Exploring the Legal and Ethical Implications of Linking Healthcare

Exploring the Legal and Ethical Implications of Linking Healthcare, Employment and Registration Data of UK Healthcare Workers During the COVID-19 Pandemic Presented by: Mrs. Reed-Berendt Date: 27 Februrary 2021 Structure - Overview of UK-REACH: the aims of the project, work packages and data being gathered - The legal framework for data use and management, and the issues arising in law for UK-REACH - An ethical approach to data management - why it is needed and recommendations for ethical use of data by UK-REACH Overview of UK-REACH - UK-REACH: a UKRI-NIHR funded mixed-methods study aiming to investigate, if, how, and why ethnicity affects COVID-19 clinical outcomes in healthcare workers (HCWs), through five interlinked work packages: • Work Package 1: expedited linkage and analysis of anonymized registration and NHS databases within a trusted research environment (SAIL) • Work Package 2: longitudinal cohort study of ethnic minority HCWs using survey and biological information with follow up over approximately 12 months • Work Package 3: doctrinal and qualitative research on the ethical and legal implications of data use across UK-REACH (two research strands of the WP) • Work Package 4: qualitative research to understand ethnic minority HCWs' perception of risk, support and coping mechanisms • Work Package 5: Stakeholder group to facilitate dissemination of findings and translation for healthcare workers, employers and policymakers. Work Package 3 - Doctrinal Research - A comprehensive review of the law, regulation and past research on data management, confidentiality and ethical questions around the use of 'big data' - The formulation of a policy report to outline the key legal and ethical issues and provide recommendations to UK-REACH - Ultimately, we are aiming to chart a path for research on COVID-19 and ethnicity to be conducted in a manner that is legally and ethically acceptable Work Package 1 Data Collection And Use - Data will be obtained from the following sources: • Data from HR databases across the 4 nations (inc. demographic and detailed employment data) • Individual health data from NHS records (inc. BMI, underlying health conditions, medications) • Professional Registration data (GMC, NMC, GDC, GPHC, GOC, PSNI, HCPC) • Other national databases - ONS mortality data, ICNARC data for intensive care observations, specialty COVID-19 databases - Data will then be merged, linked, anonymized and stored in the SAIL Databank at Swansea. Linkage for NHS data will take place in collaboration with UK health record providers. - Anonymized data will be made available to UK-REACH researchers for analysis. The legal framework in UK-REACH - The common law duty of confidentiality • Data subjects have a reasonable expectation of privacy, particularly in the context of their health and employment data - The EU General Data Protection Regulation and UK Data Protection Act 2018 • Applicable to the processing of identifiable data • It is necessary to adhere to the principles of data processing and identify the legal basis for processing (often but not necessarily consent) - The European Convention on Human Rights and UK Human Rights Act 1998 • Article 8 - Right to respect for private and family life • Article 14- Prohibition of discrimination A Legal Basis For Processing Data - Legal basis under GDPR - Article 6(1)(e) - necessary for the performance of a task in the public interest (in the area of public health) - and special category data processing exception - Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health - Although common for research affiliated to UK universities, it remains necessary to indicate why the data processing is necessary and how the research it is in the public interest - beyond stating this is by definition the case - Use of data should remain proportionate and protect fundamental rights and interests of data subjects - in accordance with GDPR principles The Limits Of Anonymization - It is assumed that the data, once available to researchers, are anonymous to the extent that GDPR is not applicable (per Recital 26), because of the removal of direct identifiers. However, this may not be the case. - Given the significant amount of data available to researchers on individuals across the UK nations, this gives rise to a risk of re-identification - Research by legal scholar Paul Ohm - majority of US population identifiable through ZIP Code, sex and date of birth - Where data are linked, re-identification risk is amplified by providing a far richer picture on a given individual than one dataset in isolation - Remains possible that the GDPR is still applicable to the anonymized dataset Reframing Anonymization - Although anonymization is not a sufficient guarantee of privacy, it remains an important part of the framework for good information governance - We suggest this framework should also include respect for the core principles of the GDPR, including measures to minimize privacy risks and ensure the integrity and confidentiality of data - We further suggest a dynamic understanding of anonymization, which does not use pre-determined measures to remove identifiers and which is not a one-off event ("release-and-forget" anonymization) The Requirement For An Ethical Approach - Legal compliance is only one part of the picture. We also need to consider moral obligations regarding participants and data subjects, and what ethical values are at stake - UK-REACH involves the use of big data (Volume, Variety and Velocity) - which brings opportunities for research, but also risks which must be considered. - The context of a global pandemic brings the need for an ethical approach into sharper focus a shifting legal and regulatory landscape, issues amongst the population of uncertainty and trust, and possibility of 'unknown unknowns' - Vulnerability as a key ethical consideration for research focusing on ethnic minority healthcare workers Defining An Ethical Approach - Using the ethical framework for big data proposed by Xafis and colleagues, we suggest an ethical approach for data linkage as proposed by UK-REACH should: • Clearly articulate and reflect upon the benefits of the research to various publics, and how this should be balanced proportionally with individual interests (such as privacy interests as a value of ethical importance) • Pay particular attention to issues of justice, considering any group harms or inequity arising through data use. Any harms should be identified and minimized • Engage with key stakeholders to allow those with morally relevant interests to participate in discussions around use of data • Be open and transparent in its processes to allow for scrutiny of data usage, including provision of public-facing information • Continue to reflect on the relevant ethical values so that any new concerns arising can be appropriately considered and responded to Key Recommendations - Projects such as UK-REACH seeking to rely on 'public interest' as the legal justification for data processing need to stipulate, and continue to interrogate, how the research purports to be in the public interest and why the processing of data is necessary. - Anonymization of big data should be approached on a dynamic basis, as part of the framework of good information governance. - Even where data are anonymized, legal and ethical obligations towards data subjects do not fall away and it remains necessary to continue to identify any infringements on their fundamental rights and interests. - Just because research meets its legal obligations does not mean that it will be ethically acceptable. It remains necessary to take an ethical approach, being particularly mindful of existing vulnerabilities linked to the Covid-19 pandemic.