Using My Health Record data for research could save lives, but we must ensure it’s ethical

There has been considerable debate about the merits and risks of the My Health Record (MHR) scheme – ranging from the deep inefficiencies in the current system, to privacy issues and control of data.

There has been less discussion of some down-the-track intended uses of this data for secondary purposes – such as for research.

A rich dataset of health information could be used in studies that generate enormous benefits to society, but medical research is carried out under strict ethical guidelines.

Unfortunately, a consent process where people are required to opt out rather than opt in doesn’t meet ethical standards for research.

Using MHR data for research
The privacy policy for My Heath Record states:

"We are authorised under the My Health Records Act to prepare and provide de-identified data for research and other public health purposes. De-identified data is data that has had information removed that could reasonably identify any individuals such as name, date of birth or address."

This access is governed by a framework to guide secondary use of My Health Record system data. Under the access controls in My Health Record you can indicate that you are not willing for your data to be shared for research purposes. But, as with My Health Record itself, this is done on an opt-out basis.

Somewhat worryingly, the framework suggests that it may permit some research use of this data without ethical approval:

For applications involving de-identified data, the Board may require ethics approval to be obtained before data can be accessed or released. 

The social benefits of research

There is great potential benefit in having such a rich dataset available for research – as long as it is done in a way that supports and encourages, rather than undermines, public trust in it.

In medicine, big data research could improve outcomes and reduce the waste of resources. For example, a recent UK study looking at the impact of adrenaline on the treatment of sufferers of cardiac arrest reported that the standard response of giving adrenaline in these cases has minimal impact on survival rates, but a significant increase in potential of subsequent death.

A key driver for that research was a retrospective study in Japan that examined the results of more than 400,000 cases. That research will almost certainly change practice across the world, and increase the quality of life of countless survivors of cardiac arrests.

But the history of research ethics suggests that research requires public support to be conducted effectively. When public support is not present, and research is done out of step with the values of society more generally, great harm can be done to the reputation of both research and science.

The abuses in the Tuskegee syphilis study, in which researchers observed the progression of untreated syphilis in 622 poor, African-American men without telling them they had the disease, and without treating them, still has an ongoing impact on the willingness of African-American people to participate in medical research.

Ethical problems with using MHR data

Two main concerns threaten public support for research based on the health data held within My Health Record: the robustness of the consent process and the risks of re-identification.

Consent

When things go awry with big data research, it is often due to issues with the consent process. In previous cases, involved parties have pointed to the existence of privacy policies or end-user licence agreements to lend legitimacy to their use of data. But these policies and agreements do not count as informed consent for participation in medical research, nor can they be.

The same concerns apply to My Health Record.

It is extremely likely that there will be some Australians in a few months’ time who do not even know they have a My Health Record, let alone that their health data may be used in research. Even those who do know may not have the technological literacy needed to opt out successfully.

This is hard to reconcile with the National Health and Ethical Research Council’s National Statement on Ethical Conduct in Human Research. The section on databanks states that when collecting data for deposit in a databank participants should be given clear and comprehensive information. They also must explicitly consent to how the data will be stored, and to the purposes for which it will be used.

There is no reason why the ethical parameters should change simply because the My Health Record database is intended to be much larger than previous databases of this kind.

Risks of re-identification

One argument made in favour of sharing My Health Record data for research purposes without explicit consent rests on the practice of de-identification. The thinking goes that once data has been de-identified, it is no longer data about a specific person. So their need to control that data for their own protection is diminished.

But de-identification is difficult. In some cases involving large datasets, it is possible to re-identify people. For example, when the federal health department released a large dataset of de-identified data in 2016, researchers showed that it was in fact re-identifiable.

This is even more of a concern with the recent revelation that genomic data may be included in My Health Record. Genomic data cannot be permanently de-identified.

Even if your data is no longer about “you”, you still might be unhappy to have provided data for particular research projects – either because of their commercial nature, or perhaps because the research potentially impacts a group to which you belong (see the Warrior Gene controversy in New Zealand).


Getting buy-in from the public

To achieve public support for research on My Health Record data, there should be an explicit opt-in, and ongoing public information campaigns to encourage participation.

This will almost certainly result in a smaller dataset, but it will be a much more ethically defensible one.

Unless the government gains public support for big data research, people will vote with their clicks and opt out of services where their data may be used without their explicit agreement.