To the Editor: With an issue as complex as identifying an optimal policy for protection of the confidentiality of patients whose records are used for research, it is reassuring to see the outlines of a consensus beginning to emerge. The authors of the articles and Dr. Goldman all appear to agree on two essentials: whenever possible, consent should be obtained in advance from patients for the use of their records for research, and when that has not or cannot be done, some sort of external review process must examine the necessity for access and ensure protection of confidentiality.
How best to achieve these desiderata has been the subject of considerable discussion. I suggest that we are unlikely to move this process forward without data regarding the relative utility of the various options and a stipulation that these data can come only from creative experimentation.
Take the issue of advance consent, for example. In my editorial, I expressed doubt as to whether meaningful consent can be offered by a patient at the inception of treatment for the use of records that have not yet been created, the content of which the patient will be unaware, for research on a disorder that the patient does not currently have but may acquire in the future. Dr. Goldman responds that it may be possible to offer patients the option of periodically updating the scope of their consent for records use. Whether that is a viable approach seems entirely an empirical question. It would be illuminating to review data from a small number of institutions that have implemented such a policy to see how well it works.
Similarly, with regard to review of requests to access records for which consent has not been provided, the most critical question is, which of the two mechanisms being offered works best? Along with Dr. Simon et al., I suggested reliance on institutional review boards for that purpose. Dr. Goldman correctly notes that institutional review boards are already overwhelmed and expresses the belief that an independent body dedicated to this role alone might do a better job. There are a number of unanswered questions about this proposal, including whether the issue arises frequently enough at any site to warrant creation of a separate body, where the resources (human and financial) will come from to support this group, and whether it will do a better job than institutional review boards in protecting privacy while permitting important research to proceed. But we will not know the answer to these questions until we have had an opportunity to inspect such a system in operation.
We have an unfortunate and frequently remarked-on tendency in this country to implement sweeping policy initiatives on the basis of much argument and few data. The debate over protecting medical records in the research setting seems to have advanced to the point at which thoughtful experimentation will provide the critical feedback to shape subsequent policy. I hope that some of our leading clinical and research institutions will seize this research opportunity.
