Academia Stack Exchange is a question and answer site for academics and those enrolled in higher education. It only takes a minute to sign up.
Sign up to join this community
Apart from taking measures to maintain confidentiality, do I need my ethical approval to specify permission to publish raw data along with my study? I'm trying to facilitate reproducibility in my research. It is a retrospective, cross-sectional study of medical records. The information is sensitive.
I know that there are other questions out there that touch on the subject, but they do not quite cover what I want to know.
If you're in the US, make sure the data set complies to HIPAA. Double check to make sure you don't have any information that would allow identification.
Another one measure that HIPAA may not touch on is the rarity of the medical outcome(s) in your data set. Participants in a flu data set are a lot harder to identify that participants in, say, an anthrax poisoning data set. You'd need to check on the definition of what constitutes a rare outcome.
Ultimately, you should seek advices and support from these following agencies: 1) your own institutional review board (IRB), 2) the funding agency that supports your work, and 3) the original owner of the medical records who allowed you to extract the retrospective data. If all these three are okay, it's very likely to be fine. If anything hits the fan, showing evidence that they had granted you support and you have done your due diligence in safeguarding the privacy of the data would do you a lot of good on legal ground.
Additionally, even for reproducibility, you don't necessarily have to make the data set available to everyone. With some work on your side you can set up a data user agreement mechanism, so that at least you can have some track records on who borrowed the data and for what reason. If you explain to the journal that any of the three agencies above prohibits free access, the editor will usually understand and agree with the data user agreement routine.
If your study deals with human subjects, for which confidentiality concerns apply, then how you manage the data definitely needs to be part of the plan that you submit for ethical approval. For some types of information, raw data may not be possible to de-identify (surveys drawn from a small population, for example, where there may be only a few people belonging to a given set of demographic groups). For other types of information, confidentiality can be maintained. Whatever ethical approval system you are dealing with (e.g., in the US, an IRB) should be given an opportunity to double-check and notice if you have overlooked anything.
If human subjects are not involved, then confidentiality probably does not apply (e.g., ethical approval is important for experiments with rats, but confidentiality is generally not a concern) though there are places where data not taken from human subjects may still end up containing people's personal information that still needs to be protected. A good example of this is Simson Garfinkel's investigation of discarded hard drives.
From the Declaration of Helsinki of “ethical principles for medical research involving human subjects, including research on identifiable human material and data”, conforming to which should be required by any journal, (boldface mine):
The research protocol must be submitted for consideration, comment, guidance and approval to the concerned research ethics committee before the study begins. This committee must be transparent in its functioning, must be independent of the researcher, the sponsor and any other undue influence and must be duly qualified. It must take into consideration the laws and regulations of the country or countries in which the research is to be performed as well as applicable international norms and standards but these must not be allowed to reduce or eliminate any of the protections for research subjects set forth in this Declaration.
[…]
[…]
- For medical research using identifiable human material or data, such as research on material or data contained in biobanks or similar repositories, physicians must seek informed consent for its collection, storage and/or reuse. There may be exceptional situations where consent would be impossible or impracticable to obtain for such research. In such situations the research may be done only after consideration and approval of a research ethics committee.
So, unless I totally misunderstand what you did, you needed ethical approval for even performing your study. Publishing the data is only possible, if the subjects gave consent acoording to the declaration, which you should really have approved by the committee, because you can get into big trouble otherwise, even if everything turns out to be correct. I know of cases where people had the perfect data for a specific study bould could not use it because what they wanted to do with it was not covered by the consent given by the subjects.
Also note that your national or institutional regulations may go further regarding this.
Almost certainly. You will need to explain how you will maintain confidentiality, and convince them that this is appropriate. You will need address any possible negative repercussions that could occur should you publish your raw data.
