The experience of accommodating privacy restrictions during implementation of a large-scale surveillance study of an osteoporosis medication.

PURPOSE: To explore whether privacy restrictions developed to protect patients have complicated research within a 15-year surveillance study conducted with US cancer registries.
METHODS: Data from enrolling 27 cancer registries over a 10-year period were examined to describe the amount of time needed to obtain study approval. We also analyzed the proportion of patients that completed a research interview out of the total reported by the registries and examined factors thought to influence this measure.
RESULTS: The average length of the research review process from submission to approval of the research was 7 months (range, <1 to 24 months), and it took 6 months or more to obtain approval of the research at 41% of the cancer registries. Most registries (78%) required additional permission steps to gain access to patients for research. After adjustment for covariates, the interview response proportion was 110% greater (ratio of response proportion = 2.1; 95% confidence interval: 1.3, 3.3) when the least restrictive versus the most restrictive permission steps were required. An interview was more often completed for patients (or proxies) if patients were alive, within a year of being diagnosed, or identified earlier in the study.
CONCLUSIONS: Lengthy research review processes increased the time between diagnosis and provision of patient information to the researcher. Requiring physician permission for access to patients was associated with lower subject participation. A single national point of entry for use of cancer registry data in health research is worthy of consideration to make the research approval process efficient.

Introduction

Health researchers may need to collect personally identifying information coupled with clinical information to conduct research. When doing so, researchers encounter a diverse array of privacy restrictions at the federal, state, and institutional levels, designed to restrict access to personal information. These restrictions are essential to protect individual privacy but may impact the ability to carry out research that benefits public health.

Institutional review and privacy boards that control disclosure of personal health information struggle with mandated restrictions stemming from US federal and state regulations that govern access to patient information for health research.1, 2 This web of regulation is especially taxing for multicenter research projects that must seek approval from numerous institution‐specific institutional review boards (IRBs). Implementation of the Health Insurance Portability and Accountability Act Privacy Rule (45 CFR Part 160; Part 164, Subparts A and E) in April 2003 expanded the burden on those conducting health research.3, 4, 5 Health care providers are permitted to disclose protected health information to state cancer registries that conduct public health surveillance and research benefitting the general public, without obtaining individual patient authorization (45 CFR Part 164 and Subpart B Part 512). Under the same law, disclosure is also permitted to those conducting postmarketing surveillance of medications mandated by the US Food and Drug Administration.

The Food and Drug Administration required a 15‐year postapproval surveillance study to monitor the long‐term safety of an osteoporosis medication (teriparatide, manufactured by Eli Lilly & Co.).6 The study is a retrospective case series initiated at the time of drug approval in 2002. Methods and interim findings from this study have been described.7 In the study, adult patients in the USA diagnosed with osteosarcoma (a rare bone cancer) or other protocol‐defined tumors are identified by cancer registries and interviewed to determine prior drug treatments. Here, we report on the delay in study approval and potential impact of increasingly restrictive steps to obtain access to conduct a noninterventional, patient contact study.

Methods

Between February 2003 and May 2013, RTI International (RTI) researchers enrolled 27 cancer registries to participate in the surveillance study and offered assistance with IRB and other applications and approvals. The study was approved by IRBs at RTI and 20 registries; seven registries did not require local IRB review during initial approval. Human subjects' protection and other required reviews varied by registry. Data collection started in July 2004 and will continue until 2019 for patients diagnosed 1 January 2003 through 31 December 2017.

We examined two indicators of research progress: the time needed to obtain final study approval and response proportion. The time needed to obtain final study approval was the time from submission of a working protocol to a cancer registry until the later of the date of initial IRB approval or registry approval. Response proportion was the proportion of patients who completed an interview of the total reported to RTI by the registries. We could not examine response proportion for patients at those cancer registries that collected their own permission because only limited data were available from these registries when permission was not obtained. We examined factors thought to influence these indicators.

We defined ease of access to patients by (1) how the patient information was reported to RTI and (2) the steps required before patients were invited to participate. Research lag time was the time elapsed between the diagnosis date and the date patient contact information was reported to RTI. Some cancer registries were permitted to release patient contact information directly to RTI; other registries required permission from the physician and/or patient before this information could be released to RTI (Figure 1).

Figure 1

Cancer Registry Patient Contact Information Flow Based on Type of Patient Information Release Policy. CR = cancer registry; RTI = RTI International. (a) Patient was not contacted because the physician did not provide permission (n = 130) or RTI was pending completion of a required waiting period before being authorized to contact the patient (n = 8)

Each cancer registry had unique permission steps that needed to be followed, based on the local level of privacy restriction required, before RTI could invite patients to participate in the study. We assigned each registry into one of three permission categories at the time of the data cut, 31 March 2014. For the least restrictive permission category, the patient's physician was notified that RTI would invite the patient to participate in the study if the physician did not object. For the moderately restrictive permission category, permission must have been obtained (by the registry or RTI) from the patient before RTI invited the patient to participate. For the most restrictive permission category, permission must have been obtained from the physician, and for some registries also the patient, before RTI could invite the patient to participate (Table 1).

Table 1

Permission steps and permission category for gaining access to patient contact information for the osteosarcoma surveillance study

Permission step	Who initiates contact?	Description of steps	Permission category
Physician notification only	Researcher	Researcher sends a notification about the study to the patient's physician. If the physician does not object to the patient being contacted for the study the researcher is allowed to contact the patient.	Least restrictive
Patient release	Either researcher or registry	If the registry initiates patient contact, a patient permission form must be obtained by the registry before the patient's contact information can be released to the researcher. If the researcher initiates contact, a patient release form must be obtained before interviewers may contact the patient.	Moderately restrictive
Physician notification and patient release	Registry	The physician is notified and allowed to object, and the cancer registry must obtain a permission form from the patient before the researcher may contact the patient to participate in the study.	Moderately restrictive
Physician permission	Either researcher or registry	If the registry initiates contact, permission must be obtained from the physician before contact information can be released to researcher. If the researcher initiates contact, permission from the physician must be obtained before interviewers may contact the patient. No patient release is required.	Most restrictive
Physician permission and patient release	Registry	The registry must obtain permission from both the physician and the patient before contact information for the patient is released to the researcher.	Most restrictive

Analyses

A descriptive analysis summarized the time necessary to obtain final study approval; this analysis was also stratified by the registries' requirement for local IRB approval versus not requiring local IRB approval.

To evaluate the characteristics of the patient population, we compared demographic information for patients reported directly to RTI versus patients where additional permissions were required before contact information was released to RTI. Patient‐level demographic information that included vital status, age, sex, geographic region, and year of diagnosis was available for comparison for all patients identified by participating cancer registries, irrespective of whether the registries were able to obtain permission to release contact information to RTI. Subsequent analyses were limited to data from patients whose contact information was released directly to RTI where registry‐level and patient‐level factors could be evaluated for each observation.

To evaluate if the response proportion was associated with the level of privacy restriction or other patient demographics or registry characteristics, we compared the response proportion stratified by the permission category, research lag time (≤1 year, >1 year), type of cancer registry—National Cancer Institute, Surveillance, Epidemiology and End Results Program affiliated or not,8 and registry size (reflecting the proportion of US osteosarcoma cases captured by the registry: small, 0% to <2%; medium, 2% to <4%; large, ≥4%). Patient‐level demographic information included vital status (alive or deceased at the time of reporting to RTI), age, sex, and state of residence when diagnosed (grouped by US census region). We assessed potential for a secular trend in participation by stratifying the response proportion by calendar year the patient data were reported to RTI.

The ratio of the response proportions was calculated across levels of each study variable, using one level as the reference category. For each variable, we evaluated potential confounding of the relationship between permission category and response proportion by comparing the ratio of response proportions unadjusted for that variable with the ratio adjusted for the same variable. For adjustment, we calculated the response proportion by permission category at each level of the variable, weighted by the patients at the same level in the overall population (patients reported directly to RTI). In addition, we evaluated the relationship between the permission category and the response proportion by adjusting the ratio of response proportions for all of the registry and patient‐level characteristics available to us by fitting a multivariate log‐binomial model.

We assumed those patients with missing values for vital status were alive. Missing values for state of residence when diagnosed were addressed by using the state of the reporting registry.

All data were analyzed using sas v9.3 (SAS Institute Inc., Cary, NC, USA) and Episheet.9

Results

Registry approval

As of 31 March 2014, of the 27 cancer registries, the average time needed to obtain final study approval was 7 months (range, <1 to 24 months); 41% of the registries took 6 months or more to obtain final study approval (<3 months, 33%; 3 to <6 months, 26%; 6 to <12 months, 22%; and ≥12 months, 19%). Of the 20 registries requiring local IRB review, the average time needed to obtain final study approval was 7 months (range, <1 to 24 months); half of these registries took 6 months or more to obtain final study approval. At the seven registries not requiring local IRB review, the average time needed to obtain final study approval was 4 months (range, <1 to 18 months); only one registry took more than 6 months to obtain final study approval.

Cancer registry and patient characteristics

Overall, 3,692 eligible patients diagnosed from January 2003 through December 2012 were identified from 27 cancer registries. Approximately 22% (n = 6) of these registries had the least restrictive permissions, 56% (n = 15) had moderately restrictive permissions, and 22% (n = 6) had the most restrictive permissions. Most registries (n = 19; 70%) were not affiliated with the National Cancer Institute.

Patient demographic characteristics were compared between registries that released patient contact information directly to RTI (n = 2,083) and registries that released contact information only after obtaining other permissions (n = 1,609). The populations were similar in most respects, but patients from registries that released patient contact information directly to RTI were more frequently diagnosed in the first 4 years of the study (38% vs 32%) and more often alive at the time of reporting to RTI (63% vs 54%) (Table 2).

Table 2

Characteristics of All patients identified, patients whose contact information was reported directly to RTI, and patients whose information was released after obtaining permission

	All patients identified (n = 3,692)			Patient information reported directly to RTI (n = 2,083)			Patient information released after permission obtained (n = 1,609)			Percentage difference*
Characteristic	n	%	95% CI	n	%	95% CI	n	%	95% CI
Sex
Male	1,885	51	49, 53	1,082	52	50, 54	803	50	47, 52	2
Female	1,807	49	47, 51	1,001	48	46, 50	806	50	48, 52	‐2
Age (years)
Mean (SD)	63.3 (13.6)			63.8 (13.8)			62.6 (13.4)
70 or older	1,249	34	32, 35	746	36	34, 38	503	31	29, 34	5
60–69	831	23	21, 24	462	22	20, 24	369	23	21, 25	−1
50–59	912	25	23, 26	495	24	22, 26	417	26	24, 28	−2
40–49	700	19	18, 20	380	18	17, 20	320	20	18, 22	−2
Vital status†
Deceased	1,508	41	39, 42	763	37	35, 39	745	46	44, 49	−10
Alive	2,184	59	58, 61	1,320	63	61, 65	864	54	51, 56	10
Geographic region‡
Midwest	741	20	19, 21	266	13	11, 14	475	30	27, 32	−17
South	1,329	36	34, 38	927	45	42, 47	402	25	23, 27	20
West	777	21	18, 22	613	29	28, 31	164	10	9, 12	19
Northeast	845	23	22, 24	277	13	12, 15	568	35	33, 38	−22
Year diagnosed
2010–2012	1,146	31	30, 33	627	30	28, 32	519	32	30, 35	‐2
2007–2009	1,243	34	32, 35	665	32	30, 34	578	36	34, 38	‐4
2003–2006	1,303	35	34, 37	791	38	36, 40	512	32	30, 34	6

CI = confidence interval; RTI = RTI International; SD = standard deviation; US = United States.

Reported directly to RTI—released after permission obtained.

Patients with a missing value for vital status were assumed to be alive.

Geographic region assigned based on state of residence at time of diagnosis, grouped by US Census.

Response proportion

The response proportion and ratio of response proportions among patients reported to RTI directly varied by permission category, patient demographics, and cancer registry characteristics (Table 3). The response proportion among registries in the least restrictive permission category was 60% greater (ratio of response proportion = 1.6; 95% confidence interval [CI]: 1.3, 2.0) than for registries in the most restrictive permission category. Research lag time showed a similar pattern. The response proportion was 30% greater (ratio of response proportion = 1.3; 95% CI: 1.2, 1.5) if the time from diagnosis to reporting of patient information to RTI was 1 year or less versus more than 1 year. Response proportion was associated with patient vital status at the time of reporting to RTI and was 90% greater (ratio of response proportion = 1.9; 95% CI: 1.6, 2.2) when a patient was reported alive, even if a proxy was located and interviewed, than when the patient was reported as deceased and had a proxy response. Patients aged 40–49 or 60–69 years had a response proportion 30% greater (ratio of response proportion = 1.3; 95% CI: 1.1, 1.5) than that for patients aged 70 years or older. Patients reported to RTI in earlier calendar years had a higher response proportion (2004–2011) than patients reported to RTI after 2011, regardless of the patient's year of diagnosis. Response proportion did not vary appreciably by sex of the patient.

Table 3

Response proportion among patients reported directly to RTI, by patient and cancer registry characteristic (n = 2,083)*

Characteristic	Total in group	Number interviewed (%)	Ratio of response proportions†	95% CI
Patient characteristic
Vital status
Deceased	763	176 (23.1)	1.0	Ref
Alive	1,320	576 (43.6)	1.9	1.6, 2.2
Age (years)
70 or older	746	235 (31.5)	1.0	Ref
60–69	462	183 (39.6)	1.3	1.1, 1.5
50–59	495	180 (36.4)	1.2	1.0, 1.4
40–49	380	154 (40.5)	1.3	1.1, 1.5
Sex
Male	1,082	404 (37.3)	1.0	Ref
Female	1,001	348 (34.8)	0.9	0.8, 1.0
Geographic region
Midwest	266	69 (25.9)	1.0	Ref
South	927	319 (34.4)	1.3	1.1, 1.7
West	613	245 (40.0)	1.5	1.2, 1.9
Northeast	277	119 (43.0)	1.7	1.3, 2.1
Year reported to RTI
≥2012	559	151 (27.0)	1.0	Ref
2008–2011	941	361 (38.4)	1.4	1.2, 1.7
2004–2007	583	240 (41.2)	1.5	1.3, 1.8
Cancer registry characteristic
Permission category
Most restrictive	297	73 (24.6)	1.0	Ref
Moderately restrictive	675	248 (36.7)	1.5	1.2, 1.9
Least restrictive	1,111	431 (38.8)	1.6	1.3, 2.0
Research lag time‡
>1 year	1,363	446 (32.7)	1.0	Ref
≤1 year	720	306 (42.5)	1.3	1.2, 1.5
Type of cancer registry
Non‐NCI	1,532	529 (34.5)	1.0	Ref
NCI	551	223 (40.5)	1.2	1.0, 1.3
Size of the cancer registry§
Small	106	36 (34.0)	1.0	Ref
Medium	525	203 (38.7)	1.1	0.9, 1.5
Large	1,452	513 (35.3)	1.0	0.8, 1.4
Cancer registry characteristic			Adjusted Ratio of Response Proportions†
Permission category
Most restrictive	297	73 (24.6)	1.0	Ref
Moderately restrictive	675	248 (36.7)	1.6	1.0, 2.7
Least restrictive	1,111	431 (38.8)	2.1	1.3, 3.3

CI = confidence interval; NCI = National Cancer Institute; RTI = RTI International; US = United States.

Nine patients reported with contact information from participating registries were missing values for vital status. The modal value of “alive” was used for these patients. The ratio of response proportions could not be prepared for patients whose information is released to RTI only after permission is obtained by the cancer registry because only limited data were provided and it was not possible to determine case‐specific information for those patients not interviewed (i.e., vital status, age, and research lag time).

Values greater than 1 indicate that a patient in the strata has a greater likelihood of being interviewed than a patient in the reference strata.

The time between the date of diagnosis and the date reported to the researcher.

Size of the registry is based on the estimated coverage of incident cases of osteosarcoma in the USA from 1 January 2007, to 31 December 2012, using NCI rate of osteosarcoma, 2.5 cases per million population per year18 applied to the annual estimates of the resident population by age and sex from 2007–2012.19 Small registries cover less than 2% of incident cases; medium registries cover 2% to less than 4% of incident cases; large registries cover at least 4% of incident cases.

A stratified analysis revealed that the year the patient was reported to RTI was a potential confounder of the association between permission category and response proportion. The association between response proportion and permission category was attenuated when controlling for the confounder. We attempted to assess potential confounding for all covariates using a stratified analysis; however, small‐cell sizes in some covariate strata limited our ability to assess potential confounding using this approach.

Using a multivariate log‐binomial model, we adjusted for the patient and registry characteristics (vital status, age, sex, geographic region, the year the patient was reported to RTI, research lag time, and the type and size of the cancer registry). After adjustment, the response proportion among registries in the least restrictive permission category was 110% greater (ratio of response proportion = 2.1; 95% CI: 1.3, 3.3) than for registries in the most restrictive permission category. Similarly after adjustment, the response proportion among registries in the moderately restrictive permission category was 60% greater (ratio of response proportion = 1.6; 95% CI: 1.0, 2.7) than for registries in the most restrictive permission category.

Discussion

Even with extensive collaboration with cancer registry professionals a substantial amount of time may be required to obtain research approval at many registries, especially when local IRB review is required, increasing the cost and burden of the research. Approval processes are heterogeneous across registries, owing to different state‐level and institutional research approval requirements and different interpretations of privacy restrictions. Local requirements were frequently conflicting and precluded using a single set of study materials and patient contact methods, increasing the time needed to obtain final study approval. Delays and the effect on subject selection and participation have been shown elsewhere to possibly limit the validity of research findings.2, 5, 10, 11, 12, 13, 14

Our research indicates that less restrictive permission steps to gain access to patients and shorter research lag times are associated with greater response. Patients identified during the earlier years of the study period had higher response proportions, which confounded the relation between permission category and response proportion. The confounding may be due to unmeasured secular trends (e.g., increasing public concern over privacy or unwillingness to participate in research) or to the manner in which registries were recruited; registries with more restrictive permissions were recruited to the study much later in the study period, which correlates with the year patients were reported to RTI.

This analysis was limited; it could not use the entire patient population identified by all participating cancer registries due to data release policies. However, based on similarity of patient‐level characteristics, patient data released directly to RTI did not appear to differ from data obtained otherwise in ways that might affect the association observed between permission category and response proportion. It is possible that patients with more advanced disease were less likely to participate in the study. Although cancer registries collect stage of disease at diagnosis, the stage data were not available to the researchers.

This analysis did not account for privacy restrictions that may have changed during the study period. However, only one state cancer registry included in the response proportion analysis changed its policy during the study period in a manner that changed how patients could be contacted for this study. That change was due, in part, to the poor patient response observed when physician permission was required before patients could be contacted for this study. In 2010, the registry modified its privacy restrictions, which allowed RTI to contact patients directly without physician permission. Prior to this change, the registry was classified in the most restrictive permission category and had one of the lowest patient response rates in the study. However, in this analysis, it was classified according to the privacy restriction after the changes went into effect (i.e., in the least restrictive permission category), which may have attenuated a stronger association between permission category and response proportion.

Limited experience of cancer registries and their IRBs with postapproval drug safety studies and possible reluctance by state health departments to engage in research sponsored by pharmaceutical companies may be barriers to prompt local approval of research. It is also possible that the frequency of IRB review meetings influenced the length of time to approval; however, we did not characterize this aspect of the delay in obtaining approval. Registries often lack resources or infrastructure to accept external funding to support research activities, including “shepherding” research protocols through internal review processes.

These findings and others15 suggest that streamlining protocol review and permission steps to gain access to patients would reduce the burden to researchers conducting studies with cancer registries. One suggestion would be consideration of a single, centralized process for approval and access to cancer registry data. For example, the National Death Index was created over 35 years ago to improve access to state‐level mortality records by simplifying data access for researchers into a single approval process.16 While some privacy and human subject's protection issues are different for cancer registry data,17 a similar model might allow greater access to cancer registry data for research of benefit to the public.

Conflict of Interest

The surveillance study of teriparatide, a postapproval requirement by the Food and Drug Administration, which served as the basis for the analysis in this paper, is being conducted by RTI International with support from Eli Lilly & Company. The analyses presented in this paper were initiated by the investigators and not the sponsoring agency. Drs. Deapen (University of Southern California), Schymura (New York State Cancer Registry), and Hornicek (Massachusetts General Hospital) did not receive funding to support this work. The sponsor did not have any role in the collection, analysis and interpretation of data, in the writing of the report, and in the decision to submit the article for publication. The authors declare no conflict of interest.

The average length of the research review process from submission to final approval across 27 U.S. cancer registries was 7 months (range, <1 to 24 months), and it took 6 months or more to obtain approval of the research at 41% of the cancer registries.

Streamlining protocol review and permission steps at cancer registries for researchers to gain access to patient contact information would reduce the burden to researchers conducting studies with cancer registries.

Cancer registries that required only physician notification prior to patient contact versus physician and/or subject permission prior to patient contact had higher interview response rates.

Requiring physician permission for access to patients was associated with lower subject participation.

Ethics Statement

The study was approved by the Institutional Review Board of each participating organization and the state departments of public health, where applicable.

Author Contributions

All authors contributed equally to this work. D. H. H. assembled the data on length of approval and edited the manuscript. K. D. M. reduced the data and performed the descriptive and stratified analyses using sas and Episheet and wrote the main draft of the paper. E. B. A., A. W. G., and D. H. H. jointly conceived the methods along with K. D. M., and edited the manuscript. M. J. S., D. M. D., and F. J. H. contributed to the conceptualization of the paper, and edited the manuscript. All authors discussed the methods, analytical results and implications and commented on the manuscript at all stages.