The application of the Personal Health Information Act of Manitoba (PHIA) in a Research Ethics Context

This document, pertaining to the application of PHIA to research involving personal health information (PHI) was developed to provide guidance to:

1.  Researchers to follow when they are requesting Research Ethics Board (REB) approval for research involving PHI.

2.  REBs to follow when they are considering approval of research proposals involving PHI.

Authority of REB to Conduct PHIA Review

Under Section 24(2)(b) of PHIA, approval must be given by an "institutional research review committee" if the personal health information is maintained by a trustee other than the government or government agency.  The institutional research review committee must be a committee established by the facility or a university to ensure that adequate safeguards are in place to protect the PHI.  Under the PHIA, the "trustee" is a health professional, health care facility, public body, or health services agency that collects and maintains personal health information.

The university REB will be responsible for granting approval for health research in accordance with Section 24(2)(b) of PHIA.  This approval will be limited to approval of the protocol research plan.  The trustee is responsible for disclosing the PHI for research after approval has been granted by the REB.

The REB will address the following issues in their review process:

1.  Recruitment

The REB must be provided with explicit information as to how patients are going to be recruited and approached (e.g. through review of medical charts, direct contact with patients, etc.) to ensure that the importance of the research outweighs the intrusion into privacy.  The REB must be assured that safeguards are in place to protect the confidentiality of PHI.  The approval to access PHI (i.e. logs, etc.) and to approach individuals about a research study will be incorporated into the REB review process.

The REB submission form has been revised to ensure that appropriate questions are asked as to how the researcher intends to recruit subjects for each specific project and, if appropriate, the REB can approve the proposed method or recommend an alternate method.  For example:

• In some situations, access to PHI should not be granted until consent is obtained from the individual.

• In some situations, posting posters in appropriate areas may be required.

• In some situations access to patients names and addresses (for contact purposes only) can be obtained from a departmental database, if the investigator is also involved with providing health care to that group of individuals in that organization (e.g. Nephrologists providing care to dialysis patients at St. Boniface Hospital).

If the investigator is not involved with providing care to that group of individuals (patients), then the physicians who are involved with providing health care should advise their patients (where appropriate) of the research project and either ask the patient to contact the researcher or obtain the patient's permission to forward their name and address to the researcher.

The examples above are analogous to "use" and "disclosure" of personal health information as provided for in PHIA.  The researcher who is also involved with providing health care would "use" the personal health information for contact purposes; the physician who is involved with providing health care, but not involved with the research would "disclose" the personal health information to the researcher (which requires the patient's consent).

In situations like Dialysis and Lung Function Clinics, it is recommended that a consent form be developed.  The patient obtaining care from those clinics could consent to their names and addresses being used by the group of physicians and nurses who are both providing health care and conducting research, for the purpose of contacting the patient to discuss possible participation in research studies.

• In some exceptional situations, it may be potentially beneficial for individuals to be approached as quickly as possible to discuss the research study.  In these situations it may be appropriate to allow access to the patient's PHI prior to discussions between the individual and researchers.  Example:

Stroke Study.  There is no good treatment for embolic stroke at present. A new IV drug is being tested to prevent brain damage from stroke.  The new drug may offer a chance to the patient that would otherwise not be provided.  Drug must be started within 6 hours of onset of stroke symptoms.  Symptom onset occurs at home, patient must physically get to hospital, be triaged and diagnosed.  Already much time has elapsed.  Researcher is aware of patient, but cannot begin screening process until permission is given via clinical staff for study staff to approach patient.  This process may involve the family and patient asking many questions about the study and may interfere both with their time together and with clinical staff assessing the patient for direct care.  Under these stressful circumstances the patient/family may simply decline and not be provided with an opportunity to potentially receive better treatment.  This situation could be avoided if the study staff gained access to the chart to see if the patient is even a candidate for the study.

The REB must address recruitment issues for each study separately.  REB approval must be study specific.

2.  Security

In their submission to the REB, researchers must:

• Specify safeguards to protect PHI

• Specify procedures to destroy PHI

• Specify long term storage of PHI (only information which identifies an individual needs to be secured (locked))

• Where appropriate, specify why the PHIN (personal health identification number) is being collected.  (PHIN should not be used unless it is absolutely necessary)

• If PHIN is being used, specify how the PHIN is going to be linked.

3.  Consent Forms

Consent forms must specify who will be accessing and/or copying records containing PHI and which records (e.g. Medical Records, if so at which site; Research Study Records; Physician's office records, etc.)

Disclosure of personal health information may be made without the consent of the individual only if the committee has determined that:

1. the research is of sufficient importance to outweigh the intrusion of privacy that would result from the disclosure of PHI,

2. the research purpose cannot reasonably be accomplished unless identifying PHI is provided in a form that identifies or may identify individuals,

3. it is unreasonable or impractical for the person proposing the research to obtain consent from the individuals the PHI is about, and

4. the research project contains:
   1. reasonable safeguards to protect the confidentiality and security of the personal health information, and

   2. procedures to destroy the information or remove all identifying information at the earliest opportunity consistent with the purpose of the project.

4.  Section 24(5):  Clarification

Section 24(5) of PHIA deals with disclosure of names and addresses.

If a research project will require direct contact with individuals, a trustee shall not disclose personal health information about those individuals under this section without first obtaining their consent.  However, the trustee need not obtain their consent if the information consists of only the individuals' names and addresses.

With respect to the last sentence above, the research study must have been considered and approved under this section by a REB before names and addresses can be released.

Researchers (who are not involved in health care) asking Manitoba Health for random sample of persons (names and addresses) require approval by the Health Information Privacy Committee (HIPC) before Manitoba Health provides names and addresses.

5.  Section 24(4):  Research Agreement

The researcher must agree to the following:

• Not to publish PHI in any form that could reasonably identify the individuals concerned.

• To use the PHI solely for the purposes of the approved research project.  If researchers will be approaching individuals participating in a study about future studies, the consent to participate in the original study should include consent to same.