of a witness is only to attest that the person actually signed the form; a witness is not responsible for certifying such factors as the signature being
p.000029: obtained under defined conditions or that the signers were competent. However, a court might subsequently seek the opinions of the witness on such
p.000029: issues". (pg. 2.8)
p.000029:
p.000029: [Time allocation]
p.000029:
p.000029: Article 2.4 Explanatory Text: "Rushing the process of free and informed consent or treating it as a perfunctory routine violates the principles of respect
p.000029: for persons, and may cause difficulty for potential subjects. The time required for the process of free and informed consent can be expected to depend
p.000029: on such factors as the magnitude and probability of harms, the setting where the information is given (e.g. hospital or home) and the subject's situation
p.000029: (e.g., level of anxiety, maturity or seriousness of disease)." (pg. 2.8)
p.000029:
p.000029: [Translating materials]
p.000029:
p.000029: Article 2.1 Explanatory text: "The requirement for free and informed consent should not disqualify research subjects who are not proficient in the
p.000029: language used by the researchers from the opportunity to participate in potential research. Such individuals may give consent provided that one or more
p.000029: of the following are observed to the extent deemed necessary by the REB, in the context of a proportionate approach to the harms envisaged in the
p.000029: research and the consent processes that are to be used: An intermediate not involved in the research study, who is competent in the language used by
p.000029: the researchers as well as that chosen by the research subject, is involved in the consent process; The intermediary has translated the consent
p.000029: document or approved an existing translation of the information relevant to the prospective subject; The intermediary has assisted the research subject in
p.000029: the discussion of the research study; The research subject has acknowledged, in his or her own language, that he or she understands the research
p.000029: study, and the nature and extent of his or her participation, including the risks involved, and freely gives consent..." (pg. 2.2.)
p.000029:
p.000029:
p.000029:
p.000029: Element #5: Informing prospective research participants about the research
p.000029:
p.000029: General statement
p.000029: Researchers should provide to prospective participants or to authorized third parties disclosure of all information relevant to voluntary and informed
p.000029: consent.
p.000029:
p.000029: As part of the consent process, the researcher or other appropriate person (depending on the approved recruitment procedure) should explain such things
p.000029: as the nature of the research, what information will be collected and how it will be used in this study and possible future studies, as well as the risks and
p.000029: benefits of the research, so that they can make an informed decision about whether they wish to participate.
p.000029: Researchers must ensure that prospective participants are given adequate opportunities to ask questions, discuss their concerns and consider their
p.000029: participation. 41
p.000029:
p.000029:
p.000029: 5.1 Understandable language
p.000029: Information should be communicated to prospective participants in plain language, in oral and/or written form, so that it is easily understood. 42
p.000029:
p.000029:
p.000029:
p.000029: 5.2 Reasonable time allocation
p.000029: The amount of time taken to communicate information to prospective participants should be appropriate to the need, and should be neither excessive nor
p.000029: too brief. For example, the information could be layered, so that participants are given a one-page summary, a short consent form with headings
p.000029: corresponding to core elements (e.g. requirements of participation, right to refuse and withdraw), and more detailed information in an appendix.
p.000029: Participants should also be informed about how to obtain more details if desired (e.g. via a web site or a toll-free telephone number).
p.000029:
p.000029:
p.000029: 5.3 Communicating results back to research participants
p.000029: 5.3.1 Informing research participants about results specifically relating to themselves
p.000029:
p.000029: During the consent process, the researcher should determine whether the participant wishes to be informed of any meaningful research results that
p.000029: specifically relate to them. 43 Also, there should be agreement on how any results relating to the participant will be communicated to the participant (e.g.
p.000029: whether the information will be provided first to a genetic counsellor or a health care provider).
p.000029:
p.000029: 5.3.2 Informing populations of general results and potential negative impacts
p.000029:
p.000029: The results of research should be made public to contribute towards better understanding of the health issue under investigation. Researchers, particularly
p.000029: those in the areas of health services, population and public health, and genetics or genomic research, who study whole populations, should strive to
...
Social / Literacy
Searching for indicator literacy:
(return to top)
p.000086:
p.000086: 30 These conditions are characteristic of much health services and population and public health research where whole populations (not specific
p.000086: individuals) are being studied.
p.000086:
p.000086: 31 See TCPS Chapter 6 - Research Involving Aboriginal Peoples (under review).
p.000086:
p.000086: 32 See TCPS Article 8.1 for more on this topic.
p.000086:
p.000086: 33 See Element #8; and the legal concordance table for Element #8, Part 2, in Appendix A-7 for legal references to data-sharing agreements for
p.000086: research purposes.
p.000086:
p.000086: 34 As above.
p.000086:
p.000086: 35 See the legal concordance table for Element #6 in Appendix A-7 for statutory prohibitions to contacting individuals.
p.000086:
p.000086: 36 See also Element #10.
p.000086:
p.000086: 37 See table of concordance for Element #4, Part 1, in Appendix A-7 for statutory references to the general consent requirement. Part 2 of the
p.000086: concordance table sets out the statutory references to consent by substitute decision-makers.
p.000086:
p.000086: 38 Note that participants should understand what withdrawal of consent will mean to the use of their previously collected information, and that non-
p.000086: identifiable data cannot be retrieved and withdrawn from the database.
p.000086:
p.000086: 39 See Element #5, 5.4.
p.000086:
p.000086: 40 See Element #3.
p.000086:
p.000086: 41 See table of concordance for Element #5 in Appendix A-7 for cross-reference to statutory provisions regarding notice/information requirements.
p.000086:
p.000086: 42 According to the results of the international Adult Literacy and Life Skills Survey (2003), a joint project of the Government of Canada, the U.S.
p.000086: National Center for Education Statistics and the Organization for Economic Cooperation and Development, some 15% of Canadians, about one
p.000086: out of every seven, have problems dealing with printed materials and score at the lowest performance level in reading prose.
p.000086: From Statistics Canada, The Daily, Wednesday, May 11, 2005, Learning a Living: First Results of the Adult Literacy and Life Skills Survey , 2003
p.000086: (89-603-XWE, free), available online.
p.000086:
p.000086: 43 When results of research tests are determined to be scientifically valid, have significant implications for the health of the participant, and
p.000086: prevention or treatment is available, these results should be communicated to the participant through his or her treating physician, unless the
p.000086: participant has chosen not to receive any results.
p.000086: In communicating results to the participant, particularly with respect to genetic research, the choices of each participant, the extent of available
p.000086: clinical services, the availability of counselling, and the implications for family members, should be taken into account (based on Quebec's
p.000086: Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000, part IV Professionalism, part 3
p.000086: Communication of Specific Results, pg. 12).
p.000086:
p.000086: Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles on the Ethical Conduct of Human Genetic Research
p.000086: 44 Involving Populations (2002), Section 6, Communication of Research Results, pg. 3.
p.000086:
p.000086: 45 As above.
p.000086:
p.000086: 46 See also Element #1.
p.000086:
p.000086: 47 See also Element #2. We recognize that certain types of research may not be compatible with full disclosure of data to be collected, for example
p.000086: in some psychology research. This is an area that requires further reflection, and CIHR welcomes suggestions from those for whom these
p.000086: exceptions may apply.
p.000086:
p.000086: 48 See also Element #4.
p.000086:
...
Social / Marital Status
Searching for indicator single:
(return to top)
p.000002: inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration with research participants. In
p.000002: such research, the development of research questions and procedures is an ongoing process. While planning their research, researchers should attempt to
p.000002: foresee both obvious and emerging issues related to privacy. These should be included in the submission to an REB. Researchers should also document
p.000002: for an REB any amendments to the protocol and consequent privacy protection strategies emerging over the course of the study.
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002:
p.000002:
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives.
p.000002:
p.000002: Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research objectives (e.g.
p.000002: data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: For research involving secondary use of data for research, if identifiable data are required for the research, direct identifiers should be avoided or
p.000002: concealed, to the extent that is reasonably practical (e.g. as soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
p.000002: foreseeable in detail at the outset of the interview. In these cases, the ongoing negotiation of consent with research participants is the best way to ensure
p.000002: that the privacy of individuals and the community is being appropriately protected.
p.000002:
p.000002:
p.000002: Element #3 : Determining whether consent from individuals is required
p.000002:
p.000002:
p.000002:
p.000002: Voluntary and informed consent from legally competent individuals or authorized third parties is a fundamental principle in research involving humans, and
p.000002: specifically for the use of their personal data.
p.000002:
p.000002: Under specified circumstances, given a satisfactory rationale by the researcher, an REB may approve the waiver of a consent requirement, or a partial
p.000002: waiver of some elements of a consent requirement. According to TCPS Article 2.1(c), the REB must find and document that:
p.000002:
...
p.000002:
p.000002: be open to the public with respect to the objectives of the research;
p.000002: be open about the policies and practices relating to the protection of personal data used in the research;
p.000002: promote ongoing dialogue between the research community and privacy oversight agencies; and
p.000002: promote ongoing dialogue between the research community and the community at large (the public).
p.000002:
p.000002: When a database is created for multiple research purposes, or across multiple sites or jurisdictions, researchers and institutional data holders should
p.000002: promote coordinated and streamlined approaches to the review of privacy and confidentiality concerns, and to data stewardship over the long term.
p.000002:
p.000002: A centralized data stewardship committee could be put in place to authorize future uses of the database in accordance with the research objectives and,
p.000002: where applicable, within the parameters set by the consent obtained from participants. The responsibilities of this committee could include the review of
p.000002: data access requests; long-term management of the database; coordination of reviews by local REBs (e.g. by means of agreements between REBs,
p.000002: institutions and researchers, as appropriate); and provision of information to the public (e.g. on a web site).
p.000002:
p.000002:
p.000002: How to navigate the document: Areas of special interest*
p.000002: Areas of special interest Element #. section #. subsection # TCPS excerpts at end of element #
p.000002:
p.000002: Type of project
p.000002:
p.000002: Single research project 1.1, 9.1.1
p.000002:
p.000002: Database created for long-term research use 1.2, 5.7, 9.1.2
p.000002:
p.000002: Qualitative (e.g. inductive analysis) 1.4, 2.4, 4.3, 5.4, 8.4.1 Element #3
p.000002:
p.000002: Genetics/Genomics 2.2, 3.5, 5.3, 6.3.3 Element #5, 8
p.000002:
p.000002: Data collection (sources)
p.000002:
p.000002: Individuals (legally competent) 2.2, 3.1, 4.1, 5.3.1, 5.5, 6.1.1, 6.2, 6.3 Element #5
p.000002:
p.000002: Individuals not legally competent Element #3
p.000002:
p.000002: Children Element #3
p.000002:
p.000002: From individuals and secondary use or disclosure 3.2, 5.6
p.000002:
p.000002: Communities 3.3.5, 5.3.2, 6.3.2
p.000002:
p.000002: Secondary use or disclosure 2.3, 3.3, 6.1, 8.1 Element #2, 3, 5, 6
p.000002:
p.000002: Data linkage 2-Summary guide (b), 8.2 Element #8
p.000002:
p.000002: Real world case studies Appendix A-3
p.000002:
p.000002: Examples of studies recruiting individuals or communities Appendix A-4 Table 1
p.000002:
p.000002: Examples of databases with research potential, in diverse settings Appendix A-4 Table 2
p.000002:
...
p.000002: Birth month/year Census enumeration or dissemination area (small area composed of one or more neighbouring blcoks,
p.000002: Birth year; Age at a time of used by Statistics Canada for distributing questionnaires to households and dwellings for the census
p.000002: data collection collection)
p.000002: Age range (e.g. 5 or 10-year Census subdivision (e.g. municipality, village)
p.000002: age group) Census agglomeration (urban core: min. 10,000 pop.)
p.000002: Census metropolitan area (urgan core: min. 100,000 pop.)
p.000002: Facilities and service providers
p.000002:
p.000002:
p.000002: Name of institution/provider
p.000002: Specific type of facility,
p.000002: provider (university hospital,
p.000002: family physician)
p.000002: Generic class (hospital,
p.000002: medical doctor)
p.000002:
p.000002:
p.000002:
p.000002: 2.3 Secondary use
p.000002: 2.3.1 As in 2.2.1, consider whether aggregate data on groups of individuals would serve the research objective. If not, consider whether non-identifiable
p.000002: data relating to individuals would serve the purpose.
p.000002:
p.000002: 2.3.2. Removal or coding of direct identifiers
p.000002: If identifiable data are required for the research purpose, direct identifiers should be avoided or concealed to the extent that is reasonably practical (e.g. as
p.000002: soon as a data linkage has been completed). Data without direct identifiers can be:
p.000002:
p.000002: coded to allow a trace-back to individuals, by means of:
p.000002: single-coding (the researcher has the key to the code to link the research data back to direct identifiers, which are held separately); or
p.000002: double-coding (an increased level of confidentiality protection over single coding because the data holder does not give the researcher the key
p.000002: to re-identify individuals); or
p.000002: without a code, if the capacity to trace the research data or results back to individuals is not required for the research purpose.
p.000002:
p.000002: Even if the direct identifiers in shared data have been removed or coded, consider how to minimize the collection or sharing of potentially identifying data
p.000002: elements.
p.000002:
p.000002:
p.000002: 2.4 Inductive data collection
p.000002: For inductive data collection, for example where open-ended interview techniques are used, the extent of personal data to be collected may not always be
p.000002: foreseeable in detail at the outset of the interview. In these cases, the ongoing negotiation of consent with research participants is the best way to ensure
p.000002: that the privacy of individuals and the community is being appropriately protected.
p.000002:
p.000002: Definition of terms: Individual identifiability of data
p.000002:
p.000002: Levels of data identifiability by capacity to identity or re-identify individuals
p.000002: In rank order from most to least identifiable
p.000002: 1) Directly identifiable: The data contains direct identifiers of an individual (e.g. name, address, health number).
p.000002:
p.000002: 2) Coded:
p.000002:
p.000002: i. Single coded: A participant's data are assigned a random code. Direct identifiers are removed from the dataset and held separately. The key
p.000002: linking the code back to direct identifiers is available only to a limited number (e.g. senior members) of the research team.
p.000002: ii. Double or multiple coded: Two or more codes are assigned to the same participant's data held in different datasets (e.g. health administrative
p.000002: data, clinical data, genetic samples and data). The key connecting the codes back to participants' direct identifiers is held by a third party (such as
p.000002: the data holder) and is not available to the researchers.
p.000002:
p.000002: 3) Not directly identifiable and not coded: Direct identifiers were never collected or have been deleted, and there is no code linking the data back to
p.000002: the individual's identity.
p.000002:
p.000002: 4) Non-identifiable: Any element or combination of elements that allows direct or indirect identification of an individual was never collected or has been
p.000002: removed, although some elements may indirectly identify a group or region. There is no code linking the data back to the individual's identity.
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: Summary guide: Levels of data identifiability needed for research-related purposes
p.000002:
p.000002: Research- Specific examples Data requested for these purposes when:
p.000002: related
p.000002: purposes
p.000002: Collecting data directly from Requesting data for secondary use:
p.000002: individuals:
p.000002:
p.000002:
p.000002: a) Contact Recruit individuals for a Direct identifiers Coded (Single coding is a more efficient mechanism for linking back
p.000002: individuals research project to individuals than double-coding. Linking back becomes
p.000002: increasingly difficult for investigators who receive double or multiple-
p.000002: Contact the participant coded data, and therefore do not have the key to the code.)
p.000002: for follow-up data
p.000002: collection
p.000002:
p.000002: Provide data, with
p.000002: consent, to health care
p.000002: provider for clinical
p.000002: monitoring of the
p.000002: participant
p.000002:
p.000002: Return individual results
p.000002: to the participant
p.000002:
p.000002: b) Data Conduct a data linkage Preferred: Direct identifiers (e.g. Preferred: Data holder conducts linkage and provides to researcher
p.000002: linkage 17 with a high degree of name and street address; or the linked dataset without direct identifiers. Data to be provided at
p.000002: accuracy personal health number) 18 the lowest level of identifiability needed, consistent with the
p.000002: research objectives.
p.000002: Conduct a data linkage Direct identifiers or potentially
p.000002: with a measurable identifying data items (e.g. date of
p.000002: degree of accuracy birth, initials, 3-character or full
p.000002: sufficient for the postal code, gender, specific health
p.000002: particular research data)
p.000002:
p.000002: c) Data Eliminate duplicate Direct identifiers or potentially Coded data so that the data holder (preferred) or researcher can
...
p.000063:
p.000063: Controlled access to personal data for research purposes
p.000063:
p.000063: Access to: Who should be permitted access: Required safeguards to include:
p.000063: (examples)
p.000063:
p.000063: Direct identifiers Selected members of the REB review and approval
p.000063: research team Review by institution data privacy committees where
p.000063: Selected institution employees relevant
p.000063: "Deemed employees" or Access on need-to-know basis
p.000063: trusted third parties, subject to Appropriate training
p.000063: the same undertaking of Undertaking of confidentiality by employees or research
p.000063: confidentiality as the data team
p.000063: holder (e.g. institution No direct access for researchers external to the research
p.000063: employees) team, except for linkage purposes in exceptional
p.000063: circumstances (see 8.2)
p.000063: Audit trails on access (where possible)
p.000063:
p.000063:
p.000063: Not directly identifiable data (single or Research team REB-approved projects
p.000063: double coded; or without codes) Collaborators at local sites of a Review by institution data privacy committees where
p.000063: multi-site study relevant
p.000063: External researchers, with Data-sharing agreement, including undertaking of
p.000063: limitations (see required confidentiality (see 8.3)
p.000063: safeguards). Disclosure of only enough data to answer the intended
p.000063: research question
p.000063:
p.000063:
p.000063: Non-identifiable data in public use files Scientific community There may be no restrictions on use, or there may be a
p.000063: (where data have been scrutinized and General public basic form of data sharing agreement, requiring an
p.000063: altered to protect against risks of Universities undertaking, for example, to not attempt to re-identify the
p.000063: inadvertent disclosure of individuals' records so as to relate the information on the file to a
p.000063: identities). 75 particular person. 76
p.000063:
p.000063:
p.000063:
p.000063: 8.2 Conducting data linkages
p.000063: The most secure way of conducting data linkages requested by external researchers is for the data holder to conduct the linkage and provide linked
p.000063: datasets to the researcher without identifiers, and at the minimum level of identifiability required for the research purpose. 77 If that is not practicable, a
...
Social / Occupation
Searching for indicator occupation:
(return to top)
p.000002: include such considerations as: (a) The type of data to be collected; (b) The purpose for which the data will be used;..." (pg. 3.3)
p.000002:
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002: General statement
p.000002: Researchers should plan to collect personal data only as necessary for the research. The amount of personal information collected and the level of
p.000002: identifiability and sensitivity of this information should be restricted to what is necessary to achieve the research objectives. 15
p.000002:
p.000002:
p.000002: 2.1. Personal data: Identifiability and sensitivity
p.000002: 2.1.1 Identifiability
p.000002:
p.000002: Limiting data identifiability means minimizing as much as possible, the collection of:
p.000002:
p.000002: direct identifiers (e.g. name, street address) and
p.000002: other data items that could potentially be used to identify an individual.
p.000002:
p.000002: Data identifiability can be characterized as being on a continuum, in which the division between degrees of "identifiability" are not always clear-cut. Even a
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
...
Social / Property Ownership
Searching for indicator home:
(return to top)
p.000002: 
p.000002: Canadian Institutes
p.000002: of Health Research
p.000002: Home î‚’ Collaboration î‚’ Ethics
p.000002:
p.000002:
p.000002:
p.000002:
p.000002: CIHR Best Practices for Protecting Privacy in Health
p.000002: Research (September 2005)
p.000002: Cat. No.: MR21-63/2005E-HTML
p.000002: ISBN: 0-662-41057-2
p.000002: Other format
p.000002:
p.000002: PDF version
p.000002:
p.000002: Table of contents (856 KB)
p.000002:
p.000002: Acronyms
p.000002: CIHR Privacy Advisory Committee: Recommendations
p.000002: Privacy Best Practices: 10 elements in summary form
p.000002: How to navigate the document: Areas of special interest
p.000002: Introduction
p.000002: CIHR's mandate
p.000002: Goals
p.000002: Statement of values
p.000002: Scope of application
p.000002: Commitment to continuous learning and review
p.000002: Privacy Best Practices: 10 elements
p.000002: Element #1 - Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002: Element #2 - Limiting the collection of personal data
p.000002: Element #3 - Determining if consent from individuals is required
p.000002: Element #4 - Managing and documenting consent
p.000002: Element #5 - Informing prospective research participants about the research
p.000002: Element #6 - Recruiting prospective research participants
p.000002: Element #7 - Safeguarding personal data
p.000002: Element #8 - Controlling access and disclosure of personal data
p.000002: Element #9 - Setting reasonable limits on retention of personal data
p.000002: Element #10 - Ensuring accountability and transparency in the management of personal data
p.000002: Appendices
...
p.000002: use of existing records with an REB waiver of the consent requirement, and then proposes to
p.000002: contact individuals for additional data collection; or
p.000002: negative impact of the findings of the research.
p.000002:
p.000002: 2) Potential benefits of the research to individuals, groups, communities or the public outweigh potential
p.000002: harms. Where there is only minimal risk of harm, the REB need only ensure that there is public interest or
p.000002: other merit in the proposed research (e.g. as determined by a peer-review committee). 27
p.000002:
p.000002:
p.000002: 3.3.3 A consent requirement being (1) 1) Seeking consent from individuals may be considered inappropriate because:
p.000002: inappropriate or (2) impracticable
p.000002: 28 a. there is potential harm to individuals from direct contact where there is:
p.000002: i. a risk of inflicting psychological, social or other harm by contacting individuals or families with
p.000002: particular conditions (e.g. where making contact might reveal an individual's condition to
p.000002: others, against the individual's wishes; or research with minors, which would normally require
p.000002: parental consent, when the minors are street youth who have left home to escape abuse) or in
p.000002: certain circumstances (e.g. during a hospital emergency room visit); or
p.000002: ii. a risk of creating additional threats to privacy by having to link otherwise usable coded data
p.000002: with identifiers in order to contact individuals to seek their consent; or
p.000002: b. contact with individuals is not permitted under a previous data-sharing agreement, law or policy.
p.000029: 29
p.000029:
p.000029:
p.000029: 2) Seeking consent from individuals for the use of their personal data may be considered impracticable
p.000029: 30 when there are difficulties in contacting or notifying individuals for reasons such as:
p.000029:
p.000029:
p.000029: the size of the population being researched;
p.000029: the proportion of prospective participants likely to have relocated or died since the time the personal
p.000029: information was originally collected; or
p.000029: the lack of an existing or continuing relationship between prospective participants and the data holder
p.000029: who would need to contact them (e.g. a patient database that does not have a regular follow-up
p.000029: program to maintain a complete and accurate record of changes in registrants' contact information
p.000029: over time);
p.000029:
p.000029: such that:
p.000029:
p.000029: a. there is a risk of introducing bias into the research because of the loss of data from segments of the
p.000029: population that cannot be contacted to seek their consent, thereby affecting the validity of results
...
p.000029: contemporaneous journal entry of the event and circumstances. These and like elements may sometimes need to be refined in concert with the REB,
p.000029: which plays an essential education and consultative role in the process of seeking free and informed consent. When in doubt about an issue involving
p.000029: free and informed consent, researchers should consult their REB." (pg. 2.2)
p.000029:
p.000029: [Witness of signatures]
p.000029:
p.000029: Article 2.4 Explanatory Text: "In some circumstances, having a witness to the signatures on the consent form may be felt to be appropriate. In law, the
p.000029: role of a witness is only to attest that the person actually signed the form; a witness is not responsible for certifying such factors as the signature being
p.000029: obtained under defined conditions or that the signers were competent. However, a court might subsequently seek the opinions of the witness on such
p.000029: issues". (pg. 2.8)
p.000029:
p.000029: [Time allocation]
p.000029:
p.000029: Article 2.4 Explanatory Text: "Rushing the process of free and informed consent or treating it as a perfunctory routine violates the principles of respect
p.000029: for persons, and may cause difficulty for potential subjects. The time required for the process of free and informed consent can be expected to depend
p.000029: on such factors as the magnitude and probability of harms, the setting where the information is given (e.g. hospital or home) and the subject's situation
p.000029: (e.g., level of anxiety, maturity or seriousness of disease)." (pg. 2.8)
p.000029:
p.000029: [Translating materials]
p.000029:
p.000029: Article 2.1 Explanatory text: "The requirement for free and informed consent should not disqualify research subjects who are not proficient in the
p.000029: language used by the researchers from the opportunity to participate in potential research. Such individuals may give consent provided that one or more
p.000029: of the following are observed to the extent deemed necessary by the REB, in the context of a proportionate approach to the harms envisaged in the
p.000029: research and the consent processes that are to be used: An intermediate not involved in the research study, who is competent in the language used by
p.000029: the researchers as well as that chosen by the research subject, is involved in the consent process; The intermediary has translated the consent
p.000029: document or approved an existing translation of the information relevant to the prospective subject; The intermediary has assisted the research subject in
p.000029: the discussion of the research study; The research subject has acknowledged, in his or her own language, that he or she understands the research
p.000029: study, and the nature and extent of his or her participation, including the risks involved, and freely gives consent..." (pg. 2.2.)
p.000029:
p.000029:
...
Searching for indicator property:
(return to top)
p.000086:
p.000086: Article 1.14 "Research to be performed outside the jurisdiction or country of the institution that employs the researcher shall undergo prospective ethics
p.000086: review both (a) by the REB within the researcher's institution; and (b) by the REB, where such exists, with the legal responsibility and equivalent ethical
p.000086: and procedural safeguards in the country or jurisdiction where the research is to be done." (pg. 1.12)
p.000086:
p.000086: LINK TO: Memorandum of Understanding on the Roles and Responsibilities in the Management of Federal Grants and Awards (MOU).
p.000086: Schedule 2- Ethics Review of Research Involving Humans.
p.000086:
p.000086: 1.0 Policy "The Agencies developed, approved and implemented a joint policy statement topromote the ethical conduct of research involving human
p.000086: subjects - the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS). The Agencies will only fund researchers,
p.000086: Institutions or partnering organizations that comply with the ethical principles and articles of the TCPS. In addition CIHR will only fund human pluripotent
p.000086: stemXcells research that adheres to its recently published guidelines.
p.000086:
p.000086: In addition to the TCPS, the ethics review of research involving humans may, where appropriate, be subject to other legislation and policies, such as:
p.000086:
p.000086: the Institution's own policy on research involving human subjects;
p.000086: the Québec Civil Code;
p.000086: provincial and federal legislation on privacy, con0dentiality, intellectual property, competence and other areas;
p.000086: Canada Food and Drug Act and Regulations;
p.000086: guidelines and policies of the Therapeutic Products Directorate of Health Canada;
p.000086: relevant laws, regulations and/or policies of other countries, when research is to be conducted in those countries;
p.000086: Good Clinical Practices: Consolidated Guidelines for clinical trials sponsored by industry, published by the International Conference on
p.000086: Harmonization.
p.000086:
p.000086: Researchers, Institutions and research ethics boards (REBs) should be aware of all applicable policies, regulations and guidelines. In some cases, it
p.000086: may be necessary for Institutions to have recourse to speci0c expertise to identify legal and other issues in the ethics review process..."
p.000086:
p.000086: Updates.
p.000086: References
p.000086: 1 Privacy Advisory Committee members are listed in Appendix A-1.
p.000086:
p.000086: 2 Under section 301(d) of the U.S. Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
p.000086: persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research.
p.000086: This authority has been delegated to the National Institutes of Health (NIH) and other Health and Human Services Agencies.
p.000086: Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for research
...
Social / Religion
Searching for indicator religion:
(return to top)
p.000086: disease or infirmity".
p.000086: From Preamble to the Constitution of the World Health Organization as adopted by the International Health Conference, New York, 19-22 June,
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
...
Social / Student
Searching for indicator student:
(return to top)
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
p.000029: [Evidence of consent]
p.000029:
p.000029: Article 2.1 "...(b) Evidence of free and informed consent by the subject or authorized third party should ordinarily be obtained in writing. Where written
...
Social / Threat of Stigma
Searching for indicator stigma:
(return to top)
p.000002:
p.000002:
p.000002: 2.1. Personal data: Identifiability and sensitivity
p.000002: 2.1.1 Identifiability
p.000002:
p.000002: Limiting data identifiability means minimizing as much as possible, the collection of:
p.000002:
p.000002: direct identifiers (e.g. name, street address) and
p.000002: other data items that could potentially be used to identify an individual.
p.000002:
p.000002: Data identifiability can be characterized as being on a continuum, in which the division between degrees of "identifiability" are not always clear-cut. Even a
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
...
p.000002: with collected. identifiability needed, consistent with the research objectives.
p.000002: individuals
p.000002: and no data
p.000002: linkage
p.000002: needed
p.000002: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000002:
p.000002: [REB approval of type of data]
p.000002:
p.000002: Article 3.2 "..researchers shall secure REB approval for obtaining identifiable personal information about subjects. Approval for such research shall
p.000002: include such considerations as: (a) the type of data to be collected..." (pg. 3.3)
p.000002:
p.000002: [Secondary use of data]
p.000002:
p.000002: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000002: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research..." (pg. 3.5)
p.000002:
p.000002: Article 3.3 Explanatory text: "Databases can vary greatly in the degree to which personal information is identifiable. A proportionate approach should be
p.000002: applied by the REB to evaluate the sensitivity of the information in the database and to modulate its requirements accordingly. If it is impossible to
p.000002: identify individuals whose records exist within a database, then researchers should be allowed access to that database. The REB must carefully
p.000002: appraise the possibility of identification, in particular with regard to the extent of the harm of stigma that might be attached to identification. The REB and
p.000002: the researcher should also be aware of legal provisions that affect the database(s) to be used in the research.
p.000002:
p.000002: REBs and researchers should also be sensitive to the context in which the database was created, such as a confidential relationship, as well as to the
p.000002: expectations of the groups or individuals at the time of the collection of the data with regard to its use, retention and disclosure. When it is unclear as to
p.000002: whether information is to be regarded as personal, researchers should consult their REBs. Confidential information collected in this manner should
p.000002: normally not be transmitted to authorities, unless required by law, the courts or similar legally constituted bodies." (pg. 3.5)
p.000002:
p.000002:
p.000002:
p.000002: Element #3 : Determining whether consent from individuals is required
p.000002:
p.000002: General statement
p.000002: Voluntary and informed consent from legally competent individuals or authorized third parties is a fundamental principle in research involving humans, and
p.000002: specifically for the use of their personal data. 19
p.000002:
p.000002: Under specified circumstances, given a satisfactory rationale by the researcher, an REB may approve the waiver of a consent requirement, or a partial
p.000002: waiver of some elements of a consent requirement. According to TCPS Article 2.1(c), the REB must find and document that: "(i)The research involves no
...
Searching for indicator threat:
(return to top)
p.000063: be sensitive if they discover that research was conducted on their data without their knowledge; others may not want any further contact. This potential
p.000063: harm underlines the importance for researchers to make all efforts to allow subjects the right to consent that their data and private information be part of
p.000063: a study." (pg. 3.6)
p.000063:
p.000063:
p.000063:
p.000063: Element #7: Safeguarding personal data
p.000063:
p.000063: General statement
p.000063: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
p.000063: safeguards should include organizational, technological and physical measures. 71
p.000063:
p.000063: Researchers should take a risk assessment and management approach to protecting research data from loss, corruption, theft or unauthorized disclosure,
p.000063: as appropriate for the sensitivity and identifiability of the data. Formal privacy impact assessments (PIAs) are required in some institutions and under
p.000063: legislation or policy in some jurisdictions. 72
p.000063:
p.000063: REBs should review and approve researchers' proposed measures for safeguarding any personal data to be collected.
p.000063:
p.000063: The safeguards described in this Element are particularly relevant to research conducted within large institutions or other organizations. However, smaller
p.000063: scale projects should also demonstrate acceptable ways of protecting the confidentiality of data.
p.000063:
p.000063:
p.000063: 7.1 Threat-risk vulnerability assessment 73
p.000063:
p.000063: A vulnerability assessment assists researchers and institutions in determining an appropriate level of security for research data and the means by which
p.000063: the data should be received, used, stored, and managed. The following are the main steps in a vulnerability assessment:
p.000063:
p.000063: Assessment Examples
p.000063: a) Determine what assets need to be protected Databases and files of personal and other confidential data
p.000063: Database management software
p.000063: Computer hardware, fax machines
p.000063:
p.000063:
p.000063: b) Determine what to protect against Five main classes of threats are: disclosure, interruption, modification, destruction and
p.000063: removal or loss
p.000063:
p.000063:
p.000063: c) Assess the probability of the threat occurring Low, medium or high
p.000063:
p.000063:
p.000063: d) Assess the magnitude of the impact and Loss of public trust
p.000063: consequences of the threat if it occurs Harms to individuals (loss of privacy or trust; social stigmatization; social discrimination
p.000063: affecting financial, employment, insurance, or other status; loss of benefits)
p.000063: Loss of data or equipment.
p.000063:
p.000063:
p.000063: e) Assess existing safeguards and need for Direct identifiers are separated from personal records as soon as reasonably practicable.
p.000063: additional safeguards Highly identifiable and sensitive data are stored at the highest level of security, e.g. on stand-
p.000063: alone servers.
p.000063: Pledge of confidentiality signed by all research staff.
p.000063:
p.000063:
p.000063: f) Recommend the appropriate security See security measures proposed in 7.2 below
p.000063: safeguards to protect the assets from threats
p.000063:
p.000063: g) Update and regularly review these safeguards Respond to changes in:
p.000063: (at least annually) the internal technological environment (including improvements in security strategies),
p.000063: the research project and the institution,
p.000063: technologies available to threat agents and
p.000063: the profile of potential threats.
p.000063:
p.000063:
p.000063:
p.000063: 7.2 Security measures
p.000063: 7.2.1 Organizational safeguards
p.000063:
p.000063: There should be ongoing commitment to privacy and continued emphasis of its importance by all involved in the research and the
p.000063: institutional/organizational management.
p.000063: All involved in the research project should be subject to a pledge of confidentiality.
p.000063: Access to personal information should be strictly limited in terms of numbers of persons, for legitimate purposes, and strictly on a realistic need-to-
p.000063: know basis.
p.000063: Data-sharing agreements between the researcher/institution and all involved should be signed prior to providing any access to data.
p.000063: Consequences for breach of confidentiality, including dismissal and/or loss of institutional privileges, should be clearly stipulated.
p.000063: Institutions and organizations housing research projects and archived data should, with ongoing commitment of adequate resources:
p.000063: develop, monitor and enforce privacy and security policies and procedures;
p.000063: appoint privacy officers and create data stewardship committees as needed; and
p.000063: implement internal and external privacy reviews and audits.
p.000063:
p.000063: 7.2.2 Technological measures
p.000063:
p.000063: Encryption, scrambling of data and other methods of reducing the identifiability of data should be used to eliminate unique profiles of potentially
p.000063: identifying information.
p.000063: Direct identifiers should be removed or destroyed at the earliest possible opportunity.
...
p.000086: The data holder's access to data for recruitment purposes must be in accordance with applicable legislation.
p.000086: See the legal concordance table for Element #6, Appendix A-7.
p.000086:
p.000086: 66 See also Element #8.
p.000086:
p.000086: 67 See the legal concordance table for Element #6, Appendix A-7.
p.000086:
p.000086: 68 For example, see Case Study #10 in CIHR's Secondary Use of Personal Information in Health Research: Case Studies , November 2002 in
p.000086: which initial contact by physicians of "hard-to-reach" patients would have confounded the results of the study which was investigating effective
p.000086: strategies for contacting patients.
p.000086: Also, because this study involved contacting patients about visiting their physicians for cancer screening services, physicians' involvement in the
p.000086: research was limited by a policy that existed at that time which prevented them from soliciting patients to come in for services.
p.000086:
p.000086: 69 The REB should weigh the benefits of the research and the potential for a perceived invasion of privacy and any legal prohibitions against
p.000086: researchers' contacting individuals. See Element #3, 3.3.2 (b).
p.000086: See also the legal concordance table for Element #6, in Appendix A-7.
p.000086:
p.000086: 70 See references to Camouflage techniques in the following: Scenario 6.3.5 (b); Element #7, 7.2.2 4th bullet; and the Glossary, Appendix A-6.
p.000086:
p.000086: 71 See the table of concordance for Element #7, Part 1, in Appendix A-7, for statutory references to general safeguarding obligations.
p.000086: 72 See the legal concordance table for Element #7, Part 2, in Appendix A-7.
p.000086:
p.000086: 73 Adapted from RCMP Security Information Publication 5, Guide to Threat and Risk Assessment for Information Technology, November 1994.
p.000086:
p.000086: 74 See the Glossary in Appendix A-6 for the definition of Camouflaged Contacting.
p.000086:
p.000086: 75 For more information on disclosure control, refer to Statistics Canada Research Data Centres (RDCs) Guide for Researchers Under Agreement
p.000086: with Statistics Canada, July 2004.
p.000086:
p.000086: 76 See, for example, the data acquisition and use agreement for Statistics Canada public use microdata files under the Data Liberation Initiative.
p.000086:
p.000086: 77 The linked dataset may have direct identifiers removed or coded, or be made non-identifiable, depending on the needs of the research. See
p.000086: Element #2, 2.2.2, 2.3, and Summary Guide in that section.
p.000086:
p.000086: 78 Refer to table of concordance for Element #8, Part 1, in Appendix A-7, for statutory cross-references to data matching/linking provisions.
p.000086:
p.000086: 79 Refer to the table of concordance for Element #8, Part 2, in Appendix A-7, for statutory provisions for research data-sharing agreements.
p.000086:
p.000086: 80 See also Element #1.
p.000086:
p.000086: 81 See also Element #2.
p.000086:
p.000086: 82 See also Element #4 and #5.
p.000086:
p.000086: 83 See also Element #3 (3.3) and #6; and the legal concordance table for Element #6 in Appendix A-7 for restrictions on contact.
p.000086:
p.000086: 84 See also Element #7.
p.000086:
p.000086: 85 See also Element #9.
p.000086:
p.000086: 86 See also Element #10.
p.000086:
p.000086: 87 See also Element #10.
p.000086:
p.000086: 88 See also Element #10.
p.000086:
p.000086: 89 For example, see CIHR's Procedure for Addressing Allegations of Non-compliance with Research Policies.
p.000086:
...
Searching for indicator stigmatization:
(return to top)
p.000002: ongoing consent, are very important.
p.000002:
p.000002:
p.000002: Element #5: Informing prospective research participants about the research
p.000002:
p.000002:
p.000002:
p.000002: Researchers should provide to prospective participants or to authorized third parties disclosure of all information relevant to voluntary and informed
p.000002: consent.
p.000002:
p.000002: Information should be communicated to prospective participants in plain language, in oral and/or written form, so that it is easily understood.
p.000002:
p.000002: The amount of time taken to communicate information to prospective participants should be appropriate to the need, not excessive nor too brief. For
p.000002: example, the information could be layered, with a one-page summary of the research, a short consent form, an appendix with more detailed information
p.000002: and instructions on how to obtain more information.
p.000002:
p.000002: During the consent process, the researcher should determine whether the participant wishes to be informed of any meaningful research results that
p.000002: specifically relate to them.
p.000002:
p.000002: Researchers, particularly those in the areas of health services, population and public health, and genetics/genomic research who study whole populations,
p.000002: should strive to communicate with the relevant population and governmental authorities regarding results that are pertinent to the improvement of health
p.000002: and/or the prevention of disease. The population studied should be made aware of possible socio-economic discrimination or group stigmatization as a
p.000002: result of the research results, such as because of perceptions of genetic risks. In the context of genetic research, the population should also be informed of
p.000002: the means taken to minimize the risks.
p.000002:
p.000002: In the consent process and discussion, researchers using qualitative methods may consider involving participants in the writing and reporting process,
p.000002: depending on the circumstances.
p.000002:
p.000002: For a hybrid project involving the direct collection of data from individuals and secondary use of data from other sources , the prospective research
p.000002: participant should also be informed of all expected types and sources of personal data to be used, any expected linkages and the expected purposes for
p.000002: which data will be used.
p.000002:
p.000002: When personal data are to be entered into a database for multiple research uses over an extended period, research participants should also be informed of
p.000002: such things as: expected types of studies, expected data types and purposes, expected commercial uses, data retention period, and the process for
p.000002: overseeing the use and security of data. Participants may also be given the opportunity to provide authorization for future uses, with or without re-contact,
p.000002: including the opportunity to withdraw consent (and any identifying information) in the future. Additional options may include:
p.000002:
p.000002: to be re-contacted on a regular (or as needed basis) to seek consent for new research uses of the data, if desired and practicable; and/or
p.000002: to not be re-contacted, but to authorize the researchers to use the data only in certain ways in the future (e.g. with or without direct identifiers, coded
...
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
p.000002: If yes, the researcher will likely propose the collection of direct identifiers.
p.000002:
p.000002: If these are not requirements of the research, the researcher should not collect direct identifiers. However, other potentially identifying elements may be
p.000002: needed to answer the research questions and for other data management reasons, such as to check for duplicate records. The lowest level of identifiability
p.000002: of these other data items should be used, consistent with the research objectives.
p.000002: Examples of reducing personal detail in specific data items collected:
p.000002:
p.000002: Personal Details Most Identifiable
...
p.000002:
p.000002: Factor Explanation
p.000002:
p.000002: 3.3.1 Necessity of the personal data Personal data, in the proposed amount and at the proposed level of identifiability and sensitivity, are
p.000002: necessary to fulfill the research objectives. (See Element #2)
p.000002: 3.3.2 Harm-benefit analysis, where (1) 1) The research should present minimal risk of harm to individuals and, if appropriate, particular groups or
p.000002: the risk of harm is minimal, and communities. In assessing potential harm, REBs should consider:
p.000002: (2) potential benefits of the
p.000002: the probability of harm (related to the identifiability of data 24 and the adequacy of security
p.000002: research to the public and
p.000002: measures) 25 , and
p.000002: individuals outweigh any potential
p.000002: the magnitude of potential harm (related to the sensitivity of data), 26 including potential:
p.000002: harm to research participants or
p.000002: physical injury;
p.000002: data subjects
p.000002: emotional or psychological harm;
p.000002: social harm (e.g. stigmatization);
p.000002: financial harm (e.g. insurability, employability);
p.000002: loss of trust;
p.000002: harm from a perceived invasion of privacy, such as when a researcher has made secondary
p.000002: use of existing records with an REB waiver of the consent requirement, and then proposes to
p.000002: contact individuals for additional data collection; or
p.000002: negative impact of the findings of the research.
p.000002:
p.000002: 2) Potential benefits of the research to individuals, groups, communities or the public outweigh potential
p.000002: harms. Where there is only minimal risk of harm, the REB need only ensure that there is public interest or
p.000002: other merit in the proposed research (e.g. as determined by a peer-review committee). 27
p.000002:
p.000002:
p.000002: 3.3.3 A consent requirement being (1) 1) Seeking consent from individuals may be considered inappropriate because:
p.000002: inappropriate or (2) impracticable
p.000002: 28 a. there is potential harm to individuals from direct contact where there is:
p.000002: i. a risk of inflicting psychological, social or other harm by contacting individuals or families with
p.000002: particular conditions (e.g. where making contact might reveal an individual's condition to
...
p.000029: Participants should also be informed about how to obtain more details if desired (e.g. via a web site or a toll-free telephone number).
p.000029:
p.000029:
p.000029: 5.3 Communicating results back to research participants
p.000029: 5.3.1 Informing research participants about results specifically relating to themselves
p.000029:
p.000029: During the consent process, the researcher should determine whether the participant wishes to be informed of any meaningful research results that
p.000029: specifically relate to them. 43 Also, there should be agreement on how any results relating to the participant will be communicated to the participant (e.g.
p.000029: whether the information will be provided first to a genetic counsellor or a health care provider).
p.000029:
p.000029: 5.3.2 Informing populations of general results and potential negative impacts
p.000029:
p.000029: The results of research should be made public to contribute towards better understanding of the health issue under investigation. Researchers, particularly
p.000029: those in the areas of health services, population and public health, and genetics or genomic research, who study whole populations, should strive to
p.000029: communicate with the relevant population and governmental authorities regarding results that are pertinent to the improvement of health and/or the
p.000029: prevention of disease. Where appropriate, researchers, in collaboration with the population concerned, should facilitate the development and the
p.000029: implementation of a follow-up plan in response to the research findings. 44
p.000029:
p.000029: The population studied should be made aware of possible socio-economic discrimination or group stigmatization as a result of the research results, for
p.000029: example, due to perceptions of genetic risks. In the context of genetic research, the population should also be informed of the means taken to minimize the
p.000029: risks. To avoid misleading or unrealistic expectations, the researchers should make known the limitations of the research results and of their practical or
p.000029: potential application. 45
p.000029:
p.000029:
p.000029: 5.4 Qualitative research
p.000029: Researchers using qualitative methods may consider involving participants in the writing and reporting process, depending on the circumstances. For
p.000029: example, during the process of informing prospective research participants about the research, it may be appropriate:
p.000029:
p.000029: to provide participants with the opportunity to look at transcripts and to delete or footnote what they consider to be inaccurate or sensitive information
p.000029: (known as member-checking);
p.000029: to ask participants if they wish to be publicly acknowledged in articles coming from the research; or
p.000029: to invite community leaders or representatives to help interpret the findings to their constituencies.
p.000029:
p.000029:
p.000029: 5.5 Providing information about privacy to prospective research participants
p.000029: The following categories of information relating to privacy matters should be included in the information provided to prospective research participants:
p.000029:
p.000029: Basic information Explanation
p.000029:
p.000029: 1) Research Specific research objectives and related questions.
p.000029: objectives 46
p.000029: and procedure
p.000029:
p.000029: 2) Data types and Types of data to be collected and why.
p.000029: uses 47 Any planned or foreseeable commercial uses of the data.
...
p.000063:
p.000063:
p.000063: 7.1 Threat-risk vulnerability assessment 73
p.000063:
p.000063: A vulnerability assessment assists researchers and institutions in determining an appropriate level of security for research data and the means by which
p.000063: the data should be received, used, stored, and managed. The following are the main steps in a vulnerability assessment:
p.000063:
p.000063: Assessment Examples
p.000063: a) Determine what assets need to be protected Databases and files of personal and other confidential data
p.000063: Database management software
p.000063: Computer hardware, fax machines
p.000063:
p.000063:
p.000063: b) Determine what to protect against Five main classes of threats are: disclosure, interruption, modification, destruction and
p.000063: removal or loss
p.000063:
p.000063:
p.000063: c) Assess the probability of the threat occurring Low, medium or high
p.000063:
p.000063:
p.000063: d) Assess the magnitude of the impact and Loss of public trust
p.000063: consequences of the threat if it occurs Harms to individuals (loss of privacy or trust; social stigmatization; social discrimination
p.000063: affecting financial, employment, insurance, or other status; loss of benefits)
p.000063: Loss of data or equipment.
p.000063:
p.000063:
p.000063: e) Assess existing safeguards and need for Direct identifiers are separated from personal records as soon as reasonably practicable.
p.000063: additional safeguards Highly identifiable and sensitive data are stored at the highest level of security, e.g. on stand-
p.000063: alone servers.
p.000063: Pledge of confidentiality signed by all research staff.
p.000063:
p.000063:
p.000063: f) Recommend the appropriate security See security measures proposed in 7.2 below
p.000063: safeguards to protect the assets from threats
p.000063:
p.000063: g) Update and regularly review these safeguards Respond to changes in:
p.000063: (at least annually) the internal technological environment (including improvements in security strategies),
p.000063: the research project and the institution,
p.000063: technologies available to threat agents and
p.000063: the profile of potential threats.
p.000063:
p.000063:
p.000063:
p.000063: 7.2 Security measures
p.000063: 7.2.1 Organizational safeguards
p.000063:
p.000063: There should be ongoing commitment to privacy and continued emphasis of its importance by all involved in the research and the
p.000063: institutional/organizational management.
p.000063: All involved in the research project should be subject to a pledge of confidentiality.
...
Social / Victim of Abuse
Searching for indicator abuse:
(return to top)
p.000002: dataset without direct identifiers may present a risk of indirectly identifying data subjects if the dataset contains sufficient information about the individuals
p.000002: concerned.
p.000002:
p.000002: For example, data items that may increase the likelihood of an individual's identity being inadvertently revealed include:
p.000002:
p.000002: geographic location (e.g. location of residence, location of health event),
p.000002: named facilities and service providers,
p.000002: dates (e.g. date of an automobile accident),
p.000002: uncommon characteristics of the individual (e.g. a rare health condition or occupation), or
p.000002: highly visible characteristics of the individual (e.g. ethnicity in certain locales).
p.000002:
p.000002: These types of data items, if needed for the research, should be collected at a minimum level of detail consistent with the research objectives.
p.000002:
p.000002: 2.1.2 Sensitivity
p.000002:
p.000002: The sensitivity of personal data is related to the potential for harm or stigma that might attach to the identification of an individual because of the nature of
p.000002: the information. 16 The type of information that an individual may consider sensitive could relate to:
p.000002:
p.000002: sexual attitudes, practices and orientation;
p.000002: use of alcohol, drugs, or other addictive substances;
p.000002: illegal activities;
p.000002: suicide; sexual abuse;
p.000002: sexual harassment;
p.000002: an individual's psychological well-being or mental health;
p.000002: some types of genetic information (e.g. information that predicts future illness or disability and raises concerns around future employability or
p.000002: insurability); and
p.000002: any other information that, if released, might lead to social stigmatization or discrimination.
p.000002:
p.000002: Researchers should also be aware of information that communities may consider sensitive because, for example, of its potential to stigmatize a community.
p.000002:
p.000002:
p.000002: 2.2 Collection from individuals
p.000002: 2.2.1 Consider first whether individually identifiable data are needed, or whether non-identifiable data or aggregate data would serve the research
p.000002: objectives (e.g. data on individuals grouped by age or some other meaningful variable).
p.000002:
p.000002: 2.2.2 If identifiable data are needed to meet the research objectives, determine the minimum level of identifiability that will be needed.
p.000002:
p.000002: Does the researcher need to do any or all of the following:
p.000002:
p.000002: Contact the research participant for follow-up data collection?
p.000002: Provide data, with consent, to a health care provider to ensure clinical monitoring of the participant?
p.000002: Return individual results to the participant?
p.000002: Conduct data linkage with a high degree of accuracy?
p.000002:
p.000002: If yes, the researcher will likely propose the collection of direct identifiers.
p.000002:
...
p.000002: contact individuals for additional data collection; or
p.000002: negative impact of the findings of the research.
p.000002:
p.000002: 2) Potential benefits of the research to individuals, groups, communities or the public outweigh potential
p.000002: harms. Where there is only minimal risk of harm, the REB need only ensure that there is public interest or
p.000002: other merit in the proposed research (e.g. as determined by a peer-review committee). 27
p.000002:
p.000002:
p.000002: 3.3.3 A consent requirement being (1) 1) Seeking consent from individuals may be considered inappropriate because:
p.000002: inappropriate or (2) impracticable
p.000002: 28 a. there is potential harm to individuals from direct contact where there is:
p.000002: i. a risk of inflicting psychological, social or other harm by contacting individuals or families with
p.000002: particular conditions (e.g. where making contact might reveal an individual's condition to
p.000002: others, against the individual's wishes; or research with minors, which would normally require
p.000002: parental consent, when the minors are street youth who have left home to escape abuse) or in
p.000002: certain circumstances (e.g. during a hospital emergency room visit); or
p.000002: ii. a risk of creating additional threats to privacy by having to link otherwise usable coded data
p.000002: with identifiers in order to contact individuals to seek their consent; or
p.000002: b. contact with individuals is not permitted under a previous data-sharing agreement, law or policy.
p.000029: 29
p.000029:
p.000029:
p.000029: 2) Seeking consent from individuals for the use of their personal data may be considered impracticable
p.000029: 30 when there are difficulties in contacting or notifying individuals for reasons such as:
p.000029:
p.000029:
p.000029: the size of the population being researched;
p.000029: the proportion of prospective participants likely to have relocated or died since the time the personal
p.000029: information was originally collected; or
p.000029: the lack of an existing or continuing relationship between prospective participants and the data holder
p.000029: who would need to contact them (e.g. a patient database that does not have a regular follow-up
p.000029: program to maintain a complete and accurate record of changes in registrants' contact information
p.000029: over time);
p.000029:
p.000029: such that:
p.000029:
p.000029: a. there is a risk of introducing bias into the research because of the loss of data from segments of the
p.000029: population that cannot be contacted to seek their consent, thereby affecting the validity of results
p.000029: and/or defeating the purpose of the study; or
...
Social / Women
Searching for indicator women:
(return to top)
p.000029: 4.2.1 Written documentation signed by the research participant (preferred)
p.000029:
p.000029: Whenever appropriate and practicable, a written documentation of opting-in or opting-out of research is preferred. This should be documented using a
p.000029: consent form or refusal statement signed by the individual.
p.000029:
p.000029: 4.2.2 Oral consent documented by the researcher
p.000029:
p.000029: Where oral consent is obtained for telephone interviews, where written documentation is culturally unacceptable, or where there are good reasons for not
p.000029: recording opt-in or opt-out in writing using a form that the participant signs, an oral procedure should be managed and documented, indicating that the opt-in
p.000029: or opt-out was conducted orally.
p.000029:
p.000029: 4.2.3 Documented consent and collection of data without direct personal identifiers
p.000029:
p.000029: Collection of data without direct personal identifiers may be necessary or proposed when the research deals with highly sensitive conditions or activities. In
p.000029: such circumstances, consent should be documented but the identity of research participants should not be linkable to their data or to results of analyses.
p.000029:
p.000029: Example: Oral consent and non-identifiable data and results
p.000029:
p.000029: Disease X prevalence study among women undergoing abortion in City Y. Before undergoing therapeutic abortions, women must necessarily
p.000029: have a blood test.
p.000029:
p.000029: Women who were scheduled for therapeutic abortions were approached in a hospital clinic about their willingness to participate in the study on Disease
p.000029: X. Those who gave oral consent to participate in this study agreed to fill out questionnaires (without providing their names) about certain risk factors for
p.000029: disease X, and to permit the testing of leftover blood from the blood test for the presence of disease X.
p.000029:
p.000029: For each participant, the computer generated a specific scrambled code linking the blood sample for the disease test and the answers to the
p.000029: questionnaire. Once the results of the disease tests were linked to the corresponding questionnaire, the computer-generated code was removed. In this
p.000029: way, it was not possible to identify the research participants, even if one had used the same computer program to try to retrace the scrambled codes.
p.000029:
p.000029: The linked information for each person was thus non-identifiable so that the researchers could look at risk factors and determine the incidence of
p.000029: disease X but could not identify any of the research participants.
p.000029:
p.000029:
p.000029:
p.000029: Example: Documented consent and non-identifiable data and results
p.000029:
p.000029: From a study on workplace injuries in nursing and laboratory staff
p.000029: ...The study questionnaire had no name or code number on it and participants were asked not to write their name on it. The cover letter from the
...
Social / Youth/Minors
Searching for indicator youth:
(return to top)
p.000002: use of existing records with an REB waiver of the consent requirement, and then proposes to
p.000002: contact individuals for additional data collection; or
p.000002: negative impact of the findings of the research.
p.000002:
p.000002: 2) Potential benefits of the research to individuals, groups, communities or the public outweigh potential
p.000002: harms. Where there is only minimal risk of harm, the REB need only ensure that there is public interest or
p.000002: other merit in the proposed research (e.g. as determined by a peer-review committee). 27
p.000002:
p.000002:
p.000002: 3.3.3 A consent requirement being (1) 1) Seeking consent from individuals may be considered inappropriate because:
p.000002: inappropriate or (2) impracticable
p.000002: 28 a. there is potential harm to individuals from direct contact where there is:
p.000002: i. a risk of inflicting psychological, social or other harm by contacting individuals or families with
p.000002: particular conditions (e.g. where making contact might reveal an individual's condition to
p.000002: others, against the individual's wishes; or research with minors, which would normally require
p.000002: parental consent, when the minors are street youth who have left home to escape abuse) or in
p.000002: certain circumstances (e.g. during a hospital emergency room visit); or
p.000002: ii. a risk of creating additional threats to privacy by having to link otherwise usable coded data
p.000002: with identifiers in order to contact individuals to seek their consent; or
p.000002: b. contact with individuals is not permitted under a previous data-sharing agreement, law or policy.
p.000029: 29
p.000029:
p.000029:
p.000029: 2) Seeking consent from individuals for the use of their personal data may be considered impracticable
p.000029: 30 when there are difficulties in contacting or notifying individuals for reasons such as:
p.000029:
p.000029:
p.000029: the size of the population being researched;
p.000029: the proportion of prospective participants likely to have relocated or died since the time the personal
p.000029: information was originally collected; or
p.000029: the lack of an existing or continuing relationship between prospective participants and the data holder
p.000029: who would need to contact them (e.g. a patient database that does not have a regular follow-up
p.000029: program to maintain a complete and accurate record of changes in registrants' contact information
p.000029: over time);
p.000029:
p.000029: such that:
p.000029:
p.000029: a. there is a risk of introducing bias into the research because of the loss of data from segments of the
...
Social / education
Searching for indicator education:
(return to top)
p.000002: ongoing legislative developments. Recognizing that important issues have yet to be addressed (see Key Outstanding Issues), these should be
p.000002: tackled by developing supporting modules with the active engagement of the relevant communities and through targeted research.
p.000002: There should be an assessment of the impact that the Best Practices will have over time on research ethics board decision-making and researcher
p.000002: practice. Mechanisms should be put in place to enable this assessment. These mechanisms should include a formal process, such as a CIHR
p.000002: Standing Committee, to assess implementation and the need for improvement of the Best Practices over time. A web tool should be considered for
p.000002: channelling research findings and capturing practical experiences to inform the ongoing evolution of the Best Practices.
p.000002:
p.000002:
p.000002: Implementation strategy
p.000002: These Privacy Best Practices should be revised in two years. With ongoing feedback and evaluation, PAC expects that the Best Practices will be
p.000002: adapted, as necessary, for the purpose of becoming mandatory CIHR funding policy. These Best Practices should also be referred to the
p.000002: Interagency Advisory Panel on Research Ethics with a view to encouraging their eventual application, in revised form, as Tri-Agency funding policy.
p.000002: For this to happen, the social science perspective needs to be strengthened.
p.000002:
p.000002:
p.000002: Support for implementation
p.000002: Underpinning the implementation strategy for these Privacy Best Practices, there should be a strong emphasis on the importance of training and
p.000002: education support for institutions, research ethics boards and researchers. CIHR should consider developing a web-based document as an
p.000002: educational resource.
p.000002: In addition, institutions should be encouraged to provide adequate support for the infrastructure needed to implement and operationalize these Best
p.000002: Practices on a systematic basis. PAC recommends that there be a line item in the budget of researchers' grant applications to accurately reflect the
p.000002: increased cost involved in adhering to these Best Practices so as to enhance commitment and feasibility.
p.000002:
p.000002:
p.000002: Harmonization of oversight framework
p.000002: There should be continuing efforts by CIHR to support and influence the federal, provincial and territorial legislative harmonization agenda as well as
p.000002: the development of a national system of research ethics oversight.
p.000002:
p.000002:
p.000002: Key outstanding issues
p.000002: Privacy concerns related to the transnational flow of data need to be addressed. These could include clear interpretive provisions and the
p.000002: development of coherent and reciprocal minimum standards to be included in international data transfer agreements.
p.000002: A separate process or initiative should be undertaken to develop a policy framework for the physical collection, use and storage of human biological
p.000002: specimens (in contrast to the personal information that may be derived from those specimens) as these are critically important and complex areas of
p.000002: activity that are having increasing importance in research.
...
p.000002:
p.000002: Retention periods for personal data should be defined in writing. Researchers should be explicit about what they plan to do with the data they collect and
p.000002: have storage, management and access policies in place.
p.000002:
p.000002: When personal data are collected in a database to support general health research purposes in the future, personal data may be retained for the general
p.000002: purposes originally consented to, subject to security safeguards proportionate to the identifiability and sensitivity of the data.
p.000002:
p.000002: Administrative databases such as hospital discharge records and vital statistics registries, which may be used to support health research, may retain
p.000002: personal data over the long-term, provided that this is permitted according to legislation or the mandate of a public body such as a government health
p.000002: department.
p.000002:
p.000002: Any long-term retention of personal data established for general health research purposes should be subject to periodic audits and effective oversight by
p.000002: independent third parties including REBs.
p.000002:
p.000002:
p.000002: Element #10: Ensuring accountability and transparency in the management of personal data
p.000002:
p.000002:
p.000002:
p.000002: Individuals and organizations engaged in health research involving personal data are accountable for the proper conduct of such research in accordance
p.000002: with applicable funding policies, privacy principles and/or legislation. Processes and practices must be clearly established and implemented in order to give
p.000002: meaningful effect to these policies, principles or laws. Proper accountability and transparency practices require adequate resources for such things as
p.000002: communication, education and training relating to privacy.
p.000002:
p.000002: Roles and responsibilities of all those involved in the conduct and evaluation of research should be clearly defined and understood, including those of
p.000002: researchers, their employing institutions, REBs, any data stewardship committees, Privacy Commissioners and other legally-designated privacy oversight
p.000002: agencies. Their concerted efforts should aim to provide a coherent governance structure for effective and efficient data stewardship.
p.000002:
p.000002: Recognizing that transparency may enhance public support for, and interest in, socially valuable research, individuals and organizations engaged in the
p.000002: conduct and evaluation of health research should:
p.000002:
p.000002: be open to the public with respect to the objectives of the research;
p.000002: be open about the policies and practices relating to the protection of personal data used in the research;
p.000002: promote ongoing dialogue between the research community and privacy oversight agencies; and
p.000002: promote ongoing dialogue between the research community and the community at large (the public).
p.000002:
p.000002: When a database is created for multiple research purposes, or across multiple sites or jurisdictions, researchers and institutional data holders should
p.000002: promote coordinated and streamlined approaches to the review of privacy and confidentiality concerns, and to data stewardship over the long term.
p.000002:
p.000002: A centralized data stewardship committee could be put in place to authorize future uses of the database in accordance with the research objectives and,
p.000002: where applicable, within the parameters set by the consent obtained from participants. The responsibilities of this committee could include the review of
...
p.000002: to health research that requires ethics review under the TCPS. 9
p.000002:
p.000002: Health research is interdependent on a range of knowledge-generating activities that are generally perceived to be outside the boundaries of research, but
p.000002: which are related to the improvement of health and health services. These "non-research" activities, such as public health surveillance, health service
p.000002: management, and program quality assurance and improvement, are beyond the manageable scope of the present document. In the future, however, these
p.000002: Best Practices could potentially serve as models for best practices in these related areas, with the necessary adaptations.
p.000002:
p.000002: Personal information
p.000002:
p.000002: These Best Practices cover identifiable personal information. Identifiable personal information may contain a direct link to a specific individual (e.g. name
p.000002: and street address, personal health number, etc.) or any element or a combination of elements that allows indirect identification of an individual (e.g. if birth
p.000002: date combined with postal code and other personal information on the record such as ethnicity could lead to the identification of an individual).
p.000002:
p.000002: The TCPS definition of identifiable personal information covers a wide range of personal information that may be used in the conduct of research. 10
p.000002: For example, health researchers may need information about such things as a person's clinical history and use of health care services, but also about
p.000002: broad determinants of health, such as a person's education, employment, and income level.
p.000002:
p.000002: The scope of personal information covered in these Privacy Best Practices includes personal information derived from blood and other human biological
p.000002: materials (e.g. information such as blood type, DNA code and the presence or absence of disease), but not the materials themselves. The privacy issues
p.000002: related to the banking, storage and use of those biological materials are beyond the scope of this document.
p.000002:
p.000002:
p.000002: Commitment to continuous learning and review
p.000002: These Privacy Best Practices are expected to evolve over time in response to changes in the circumstances of research and as new best practices
p.000002: emerge. One of the valuable ways in which researchers, REBs and institutions can assist the evolution of this document is by bringing to the attention of
p.000002: the CIHR Ethics Office lessons learned through the application of these Best Practices and suggesting areas for further development.
p.000002:
p.000002: Emailed feedback can be sent to the CIHR Ethics Office at ethics-ethique@cihr-irsc.gc.ca.
p.000002:
p.000002:
p.000002: Privacy Best Practices: 10 Elements
p.000002:
p.000002: How to read these elements
p.000002: These Best Practices are organized into a series of elements that should be considered in the design, conduct and evaluation of health research to address
p.000002: privacy and confidentiality concerns. These elements are not meant to represent a step-by-step process, since many of the elements are interdependent.
p.000002:
p.000002: As noted in the Introduction, the TCPS and the laws of Canada are the minimum standard for protecting privacy and confidentiality in health research. To
...
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
p.000002: management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: Describe the general types of personal data that are necessary for these general research objectives (e.g. diagnoses, risk factors, outcomes). Include data
p.000002: that are expected to be collected over the lifespan of the database, particularly if there will be multiple data collection periods per participant, or data that will
p.000002: be requested from secondary sources. Be as specific as possible.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research database on disease X
p.000002:
p.000002: Research objectives:
p.000002:
p.000002: 1. Compiling statistics on population trends in disease X and in its risk factors.
p.000002: 2. Conducting health and epidemiological research to improve screening and treatment programs for disease X.
p.000002:
p.000002: Types of research questions (examples):
p.000002:
p.000002: 1. What is the association between disease X and risk factors such as diet, tobacco use, physical activity level, education, income or gender?
p.000002: 2. What is the risk of developing disease X after exposure to environmental risk factors, such as pollutants in the area of residence?
p.000002: 3. What is the cost-effectiveness and efficacy of screening programs for disease X?
p.000002: Types of personal data to be collected over multiple collection periods Research justification
p.000002:
p.000002:
p.000002: Name, address, telephone number Contact information to follow-up with participants for further data
p.000002: collection
p.000002:
p.000002: Demographic information Assess other variables by demographics of the population
p.000002:
p.000002: Family history Disease X is known to have an inherited basis
p.000002:
p.000002: Diet, reproductive factors, physical activity, anthropometric measures, Assess risk factors for disease X
p.000002: education, income, gender
p.000002:
p.000002: Medical conditions, medication use Assess impact of other existing conditions on disease X and
p.000002: effectiveness of medications.
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
...
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
p.000029: [Evidence of consent]
p.000029:
p.000029: Article 2.1 "...(b) Evidence of free and informed consent by the subject or authorized third party should ordinarily be obtained in writing. Where written
p.000029: consent is culturally unacceptable, or where there are good reasons for not recording consent in writing, the procedures used to seek free and informed
p.000029: consent shall be documented..." Explanatory text: "Free and informed consent... encompasses a process that begins with the initial contact and carries
p.000029: through to the end of the involvement of research subjects in the project. As used in this Policy, the process of free and informed consent refers to the
p.000029: dialogue, information sharing and general process through which prospective subjects choose to participate in research that involves themselves. " (pg.
p.000029: 2.1)
p.000029:
p.000029: [Written and oral documentation]
p.000029:
p.000029: Article 2.1 Explanatory text: "Article 2.1 (b) states the preference for written evidence of free and informed consent. The article acknowledges that written
p.000029: consent is not always appropriate. For most people in our society, a signed statement is the normal evidence of consent. However, for some groups or
p.000029: individuals, a verbal agreement, perhaps with a handshake, is evidence of trust, and a request for a signature may imply distrust. Nonetheless, in most
p.000029: cases a written statement of the information conveyed in the consent process, signed or not, should be left with the subject. In some types of research,
p.000029: oral consent may be preferable. In others, written consent is mandatory. Where oral consent is appropriate, the researcher may wish to make a
p.000029: contemporaneous journal entry of the event and circumstances. These and like elements may sometimes need to be refined in concert with the REB,
p.000029: which plays an essential education and consultative role in the process of seeking free and informed consent. When in doubt about an issue involving
p.000029: free and informed consent, researchers should consult their REB." (pg. 2.2)
p.000029:
p.000029: [Witness of signatures]
p.000029:
p.000029: Article 2.4 Explanatory Text: "In some circumstances, having a witness to the signatures on the consent form may be felt to be appropriate. In law, the
p.000029: role of a witness is only to attest that the person actually signed the form; a witness is not responsible for certifying such factors as the signature being
p.000029: obtained under defined conditions or that the signers were competent. However, a court might subsequently seek the opinions of the witness on such
p.000029: issues". (pg. 2.8)
p.000029:
p.000029: [Time allocation]
p.000029:
p.000029: Article 2.4 Explanatory Text: "Rushing the process of free and informed consent or treating it as a perfunctory routine violates the principles of respect
p.000029: for persons, and may cause difficulty for potential subjects. The time required for the process of free and informed consent can be expected to depend
p.000029: on such factors as the magnitude and probability of harms, the setting where the information is given (e.g. hospital or home) and the subject's situation
p.000029: (e.g., level of anxiety, maturity or seriousness of disease)." (pg. 2.8)
p.000029:
p.000029: [Translating materials]
p.000029:
...
p.000086: be required by regulators, study sponsors and/or publishers. 93
p.000086:
p.000086: 9.1.2 Database for general health research purposes
p.000086:
p.000086: When personal data are collected in a database to support general health research purposes in the future, personal data may be retained for the general
p.000086: purposes originally consented to, subject to security safeguards proportionate to the identifiability, sensitivity and amount of the data, as well as its format
p.000086: and method of storage.
p.000086:
p.000086: Administrative databases such as hospital discharge records and vital statistics registries, which may be used to support health research, may retain
p.000086: personal data over the long term, provided that this is permitted according to legislation or the mandate of a public body such as a government health
p.000086: department.
p.000086:
p.000086: Any long-term retention of personal data established for general health research purposes should be subject to periodic audits and effective oversight by
p.000086: independent third parties including REBs.
p.000086:
p.000086:
p.000086: Element #10: Ensuring accountability and transparency in the management of personal data
p.000086:
p.000086: General statement
p.000086: Individuals and organizations engaged in health research involving personal data are accountable for the proper conduct of such research in accordance
p.000086: with applicable funding policies, privacy principles and/or legislation. Processes and practices must be clearly established and implemented in order to give
p.000086: meaningful effect to these policies, principles or laws. Proper accountability and transparency practices require adequate resources for such things as
p.000086: communication, education and training relating to privacy.
p.000086:
p.000086: Roles and responsibilities of all those involved in the conduct and evaluation of research should be clearly defined and understood, including those of
p.000086: researchers, their employing institutions, REBs, any data stewardship committees, Privacy Commissioners and other legally-designated privacy oversight
p.000086: agencies. Their concerted efforts should aim to provide a coherent governance structure for effective and efficient data stewardship. 94
p.000086:
p.000086:
p.000086: 10.1 Transparency
p.000086: Recognizing that transparency may enhance public support for, and interest in, socially valuable research, individuals and organizations engaged in the
p.000086: conduct and evaluation of health research should:
p.000086: be open to the public with respect to the objectives of the research;
p.000086: be open about the policies and practices relating to the protection of personal data used in the research;
p.000086: promote ongoing dialogue between the research community and privacy oversight agencies; and
p.000086: promote ongoing dialogue between the research community and the community at large (the public).
p.000086:
p.000086:
p.000086: 10.2 Accountability
p.000086: Key roles and responsibilities with respect to privacy concerns of those involved in designing, conducting and approving publicly-funded health research
p.000086: are outlined below.
p.000086:
p.000086: 10.2.1 Researchers (Principal investigator, researchers)
p.000086: Privacy-related responsibilities include:
p.000086:
p.000086: being aware of all applicable policies and laws in the jurisdictions in which the research is conducted and conducting their research in accordance
p.000086: with such requirements;
p.000086: seeking REB and institutional approval and, where required or considered appropriate, the review or approval of other relevant legal privacy
p.000086: oversight bodies;
p.000086: providing a mechanism to handle queries and complaints from participants about the privacy aspects of the research (e.g. REB contact information
p.000086: in the consent form); and
p.000086: promoting openness and accountability through publicly available information which describes the purpose and conduct of the research project(s)
p.000086: and how privacy concerns are being managed.
p.000086:
p.000086: 10.2.2 Academic and other affiliated or hosting institutions
p.000086: Privacy-related responsibilities include:
p.000086:
p.000086: developing and applying institutional privacy policies and procedures for the conduct and review of research that meet, as a minimum, the
p.000086: requirements set out in the TCPS and other applicable funding policies and laws;
p.000086: designating an individual who is accountable for the institution's compliance with those policies and procedures;
p.000086: providing for the education and training of researchers and REB members on how to manage personal data in health research;
p.000086: providing a mechanism for handling queries and complaints about the privacy and confidentiality aspects of research;
p.000086: demonstrating impartial and accountable procedures to investigate allegations of individual non-compliance, with appropriate sanctions for non-
p.000086: compliance;
p.000086: being open with the public about research supported by the institution; processes and practices for managing personal information; and procedures
p.000086: for receiving and handling complaints; and
p.000086: fostering coordinated data stewardship and institutional review processes within and between institutions.
p.000086:
p.000086: 10.2.3 REBs
p.000086: Privacy-related responsibilities include:
p.000086:
p.000086: reviewing any proposed and ongoing research involving humans in accordance with the TCPS and its principles, 95 as well as other applicable
p.000086: laws and policies, including:
p.000086: the institution's own policies;
p.000086: federal, provincial and territorial legislation; and
p.000086: relevant laws, regulations, policies and/or research contexts of other countries, when research is to be conducted in those countries;
p.000086: serving as a consultative body to the research community and thus contributing to education in research ethics;
p.000086: fostering coordinated and consistent REB review processes, particularly with respect to multi-jurisdictional and multi-site research; and
p.000086: undertaking regular monitoring of research and coordinating reviews of multi-centre research to ensure equivalencies in standards across
p.000086: jurisdictions, by conducting:
p.000086: an annual review of the research (required under TCPS);
p.000086: an audit of critical aspects of the research protocol including the consent process, safeguards and, where relevant, methods of reducing the
p.000086: identifiability of data prior to disclosure; and
p.000086: other effective monitoring mechanisms, as appropriate.
p.000086:
p.000086: 10.2.4 Independent data stewardship committees
p.000086: When a database is created for multiple research purposes, or across multiple sites or jurisdictions, researchers and institutional data holders should
p.000086: promote coordinated and streamlined approaches to data stewardship over the long term. A centralized data stewardship committee could be put in place
p.000086: to authorize future uses of the database in accordance with the research objectives, REB approval and, where applicable, within the parameters set by the
p.000086: consent obtained from participants.
p.000086:
p.000086: The responsibilities of this advisory committee could include:
p.000086:
p.000086: the review of data access requests;
p.000086: long-term management of the database;
p.000086: coordination of reviews by local REBs, for example, by means of agreements between REBs, institutions and researchers, as appropriate; and
p.000086: provision of information to the public (e.g. on a web site).
p.000086:
p.000086: The composition of the committee should include scientific experts in the field and representatives from the population being studied.
p.000086:
p.000086:
p.000086: 10.3 Legally-designated privacy oversight agencies
p.000086: As specified in legislation, the responsibilities of privacy oversight agencies, such as the Office of the Privacy Commissioner or Ombudsman in each
p.000086: jurisdiction, may include all or any of the following:
p.000086:
p.000086: monitoring and investigating compliance with legal requirements;
p.000086: issuing findings and recommendations and/or adjudicating complaints from the public with regard to non-compliance;
p.000086: initiating and/or participating in court action for breach of legal requirements for privacy protection;
p.000086: conducting audits of organizations' information management practices;
p.000086: reviewing privacy impact assessments for proposed research;
p.000086: reviewing and/or approving the collection of personal information without consent; 96
p.000086: reporting publicly on matters of privacy compliance;
p.000086: reviewing and providing comments or approvals on proposed laws or policies; and
p.000086: promoting public education with respect to privacy issues.
p.000086: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000086:
p.000086: [Mandate of the three federal research granting agencies: CIHR, SSHRC and NSERC]
p.000086:
p.000086: "The...Agencies have adopted this Policy as their standard of ethical conduct for research involving human subjects. As a condition of funding, the
p.000086: Agencies require, as a minimum, that researchers and their institutions apply the ethical principles and the articles of this policy." (pg. i.2)
p.000086:
p.000086: Article 1.1 "(a) All research that involves living human subjects requires review and approval by an REB in accordance with their Policy Statement,
p.000086: before the research is started, except as stipulated.." (pg. 1.1)
p.000086:
p.000086: [Review procedures for ongoing research]
p.000086:
p.000086: Article 1.13 "(a) Ongoing research shall be subject to continuing ethics review. The rigour of the review should be in accordance with a proportionate
p.000086: approach to ethics assessment. (b) As part of each research proposal submitted for REB review, the researcher shall propose to the REB the continuing
p.000086: review process deemed appropriate for that project.(c) Normally, continuing review should consist of at least the submission of a succinct annual status
p.000086: report to the REB. The REB shall be promptly notified when the project concludes." (pg. 1.10)
p.000086:
p.000086: "In accordance with the principle of proportionate review, research that exposes subjects to minimal risk or less requires only a minimal review process.
...
p.000086: individuals) are being studied.
p.000086:
p.000086: 31 See TCPS Chapter 6 - Research Involving Aboriginal Peoples (under review).
p.000086:
p.000086: 32 See TCPS Article 8.1 for more on this topic.
p.000086:
p.000086: 33 See Element #8; and the legal concordance table for Element #8, Part 2, in Appendix A-7 for legal references to data-sharing agreements for
p.000086: research purposes.
p.000086:
p.000086: 34 As above.
p.000086:
p.000086: 35 See the legal concordance table for Element #6 in Appendix A-7 for statutory prohibitions to contacting individuals.
p.000086:
p.000086: 36 See also Element #10.
p.000086:
p.000086: 37 See table of concordance for Element #4, Part 1, in Appendix A-7 for statutory references to the general consent requirement. Part 2 of the
p.000086: concordance table sets out the statutory references to consent by substitute decision-makers.
p.000086:
p.000086: 38 Note that participants should understand what withdrawal of consent will mean to the use of their previously collected information, and that non-
p.000086: identifiable data cannot be retrieved and withdrawn from the database.
p.000086:
p.000086: 39 See Element #5, 5.4.
p.000086:
p.000086: 40 See Element #3.
p.000086:
p.000086: 41 See table of concordance for Element #5 in Appendix A-7 for cross-reference to statutory provisions regarding notice/information requirements.
p.000086:
p.000086: 42 According to the results of the international Adult Literacy and Life Skills Survey (2003), a joint project of the Government of Canada, the U.S.
p.000086: National Center for Education Statistics and the Organization for Economic Cooperation and Development, some 15% of Canadians, about one
p.000086: out of every seven, have problems dealing with printed materials and score at the lowest performance level in reading prose.
p.000086: From Statistics Canada, The Daily, Wednesday, May 11, 2005, Learning a Living: First Results of the Adult Literacy and Life Skills Survey , 2003
p.000086: (89-603-XWE, free), available online.
p.000086:
p.000086: 43 When results of research tests are determined to be scientifically valid, have significant implications for the health of the participant, and
p.000086: prevention or treatment is available, these results should be communicated to the participant through his or her treating physician, unless the
p.000086: participant has chosen not to receive any results.
p.000086: In communicating results to the participant, particularly with respect to genetic research, the choices of each participant, the extent of available
p.000086: clinical services, the availability of counselling, and the implications for family members, should be taken into account (based on Quebec's
p.000086: Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000, part IV Professionalism, part 3
p.000086: Communication of Specific Results, pg. 12).
p.000086:
p.000086: Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles on the Ethical Conduct of Human Genetic Research
p.000086: 44 Involving Populations (2002), Section 6, Communication of Research Results, pg. 3.
p.000086:
p.000086: 45 As above.
p.000086:
p.000086: 46 See also Element #1.
p.000086:
...
Searching for indicator educational:
(return to top)
p.000002: There should be an assessment of the impact that the Best Practices will have over time on research ethics board decision-making and researcher
p.000002: practice. Mechanisms should be put in place to enable this assessment. These mechanisms should include a formal process, such as a CIHR
p.000002: Standing Committee, to assess implementation and the need for improvement of the Best Practices over time. A web tool should be considered for
p.000002: channelling research findings and capturing practical experiences to inform the ongoing evolution of the Best Practices.
p.000002:
p.000002:
p.000002: Implementation strategy
p.000002: These Privacy Best Practices should be revised in two years. With ongoing feedback and evaluation, PAC expects that the Best Practices will be
p.000002: adapted, as necessary, for the purpose of becoming mandatory CIHR funding policy. These Best Practices should also be referred to the
p.000002: Interagency Advisory Panel on Research Ethics with a view to encouraging their eventual application, in revised form, as Tri-Agency funding policy.
p.000002: For this to happen, the social science perspective needs to be strengthened.
p.000002:
p.000002:
p.000002: Support for implementation
p.000002: Underpinning the implementation strategy for these Privacy Best Practices, there should be a strong emphasis on the importance of training and
p.000002: education support for institutions, research ethics boards and researchers. CIHR should consider developing a web-based document as an
p.000002: educational resource.
p.000002: In addition, institutions should be encouraged to provide adequate support for the infrastructure needed to implement and operationalize these Best
p.000002: Practices on a systematic basis. PAC recommends that there be a line item in the budget of researchers' grant applications to accurately reflect the
p.000002: increased cost involved in adhering to these Best Practices so as to enhance commitment and feasibility.
p.000002:
p.000002:
p.000002: Harmonization of oversight framework
p.000002: There should be continuing efforts by CIHR to support and influence the federal, provincial and territorial legislative harmonization agenda as well as
p.000002: the development of a national system of research ethics oversight.
p.000002:
p.000002:
p.000002: Key outstanding issues
p.000002: Privacy concerns related to the transnational flow of data need to be addressed. These could include clear interpretive provisions and the
p.000002: development of coherent and reciprocal minimum standards to be included in international data transfer agreements.
p.000002: A separate process or initiative should be undertaken to develop a policy framework for the physical collection, use and storage of human biological
p.000002: specimens (in contrast to the personal information that may be derived from those specimens) as these are critically important and complex areas of
p.000002: activity that are having increasing importance in research.
p.000002: As one important means of responding to public concerns over potential unauthorized uses of personal information gathered for research, CIHR
p.000002: should consider raising discussion among stakeholders and governments about the desirability and feasibility of introducing in Canada instruments
...
p.000086: report to the REB. The REB shall be promptly notified when the project concludes." (pg. 1.10)
p.000086:
p.000086: "In accordance with the principle of proportionate review, research that exposes subjects to minimal risk or less requires only a minimal review process.
p.000086: The continuing review of research exceeding the threshold of minimal risk that is referred to in Article 1.13(b), in addition to annual review (Article 1.13
p.000086: (c)) might include:
p.000086:
p.000086: formal review of the process of free and informed consent
p.000086: establishment of a safety monitoring committee
p.000086: periodic review by a third party of the documents generated by the study
p.000086: review of reports of adverse events
p.000086: review of patients' charts or
p.000086: a random audit of the process of free and informed consent.
p.000086:
p.000086: Other models of a continuing ethics review may be designed by researchers and REBs to fit particular circumstances.
p.000086:
p.000086: The process of a continuing ethics review should be understood as a collective responsibility, to be carried out with a common interest in maintaining the
p.000086: highest ethical and scientific standards. Research institutions should strive to educate researchers on the process of a continuing ethics review through
p.000086: workshops, seminars and other educational opportunities." (pg. 1.10- 1.11)
p.000086:
p.000086: [Review of multi-centered research]
p.000086:
p.000086: "Principles of institutional accountability require each local REB to be responsible for the ethical acceptability of research undertaken within its institution.
p.000086: However, in multi-centred research, when several REBs consider the same proposal from the perspectives of their respective institutions, they may
p.000086: reach different conclusions on one or more aspects of the proposed research. To facilitate coordination of ethics review, when submitting a proposal for
p.000086: multi-centered research, the researcher may wish to distinguish between core elements of the research-which cannot be altered without invalidating the
p.000086: pooling of data from the participating institutions-and those elements that can be altered to comply with local requirements without invalidating the
p.000086: research project. REBs may also wish to coordinate their review of multi-centred projects, and to communicate any concerns that they may have with
p.000086: other REBs reviewing the same project. The needed communication would be facilitated if the researcher provides information on the institutional REBs
p.000086: that will consider the project." (pg. 1.11)
p.000086:
p.000086: [Equivalence level of protection in multi-jurisdictional research]
p.000086:
p.000086: Article 1.14 "Research to be performed outside the jurisdiction or country of the institution that employs the researcher shall undergo prospective ethics
p.000086: review both (a) by the REB within the researcher's institution; and (b) by the REB, where such exists, with the legal responsibility and equivalent ethical
...
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
p.000086: 15 See the table of concordance for Element #2 in Appendix A-7 referring to the statutory provisions regarding the general requirement to collect a
p.000086: limited amount of personal information.
p.000086:
...
Social / employees
Searching for indicator employees:
(return to top)
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000050: eligible for participation in the research. For example, a health care provider may not yet have informed the patient of a diagnosis (e.g. cancer) that is in the
p.000050: patient health record and that is used to determine eligibility. The researcher should confirm with the data holder that individuals have been informed of
p.000050: relevant health-related information before initiating contact.
p.000050:
p.000050:
p.000050: 6.3 Selected scenarios and preferred recruitment practices
p.000050: Index to recruitment scenarios
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050: 6.3.3 Scenario: *A genetics researcher proposes to recruit the family members of research participants.
p.000050: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000050: research on patients. * The researcher is the health care provider of eligible individuals.
p.000050: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000050: employees or students of the organization.
p.000050: 6.3.6 Scenario: * A clinician-researcher at a health care facility wants to conduct research on patients being treated by another physician in the same
p.000050: facility. * An academic wants to conduct research on students in his or her university department or program, but not in a class that he or she is
p.000050: currently teaching.
p.000050:
p.000050:
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
p.000050:
p.000050:
p.000050:
p.000050: When eligibility information and the means of notifying individuals about the research are publicly available, the researcher should normally be able to make
p.000050: the initial contact without needing an intermediary.
p.000050:
p.000050:
p.000050: 6.3.2 Scenario: * A research team proposes to recruit research participants from members of an Aboriginal community.
p.000050:
p.000050:
p.000050:
p.000050: As a general rule, researchers planning to work in a community should make contact with and inform community leaders and groups relevant to their
p.000050: research, prior to initiating the recruitment or informed consent process with members of that community.
p.000050:
p.000050: For many Aboriginal communities and groups, approval by local authorities may be required prior to beginning the recruitment of research participants.
p.000063: 63
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.3 Scenario: * A genetics researcher proposes to recruit the family members of research participants.
p.000063:
p.000063:
p.000063:
...
p.000063: a position of
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the In some cases, the researcher/data holder is considered to potentially be in a position of undue influence over eligible individuals with
p.000063: researcher/data regard to the research or there is a potential conflict of interest. For example, an REB may decide that patients who will be recruited
p.000063: holder is in a for a clinical trial being conducted by their health care provider may not understand the difference between the research treatment and
p.000063: position of the standard treatment provided at the health centre.
p.000063: undue
p.000063: In such cases, initial contact with prospective research participants should be made by neutral means, so that there is no undue
p.000063: influence.
p.000063: influence exerted on individuals to participate. For example, a neutral person on the research team or in the data holder's agency who
p.000063: is not in a position of authority over prospective research participants, could contact eligible individuals. Alternatively, it may be
p.000063: possible to make initial contact with eligible individuals by advertising in newspapers or in public locations, and then having a neutral
p.000063: member of the research team or staff provide further information to interested individuals.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000063: employees or students of the organization.
p.000063:
p.000063:
p.000063:
p.000063: In this scenario, the researcher is not the data holder, and does not have undue influence over prospective research participants. If permitted by law, 67
p.000063: the preferred recruitment approach is for the data holder to assess eligibility for research and to make initial contact with eligible individuals, unless the REB
p.000063: considers that the preferred approach is impracticable or inappropriate (see the ranked Options table).
p.000063:
p.000063: Ranked options for assessing eligibility and contacting prospective participants, when the researcher is not the data holder and does not have
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
p.000063: A) The data holder assesses eligibility and makes If permitted by law and subject to REB approval, the data holder should determine eligibility of
p.000063: initial contact. (Preferred) individuals for the research on the basis of criteria provided by the researcher. The data holder
p.000063: should make the initial contact to: (i) inform eligible individuals about the research so that they can
p.000063: contact the researcher, if interested, or (ii) to seek consent from individuals to release their nominal
p.000063: information to the researcher who will contact them to inform them about the research.
p.000063:
p.000063: B) If the REB considers option A impracticable or In some cases, the preferred option above may be considered impracticable or inappropriate. For
...
p.000063:
p.000063: sensitive and/or highly identifiable data are accessible to the minimum number of persons necessary on the research team on a need-to-know basis
p.000063: (e.g. for cleaning data, conducting data linkages, and verifying the accuracy of data matches);
p.000063: team members have appropriate training in, and comply with, security safeguards;
p.000063: access to coded data, or to data where the direct identifiers are removed but potentially identifying elements remain in the dataset, may be permitted
p.000063: for researchers outside the research team only under strictly controlled conditions described in a written agreement and following REB approval; and
p.000063: non-identifiable data about individuals and aggregated data are made available to the general scientific community and for public use after
p.000063: appropriate scrutiny to minimize or avoid risks of inadvertent disclosure of individuals' identities.
p.000063:
p.000063: Controlled access to personal data for research purposes
p.000063:
p.000063: Access to: Who should be permitted access: Required safeguards to include:
p.000063: (examples)
p.000063:
p.000063: Direct identifiers Selected members of the REB review and approval
p.000063: research team Review by institution data privacy committees where
p.000063: Selected institution employees relevant
p.000063: "Deemed employees" or Access on need-to-know basis
p.000063: trusted third parties, subject to Appropriate training
p.000063: the same undertaking of Undertaking of confidentiality by employees or research
p.000063: confidentiality as the data team
p.000063: holder (e.g. institution No direct access for researchers external to the research
p.000063: employees) team, except for linkage purposes in exceptional
p.000063: circumstances (see 8.2)
p.000063: Audit trails on access (where possible)
p.000063:
p.000063:
p.000063: Not directly identifiable data (single or Research team REB-approved projects
p.000063: double coded; or without codes) Collaborators at local sites of a Review by institution data privacy committees where
p.000063: multi-site study relevant
p.000063: External researchers, with Data-sharing agreement, including undertaking of
p.000063: limitations (see required confidentiality (see 8.3)
p.000063: safeguards). Disclosure of only enough data to answer the intended
p.000063: research question
p.000063:
p.000063:
p.000063: Non-identifiable data in public use files Scientific community There may be no restrictions on use, or there may be a
p.000063: (where data have been scrutinized and General public basic form of data sharing agreement, requiring an
p.000063: altered to protect against risks of Universities undertaking, for example, to not attempt to re-identify the
p.000063: inadvertent disclosure of individuals' records so as to relate the information on the file to a
p.000063: identities). 75 particular person. 76
p.000063:
p.000063:
p.000063:
p.000063: 8.2 Conducting data linkages
...
p.000063: datasets to the researcher without identifiers, and at the minimum level of identifiability required for the research purpose. 77 If that is not practicable, a
p.000063: trusted third party may conduct the linkage or the researcher may conduct the linkage on the data holder's site. As a last option, a researcher may be
p.000063: permitted to conduct the linkage at a secure site but under strict controls, as specified in a data-sharing agreement. 78
p.000063:
p.000063: Ranked options for conducting data linkages
p.000063:
p.000063: Who should Conditions for REB consideration
p.000063: conduct the
p.000063: linkage
p.000063:
p.000063: A) Data The data holder performs the linkage(s) and subsequently removes all direct identifiers, or replaces direct identifiers with a code, prior to
p.000063: holder releasing the linked data set to the external researcher.
p.000063: (Preferred)
p.000063:
p.000063: B) A trusted When the original data holder does not have the technical capacity or resources to perform linkages in-house:
p.000063: third party
p.000063: a trusted third party acting as an information manager may conduct the linkage off site; or
p.000063: (e.g. a
p.000063: the researcher as a "deemed employee" (e.g. the Statistics Canada model) may conduct the linkage on the data holder's site.
p.000063: statistical
p.000063: agency) or The third party and the researchers should be bound by equivalent conditions of confidentiality and security as apply to the data holder
p.000063: and the data holder's employees.
p.000063: C) The
p.000063: researcher
p.000063: conducts the
p.000063: linkage on
p.000063: the data
p.000063: holder's site
p.000063:
p.000063:
p.000063: D) The If Options A, B or C are demonstrably impracticable, the researcher may conduct the linkage in compliance with a data-
p.000063: researcher sharing/confidentiality agreement with the data holder, setting out their respective and shared obligations, including restrictions on use
p.000063: conducts the and disclosure and appropriate security requirements (see 8.3 below). In this situation, any direct identifiers or other personal data not
p.000063: linkage off required to answer the research question should be destroyed or returned to the original data holder as soon as is practicable, and in
p.000063: site compliance with the terms of the data-sharing agreement.
p.000063:
p.000063:
p.000063: Following the linkage of datasets, the person doing the data linkage should reduce datasets to the lowest level of identifiability needed to accomplish the
p.000063: research objectives.
p.000063:
p.000063: For example, direct identifiers (e.g. name or personal health number) or potentially identifying elements when combined (e.g. a full date of birth or full
p.000063: postal code) may be needed for data linkage but may not be needed to answer the research questions. In such cases, these identifiers should be destroyed
p.000063: as soon as is reasonably practicable or returned to the data holder, as per the terms of the data-sharing agreement.
p.000063:
p.000063: Universities may have specified retention periods for research data. Researchers should either destroy the new linked dataset at the end of the specified
p.000063: period, or use enhanced security measures to store it as per the terms of the data-sharing agreement. Within some research or statistical agencies it may
...
Social / gender
Searching for indicator gender:
(return to top)
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002:
p.000002: 1.1 Research study
p.000002: For each research study, researchers should identify and document the specific research objectives and related research questions.
p.000002:
p.000002: Researchers should also describe and justify the data needed to fulfill the research objectives and to answer any related research questions.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research study: Impact of ethnic group membership and age on health
p.000002:
p.000002: Study objectives: To examine and compare the health status, health care, and social involvement of distinct ethnic groups living in [region X of
p.000002: province Y], to inform policy development by community organizations and governments.
p.000002:
p.000002: Research questions: (examples) What is the association between health status, experience of health care and ethnicity? What are the impacts of
p.000002: personal support networks and activity level on health status and perceived well-being?
p.000002:
p.000002: Personal data needed and justification:
p.000002: Initials: To assist in checking for duplicate records, using a combination of initials and demographic data.
p.000002:
p.000002: Demographics (date of birth, gender, ethnicity...): Needed to make between-group comparisons on health variables by ethnicity, and between- and
p.000002: within-group comparisons by other demographic variables.
p.000002:
p.000002: Physical health and sense of well-being/Use of health services: Needed to investigate and compare health status and perceived health status by health
p.000002: care-related knowledge, behaviours, attitudes and use.
p.000002:
p.000002: Meaning of health and of aging: Needed to explore the meanings of health and illness and the cultural context of aging in the ethnic community.
p.000002:
p.000002: Family and friends/Social activities: Needed to investigate the impact of family structure and interaction and environmental factors on measures of health
p.000002: and well-being.
p.000002:
p.000002:
p.000002:
p.000002: 1.2 Creation of a database for general research purposes
p.000002: Define the scope and purpose of the database in a way that will be meaningful for REBs and any prospective research participants, even if the boundaries
p.000002: are at a relatively general level.
p.000002:
p.000002: Even though all of the research studies that may use data from this database cannot be anticipated or explained in detail at the time the database is being
p.000002: created, try to describe the types of studies that could be undertaken.
p.000002:
p.000002: In addition to the scope and purpose, describe what the database will not be used for. This is an opportunity to be as open and transparent as possible
p.000002: about the proposed research, and to reassure research participants and REBs that although future research purposes are not specified in detail, data
p.000002: management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: Describe the general types of personal data that are necessary for these general research objectives (e.g. diagnoses, risk factors, outcomes). Include data
p.000002: that are expected to be collected over the lifespan of the database, particularly if there will be multiple data collection periods per participant, or data that will
p.000002: be requested from secondary sources. Be as specific as possible.
p.000002:
p.000002: Example:
p.000002:
p.000002: Research database on disease X
p.000002:
p.000002: Research objectives:
p.000002:
p.000002: 1. Compiling statistics on population trends in disease X and in its risk factors.
p.000002: 2. Conducting health and epidemiological research to improve screening and treatment programs for disease X.
p.000002:
p.000002: Types of research questions (examples):
p.000002:
p.000002: 1. What is the association between disease X and risk factors such as diet, tobacco use, physical activity level, education, income or gender?
p.000002: 2. What is the risk of developing disease X after exposure to environmental risk factors, such as pollutants in the area of residence?
p.000002: 3. What is the cost-effectiveness and efficacy of screening programs for disease X?
p.000002: Types of personal data to be collected over multiple collection periods Research justification
p.000002:
p.000002:
p.000002: Name, address, telephone number Contact information to follow-up with participants for further data
p.000002: collection
p.000002:
p.000002: Demographic information Assess other variables by demographics of the population
p.000002:
p.000002: Family history Disease X is known to have an inherited basis
p.000002:
p.000002: Diet, reproductive factors, physical activity, anthropometric measures, Assess risk factors for disease X
p.000002: education, income, gender
p.000002:
p.000002: Medical conditions, medication use Assess impact of other existing conditions on disease X and
p.000002: effectiveness of medications.
p.000002:
p.000002: Limits on data uses (examples):
p.000002: Access to data will be restricted to academic and health researchers with a primary purpose of public (non-commercial) benefit, for the purpose of
p.000002: research on disease X or related conditions. The database will be managed by an independent data stewardship committee 14 to ensure that the
p.000002: confidentiality of the information is maintained and access is controlled, consistent with the consents obtained from participants. Any future use of the
p.000002: data for new purposes will require approval by an REB.
p.000002:
p.000002:
p.000002:
p.000002: 1.3 Advisory committee for defining the scope and strategic priorities of the research
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
...
p.000002: individuals:
p.000002:
p.000002:
p.000002: a) Contact Recruit individuals for a Direct identifiers Coded (Single coding is a more efficient mechanism for linking back
p.000002: individuals research project to individuals than double-coding. Linking back becomes
p.000002: increasingly difficult for investigators who receive double or multiple-
p.000002: Contact the participant coded data, and therefore do not have the key to the code.)
p.000002: for follow-up data
p.000002: collection
p.000002:
p.000002: Provide data, with
p.000002: consent, to health care
p.000002: provider for clinical
p.000002: monitoring of the
p.000002: participant
p.000002:
p.000002: Return individual results
p.000002: to the participant
p.000002:
p.000002: b) Data Conduct a data linkage Preferred: Direct identifiers (e.g. Preferred: Data holder conducts linkage and provides to researcher
p.000002: linkage 17 with a high degree of name and street address; or the linked dataset without direct identifiers. Data to be provided at
p.000002: accuracy personal health number) 18 the lowest level of identifiability needed, consistent with the
p.000002: research objectives.
p.000002: Conduct a data linkage Direct identifiers or potentially
p.000002: with a measurable identifying data items (e.g. date of
p.000002: degree of accuracy birth, initials, 3-character or full
p.000002: sufficient for the postal code, gender, specific health
p.000002: particular research data)
p.000002:
p.000002: c) Data Eliminate duplicate Direct identifiers or potentially Coded data so that the data holder (preferred) or researcher can
p.000002: accuracy records identifying data items use the key to check direct identifiers for duplication
p.000002: check
p.000002:
p.000002: d) No contact No direct identifiers need to be No direct identifiers. Data to be provided at the lowest level of
p.000002: with collected. identifiability needed, consistent with the research objectives.
p.000002: individuals
p.000002: and no data
p.000002: linkage
p.000002: needed
p.000002: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000002:
p.000002: [REB approval of type of data]
p.000002:
p.000002: Article 3.2 "..researchers shall secure REB approval for obtaining identifiable personal information about subjects. Approval for such research shall
p.000002: include such considerations as: (a) the type of data to be collected..." (pg. 3.3)
p.000002:
p.000002: [Secondary use of data]
p.000002:
p.000002: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000002: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research..." (pg. 3.5)
p.000002:
p.000002: Article 3.3 Explanatory text: "Databases can vary greatly in the degree to which personal information is identifiable. A proportionate approach should be
...
Social / parents
Searching for indicator parent:
(return to top)
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: Data stewardship tasks could be addressed by this advisory committee or by another body, as described in Element #10, 10.4.
p.000002:
p.000002: Example:
p.000002:
p.000002: Multi-year family-centered study on childhood condition X
p.000002:
p.000002: Research objectives
p.000002:
p.000002: 1. Track and assess the factors that facilitate or hinder the development of family-centered provincial services for children with condition X and their
p.000002: family members.
p.000002: 2. Provide guidance to community organizations and provincial governments.
p.000002: 3. Validate questionnaire and interview methods for creating individualized family service plans.
p.000002: 4. Assess long term effectiveness and adverse effects of standard and emerging treatments for Condition X.
p.000002:
p.000002:
p.000002: Setting the scope of research
p.000002:
p.000002: Initial partnership between the research team and Provincial Ministry of Children's Services results in agreement on key objectives.
p.000002: A Local Advisory Committee is established to assist in setting out the scope and strategic priorities for the research program, to review research
p.000002: progress, to facilitate the achievement of study objectives, and to assist with the dissemination of results; with representatives from the Ministry,
p.000002: provincial clinic for childhood condition X, two community advocacy groups for persons with condition X, and parent representatives.
p.000002: A National Project Advisory Committee with representation from provinces actively interested in this initiative meets annually to advance services
p.000002: to young children with condition X, and to plan and disseminate research findings.
p.000002:
p.000002:
p.000002:
p.000002: 1.4 Qualitative research using inductive data collection and analysis
p.000002: It is important to recognize that all potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For
p.000002: example, researchers using inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration
p.000002: with research participants. In such research, the development of research questions and procedures is an ongoing process. For example, open-ended
p.000002: interviewing often goes down avenues not anticipated leading to new questions and new approaches.
p.000002:
p.000002: The wide range of methods in inductive approaches makes it difficult to document detailed and specific strategies for protection of privacy. Therefore, while
p.000002: planning their research, researchers should attempt to foresee both obvious and emerging issues related to privacy. These should be included in the
p.000002: submission to a research ethics board.
p.000002:
p.000002: Researchers should also document for a research ethics board any amendments to the protocol and consequent privacy protection strategies emerging
...
Economic / Economic/Poverty
Searching for indicator social status:
(return to top)
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
p.000086: 8 The core principles and associated sub-principles of the CSA Model Code were incorporated into the Personal Information Protection and
p.000086: Electronic Documents Act (PIPEDA), Schedule 1, accessible on the Department of Justice website.
p.000086:
p.000086: 9 Research is defined in the TCPS as "a systematic investigation designed to develop or establish principles, facts or generalizable knowledge"
p.000086: (TCPS, pg. 1.1). The range of research requiring ethics review in the TCPS is listed in Appendix 1 (TCPS, pg. A.1).
p.000086:
p.000086: 10 "Identifiable personal information" is defined in TCPS as: "information relating to a reasonably identifiable person who has a reasonable
p.000086: expectation of privacy.
p.000086: It includes information about personal characteristics such as culture, age, religion and social status, as well as their life experiences and
p.000086: educational, medical or employment histories." TCPS, Section 3, pg. 3.2.
p.000086:
p.000086: 11 The current version of the TCPS and information about its further evolution are accessible on the Interagency Advisory Panel on Research
p.000086: Ethics (PRE) website.
p.000086:
p.000086: 12 International Conference on Harmonization of Technical Requirements of the Registration of Pharmaceuticals for Human Use.
p.000086:
p.000086: 13 These documents are accessible on the Health Canada Therapeutic Products Directorate website.
p.000086: The Food and Drug Regulations, ICH GCP and further Health Canada guidance documents cover such privacy-related topics as the roles of
p.000086: investigators, industry sponsors and ethics review committees; informed consent of trial subjects; information to be collected from subjects;
p.000086: information to be included in the study protocol; access to trial records and data for quality assurance purposes; and record retention periods.
p.000086: The ICH GCP is also referenced in the TCPS- Section 7- Clinical Trials, pg. 7.3.
p.000086:
p.000086: 14 A data stewardship committee could be established to oversee and authorize future uses of the database in accordance with the research
p.000086: objectives. This committee could also assist in coordinating reviews by local REBs, in the case of multi‑site studies. See Element #10, 10.2.4.
p.000086:
...
General/Other / Dependent
Searching for indicator dependent:
(return to top)
p.000029: special consideration. Every researcher working with child subjects must consider the possibility of the children suffering pain, anxiety or injury, and must
p.000029: develop and implement suitable precautions and ameliorating measures. Cumulative physical, moral, psychological and social consequences (relevant
p.000029: to pain, anxiety and injury) should be reviewed by REBs when assessing the probability, magnitude and character of any harmful impact the research
p.000029: may have on the child." (pg 2.10)
p.000029:
p.000029: [Secondary use of data]
p.000029:
p.000029: Article 3.3 "If identifying information is involved, REB approval shall be sought for secondary uses of data. Researchers may gain access to identifying
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
p.000029: Consultation with representatives of those who contributed data." (pg. 3.5)
p.000029:
p.000029:
p.000029:
p.000029: Element #4: Managing and documenting consent
p.000029:
p.000029: General statement
p.000029: Consent is an ongoing process that begins upon first contact with prospective participants or authorized third parties, and ends only with the conclusion of
p.000029: their participation in the research or the use of their information. Participants should understand that their consent is voluntary, to be obtained without
p.000029: manipulation, undue influence or coercion, and can be withdrawn at any time. 37
p.000029:
p.000029: Evidence of initial and ongoing consent and the withdrawal of consent should be documented as appropriate for audit and legal purposes.
p.000029:
p.000029:
p.000029: 4.1 Forms of consent
p.000029: 4.1.1 Opt-in consent
p.000029:
p.000029: The majority of research studies use an opt-in consent. Opting-in means that prior to the start of the research or data collection, informed individuals give
p.000029: clear indication that they voluntarily agree to participate in the research.
p.000029:
...
p.000029: The researcher may need information on who does not want to participate in research or who withdraws from research, for example to:
p.000029:
p.000029: document who is not to be included in follow-up research activities; and/or
p.000029: take into consideration relevant characteristics of the population not included in the study, when reporting possible bias in research results.
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
...
p.000050: time.
p.000050:
p.000050: For example, patients could be asked at the time of the original collection of their personal information whether they consent to the health care provider
p.000050: reviewing their records and contacting them to inform them of research for which they are eligible. If such a prior opt-in consent procedure is not a
p.000050: practicable option, a health care provider could inform patients through notices that their personal information may be reviewed from time to time for
p.000050: recruitment purposes, and that they have the opportunity to opt-out. If patients do not opt-out, their consent for the use of their personal information to
p.000050: assess their eligibility for research or to contact them about the research project would be presumed.
p.000050:
p.000050:
p.000050: 6.2 Initial contacting and informing prospective participants
p.000050: 6.2.1 Trust vs. undue influence
p.000050:
p.000050: Recruitment raises complex issues around who is the appropriate person to make initial contact and inform eligible individuals about the research. On the
p.000050: one hand, individuals may feel more comfortable if approached by a data holder, such as a clinic physician or nurse, whom they trust and accept as having
p.000050: access to their personal information. On the other hand, individuals may be unduly influenced to agree to participate in research if approached by someone
p.000050: on whom they are dependent, for example, their employer, health provider, community leader or program director.
p.000050:
p.000050: In some cases, someone who has a relationship of some influence over prospective research participants may be the preferred person to contact
p.000050: individuals and inform them of the research where this is considered the best way to ensure that prospective research participants fully understand the risks
p.000050: and the benefits of the research to themselves. For example, a health care provider or professional (who may or may not be involved in the research) may
p.000050: be the preferred person to contact individuals and inform them about the research because of a relationship of medical confidence, special expertise and/or
p.000050: in-depth knowledge of the patients' situations. It is critical in such cases that the participants are reassured that their reasonable expectations of care will be
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
p.000050: eligible for participation in the research. For example, a health care provider may not yet have informed the patient of a diagnosis (e.g. cancer) that is in the
p.000050: patient health record and that is used to determine eligibility. The researcher should confirm with the data holder that individuals have been informed of
p.000050: relevant health-related information before initiating contact.
p.000050:
p.000050:
p.000050: 6.3 Selected scenarios and preferred recruitment practices
p.000050: Index to recruitment scenarios
p.000050:
p.000050:
p.000050: 6.3.1 Scenario: * Eligible research participants are in a city telephone directory.
...
General/Other / Impaired Autonomy
Searching for indicator autonomy:
(return to top)
p.000002:
p.000002: Tri-Council Policy Statement (TCPS)
p.000002:
p.000002: The Best Practices are firmly embedded in CIHR's ongoing commitment to support TCPS. 4 Compliance with TCPS is mandatory for all research
p.000002: funded through the three main federal research funding agencies: Canadian Institutes of Health Research (formerly Medical Research Council of Canada),
p.000002: Natural Sciences and Engineering Research Council of Canada (NSERC) and Social Sciences and Humanities Research Council of Canada (SSHRC).
p.000002: Research ethics boards (REBs) also use the TCPS as guidance in the review of research funded through other sources.
p.000002:
p.000002: The broad ethical framework of the TCPS is based on recognition of the need for and social value of research, along with moral imperatives to respect
p.000002: human dignity, ethical guiding principles and the law. 5 Ethical guiding principles for research include respect for privacy and confidentiality, among the
p.000002: following fundamental and interrelated ethical guiding principles in the TCPS:
p.000002:
p.000002:
p.000002: Respect for human dignity
p.000002: Respect for justice and inclusiveness
p.000002: Respect for free and informed consent
p.000002: Balancing harms and benefits
p.000002: Respect for vulnerable persons
p.000002: Respect for privacy and confidentiality
p.000002: Minimizing harm
p.000002: Maximizing benefit 6
p.000002:
p.000002:
p.000002: The TCPS acknowledges privacy as a fundamental value, and dignity and autonomy of individuals as the ethical basis of respect for the privacy of research
p.000002: subjects. These national research ethics guidelines also recognize that the right to privacy is not absolute and that compelling and specifically identified
p.000002: public interests may justify an infringement of that right, specifically the requirement to obtain consent before collecting, using or disclosing personal
p.000002: information. 7
p.000002:
p.000002: Fair information principles
p.000002:
p.000002: These Best Practices are also grounded in internationally recognized fair information principles, which are at the heart of Canadian privacy legislation and
p.000002: form the basis of the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information. 8 These ten core principles are:
p.000002:
p.000002: 1. Accountability - An organization is responsible for personal information under its control and shall designate an individual or individuals who are
p.000002: accountable for the organization's compliance with the following principles.
p.000002: 2. Identifying Purposes -The purposes for which personal information is collected shall be identified by the organization at or before the time the
p.000002: information is collected.
p.000002: 3. Consent - The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where
p.000002: inappropriate.
p.000002: 4. Limiting Collection - The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization.
...
General/Other / Public Emergency
Searching for indicator emergency:
(return to top)
p.000002: contact individuals for additional data collection; or
p.000002: negative impact of the findings of the research.
p.000002:
p.000002: 2) Potential benefits of the research to individuals, groups, communities or the public outweigh potential
p.000002: harms. Where there is only minimal risk of harm, the REB need only ensure that there is public interest or
p.000002: other merit in the proposed research (e.g. as determined by a peer-review committee). 27
p.000002:
p.000002:
p.000002: 3.3.3 A consent requirement being (1) 1) Seeking consent from individuals may be considered inappropriate because:
p.000002: inappropriate or (2) impracticable
p.000002: 28 a. there is potential harm to individuals from direct contact where there is:
p.000002: i. a risk of inflicting psychological, social or other harm by contacting individuals or families with
p.000002: particular conditions (e.g. where making contact might reveal an individual's condition to
p.000002: others, against the individual's wishes; or research with minors, which would normally require
p.000002: parental consent, when the minors are street youth who have left home to escape abuse) or in
p.000002: certain circumstances (e.g. during a hospital emergency room visit); or
p.000002: ii. a risk of creating additional threats to privacy by having to link otherwise usable coded data
p.000002: with identifiers in order to contact individuals to seek their consent; or
p.000002: b. contact with individuals is not permitted under a previous data-sharing agreement, law or policy.
p.000029: 29
p.000029:
p.000029:
p.000029: 2) Seeking consent from individuals for the use of their personal data may be considered impracticable
p.000029: 30 when there are difficulties in contacting or notifying individuals for reasons such as:
p.000029:
p.000029:
p.000029: the size of the population being researched;
p.000029: the proportion of prospective participants likely to have relocated or died since the time the personal
p.000029: information was originally collected; or
p.000029: the lack of an existing or continuing relationship between prospective participants and the data holder
p.000029: who would need to contact them (e.g. a patient database that does not have a regular follow-up
p.000029: program to maintain a complete and accurate record of changes in registrants' contact information
p.000029: over time);
p.000029:
p.000029: such that:
p.000029:
p.000029: a. there is a risk of introducing bias into the research because of the loss of data from segments of the
p.000029: population that cannot be contacted to seek their consent, thereby affecting the validity of results
p.000029: and/or defeating the purpose of the study; or
p.000029: b. the additional financial, material, human, organizational and other resources needed to obtain
...
General/Other / Relationship to Authority
Searching for indicator authority:
(return to top)
p.000029: informed consent should be an ongoing negotiation.
p.000029:
p.000029:
p.000029: 4.4 Documenting non-participation or withdrawal of consent
p.000029: The researcher may need information on who does not want to participate in research or who withdraws from research, for example to:
p.000029:
p.000029: document who is not to be included in follow-up research activities; and/or
p.000029: take into consideration relevant characteristics of the population not included in the study, when reporting possible bias in research results.
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
...
p.000063:
p.000063: Option Contacting prospective research participants
p.000063:
p.000063: A) If the If the researcher/data holder is not in a position of undue influence over prospective participants with regard to the research, the
p.000063: researcher/data researcher should make the initial contact and inform prospective participants about the research, if permitted by law and subject to
p.000063: holder is not in REB approval.
p.000063: a position of
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the In some cases, the researcher/data holder is considered to potentially be in a position of undue influence over eligible individuals with
p.000063: researcher/data regard to the research or there is a potential conflict of interest. For example, an REB may decide that patients who will be recruited
p.000063: holder is in a for a clinical trial being conducted by their health care provider may not understand the difference between the research treatment and
p.000063: position of the standard treatment provided at the health centre.
p.000063: undue
p.000063: In such cases, initial contact with prospective research participants should be made by neutral means, so that there is no undue
p.000063: influence.
p.000063: influence exerted on individuals to participate. For example, a neutral person on the research team or in the data holder's agency who
p.000063: is not in a position of authority over prospective research participants, could contact eligible individuals. Alternatively, it may be
p.000063: possible to make initial contact with eligible individuals by advertising in newspapers or in public locations, and then having a neutral
p.000063: member of the research team or staff provide further information to interested individuals.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000063: employees or students of the organization.
p.000063:
p.000063:
p.000063:
p.000063: In this scenario, the researcher is not the data holder, and does not have undue influence over prospective research participants. If permitted by law, 67
p.000063: the preferred recruitment approach is for the data holder to assess eligibility for research and to make initial contact with eligible individuals, unless the REB
p.000063: considers that the preferred approach is impracticable or inappropriate (see the ranked Options table).
p.000063:
p.000063: Ranked options for assessing eligibility and contacting prospective participants, when the researcher is not the data holder and does not have
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
p.000063: A) The data holder assesses eligibility and makes If permitted by law and subject to REB approval, the data holder should determine eligibility of
p.000063: initial contact. (Preferred) individuals for the research on the basis of criteria provided by the researcher. The data holder
...
p.000086:
p.000086: the Institution's own policy on research involving human subjects;
p.000086: the Québec Civil Code;
p.000086: provincial and federal legislation on privacy, con0dentiality, intellectual property, competence and other areas;
p.000086: Canada Food and Drug Act and Regulations;
p.000086: guidelines and policies of the Therapeutic Products Directorate of Health Canada;
p.000086: relevant laws, regulations and/or policies of other countries, when research is to be conducted in those countries;
p.000086: Good Clinical Practices: Consolidated Guidelines for clinical trials sponsored by industry, published by the International Conference on
p.000086: Harmonization.
p.000086:
p.000086: Researchers, Institutions and research ethics boards (REBs) should be aware of all applicable policies, regulations and guidelines. In some cases, it
p.000086: may be necessary for Institutions to have recourse to speci0c expertise to identify legal and other issues in the ethics review process..."
p.000086:
p.000086: Updates.
p.000086: References
p.000086: 1 Privacy Advisory Committee members are listed in Appendix A-1.
p.000086:
p.000086: 2 Under section 301(d) of the U.S. Public Health Service Act (42 U.S.C. 241(d)) the Secretary of Health and Human Services may authorize
p.000086: persons engaged in biomedical, behavioral, clinical, or other research to protect the privacy of individuals who are the subjects of that research.
p.000086: This authority has been delegated to the National Institutes of Health (NIH) and other Health and Human Services Agencies.
p.000086: Certificates of Confidentiality may be granted for studies collecting information that, if disclosed, could have adverse consequences for research
p.000086: participants, such as damage to their financial standing, employability, insurability, or reputation. A Certificate allows the investigator and others
p.000086: who have access to research records to refuse to disclose identifying information on research participants in any civil, criminal, administrative,
p.000086: legislative, or other proceeding, whether at the federal, state, or local level. See U.S. Office of Human Subject Protection- Guidance .
p.000086:
p.000086: 3 The World Health Organization defines "health" as "a state of complete physical, mental and social well-being and not merely the absence of
p.000086: disease or infirmity".
p.000086: From Preamble to the Constitution of the World Health Organization as adopted by the International Health Conference, New York, 19-22 June,
p.000086: 1946; signed on 22 July 1946 by the representatives of 61 States (Official Records of the World Health Organization, no. 2, p. 100) and entered
p.000086: into force on 7 April 1948).
p.000086:
p.000086: 4 The TCPS can be accessed on the Interagency Advisory Panel for Research Ethics website.
p.000086:
p.000086: 5 TCPS, pg. i.4.
p.000086:
p.000086: 6 TCPS, Context of an Ethics Framework, Section C, pg. i.5.
p.000086:
p.000086: 7 TCPS, Section 3- Privacy and Confidentiality, pg. 3.1.
p.000086:
...
p.000086:
p.000086: 43 When results of research tests are determined to be scientifically valid, have significant implications for the health of the participant, and
p.000086: prevention or treatment is available, these results should be communicated to the participant through his or her treating physician, unless the
p.000086: participant has chosen not to receive any results.
p.000086: In communicating results to the participant, particularly with respect to genetic research, the choices of each participant, the extent of available
p.000086: clinical services, the availability of counselling, and the implications for family members, should be taken into account (based on Quebec's
p.000086: Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000, part IV Professionalism, part 3
p.000086: Communication of Specific Results, pg. 12).
p.000086:
p.000086: Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles on the Ethical Conduct of Human Genetic Research
p.000086: 44 Involving Populations (2002), Section 6, Communication of Research Results, pg. 3.
p.000086:
p.000086: 45 As above.
p.000086:
p.000086: 46 See also Element #1.
p.000086:
p.000086: 47 See also Element #2. We recognize that certain types of research may not be compatible with full disclosure of data to be collected, for example
p.000086: in some psychology research. This is an area that requires further reflection, and CIHR welcomes suggestions from those for whom these
p.000086: exceptions may apply.
p.000086:
p.000086: 48 See also Element #4.
p.000086:
p.000086: 49 TCPS states that " undue influence may take the form of inducement, deprivation or the exercise of control or authority over prospective
p.000086: subjects." (TCPS Article 2.2, pg. 2.4)
p.000086:
p.000086: 50 See also Element #7.
p.000086:
p.000086: 51 See Element #2, 2.3.2 and Box- Definition of terms.
p.000086:
p.000086: 52 See also Element #8.
p.000086:
p.000086: 53 See also Element #8.
p.000086:
p.000086: 54 See also Element #9.
p.000086:
p.000086: 55 See also Element #10.
p.000086:
p.000086: 56 See Box- Definition of terms: Individual Identifiability of Data , in Element #2.
p.000086:
p.000086: 57 See Element #10, 10.2.1
p.000086:
p.000086: 58 See also Element #4 regarding managing and documenting the consent process.
p.000086:
p.000086: 59 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 60 See Element #3 regarding determining if consent is required.
p.000086:
p.000086: 61 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 62 See also TCPS Article 4.1 and Section 4-A Conflicts of Interest Involving Researchers (pg. 4.1); TCPS Section 7-Clinical Trials; and TCPS
p.000086: Articles 7.1, 7.2 and explanatory text regarding recruitment and informed consent (pg. 7.2).
p.000086:
p.000086: 63 TCPS Section 6 (Research Involving Aboriginal Peoples) is currently under review, coordinated by the Interagency Advisory Panel on Research
p.000086: Ethics and including CIHR Aboriginal health research guidelines (in development).
p.000086: See also the articulation of First Nations' principles: Ownership, Control, Access and Possession (OCAP) or Self‑determination Applied to
p.000086: Research.
p.000086:
...
General/Other / Undue Influence
Searching for indicator undue influence:
(return to top)
p.000002: the proportion of prospective participants likely to have relocated or died since the time the personal information was originally collected; or
p.000002: the lack of an existing or continuing relationship between prospective participants and the data holder who would need to contact them (e.g. a patient
p.000002: database that does not have a regular follow-up program to maintain a complete and accurate record of changes in registrants' contact information
p.000002: over time);
p.000002:
p.000002: such that:
p.000002:
p.000002: there is a risk of introducing bias into the research because of the loss of data from segments of the population that cannot be contacted to seek
p.000002: their consent, thereby affecting the validity of results and/or defeating the purpose of the study; or
p.000002: the additional financial, material, human, organizational and other resources needed to obtain consent could impose a hardship or burden on the
p.000002: researchers or organization so burdensome that the research could not be done.
p.000002:
p.000002:
p.000002: Element # 4: Managing and documenting consent
p.000002:
p.000002:
p.000002:
p.000002: Consent is an ongoing process that begins upon first contact with prospective participants or authorized third parties, and ends only with the conclusion of
p.000002: their participation in the research or use of their information. Participants should understand that their consent is voluntary, to be obtained without
p.000002: manipulation, undue influence or coercion, and can be withdrawn at any time.
p.000002:
p.000002: Evidence of initial and ongoing consent and the withdrawal of consent should be documented as appropriate for audit and legal purposes.
p.000002:
p.000002: The majority of research studies use an opt-in consent. Opting-in means that prior to the start of the research or data collection, informed individuals give
p.000002: clear indication that they voluntarily agree to participate in the research.
p.000002:
p.000002: Presumed consent with an opt-out mechanism should be used only when an REB considers prior opt-in consent to be inappropriate or impracticable. A
p.000002: valid opt-out mechanism means that individuals have the opportunity at some time during the research or data collection process to give a clear indication
p.000002: (in writing or orally) that they do not want to be participants in the research or to have their data used in the research. If individuals do not choose to opt-out
p.000002: of the research, their consent is presumed as long as they were given reasonable notice of the research and meaningful opportunity to opt-out.
p.000002: Collection of data without direct personal identifiers may be necessary or proposed when the research deals with highly sensitive conditions or activities. In
...
p.000002: participant should also be informed of all expected types and sources of personal data to be used, any expected linkages and the expected purposes for
p.000002: which data will be used.
p.000002:
p.000002: When personal data are to be entered into a database for multiple research uses over an extended period, research participants should also be informed of
p.000002: such things as: expected types of studies, expected data types and purposes, expected commercial uses, data retention period, and the process for
p.000002: overseeing the use and security of data. Participants may also be given the opportunity to provide authorization for future uses, with or without re-contact,
p.000002: including the opportunity to withdraw consent (and any identifying information) in the future. Additional options may include:
p.000002:
p.000002: to be re-contacted on a regular (or as needed basis) to seek consent for new research uses of the data, if desired and practicable; and/or
p.000002: to not be re-contacted, but to authorize the researchers to use the data only in certain ways in the future (e.g. with or without direct identifiers, coded
p.000002: or in non-identifiable form; or for certain areas of research).
p.000002:
p.000002:
p.000002: Element #6: Recruiting prospective research participants
p.000002:
p.000002:
p.000002:
p.000002: The proposed recruitment procedure and materials should be included in the submission for REB approval. The procedure and materials should foster the
p.000002: conditions for voluntary consent, and not exert undue influence on prospective participants to agree to take part in research.
p.000002:
p.000002: Initial contact with individuals about a research project should be made by someone that individuals would expect to have relevant information about them,
p.000002: or in other ways that do not inappropriately intrude on their life or privacy.
p.000002:
p.000002: Wherever possible, the researcher should anticipate at the time of the original collection the future uses of personal information for further recruitment
p.000002: purposes, and seek consent from individuals for these purposes.
p.000002:
p.000002: The REB will need to determine if consent is required for the secondary use of personal information for recruitment purposes . Researchers and REBs
p.000002: should be aware of any legal restrictions on contacting individuals in these circumstances.
p.000002:
p.000002: When a researcher is making a request for access to data to recruit participants, the preferred option is for the data holder to determine eligibility of
p.000002: individuals for the research on the basis of criteria provided by the researchers, and to make the initial contact to:
p.000002:
p.000002: inform eligible individuals about the research so that they can contact the researcher, if interested, or
p.000002: to seek consent from individuals to release their nominal information to the researcher who will contact them to inform them about the research.
p.000002:
p.000002: When the preferred option is impracticable or inappropriate, an REB may consider whether a researcher should be permitted access to minimal personal
...
p.000029: information if they have demonstrated to the satisfaction of the REB that: (a) identifying information is essential to the research;(b) They will take
p.000029: appropriate measures to protect the privacy of the individuals, to ensure the confidentiality of the data, and to minimize harms to subjects; and (c)
p.000029: Individuals to whom the data refer have not objected to secondary use." (pg. 3.5)
p.000029:
p.000029: Article 3.4 "The REB may also require that a researcher's access to secondary use of data involving identifying information be dependent on (a) The
p.000029: informed consent of those who contributed data or of authorized third parties; or (b) An appropriate strategy for informing the subjects; or (c)
p.000029: Consultation with representatives of those who contributed data." (pg. 3.5)
p.000029:
p.000029:
p.000029:
p.000029: Element #4: Managing and documenting consent
p.000029:
p.000029: General statement
p.000029: Consent is an ongoing process that begins upon first contact with prospective participants or authorized third parties, and ends only with the conclusion of
p.000029: their participation in the research or the use of their information. Participants should understand that their consent is voluntary, to be obtained without
p.000029: manipulation, undue influence or coercion, and can be withdrawn at any time. 37
p.000029:
p.000029: Evidence of initial and ongoing consent and the withdrawal of consent should be documented as appropriate for audit and legal purposes.
p.000029:
p.000029:
p.000029: 4.1 Forms of consent
p.000029: 4.1.1 Opt-in consent
p.000029:
p.000029: The majority of research studies use an opt-in consent. Opting-in means that prior to the start of the research or data collection, informed individuals give
p.000029: clear indication that they voluntarily agree to participate in the research.
p.000029:
p.000029: Opt-in consent can be indicated in writing (e.g. by signing a consent form), orally (e.g. in a face-to-face or telephone encounter with the researcher) or by
p.000029: conduct (e.g. by filling out and returning a questionnaire received by mail). Consent is only voluntary if it can be withdrawn at any time. 38
p.000029:
p.000029: 4.1.2 Presumed consent with opt-out
p.000029:
p.000029: Presumed consent with an opt-out mechanism should be used only when an REB considers prior opt-in consent to be inappropriate or impracticable.
p.000029:
...
p.000029: should be given the opportunity to reiterate their consent, to withdraw from the research, or to withdraw their particular comments. 39 Thus, obtaining
p.000029: informed consent should be an ongoing negotiation.
p.000029:
p.000029:
p.000029: 4.4 Documenting non-participation or withdrawal of consent
p.000029: The researcher may need information on who does not want to participate in research or who withdraws from research, for example to:
p.000029:
p.000029: document who is not to be included in follow-up research activities; and/or
p.000029: take into consideration relevant characteristics of the population not included in the study, when reporting possible bias in research results.
p.000029:
p.000029: In these circumstances, researchers may obtain information about non-participants or those withdrawing consent only with:
p.000029:
p.000029: individuals' consent or
p.000029: the approval of an REB to waive the consent requirement in the particular circumstances. 40
p.000029: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000029:
p.000029: [Voluntary consent: No manipulation, undue influuence or coercion]
p.000029:
p.000029: Article 2.2 "Free and informed consent must be voluntarily given, without manipulation, undue influence or coercion". Explanatory text: "...Undue
p.000029: infiuence may take the form of inducement, deprivation or the exercise of control, or authority over prospective subjects. Voluntariness is especially
p.000029: relevant in research involving restricted or dependent subjects, and is absent if consent is secured by the order of authorities or as a result of coercion or
p.000029: manipulation..REBS should also pay particular attention to the elements of trust and dependency, for example, within doctor/patient or professor/student
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
...
p.000029: objectives 46
p.000029: and procedure
p.000029:
p.000029: 2) Data types and Types of data to be collected and why.
p.000029: uses 47 Any planned or foreseeable commercial uses of the data.
p.000029: If appropriate, a statement indicating whether test results are for research purposes only or if they can serve other non-
p.000029: research purposes (e.g. clinical care).
p.000029:
p.000029:
p.000029: 3) Voluntary basis Voluntary basis for participation, and ongoing meaningful opportunities to decide whether to continue.
p.000029: for participation Withdrawal, without any negative effect on a person's reasonable expectations of rights and benefits, being possible at any
p.000029: 48 time (but be clear that data which have already been made non-identifiable cannot be retrieved and destroyed).
p.000029: Option of contacting other family members to ask their willingness to be contacted by the researcher (e.g. in genetic
p.000029: research, participants should make first contact with related family members).
p.000029: Circumstances under which the researcher may terminate the participant's involvement in the research (e.g. in clinical drug
p.000029: trials).
p.000029: 4) Risks, benefits, Possible risks or discomforts to the research participant (including physical, emotional and psychological impacts, or
p.000029: compensation privacy intrusion).
p.000029: Benefits of the research in general and, if relevant, the benefits to the individual participant.
p.000029: Any compensation offered to participants should not constitute an undue influence to agree to participate. 49
p.000029:
p.000029:
p.000029: 5) Confidentiality Protection of data confidentiality (e.g. affirmation that genetic data will not be given to third parties)
p.000029: and safeguards General description of security measures (e.g. coding of data, 51 locked storage).
p.000050: 50
p.000050:
p.000050:
p.000050: 6) Data access and Who will have access to the data and for what purposes (include any legal requirements, such as mandatory public health
p.000050: legal disclosure reporting of certain diseases or obligation to produce evidence on court order; access required for scientific integrity such
p.000050: requirements 52 as auditing or verification of data; and any plans to archive or destroy the data).
p.000050:
p.000050:
p.000050: 7) Reporting of Explanation of the conditions, if any, under which personal results are to be reported back (e.g. results of genetic testing
p.000050: results 53 should normally be reported back to the participant through a physician and with provision of genetic counseling; conditions
p.000050: for informing implicated family members of research results should be clearly stated).
p.000050: A clear statement, if relevant, of conditions under which results will not be given to the participant (e.g. exploratory research
p.000050: for which results are not clinically meaningful or community-based research where results are applicable only to the
p.000050: community).
...
p.000050: of the true objective of the research. For such techniques to fall within the exception to the general requirements of full disclosure for free and informed
p.000050: consent, the research must meet the requirements of Article 2.1 (c)..." (pg. 2.2- 2.3)
p.000050:
p.000050: [Secondary uses]
p.000050:
p.000050: Article 3.2 Explanatory text: "It is essential that subsequent uses of data be specified in sufficient detail that prospective subjects may give free and
p.000050: informed consent; it is inappropriate to seek blanket permission for "research in general". (pg. 3.4)
p.000050:
p.000050:
p.000050:
p.000050:
p.000050: Element #6: Recruiting prospective research participants
p.000050:
p.000050: General statement
p.000050: To recruit research participants, the researcher will typically need to complete the following steps, each of which involves the researcher or another more
p.000050: appropriate person having access to personal information:
p.000050:
p.000050:
p.000050: Step A: Assess eligibility criteria for the research and assemble a list of eligible individuals.
p.000050:
p.000050: Step B: Establish initial contact with eligible individuals.
p.000050:
p.000050: Step C: Inform eligible individuals about the research, as part of the informed consent process.
p.000050:
p.000050:
p.000050: The proposed recruitment procedure and materials should be included in the submission for REB approval.
p.000050:
p.000050: The procedure and materials should foster conditions for voluntary consent, and not exert undue influence on prospective participants to agree to take part
p.000050: in the research. 58
p.000050:
p.000050: Initial contact with individuals about a research project should be made by someone that individuals would expect to have relevant information about them,
p.000050: or in other ways that do not inappropriately intrude on their life or privacy.
p.000050:
p.000050: If permitted by law 59 and subject to REB approval, the data holder who would normally have access to the required personal information is the
p.000050: preferred person to access that information to assess eligibility of individuals for the research (Step A) and to make initial contact with those individuals
p.000050: (Step B), unless the REB considers this approach to be impracticable or inappropriate.
p.000050:
p.000050: Typical scenarios for recruiting participants and preferred approaches are described under 6.3.
p.000050:
p.000050:
p.000050: 6.1 Consent and secondary use of personal information to assess eligibility and contact individuals
p.000050: The REB will need to determine if consent from individuals is required for the secondary use of their personal information for assembling a list of eligible
p.000050: individuals for research or contacting these individuals to seek their consent for participation. 60 Researchers and REBs should be aware of any legal
p.000050: restrictions on contacting individuals in these circumstances. 61
p.000050:
p.000050: 6.1.1 Anticipating future uses of personal information at the time of the original collection
p.000050:
p.000050: Wherever possible at the time of the original collection of personal information from individuals, the researcher and/or data custodian should anticipate the
p.000050: future uses of this information to assemble eligibility lists for research or to contact eligible individuals, and should seek consent for these future uses at that
p.000050: time.
p.000050:
p.000050: For example, patients could be asked at the time of the original collection of their personal information whether they consent to the health care provider
p.000050: reviewing their records and contacting them to inform them of research for which they are eligible. If such a prior opt-in consent procedure is not a
p.000050: practicable option, a health care provider could inform patients through notices that their personal information may be reviewed from time to time for
p.000050: recruitment purposes, and that they have the opportunity to opt-out. If patients do not opt-out, their consent for the use of their personal information to
p.000050: assess their eligibility for research or to contact them about the research project would be presumed.
p.000050:
p.000050:
p.000050: 6.2 Initial contacting and informing prospective participants
p.000050: 6.2.1 Trust vs. undue influence
p.000050:
p.000050: Recruitment raises complex issues around who is the appropriate person to make initial contact and inform eligible individuals about the research. On the
p.000050: one hand, individuals may feel more comfortable if approached by a data holder, such as a clinic physician or nurse, whom they trust and accept as having
p.000050: access to their personal information. On the other hand, individuals may be unduly influenced to agree to participate in research if approached by someone
p.000050: on whom they are dependent, for example, their employer, health provider, community leader or program director.
p.000050:
p.000050: In some cases, someone who has a relationship of some influence over prospective research participants may be the preferred person to contact
p.000050: individuals and inform them of the research where this is considered the best way to ensure that prospective research participants fully understand the risks
p.000050: and the benefits of the research to themselves. For example, a health care provider or professional (who may or may not be involved in the research) may
p.000050: be the preferred person to contact individuals and inform them about the research because of a relationship of medical confidence, special expertise and/or
p.000050: in-depth knowledge of the patients' situations. It is critical in such cases that the participants are reassured that their reasonable expectations of care will be
p.000050: met whether or not they take part in the research. 62
p.000050:
p.000050: 6.2.2 Prior communication
p.000050:
p.000050: Researchers should avoid situations where eligible individuals are not aware, prior to being contacted, of information about themselves that makes them
...
p.000063:
p.000063:
p.000063:
p.000063: For the purpose of recruiting relatives for genetic or genomic research, there should be no direct contact between the researcher and the family members of
p.000063: the initial research participant. In order to respect the privacy of the participant and his family, only the participant or his/her spouse or a designated family
p.000063: member should contact other family members to ask their willingness to be approached by the researcher. The principal researcher (or a member of the
p.000063: research team) should not directly contact the family. 64
p.000063:
p.000063:
p.000063: 6.3.4 Scenarios: * The researcher has access to personal data from prior research studies. * The research unit of a hospital is proposing to conduct
p.000063: research on patients. * The researcher is the health care provider of eligible individuals.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is the data holder or is employed by the data holder. If permitted by law 65 and subject to REB approval, the data
p.000063: holder may assess the eligibility of individuals for the research.
p.000063:
p.000063: The data holder should have rules nevertheless to limit the number of people permitted access to data for this purpose. 66
p.000063:
p.000063:
p.000063: Preferred options for contacting individuals will depend on whether the REB considers that the researcher/data holder has undue influence over
p.000063: prospective research participants (see the Options table).
p.000063:
p.000063: Options for contacting individuals according to whether the researcher/data holder has influence over prospective research participants
p.000063:
p.000063: Option Contacting prospective research participants
p.000063:
p.000063: A) If the If the researcher/data holder is not in a position of undue influence over prospective participants with regard to the research, the
p.000063: researcher/data researcher should make the initial contact and inform prospective participants about the research, if permitted by law and subject to
p.000063: holder is not in REB approval.
p.000063: a position of
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the In some cases, the researcher/data holder is considered to potentially be in a position of undue influence over eligible individuals with
p.000063: researcher/data regard to the research or there is a potential conflict of interest. For example, an REB may decide that patients who will be recruited
p.000063: holder is in a for a clinical trial being conducted by their health care provider may not understand the difference between the research treatment and
p.000063: position of the standard treatment provided at the health centre.
p.000063: undue
p.000063: In such cases, initial contact with prospective research participants should be made by neutral means, so that there is no undue
p.000063: influence.
p.000063: influence exerted on individuals to participate. For example, a neutral person on the research team or in the data holder's agency who
p.000063: is not in a position of authority over prospective research participants, could contact eligible individuals. Alternatively, it may be
p.000063: possible to make initial contact with eligible individuals by advertising in newspapers or in public locations, and then having a neutral
p.000063: member of the research team or staff provide further information to interested individuals.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.5 Scenario: * The researcher is external to the data-holding organization, and is submitting a proposal to conduct research on patients,
p.000063: employees or students of the organization.
p.000063:
p.000063:
p.000063:
p.000063: In this scenario, the researcher is not the data holder, and does not have undue influence over prospective research participants. If permitted by law, 67
p.000063: the preferred recruitment approach is for the data holder to assess eligibility for research and to make initial contact with eligible individuals, unless the REB
p.000063: considers that the preferred approach is impracticable or inappropriate (see the ranked Options table).
p.000063:
p.000063: Ranked options for assessing eligibility and contacting prospective participants, when the researcher is not the data holder and does not have
p.000063: undue influence
p.000063:
p.000063: Option Assessing eligibility and contacting prospective research participants
p.000063:
p.000063: A) The data holder assesses eligibility and makes If permitted by law and subject to REB approval, the data holder should determine eligibility of
p.000063: initial contact. (Preferred) individuals for the research on the basis of criteria provided by the researcher. The data holder
p.000063: should make the initial contact to: (i) inform eligible individuals about the research so that they can
p.000063: contact the researcher, if interested, or (ii) to seek consent from individuals to release their nominal
p.000063: information to the researcher who will contact them to inform them about the research.
p.000063:
p.000063: B) If the REB considers option A impracticable or In some cases, the preferred option above may be considered impracticable or inappropriate. For
p.000063: inappropriate, the REB may permit the researcher example, the preferred option may be impracticable if:
p.000063: to access minimal personal information for
p.000063: the data holder does not, despite funding from the researcher, have the resources to assess
p.000063: assessing eligibility and/or making contact with
p.000063: eligibility and make initial contact, and therefore the research could not proceed unless an
p.000063: eligible individuals, if permitted by law and under
p.000063: alternative recruitment procedure is used; or
p.000063: strict controls (e.g. access restricted to data
p.000063: the data holder does not have an ongoing relationship with eligible individuals to make
p.000063: holder's site).
p.000063: contact (e.g. as may the case for a registrar of a population records database, or a
p.000063: government agency holding health insurance registration and billing information).
p.000063:
p.000063: The preferred option may be considered inappropriate where the data holder has undue influence
p.000063: over eligible individuals; professional or other legal requirements makes the data custodian's
p.000063: involvement in the recruitment process inappropriate; or the data holder's contacting of eligible
p.000063: individuals would defeat the purpose of the research. 68
p.000063:
p.000063: When the preferred option is impracticable or inappropriate, an REB may consider whether a
p.000063: researcher should be permitted access to minimal personal data only for the purposes of
p.000063: determining eligibility for the research or contacting individuals to invite them to join the study 69
p.000063: . If it is legally permissible and the REB gives approval, the researcher may be given access to
p.000063: personal information with appropriate confidentiality protections such as a signed confidentiality
p.000063: agreement with access restricted to the data holder's site, and use limited to the stated purpose.
p.000063:
p.000063: Minimal personal data provided to the researcher should normally contain only contact information
p.000063: and no other personal information related to health status. However, if health-related data are
p.000063: inherent in the eligibility criteria used to assemble the list of individuals to be contacted, an REB
p.000063: may determine that camouflage sampling or other masking techniques should be used to enable
p.000063: researchers to contact individuals while preventing researchers from viewing any identifiable
p.000063: health-related information of eligible individuals prior to gaining consent. 70
p.000063:
p.000063:
p.000063:
p.000063: Option A: Examples of recruitment methods:
p.000063:
...
p.000063: members.
p.000063: Data holder assesses eligibility and provides camouflaged list to researcher to make initial contact
p.000063:
p.000063: The study is approved by the REB and the privacy branch of the Ministry of Health. Ministry of Health staff produces a "camouflaged" list of patient
p.000063: names for the researchers, containing scrambled personal health numbers of patients potentially affected by a new health care policy with scrambled
p.000063: numbers of a random sample of patients who are not affected by the policy. When the scrambled numbers are unscrambled and converted to names,
p.000063: addresses and telephone numbers by the Ministry of Health's Client Registry, the health status of each patient remains unknown to the researchers and
p.000063: to the Ministry of Health staff. The addition of persons not affected by the health condition prevents the researchers from knowing who is affected and
p.000063: who is not; only those who respond are identified. In order to be most effective, camouflaging should aim to protect the privacy of targeted patients,
p.000063: while limiting the total number of patients who need to be contacted.
p.000063:
p.000063:
p.000063:
p.000063:
p.000063: 6.3.6 Scenario: * A clinician/researcher at a health care facility wants to conduct research on patients being treated by another physician in the same
p.000063: facility. * An academic wants to conduct research on students in his or her university department or program, but not in a class that he or she is
p.000063: currently teaching.
p.000063:
p.000063:
p.000063:
p.000063: In these scenarios, the researcher is not the data holder, but does potentially have undue influence over prospective participants with regard to the
p.000063: research.
p.000063:
p.000063: Preferred approaches to assessing eligibility for research and contacting eligible individuals will depend on whether the REB considers the data holder to
p.000063: have undue influence over prospective research participants (see the Options table).
p.000063:
p.000063: Options for assessing eligibility and making contact with individuals when the researcher has undue influence over prospective individuals
p.000063:
p.000063: Option Assessing eligibility and contacting individuals
p.000063:
p.000063: A) If the data If the data holder is not in a position of undue influence over prospective research participants, the REB may permit the data holder to
p.000063: holder is not in assess eligibility and make the initial contact with these individuals, if the data holder is permitted to do so by law (see scenario 6.3.5,
p.000063: a position of option A).
p.000063: undue
p.000063: influence.
p.000063:
p.000063: B) If the data If the data holder is considered by an REB to have undue influence on prospective participants, the researcher could make initial
p.000063: holder is in a contact with eligible individuals by neutral means such as by putting up notices in public areas of the facility or institution with
p.000063: position of information on how to contact the research team, and a neutral member of the research team or staff could inform interested
p.000063: undue individuals about the research (see scenario 6.3.4, option B).
p.000063: influence.
p.000063:
p.000063:
p.000063:
p.000063: LINK TO TRI-COUNCIL POLICY STATEMENT:
p.000063:
p.000063: [Secondary use of data for prospective collection]
p.000063:
p.000063: Article 3.5 "Researchers who wish to contact individuals to whom data refer shall seek the authorization of the REB prior to contact." Explanatory text:
p.000063: "In certain cases, the research goal may only be achieved by follow-up contact and interviews with persons. It is evident that individuals or groups might
p.000063: be sensitive if they discover that research was conducted on their data without their knowledge; others may not want any further contact. This potential
p.000063: harm underlines the importance for researchers to make all efforts to allow subjects the right to consent that their data and private information be part of
p.000063: a study." (pg. 3.6)
p.000063:
p.000063:
p.000063:
p.000063: Element #7: Safeguarding personal data
p.000063:
p.000063: General statement
p.000063: Institutions or organizations where research data are held have a responsibility to establish appropriate institutional security safeguards. Data security
...
p.000086: (89-603-XWE, free), available online.
p.000086:
p.000086: 43 When results of research tests are determined to be scientifically valid, have significant implications for the health of the participant, and
p.000086: prevention or treatment is available, these results should be communicated to the participant through his or her treating physician, unless the
p.000086: participant has chosen not to receive any results.
p.000086: In communicating results to the participant, particularly with respect to genetic research, the choices of each participant, the extent of available
p.000086: clinical services, the availability of counselling, and the implications for family members, should be taken into account (based on Quebec's
p.000086: Network of Applied Genetic Medicine (RMGA) Statement of Principles: Human Genome Research Version 2000, part IV Professionalism, part 3
p.000086: Communication of Specific Results, pg. 12).
p.000086:
p.000086: Based on Quebec Network of Applied Genetic Medicine (RMGA) Statement of Principles on the Ethical Conduct of Human Genetic Research
p.000086: 44 Involving Populations (2002), Section 6, Communication of Research Results, pg. 3.
p.000086:
p.000086: 45 As above.
p.000086:
p.000086: 46 See also Element #1.
p.000086:
p.000086: 47 See also Element #2. We recognize that certain types of research may not be compatible with full disclosure of data to be collected, for example
p.000086: in some psychology research. This is an area that requires further reflection, and CIHR welcomes suggestions from those for whom these
p.000086: exceptions may apply.
p.000086:
p.000086: 48 See also Element #4.
p.000086:
p.000086: 49 TCPS states that " undue influence may take the form of inducement, deprivation or the exercise of control or authority over prospective
p.000086: subjects." (TCPS Article 2.2, pg. 2.4)
p.000086:
p.000086: 50 See also Element #7.
p.000086:
p.000086: 51 See Element #2, 2.3.2 and Box- Definition of terms.
p.000086:
p.000086: 52 See also Element #8.
p.000086:
p.000086: 53 See also Element #8.
p.000086:
p.000086: 54 See also Element #9.
p.000086:
p.000086: 55 See also Element #10.
p.000086:
p.000086: 56 See Box- Definition of terms: Individual Identifiability of Data , in Element #2.
p.000086:
p.000086: 57 See Element #10, 10.2.1
p.000086:
p.000086: 58 See also Element #4 regarding managing and documenting the consent process.
p.000086:
p.000086: 59 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 60 See Element #3 regarding determining if consent is required.
p.000086:
p.000086: 61 See the legal concordance table for Element #6 in Appendix A-7.
p.000086:
p.000086: 62 See also TCPS Article 4.1 and Section 4-A Conflicts of Interest Involving Researchers (pg. 4.1); TCPS Section 7-Clinical Trials; and TCPS
p.000086: Articles 7.1, 7.2 and explanatory text regarding recruitment and informed consent (pg. 7.2).
p.000086:
p.000086: 63 TCPS Section 6 (Research Involving Aboriginal Peoples) is currently under review, coordinated by the Interagency Advisory Panel on Research
p.000086: Ethics and including CIHR Aboriginal health research guidelines (in development).
...
General/Other / cultural difference
Searching for indicator culturally:
(return to top)
p.000029: opt-out mechanism the person opts out
p.000029: Voluntary.
p.000029: Ways of opting out: Informed (e.g. through notices, brochures, letters, media announcements):
p.000029: of the research
p.000029: 1. Written (preferred)
p.000029: of the opportunity to opt-out
p.000029: 2. Oral
p.000029: of the means of opting out.
p.000029: Accessible means for opting out.
p.000029: Opt-out may be done at any time before or during the research, with a clear
p.000029: understanding of what opting out means, for example:
p.000029: no further collection of additional data; or
p.000029: no further analyses using the already collected data; or,
p.000029: removal of data from the database to the extent possible (Note: Non-
p.000029: identifiable data will be impossible to isolate and retrieve).
p.000029: The process of opting-out to be documented by the researcher.
p.000029:
p.000029:
p.000029:
p.000029: 4.2 Documenting consent
p.000029: 4.2.1 Written documentation signed by the research participant (preferred)
p.000029:
p.000029: Whenever appropriate and practicable, a written documentation of opting-in or opting-out of research is preferred. This should be documented using a
p.000029: consent form or refusal statement signed by the individual.
p.000029:
p.000029: 4.2.2 Oral consent documented by the researcher
p.000029:
p.000029: Where oral consent is obtained for telephone interviews, where written documentation is culturally unacceptable, or where there are good reasons for not
p.000029: recording opt-in or opt-out in writing using a form that the participant signs, an oral procedure should be managed and documented, indicating that the opt-in
p.000029: or opt-out was conducted orally.
p.000029:
p.000029: 4.2.3 Documented consent and collection of data without direct personal identifiers
p.000029:
p.000029: Collection of data without direct personal identifiers may be necessary or proposed when the research deals with highly sensitive conditions or activities. In
p.000029: such circumstances, consent should be documented but the identity of research participants should not be linkable to their data or to results of analyses.
p.000029:
p.000029: Example: Oral consent and non-identifiable data and results
p.000029:
p.000029: Disease X prevalence study among women undergoing abortion in City Y. Before undergoing therapeutic abortions, women must necessarily
p.000029: have a blood test.
p.000029:
p.000029: Women who were scheduled for therapeutic abortions were approached in a hospital clinic about their willingness to participate in the study on Disease
p.000029: X. Those who gave oral consent to participate in this study agreed to fill out questionnaires (without providing their names) about certain risk factors for
p.000029: disease X, and to permit the testing of leftover blood from the blood test for the presence of disease X.
...
p.000029: relationships, because these can constitute undue infiuence on the patient to participate in research projects, especially those involving residents in
p.000029: long-term care facilities or psychiatric institutions..." (pg. 2.4)
p.000029:
p.000029: Article 2.4 "... researchers or their qualified designated representatives shall provide prospective subjects with the following:.. (d) An assurance that
p.000029: prospective subjects are free not to participate, have the right to withdraw at any time without prejudice to pre-existing entitlements, and will be given
p.000029: continuing and meaningful opportunities for deciding whether to continue to participate.." Explanatory text:"..Articles 2.2 and 2.4(d) help to ensure that a
p.000029: prospective subject's choice to participate is voluntary. Pre-existing entitlement to care, education and other services shall not be prejudiced by the
p.000029: decision on whether to participate. Accordingly, a physician should ensure that continued clinical care is not linked to research participation, and
p.000029: teachers should not recruit prospective subjects from their classes, or students under their supervision, without REB approval. Nothing in this Section
p.000029: should be interpreted as meaning that normal classroom assessments of course work require REB approval..." (pg. 2.6)
p.000029:
p.000029: [Evidence of consent]
p.000029:
p.000029: Article 2.1 "...(b) Evidence of free and informed consent by the subject or authorized third party should ordinarily be obtained in writing. Where written
p.000029: consent is culturally unacceptable, or where there are good reasons for not recording consent in writing, the procedures used to seek free and informed
p.000029: consent shall be documented..." Explanatory text: "Free and informed consent... encompasses a process that begins with the initial contact and carries
p.000029: through to the end of the involvement of research subjects in the project. As used in this Policy, the process of free and informed consent refers to the
p.000029: dialogue, information sharing and general process through which prospective subjects choose to participate in research that involves themselves. " (pg.
p.000029: 2.1)
p.000029:
p.000029: [Written and oral documentation]
p.000029:
p.000029: Article 2.1 Explanatory text: "Article 2.1 (b) states the preference for written evidence of free and informed consent. The article acknowledges that written
p.000029: consent is not always appropriate. For most people in our society, a signed statement is the normal evidence of consent. However, for some groups or
p.000029: individuals, a verbal agreement, perhaps with a handshake, is evidence of trust, and a request for a signature may imply distrust. Nonetheless, in most
p.000029: cases a written statement of the information conveyed in the consent process, signed or not, should be left with the subject. In some types of research,
...
Orphaned Trigger Words
p.000002:
p.000002: ICH GCP International Conference on Harmonization of Technical Requirements for Registration of Pharmaceuticals for Human
p.000002: Use- Good Clinical Practice: Consolidated Guideline
p.000002:
p.000002: NCEHR National Council on Ethics in Human Research
p.000002:
p.000002: NIH National Institutes of Health (United States of America)
p.000002:
p.000002: NSERC Natural Sciences and Engineering Research Council of Canada
p.000002:
p.000002: PAC CIHR Privacy Advisory Committee
p.000002:
p.000002: PRE Interagency Advisory Panel on Research Ethics
p.000002:
p.000002: REB Research Ethics Board
p.000002:
p.000002: RMGA Quebec Network of Applied Genetic Medicine
p.000002:
p.000002: SSHRC Social Sciences and Humanities Research Council of Canada
p.000002: TCPS Canadian Institutes of Health Research, Natural Sciences and Engineering Research Council of Canada, Social
p.000002: Sciences and Humanities Research Council of Canada, Tri-Council Policy Statement: Ethical Conduct for Research
p.000002: Involving Humans, 1998 (with 2000, 2002, 2005 amendments)
p.000002:
p.000002: U.S. United States of America
p.000002:
p.000002:
p.000002:
p.000002: CIHR Privacy Advisory Committee 1 - Recommendations
p.000002:
p.000002: Background
p.000002: Recognizing that one of the key ethical challenges for the health research community is to appropriately protect the privacy of those individuals whose
p.000002: information is used for research purposes, CIHR has promoted and initiated dialogue with the broad health research community on a range of privacy-
p.000002: related matters for many years. In particular, a multi-stakeholder workshop in November 2002 entitled Privacy in Health Research: Sharing Perspectives
p.000002: and Paving the Way Forward resulted in a number of recommendations, including that CIHR initiate the development of privacy best practices and promote
p.000002: the harmonization of privacy laws and policies that impact on health research.
p.000002:
p.000002:
p.000002: Privacy Advisory Committee
p.000002: Following on these recommendations, CIHR established a Privacy Advisory Committee (PAC) in 2003 to advise CIHR on the development of privacy best
p.000002: practices for health research, and on strategies for consultation, communication and knowledge translation. The Committee's mandate ends with the public
p.000002: release of the Privacy Best Practices in 2005.
p.000002:
p.000002: PAC members were drawn from across Canada and include an international advisor. They represent themselves, not their organizations or institutions.
p.000002: Members bring the perspectives of the following interested groups: privacy commissioners, research ethics boards, health researchers, voluntary health
p.000002: organizations, patients/consumers, policy-makers, data providers, law/ethics, Aboriginal communities, and health service providers. Ex-officio members are
p.000002: drawn from key groups involved in developing or implementing research ethics policy/regulations, namely the Interagency Advisory Panel for Research
p.000002: Ethics, the National Council on Ethics in Human Research, Health Canada, and the Social Sciences and Humanities Research Council of Canada. The
p.000002: Natural Sciences and Engineering Research Council of Canada was invited to appoint a member on PAC but preferred to assume a consultative role. PAC
p.000002: members agreed by consensus to have the CIHR Ethics Office chair the Committee in the role of facilitator.
p.000002:
p.000002: An earlier version of the current document was the subject of public consultations through 2004. The current document was revised based on feedback
p.000002: received.
p.000002:
p.000002:
p.000002: Recommendations
p.000002: The following recommendations are intended to promote the effective implementation of these Privacy Best Practices in the health research community
p.000002: and to ensure that these best practices continue to respond to the evolving nature of health research and challenges of privacy protection.
p.000002:
p.000002:
p.000002: Continuous learning and evaluation
...
p.000002:
p.000002: These Privacy Best Practices do not replace existing laws, policies and professional codes of conduct that apply to certain types of personal information,
p.000002: designated organizations and/or specific kinds of activity.
p.000002:
p.000002:
p.000002: Privacy Best Practices
p.000002: The Elements are presented in summary in this section to provide a quick reference for the reader. Full descriptions of each Element along with links to
p.000002: selected excerpts from the TCPS are in the main body of this document.
p.000002:
p.000002: Tables of Concordances are included in the Appendices to supplement key provisions in the Elements with cross-references to related requirements under
p.000002: Canadian privacy legislation. The Tables should be used only as preliminary guidance. The application of the information in the Tables to a particular
p.000002: research project should be determined in consultation with a legal advisor.
p.000002:
p.000002:
p.000002: Element #1: Determining the research objectives and justifying the data needed to fulfill these objectives
p.000002:
p.000002:
p.000002:
p.000002: At the outset of the research design process, and as thoroughly as possible given the proposed research method, researchers should:
p.000002:
p.000002: identify and document research objectives and questions as a basis for determining what data will be needed;
p.000002: anticipate and document research questions related to the primary research objective, which might become relevant after the initial data analyses;
p.000002: and
p.000002: anticipate and document likely future uses of the data, including possible collaborations with other researchers or possible commercial uses.
p.000002:
p.000002: In the case of a database created for general research purposes , researchers should define the scope and purpose in a way that will be meaningful for
p.000002: research ethics boards (REBs) and any prospective research participants, even if the boundaries are at a relatively general level. This is an opportunity to
p.000002: be as open and transparent as possible about the proposed research, and to reassure research participants and REBs that although future research
p.000002: purposes are not specified in detail, data management, storage and use will occur within a defined framework, including review and approval by an REB.
p.000002:
p.000002: If appropriate, setting up an advisory committee drawn from the scientific community, other relevant areas (such as ethics, policy, or information
p.000002: technology) and those affected by the condition or health event under study, can assist in defining the scope and strategic priorities for a research project in
p.000002: the context of both short and long-term initiatives.
p.000002:
p.000002: All potential relevant and useful research questions cannot always be foreseen at the outset of a research project. For example, researchers using
p.000002: inductive methods of research may discover an "emergent" research approach through encounters with and in collaboration with research participants. In
p.000002: such research, the development of research questions and procedures is an ongoing process. While planning their research, researchers should attempt to
p.000002: foresee both obvious and emerging issues related to privacy. These should be included in the submission to an REB. Researchers should also document
p.000002: for an REB any amendments to the protocol and consequent privacy protection strategies emerging over the course of the study.
p.000002:
p.000002:
p.000002: Element #2: Limiting the collection of personal data
p.000002:
p.000002:
p.000002:
...
p.000002:
p.000002: From individuals and secondary use or disclosure 3.2, 5.6
p.000002:
p.000002: Communities 3.3.5, 5.3.2, 6.3.2
p.000002:
p.000002: Secondary use or disclosure 2.3, 3.3, 6.1, 8.1 Element #2, 3, 5, 6
p.000002:
p.000002: Data linkage 2-Summary guide (b), 8.2 Element #8
p.000002:
p.000002: Real world case studies Appendix A-3
p.000002:
p.000002: Examples of studies recruiting individuals or communities Appendix A-4 Table 1
p.000002:
p.000002: Examples of databases with research potential, in diverse settings Appendix A-4 Table 2
p.000002:
p.000002: Additional stewardship, oversight
p.000002:
p.000002: Advisory committee on research priorities 1.3
p.000002:
p.000002: Data stewardship committee 10.2.4
p.000002:
p.000002: Legal requirements
p.000002:
p.000002: Tables of concordance with privacy legislation Appendix A-7
p.000002:
p.000002:
p.000002: * based on feedback during 2004 consultations on draft CIHR privacy best practice guidelines.
p.000002:
p.000002:
p.000002: Introduction
p.000002:
p.000002: CIHR's Mandate
p.000002: The Canadian Institutes of Health Research (CIHR) is Canada's main federal funding agency for health research. CIHR's mandate is to invest in research
p.000002: that has the potential to lead to improved health 3 for Canadians, more effective health services and products, and a strengthened Canadian health care
p.000002: system. CIHR-funded health research must also meet the highest standards of scientific excellence and ethics.
p.000002:
p.000002: In the area of ethics, one of the key challenges for the health research community is to protect the privacy of individuals and the confidentiality of personal
p.000002: information, at a time of great change in research. For example, technological advances in information technology and the advance of genetic research are
p.000002: challenging existing standards and mechanisms for privacy protection. Also, the sheer number, diversity and complexity of new privacy laws and policies
p.000002: within and beyond Canada's borders are increasing the practical challenges faced by researchers, particularly for those conducting studies across
p.000002: jurisdictions. And, while there are increasing demands for privacy protection in health research, there is also clear recognition that health research plays a
p.000002: critical role in improving the health of Canadians and supporting an evidence-based health care system.
p.000002:
p.000002:
p.000002: Goals
p.000002: These Best Practices are intended to be innovative approaches to the challenge of protecting the privacy of individuals and the confidentiality of personal
p.000002: information in the context of health research. These Best Practices are meant to:
p.000002:
p.000002: provide guidance for health researchers in the design and conduct of health research involving personal information;
p.000002: be a resource for research ethics boards and institutions to consult when reviewing and evaluating health research involving personal information;
p.000002: and
p.000002: through the uptake and application of these Best Practices in the development of privacy laws or policies across Canada, contribute toward a more
p.000002: coherent and harmonized framework for addressing privacy and confidentiality issues in health research.
p.000002:
p.000002:
p.000002: Statement of values
p.000002: These Best Practices primarily reflect the values articulated in two foundational documents: the Tri-Council Policy Statement: Ethical Conduct for Research
p.000002: involving Humans (TCPS), Canada's national ethics guidelines for research funded by the three main federal funding agencies, and internationally
p.000002: accepted fair information principles codified by the Canadian Standards Association.
p.000002:
p.000002: Tri-Council Policy Statement (TCPS)
p.000002:
p.000002: The Best Practices are firmly embedded in CIHR's ongoing commitment to support TCPS. 4 Compliance with TCPS is mandatory for all research
p.000002: funded through the three main federal research funding agencies: Canadian Institutes of Health Research (formerly Medical Research Council of Canada),
p.000002: Natural Sciences and Engineering Research Council of Canada (NSERC) and Social Sciences and Humanities Research Council of Canada (SSHRC).
p.000002: Research ethics boards (REBs) also use the TCPS as guidance in the review of research funded through other sources.
p.000002:
p.000002: The broad ethical framework of the TCPS is based on recognition of the need for and social value of research, along with moral imperatives to respect
...
p.000002: the researcher should also be aware of legal provisions that affect the database(s) to be used in the research.
p.000002:
p.000002: REBs and researchers should also be sensitive to the context in which the database was created, such as a confidential relationship, as well as to the
p.000002: expectations of the groups or individuals at the time of the collection of the data with regard to its use, retention and disclosure. When it is unclear as to
p.000002: whether information is to be regarded as personal, researchers should consult their REBs. Confidential information collected in this manner should
p.000002: normally not be transmitted to authorities, unless required by law, the courts or similar legally constituted bodies." (pg. 3.5)
p.000002:
p.000002:
p.000002:
p.000002: Element #3 : Determining whether consent from individuals is required
p.000002:
p.000002: General statement
p.000002: Voluntary and informed consent from legally competent individuals or authorized third parties is a fundamental principle in research involving humans, and
p.000002: specifically for the use of their personal data. 19
p.000002:
p.000002: Under specified circumstances, given a satisfactory rationale by the researcher, an REB may approve the waiver of a consent requirement, or a partial
p.000002: waiver of some elements of a consent requirement. According to TCPS Article 2.1(c), the REB must find and document that: "(i)The research involves no
p.000002: more than minimal risk 20 to the subjects; (ii) The waiver or alteration is unlikely to adversely affect the rights and welfare of the subjects; (iii) The
p.000002: research could not practicably be carried out without the waiver or alteration; (iv) Whenever possible and appropriate, the subjects will be provided with
p.000002: additional pertinent information after participation; and (v) The waived or altered consent does not involve a therapeutic intervention."
p.000002:
p.000002: In addition to REB approval, disclosure of personal data for research without consent will be subject to other specific legal requirements in relevant
p.000002: jurisdictions. 21
p.000002:
p.000002:
p.000002: 3.1 Collection from individuals
p.000002: The requirement for consent from participants applies to research involving:
p.000002:
p.000002: Collection of personal (including genetic) information from persons (e.g. in face-to-face meetings, by mail, telephone or email).
p.000002: Procedures to screen for, prevent or treat disease.
p.000002: Medical examinations.
p.000002: Clinical trials of new drugs or other health care products. 22
p.000002:
p.000002: 3.2 Direct collection and secondary use (Hybrid model)
p.000002: When a research objective requires the collection of personal information directly from individuals to whom the data belong and subsequent linking to other
p.000002: sources to form a combined file, consent should be sought for both types of data collection at the time of direct contact with prospective research
p.000002: participants.
p.000002:
p.000002: If the secondary use involves identifying individuals eligible to be invited into a study, the procedures under Element #6 are applicable. As described in
p.000002: Element #6, the preferred practice is for a data holder to assess the eligibility of individuals for a particular research project (e.g. on the basis of criteria
p.000002: provided by the researcher). The data holder would then make the initial contact with individuals to seek their permission for disclosure of contact
p.000002: information to a researcher or to inform them as to how to contact a researcher. An REB will need to determine if consent is required for this secondary
p.000002: use of data and for the contacting of individuals.
p.000002:
p.000002:
p.000002: 3.3 Secondary use
p.000002: When personal data are to be collected from sources other than the individuals to whom the data relate, consent should be obtained from those individuals
p.000002: unless an REB determines that a waiver of consent is appropriate in the specified circumstances. These circumstances should include that a waiver of the
p.000002: consent requirement is permitted by law 23
p.000002:
p.000002: For secondary use of data for research, an REB should consider the factors set out in the following table in determining whether a research proposal meets
p.000002: the requirements for waiver of consent. These factors, and their description in the table, expand on TCPS Article 2.1(c)(i)- (iii).
p.000002:
p.000002: Factors to consider in determining whether a research proposal meets the requirement for waiver of consent
p.000002:
p.000002: Factor Explanation
p.000002:
p.000002: 3.3.1 Necessity of the personal data Personal data, in the proposed amount and at the proposed level of identifiability and sensitivity, are
p.000002: necessary to fulfill the research objectives. (See Element #2)
p.000002: 3.3.2 Harm-benefit analysis, where (1) 1) The research should present minimal risk of harm to individuals and, if appropriate, particular groups or
p.000002: the risk of harm is minimal, and communities. In assessing potential harm, REBs should consider:
p.000002: (2) potential benefits of the
p.000002: the probability of harm (related to the identifiability of data 24 and the adequacy of security
p.000002: research to the public and
p.000002: measures) 25 , and
p.000002: individuals outweigh any potential
p.000002: the magnitude of potential harm (related to the sensitivity of data), 26 including potential:
p.000002: harm to research participants or
p.000002: physical injury;
p.000002: data subjects
p.000002: emotional or psychological harm;
...
p.000029:
p.000029:
p.000029: 4.1 Forms of consent
p.000029: 4.1.1 Opt-in consent
p.000029:
p.000029: The majority of research studies use an opt-in consent. Opting-in means that prior to the start of the research or data collection, informed individuals give
p.000029: clear indication that they voluntarily agree to participate in the research.
p.000029:
p.000029: Opt-in consent can be indicated in writing (e.g. by signing a consent form), orally (e.g. in a face-to-face or telephone encounter with the researcher) or by
p.000029: conduct (e.g. by filling out and returning a questionnaire received by mail). Consent is only voluntary if it can be withdrawn at any time. 38
p.000029:
p.000029: 4.1.2 Presumed consent with opt-out
p.000029:
p.000029: Presumed consent with an opt-out mechanism should be used only when an REB considers prior opt-in consent to be inappropriate or impracticable.
p.000029:
p.000029: A valid opt-out mechanism means that individuals have the opportunity at some time during the research or data collection process to give a clear indication
p.000029: (in writing or orally) that they do not want to be participants in the research or to have their data used in the research.
p.000029:
p.000029: If individuals do not choose to opt-out of the research, their consent is presumed as long as they were given reasonable notice of the research and
p.000029: meaningful opportunity to opt-out.
p.000029:
p.000029: Ranked forms of consent and associated conditions
p.000029:
p.000029: Type of consent Specific forms of consent Required conditions for REB consideration
p.000029:
p.000029: (i) Opt-in consent (preferred) Ways of opting in: All of the following:
p.000029:
p.000029: 1. Written (preferred) Voluntary.
p.000029: 2. Oral Informed.
p.000029: 3. Conduct (e.g. returning Unambiguous.
p.000029: a questionnaire) Obtained before beginning the research.
p.000029: Consent can be withdrawn at any time, with a clear understanding of what that
p.000029: means, for example:
p.000029: no further collection of additional data;
p.000029: no further analyses using the already collected data; or,
p.000029: removal of data from the database to the extent possible (Note: Non-
p.000029: identifiable data will be impossible to isolate and retrieve).
p.000029: The process of consent to be documented by the researcher.
p.000029: (ii) Presumed consent, with Consent is presumed unless All of the following:
p.000029: opt-out mechanism the person opts out
p.000029: Voluntary.
p.000029: Ways of opting out: Informed (e.g. through notices, brochures, letters, media announcements):
p.000029: of the research
p.000029: 1. Written (preferred)
p.000029: of the opportunity to opt-out
p.000029: 2. Oral
p.000029: of the means of opting out.
p.000029: Accessible means for opting out.
p.000029: Opt-out may be done at any time before or during the research, with a clear
p.000029: understanding of what opting out means, for example:
p.000029: no further collection of additional data; or
p.000029: no further analyses using the already collected data; or,
p.000029: removal of data from the database to the extent possible (Note: Non-
p.000029: identifiable data will be impossible to isolate and retrieve).
p.000029: The process of opting-out to be documented by the researcher.
p.000029:
p.000029:
p.000029:
p.000029: 4.2 Documenting consent
p.000029: 4.2.1 Written documentation signed by the research participant (preferred)
p.000029:
p.000029: Whenever appropriate and practicable, a written documentation of opting-in or opting-out of research is preferred. This should be documented using a
p.000029: consent form or refusal statement signed by the individual.
p.000029:
p.000029: 4.2.2 Oral consent documented by the researcher
p.000029:
...
p.000086:
p.000086: 23 For conditions in privacy legislation under which a waiver of the consent requirement may be permitted see the legal concordance table for
p.000086: Element #3 in Appendix A-7.
p.000086:
p.000086: 24 See Element #2, 2.1.
p.000086:
p.000086: 25 The REB should review and approve the researcher's proposed measures for safeguarding personal data.
p.000086: See also Element #7, Element #8, and Element #10, 10.2.3.
p.000086:
p.000086: 26 See Element #2, 2.2.
p.000086:
p.000086: 27 Note that the TCPS (Article 1.5 and explanatory text) states that REBs are normally to avoid duplicating previous professional peer-review
p.000086: assessments of the scientific merit of a research proposal unless there is a good and specified reason to do so.
p.000086: REBs may have specific criteria, set out in legislation, to take into account in assessing the potential benefits of research proposing to use health
p.000086: sector data without consent (e.g. the requirements set out in Alberta's Health Information Act, referenced in the legal concordance table for
p.000086: Element #3, in Appendix A-7.)
p.000086:
p.000086: 28 See real world examples summarized in Appendix A-3, from CIHR Secondary Use of Personal Information in Health Research: Case Studies
p.000086: (November 2002).
p.000086:
p.000086: 29 For legal prohibitions against contacting individuals see the legal concordance table for Element #6 in Appendix A-7.
p.000086: For an example of prohibitions against contact in policy, see CIHR Secondary Use of Personal Information in Health Research: Case studies
p.000086: (November 2002), Case Study #10, in which researchers investigating cancer screening services were unable to institute a consent process in
p.000086: part because of an existing policy which prevented physicians (who were the data holders) from contacting patients.
p.000086:
p.000086: 30 These conditions are characteristic of much health services and population and public health research where whole populations (not specific
p.000086: individuals) are being studied.
p.000086:
p.000086: 31 See TCPS Chapter 6 - Research Involving Aboriginal Peoples (under review).
p.000086:
p.000086: 32 See TCPS Article 8.1 for more on this topic.
p.000086:
p.000086: 33 See Element #8; and the legal concordance table for Element #8, Part 2, in Appendix A-7 for legal references to data-sharing agreements for
p.000086: research purposes.
p.000086:
p.000086: 34 As above.
p.000086:
p.000086: 35 See the legal concordance table for Element #6 in Appendix A-7 for statutory prohibitions to contacting individuals.
p.000086:
p.000086: 36 See also Element #10.
p.000086:
p.000086: 37 See table of concordance for Element #4, Part 1, in Appendix A-7 for statutory references to the general consent requirement. Part 2 of the
p.000086: concordance table sets out the statutory references to consent by substitute decision-makers.
p.000086:
p.000086: 38 Note that participants should understand what withdrawal of consent will mean to the use of their previously collected information, and that non-
p.000086: identifiable data cannot be retrieved and withdrawn from the database.
p.000086:
p.000086: 39 See Element #5, 5.4.
p.000086:
p.000086: 40 See Element #3.
p.000086:
p.000086: 41 See table of concordance for Element #5 in Appendix A-7 for cross-reference to statutory provisions regarding notice/information requirements.
p.000086:
...
Appendix
Indicator List
| Indicator | Vulnerability |
|---|
| abuse | Victim of Abuse |
| access | Access to Social Goods |
| access to information | Access to information |
| age | Age |
| authority | Relationship to Authority |
| autonomy | Impaired Autonomy |
| child | Child |
| children | Child |
| criminal | criminal |
| culturally | cultural difference |
| dependency | Drug Dependence |
| dependent | Dependent |
| disability | Mentally Disabled |
| drug | Drug Usage |
| education | education |
| educational | education |
| emergency | Public Emergency |
| employees | employees |
| ethnic | Ethnicity |
| ethnicity | Ethnicity |
| family | Motherhood/Family |
| gender | gender |
| home | Property Ownership |
| homeless | Homeless Persons |
| illegal | Illegal Activity |
| illness | Physically Disabled |
| influence | Drug Usage |
| laboratory staff | Laboratory Staff |
| language | Linguistic Proficiency |
| literacy | Literacy |
| occupation | Occupation |
| parent | parents |
| party | political affiliation |
| political | political affiliation |
| property | Property Ownership |
| religion | Religion |
| research staff | Laboratory Staff |
| restricted | Incarcerated |
| single | Marital Status |
| social status | Economic/Poverty |
| stigma | Threat of Stigma |
| stigmatization | Threat of Stigma |
| student | Student |
| terminal | Terminally Ill |
| threat | Threat of Stigma |
| undue influence | Undue Influence |
| vulnerability | vulnerable |
| vulnerable | vulnerable |
| women | Women |
| youth | Youth/Minors |
Indicator Peers (Indicators in Same Vulnerability)
| Indicator | Peers |
|---|
| child | ['children'] |
| children | ['child'] |
| drug | ['influence'] |
| education | ['educational'] |
| educational | ['education'] |
| ethnic | ['ethnicity'] |
| ethnicity | ['ethnic'] |
| home | ['property'] |
| influence | ['drug'] |
| laboratory staff | ['researchXstaff'] |
| party | ['political'] |
| political | ['party'] |
| property | ['home'] |
| research staff | ['laboratoryXstaff'] |
| stigma | ['threat', 'stigmatization'] |
| stigmatization | ['stigma', 'threat'] |
| threat | ['stigma', 'stigmatization'] |
| vulnerability | ['vulnerable'] |
| vulnerable | ['vulnerability'] |
Trigger Words
capacity
coercion
consent
cultural
developing
ethics
harm
justice
protect
protection
risk
sensitive
welfare
Applicable Type / Vulnerability / Indicator Overlay for this Input