Calvo, Fran
Guillén, Ana
Carbonell, Xavier
Alfranca, Rebeca
Beranuy, Marta
Parés-Bayerri, Alícia
Font-Mayolas, Sílvia
Article History
Received: 29 December 2022
Accepted: 12 June 2023
First Online: 22 June 2023
Declarations
:
: The authors declare no competing interests.
: All methods were carried out in accordance with relevant guidelines and regulations.This study was approved by the <i>Ethics Committee of the Institut d’Assistència Sanitària (CIEC-IAS)</i>, <i>Catalan Institute of Health</i>, with the code <i>Estudi_homeless_2008</i> on December 12, 2014. On October 28, 2016 the same project was again supervised by the <i>Research Ethics Committee CEI GIRONA</i> with the name <i>Evolució homeless de Girona: Seguiment longitudinal Cohort 2006/2016</i> (<i>Code COHORT2006</i>).The ethical committee approved the study authorizing the analysis of health and mortality data of homeless people considering the exceptions for the signature of the informed consent by the patients. Informed consent was waived after approval by the ethics committee, taking into account the international and Spanish legal framework argued below:Article 3. of Law 14/2007, on biomedical research, defines an observational study as one “conducted on individuals with respect to whom the treatment or intervention to which they might be subjected is not modified, nor are they prescribed any other guideline that could affect their personal integrity.“Article 25 of the Declaration of Helsinki states: “For medical research involving identifiable human material or data, the physician should normally seek consent for collection, analysis, storage and reuse. There may be situations in which it will be impossible or impracticable to obtain consent for such research or could be a threat to its validity. In this situation, the research may only be conducted after consideration and approval by a research ethics committee.“The Medical Research Council guidelines consider that exceptions to the need for informed consent for the use of personal data can be made when these five issues are adequately analyzed and justified:Necessity (Are there valid alternatives for doing the study? Could anonymized information be used? Why is it not possible to seek authorization from patients?); Sensitivity (What and how sensitive is the information required by the research?); Significance (Will the research contribute to increasing knowledge in a substantive way?). Safeguards (Are security measures in place to prevent leaks and avoid harm to patients?); Independent review (Has a Research Ethics Committee evaluated the proposal and endorses the exception?).The Spanish legal system, at the time the study approval was requested, established that access to the clinical history for research purposes (Law 41/2002) or the collection and processing of personal data (Law 15/1999) requires the express authorization of the interested party:Article 6. 3 of the basic Law 41/2002 regulating patient autonomy and rights and obligations regarding clinical information and documentation, states, after the amendment to which it was subject by Law 33/2011 General Law on Public Health): “Access to the clinical history for judicial, epidemiological, public health, research or teaching purposes is governed by the provisions of Organic Law 15/1999, of 13 December, on the Protection of Personal Data, and Law 14/1986, of 25 April, General Health, and other regulations applicable in each case. Access to the clinical history for these purposes requires the preservation of the patient’s personal identification data, separate from those of a clinical-healthcare nature, so that, as a general rule, anonymity is assured, unless the patient himself has given his consent not to separate them”.Article 7.3 of Organic Law 15/1999 on the Protection of Personal Data. As a general rule, it provided that “Personal data referring to racial origin, health and sex life may only be collected, processed and transferred when, for reasons of general interest, a law so provides or the affected party expressly consents.“And Article 7.6 of this same Organic Law 15/1999 on Data Protection established the following as exceptions to the aforementioned article: “Notwithstanding the provisions of the preceding paragraphs, the personal data referred to in paragraphs 2 and 3 of this article may be processed when such processing is necessary for medical prevention or diagnosis, the provision of health care or medical treatment or the management of health services, provided that such data processing is carried out by a health professional subject to professional secrecy or by another person also subject to an equivalent obligation of secrecy.“Article 11 of Organic Law 15/1999 on data protection stated “1. Personal data subject to processing may only be communicated to a third party for the fulfillment of purposes directly related to the legitimate functions of the transferor and transferee with the prior consent of the data subject. [3. Consent for the communication of personal data to a third party is null and void when the information provided to the data subject does not enable him/her to know the purpose for which the data whose communication is authorized or the type of activity of the recipient of the communication is intended. 4. Consent for the communication of personal data shall also be revocable. 5. The recipient of the communication of personal data undertakes, by the mere fact of communication, to comply with the provisions of this law. 6. If the communication is made after a disassociation procedure, the provisions of the previous paragraphs shall not apply.In view of the fact that strict compliance with these Spanish legislative prescriptions would make many retrospective observational studies impossible or very costly, most authors in our country defend the possibility of making exceptions when certain requirements are met. Let us look at some of these proposals: “12. Only in exceptional circumstances may consent for the creation and/or use of records containing personal data for research purposes be dispensed with. The exception will have to be justified by the principal investigator for the specific case to be applied, and be discussed and approved by a Research Ethics Committee. When the information necessary to carry out the clinical or epidemiological research is to be obtained from the clinical history, the explicit consent of the subject will not be required if the researcher is part of the medical team attending him/her, although once the necessary information has been extracted and incorporated into the data collection notebook, it should be coded or anonymized appropriately to avoid a breach of confidentiality. In any case, the research and the procedure for obtaining the information must be approved by a Research Ethics Committee.“ And, “The collection of data from the clinical history for research requires the express consent of the patient. When the subject’s consent has not been obtained, it is recommended that access to the medical record be provided by a member of the health care team. Although this does not obviate the need for consent, given that the Law on Patient Autonomy guarantees access to the history for care and not for research, the fact that the healthcare professional has participated in obtaining the care data and is bound by professional secrecy offers an additional guarantee of confidentiality. It is recommended that the information should always be obtained in a dissociated form, to the extent possible for the development of the research.In view of this, and in accordance with the recommendations of the Medical Research Council, the ethics committee considered that access to patients’ clinical records for clinical research purposes could be authorized without their consent, when the following requirements are met: (1) Necessity. It is not possible to seek patients’ authorization or to do so would involve unreasonable effort, (2) Sensitivity. The information to be collected is not exceptionally sensitive. (3) Importance. The results of the research will contribute significant knowledge to science.Safeguards: (a) The collection of personal data from the clinical history will be carried out by healthcare professionals who are part of the team attending the patient. Health professionals, therefore, who collect the information or who have access to the patient’s clinical history. b) The collection of personal data from the clinical history will be collected in an anonymized form. In other words, once the clinical history has been collected, it will no longer be possible to find out in any way who it belongs to. The result will therefore not be a coded or dissociated personal data file, but a strictly epidemiological documentation.In 2018, Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights came into force, which amended the previous law authorizing the present study. The new law, in its sixth transitory provision on reuse for health and biomedical research purposes of personal data collected prior to the entry into force of this organic law says: The reuse for health and biomedical research purposes of personal data lawfully collected prior to the entry into force of this organic law will be considered lawful and compatible when any of the following circumstances concur: (a) That such personal data are used for the specific purpose for which consent was given. (b) That, having obtained consent for a specific purpose, such data are used for purposes or areas of research related to the medical or research specialty in which the initial study was scientifically integrated.Furthermore, the study also complies with Additional Provision 17.2 of Organic Law 3/2018, of 5 December, on the Protection of Personal Data and guarantee of digital rights under Spanish law. As this was a retrospective observational study on mortality, it was not possible to access the participants to obtain informed consent. Given that the participants were homeless, many of whom came from other countries of origin, it was not possible to request informed consent from their relatives. Informed consent was obviated by Additional Provision 17.2.d LOPD-GDD on pseudo-anonymization of personal data. A personal data obtained from a process (pseudonymization), consists of the replacement of an attribute of a dataset by a pseudonym using a pseudonymization technique, so that its identification is not allowed without additional information (matching table). Additional Provision 17.2. d of the Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights of the Spanish legal system establishes that pseudonymized data may be used for research purposes, without the need to obtain the consent of the data subjects, provided that there is a technical and functional separation between the team conducting the research and the one performing the pseudonymization, and that the data are only accessible within the research team that has signed a commitment of confidentiality and non-reidentification, and that technical measures have been adopted to prevent this re-identification and access by third parties. Thus, pseudonymization means “the processing of personal data in such a way that they can no longer be attributed to a data subject without the use of additional information, provided that this information is recorded separately and is subject to technical and organizational measures designed to ensure that the personal data are not attributed to an identified or identifiable natural person”.Following the recommendations of the <i>Research Ethics Committee CEI GIRONA</i>, the researchers, who were themselves clinicians caring for people experiencing homelessness in the mental health and addictions and primary care services of the public health services, provided the database to an administrative team of the same institution. This administrative team proceeded to perform the pseudo-anonymization by reordering the database and attributing to each person a numerical code, complying with the criteria established in the Additional Provision 17.2.d of the Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights of the Spanish legislation.Finally, it is worth mentioning that the same ethics committee, which is the reference ethics committee of the province of Girona public health services, annually renews the permission to continue analyzing the data of the cohort on which this study is based according to the Spanish legality reflected in this text. Therefore, the permission to proceed with research using this database is currently in force, in compliance with Spanish law. The renewal code of the permit is dated January 10, 2023 with the renewal code <i>COHORT_2016.133</i>.
: Not applicable.