Ethics and Integrity Ethics and Integrity in Data Use and in Data Use and

ManagementManagement

John E. Sidle, M.D., M.S.John E. Sidle, M.D., M.S.

May 10, 2010May 10, 2010

This module was recorded at the health informatics-training course – data management series offered by the Regional East African This module was recorded at the health informatics-training course – data management series offered by the Regional East African Centre for Health Informatics (Centre for Health Informatics (REACH-Informatics) in Eldoret, Kenya. Funding was made possible by NIH’s Fogarty Center and a ) in Eldoret, Kenya. Funding was made possible by NIH’s Fogarty Center and a grant from the Rockefeller Center.   The training was held at the Academic Model Providing Access to Healthcare (grant from the Rockefeller Center.   The training was held at the Academic Model Providing Access to Healthcare (AMPATH), a ), a USAID-funded program, supported by the USAID-funded program, supported by the Regenstrief Institute at  at Indiana University. The modules were created in collaboration with . The modules were created in collaboration with the the School of Informatics at IUPUI. .

Content licensed under Creative Commons Attribution-Share Alike 3.0 Unported

ObjectivesObjectives

Examine a brief history of ethics in research Examine a brief history of ethics in research and data managementand data management

Discuss pertinent principles of ethics in data Discuss pertinent principles of ethics in data managementmanagement

Discuss the concept of “data integrity” and Discuss the concept of “data integrity” and ethics in data managementethics in data management

Discuss applications for data management Discuss applications for data management personnel in ethical use of datapersonnel in ethical use of data

OutlineOutline

DefinitionsDefinitions

Ethical Principles in BioethicsEthical Principles in Bioethics

Guidelines and Regulations Guidelines and Regulations

Data IntegrityData Integrity

Applications for ethics and maintenance of Applications for ethics and maintenance of data integritydata integrity

DefinitionsDefinitions

In·teg·ri·ty In·teg·ri·ty n. 1. Strict adherence to a standard of value n. 1. Strict adherence to a standard of value or conduct. 2. Personal honesty and independence. 3. or conduct. 2. Personal honesty and independence. 3. Completeness: unity 4.SoundnessCompleteness: unity 4.Soundness

Eth·ic Eth·ic n. 1. A principle of right or good conduct. 2. A n. 1. A principle of right or good conduct. 2. A system of moral values. 3. system of moral values. 3. ethics ethics (sing. In number). The (sing. In number). The branch of philosophy dealing with the rules of right branch of philosophy dealing with the rules of right conduct.conduct.

Source: Webster’s II New Riverside Dictionary, Based on the Webster’s II New College Source: Webster’s II New Riverside Dictionary, Based on the Webster’s II New College Dictionary (1996)Dictionary (1996)

Ethical PrinciplesEthical Principles

BeneficenceBeneficence Minimize harmMinimize harm Maximize BenefitsMaximize Benefits

Respect of Persons (Autonomy)Respect of Persons (Autonomy) Informed voluntary consentInformed voluntary consent Vulnerable subjects must be protectedVulnerable subjects must be protected

JusticeJustice Equity in distributing risks and benefits between Equity in distributing risks and benefits between

populationspopulations ““fairness” in dealing with research participantsfairness” in dealing with research participants Equity between institutions and research partnersEquity between institutions and research partners

Clinical Data vs. Research Data: Clinical Data vs. Research Data: Are the Ethics Different?Are the Ethics Different?

Privacy and ConfidentialityPrivacy and Confidentiality

Informed Consent vs. Implied ConsentInformed Consent vs. Implied Consent

Data Integrity / Data QualityData Integrity / Data Quality

Data Security and StorageData Security and Storage

Ethical Guidelines (for Research)Ethical Guidelines (for Research)

Declaration of HelsinkiDeclaration of Helsinki ethical standard used by the International Committee ethical standard used by the International Committee

of Medical Journal Editorsof Medical Journal Editors guidelines govern all medical researchguidelines govern all medical research

CIOMS GuidelinesCIOMS Guidelines Council for International Organizations of Medical Council for International Organizations of Medical

Sciences Sciences developed guidelines in collaboration with WHOdeveloped guidelines in collaboration with WHO

Belmont ReportBelmont ReportNational Guidelines (Kenya)National Guidelines (Kenya)

Regulations Regulations

US: Code of Federal Regulations Title 45, US: Code of Federal Regulations Title 45, Part 46 (45CFR46)Part 46 (45CFR46)

FDA– 21CFR50 and 56FDA– 21CFR50 and 56

NIH--“he who has the gold makes the rules”NIH--“he who has the gold makes the rules”

HIPAA—related both to clinical records and HIPAA—related both to clinical records and use of subject data in researchuse of subject data in research

45CFR4645CFR46US Code of Federal Regulations Title 45, Part US Code of Federal Regulations Title 45, Part 46 (45CFR46)46 (45CFR46) Human Subjects ProtectionsHuman Subjects Protections IRB requirementsIRB requirements Protection of Vulnerable SubjectsProtection of Vulnerable Subjects

Human subjectHuman subject Human subjectHuman subject means a living individual about whom means a living individual about whom

an investigator (whether professional or student) an investigator (whether professional or student) conducting research obtains:conducting research obtains:

(1) data through intervention or interaction with the (1) data through intervention or interaction with the individual, orindividual, or(2) identifiable private information.(2) identifiable private information.

Privacy/ConfidentialityPrivacy/Confidentiality

Applies to both clinical and research dataApplies to both clinical and research data

Major concern for patients when it comes Major concern for patients when it comes to electronic records and datato electronic records and data

Must be safeguarded by all members on Must be safeguarded by all members on the teamthe team

HIPAAHIPAA

Health Insurance Portability and Health Insurance Portability and Accountability Act of 1996 (HIPAA), HHS Accountability Act of 1996 (HIPAA), HHS issued regulations entitled issued regulations entitled Standards for Standards for Privacy of Individually Identifiable Health Privacy of Individually Identifiable Health InformationInformation. .

For most covered entities, compliance with For most covered entities, compliance with these regulations, known as the Privacy these regulations, known as the Privacy Rule, was required by April14, 2003.Rule, was required by April14, 2003.

HIPAA and Privacy RuleHIPAA and Privacy RuleThe Privacy Rule, at 45 CFR parts 160 and 164, The Privacy Rule, at 45 CFR parts 160 and 164, establishes a category of health information, establishes a category of health information, defined as protected health information (PHI), defined as protected health information (PHI), which a covered entity may only use or disclose which a covered entity may only use or disclose to others in certain circumstances and under to others in certain circumstances and under certain conditions. certain conditions. Usually requires an individual to provide signed Usually requires an individual to provide signed permission, known as an Authorization before a permission, known as an Authorization before a covered entity can use or disclose the covered entity can use or disclose the individual's PHI for research purposes. individual's PHI for research purposes. Need for authorization may be waived in some Need for authorization may be waived in some instances by an IRB (and a Privacy Board)instances by an IRB (and a Privacy Board)

Individually Identifiable Information Individually Identifiable Information and Protected Health Informationand Protected Health InformationIncludes any subset of health information, including Includes any subset of health information, including demographic information, that identifies the individual (or demographic information, that identifies the individual (or there is a reasonable basis to believe that the information there is a reasonable basis to believe that the information can be used to identify the individual). can be used to identify the individual).

1. Name1. Name2. All elements of dates except Year.2. All elements of dates except Year.3. SSN3. SSN4. Driver's License Number4. Driver's License Number5. Geographic subdivisions smaller than a State.5. Geographic subdivisions smaller than a State.6. URL's and IP's6. URL's and IP's7. Vehicle Identifiers including VIN and License #7. Vehicle Identifiers including VIN and License #8. Phone numbers8. Phone numbers

PHIPHI

Individually identifiable information becomes PHI when it Individually identifiable information becomes PHI when it is created or received by a covered entity:is created or received by a covered entity:

US health plansUS health plans US health care clearinghousesUS health care clearinghouses US health providers that transmit electronic health informationUS health providers that transmit electronic health information

A researcher is not a covered entity unless he/she is A researcher is not a covered entity unless he/she is also a provider within a covered entity. also a provider within a covered entity. Research is also governed by HIPAA if data is obtained Research is also governed by HIPAA if data is obtained from a covered entity.from a covered entity.IRB may on occasion waive the HIPAA restrictions on IRB may on occasion waive the HIPAA restrictions on use of PHIuse of PHI

How does all this translate to How does all this translate to practice?practice?

Electronic health information (clinical or research)Electronic health information (clinical or research) Can improve quality and safety of medical care Can improve quality and safety of medical care

(beneficence)(beneficence) Is key to showing outcomes in research on health and Is key to showing outcomes in research on health and

health practices (beneficence)health practices (beneficence) Confidentiality and Privacy can be lost (breach of Confidentiality and Privacy can be lost (breach of

autonomy and beneficence)autonomy and beneficence) Can be used without a patient’s knowledge or consent Can be used without a patient’s knowledge or consent

(breach of autonomy)(breach of autonomy) Might exclude some populations (breach of justice)Might exclude some populations (breach of justice)

Data IntegrityData IntegrityThe assurance that data is accurate, correct and The assurance that data is accurate, correct and valid. valid. Accuracy and consistency of stored data, Accuracy and consistency of stored data, indicated by an absence of any alteration in data indicated by an absence of any alteration in data between two updates of a data record. Data between two updates of a data record. Data integrity is imposed within a database at its integrity is imposed within a database at its design stage through the use of standard rules design stage through the use of standard rules and procedures, and is maintained through the and procedures, and is maintained through the use of error checking and validation routines. use of error checking and validation routines. Exact duplication of the sent data at the Exact duplication of the sent data at the receiving end, achieved through the use of error receiving end, achieved through the use of error checking and correcting protocols. checking and correcting protocols. Assurance that the data are unchanged from Assurance that the data are unchanged from creation to reception. creation to reception.

Data Integrity (2)Data Integrity (2)

Process to maintain data integrity depends Process to maintain data integrity depends on: on: Collection (accurate representation)Collection (accurate representation) Data transfer (accurate recording and transfer Data transfer (accurate recording and transfer

of data)of data) Storage and Security (preventing loss of data)Storage and Security (preventing loss of data) Sharing of DataSharing of Data Use of data (analysis)Use of data (analysis)

Data Integrity (3)Data Integrity (3)

Fabrication and Falsification of data are one of Fabrication and Falsification of data are one of the most serious challenges to data integritythe most serious challenges to data integrityHuman error also contributes to loss of data Human error also contributes to loss of data integrityintegrityConcern about research misconduct was a Concern about research misconduct was a primary motivation for a 1990 conference on primary motivation for a 1990 conference on data management sponsored by the US data management sponsored by the US Department of Health and Human Services. Department of Health and Human Services. Conference summarized the many ways in Conference summarized the many ways in which the conduct of research depends on which the conduct of research depends on responsible data management. responsible data management.

Data Integrity (4)Data Integrity (4)

Responsible research begins with Responsible research begins with experimental design and protocol approvalexperimental design and protocol approval

It involves recordkeeping in a way that It involves recordkeeping in a way that ensures accuracy and avoids biasensures accuracy and avoids bias

It guides criteria for including and It guides criteria for including and excluding data from statistical analysesexcluding data from statistical analyses

It entails responsibility for collection, use, It entails responsibility for collection, use, and sharing of data. and sharing of data.

Data Integrity (5)Data Integrity (5)EveryoneEveryone with a role in research has a with a role in research has a responsibility to ensure the integrity of the data.responsibility to ensure the integrity of the data.

The ultimate responsibility belongs to the The ultimate responsibility belongs to the principal investigator, but the central importance principal investigator, but the central importance of data to all research means that this of data to all research means that this responsibility extends to anyone who:responsibility extends to anyone who: helps in planning the studyhelps in planning the study collecting the datacollecting the data analyzing or interpreting the research findingsanalyzing or interpreting the research findings publishing the results of the studypublishing the results of the study maintaining the research records.maintaining the research records.

Data Collection and IntegrityData Collection and Integrity

Because data collection can be repetitious, time-Because data collection can be repetitious, time-consuming, and tedious there is a temptation to consuming, and tedious there is a temptation to underestimate its importance. underestimate its importance.

Those responsible for collecting data must be Those responsible for collecting data must be adequately trained and motivatedadequately trained and motivated

They should employ methods that limit or They should employ methods that limit or eliminate the effect of biaseliminate the effect of bias

They should keep records of what was done by They should keep records of what was done by whom and whenwhom and when

Analysis and Selection of DataAnalysis and Selection of Data

The use of statistical methods varies widely The use of statistical methods varies widely among research disciplines and also clinical among research disciplines and also clinical programs (reporting)programs (reporting)

It is a laudable ideal to analyze and report all It is a laudable ideal to analyze and report all datadata

Because it is not possible to report everything Because it is not possible to report everything that has been done, researchers must make that has been done, researchers must make decisions about which studies, data points, and decisions about which studies, data points, and methods of analysis to present.methods of analysis to present.

Analysis and Selection of Data (2)Analysis and Selection of Data (2)

Must critically evaluate the reasons for Must critically evaluate the reasons for inclusion or exclusion of data, the inclusion or exclusion of data, the measures taken to avoid bias, and measures taken to avoid bias, and possible ways in which bias may possible ways in which bias may nonetheless influence data selectionnonetheless influence data selectionMust clearly document how the data were Must clearly document how the data were obtained, selected, and analyzed-- obtained, selected, and analyzed-- especially if the methods are unusual or especially if the methods are unusual or potentially controversialpotentially controversial

Retention of DataRetention of Data

What should be retained?What should be retained?

It may be impractical to store It may be impractical to store extraordinarily large volumes of primary extraordinarily large volumes of primary data. data.

At minimum, enough data should be At minimum, enough data should be retained to reconstruct what was done.retained to reconstruct what was done.

How long should clinical records be How long should clinical records be retained?retained?

Sharing of DataSharing of Data

This is considered an important part of This is considered an important part of responsible research. responsible research.

De-identified data should be shared so De-identified data should be shared so that others can verify your conclusions or that others can verify your conclusions or analysisanalysis

Sharing of personal patient information is Sharing of personal patient information is NOT a good practice as noted in Privacy NOT a good practice as noted in Privacy sections earlier. sections earlier.

Data SecurityData Security

Limiting AccessLimiting Access Locked Paper Records OfficesLocked Paper Records Offices Limiting access to Paper or Electronic records Limiting access to Paper or Electronic records

to appropriate personnelto appropriate personnel Password Protection of electronic recordsPassword Protection of electronic records Defined privileges for electronic data usersDefined privileges for electronic data users Firewalls to prevent outside accessFirewalls to prevent outside access

Regular Backups and proper archivingRegular Backups and proper archiving

Ownership of DataOwnership of Data

Who owns the data that is generated?Who owns the data that is generated? Patient?Patient? Institution?Institution? Funder?Funder? Investigator?Investigator? Publisher?Publisher?

Ethics in Publication—General Ethics in Publication—General guidelines pertinent to dataguidelines pertinent to data

Research should strive to answer specific Research should strive to answer specific questions—not just collect or mine dataquestions—not just collect or mine dataStatistical issues (sample size) are an Statistical issues (sample size) are an important part of design to ensure that the important part of design to ensure that the research data is likely to answer the research data is likely to answer the questionquestionIRB approval is required when using IRB approval is required when using human subjects, human tissues, or human subjects, human tissues, or medical recordsmedical records

Publication Ethics and Data Publication Ethics and Data Management/Data AnalysisManagement/Data Analysis

Data should be appropriately analyzedData should be appropriately analyzed

Inappropriate analysis is not necessarily Inappropriate analysis is not necessarily ethical misconductethical misconduct

Fabrication or falsification of data is Fabrication or falsification of data is always ethical misconductalways ethical misconduct

Publication Ethics and Data Publication Ethics and Data Management/AnalysisManagement/Analysis

Sources and methods of obtaining and Sources and methods of obtaining and processing data should be disclosedprocessing data should be disclosedData exclusions should be explained in fullData exclusions should be explained in fullMethods used to analyze data should be Methods used to analyze data should be explained in detailexplained in detailPost hoc analysis of subgroups is Post hoc analysis of subgroups is acceptable as long as this is disclosedacceptable as long as this is disclosedData Bias should be discussed in all Data Bias should be discussed in all publications of data or analysispublications of data or analysis

Questions??Questions??

THE WORK IS PROVIDED UNDER THE TERMS OF THIS CREATIVE COMMONS PUBLIC LICENSE ("CCPL" OR "LICENSE"). THE WORK IS PROTECTED BY COPYRIGHT AND/OR OTHER APPLICABLE LAW. ANY USE OF THE WORK OTHER THAN AS AUTHORIZED UNDER

THIS LICENSE OR COPYRIGHT LAW IS PROHIBITED.