The application of the Personal Health Information Act of Manitoba (PHIA) in a Research Ethics Context
This document, pertaining to the application of PHIA to research involving personal health information (PHI) was developed to provide guidance to:
Under Section 24(2)(b) of PHIA, approval must be given by an "institutional research review committee" if the personal health information is maintained by a trustee other than the government or government agency. The institutional research review committee must be a committee established by the facility or a university to ensure that adequate safeguards are in place to protect the PHI. Under the PHIA, the "trustee" is a health professional, health care facility, public body, or health services agency that collects and maintains personal health information.
The university REB will be responsible for granting approval for health research in accordance with Section 24(2)(b) of PHIA. This approval will be limited to approval of the protocol research plan. The trustee is responsible for disclosing the PHI for research after approval has been granted by the REB.
The REB will address the following issues in their review process.
The REB must be provided with explicit information as to how patients are going to be recruited and approached (e.g. through review of medical charts, direct contact with patients, etc.) to ensure that the importance of the research outweighs the intrusion into privacy. The REB must be assured that safeguards are in place to protect the confidentiality of PHI. The approval to access PHI (i.e. logs, etc.) and to approach individuals about a research study will be incorporated into the REB review process.
The REB submission form has been revised to ensure that appropriate questions are asked as to how the researcher intends to recruit subjects for each specific project and, if appropriate, the REB can approve the proposed method or recommend an alternate method. For example:
If the investigator is not involved with providing care to that group of individuals (patients), then the physicians who are involved with providing health care should advise their patients (where appropriate) of the research project and either ask the patient to contact the researcher or obtain the patient's permission to forward their name and address to the researcher.
The examples above are analogous to "use" and "disclosure" of personal health information as provided for in PHIA. The researcher who is also involved with providing health care would "use" the personal health information for contact purposes; the physician who is involved with providing health care, but not involved with the research would "disclose" the personal health information to the researcher (which requires the patient's consent).
In situations like Dialysis and Lung Function Clinics, it is recommended that a consent form be developed. The patient obtaining care from those clinics could consent to their names and addresses being used by the group of physicians and nurses who are both providing health care and conducting research, for the purpose of contacting the patient to discuss possible participation in research studies
The REB must address recruitment issues for each study separately. REB approval must be study specific.
In their submission to the REB, researchers must:
Consent forms must specify who will be accessing and/or copying records containing PHI and which records (e.g. Medical Records, if so at which site; Research Study Records; Physician's office records, etc.)
Disclosure of personal health information may be made without the consent of the individual only if the committee has determined that:
Section 24(5) of PHIA deals with disclosure of names and addresses.
If a research project will require direct contact with individuals, a trustee shall not disclose personal health information about those individuals under this section without first obtaining their consent. However, the trustee need not obtain their consent if the information consists of only the individuals' names and addresses.
With respect to the last sentence above, the research study must have been considered and approved under this section by a REB before names and addresses can be released.
Researchers (who are not involved in health care) asking Manitoba Health for random sample of persons (names and addresses) require approval by the Health Information Privacy Committee (HIPC) before Manitoba Health provides names and addresses.
Section 24(4) - The researcher must agree to the following:
PHIA Requirements for Databases
Simply stating your database or project is PHIA compliant in the REB application will not be sufficient without providing a brief description of how the safeguards comply with PHIA and other applicable privacy legislation.