Case study on communicating with research ethics committees about minimizing risk through software: an application for record linkage in secondary data analysis

Objective In retrospective secondary data analysis studies, researchers often seek waiver of consent from institutional Review Boards (IRB) and minimize risk by utilizing complex software. Yet, little is known about the perspectives of IRB experts on these approaches. To facilitate effective communication about risk mitigation strategies using software, we conducted two studies with IRB experts to co-create appropriate language when describing a software to IRBs.Materials and Methods We conducted structured focus groups with IRB experts to solicit ideas on questions regarding benefits, risks, and informational needs. Based on these results, we developed a template IRB application and template responses for a generic study using privacy-enhancing software. We then conducted a three-round Delphi study to refine the template IRB application and the template responses based on expert panel feedback. To facilitate participants' deliberation, we shared the revisions and a summary of participants' feedback during each Delphi round.Results 11 experts in two focus groups generated 13 ideas on risks, benefits, and informational needs. 17 experts participated in the Delphi study with 13 completing all rounds. Most agreed that privacy-enhancing software will minimize risk, but regardless all secondary data studies have an inherent risk of unexpected disclosures. The majority (84.6%) noted that subjects in retrospective secondary data studies experience no greater risks than the risks experienced in ordinary life in the modern digital society. Hence, all retrospective data-only studies with no contact with subjects would be minimal risk studies.Conclusion First, we found fundamental disagreements in how some IRB experts view risks in secondary data research. Such disagreements are consequential because they can affect determination outcomes and might suggest IRBs at different institutions might come to different conclusions regarding similar study protocols. Second, the highest ranked risks and benefits of privacy-enhancing software in our study were societal rather than individual. The highest ranked benefits were facilitating more research and promoting responsible data governance practices. The highest ranked risks were risk of invalid results from systematic user error or erroneous algorithms. These societal considerations are typically more characteristic of public health ethics as opposed to the bioethical approach of research ethics, possibly reflecting the difficulty applying a bioethical approach (eg, informed consent) in secondary data studies. Finally, the development of privacy-enhancing technology for secondary data research depends on effective communication and collaboration between the privacy experts and technology developers. Privacy is a complex issue that requires a holistic approach that is best addressed through privacy-by-design principles. Privacy expert participation is important yet often neglected in this design process. This study suggests best practice strategies for engaging the privacy community through co-developing companion documents for software through participatory design to facilitate transparency and communication. In this case study, the final template IRB application and responses we released with the open-source software can be easily adapted by researchers to better communicate with their IRB when using the software. This can help increase responsible data governance practices when many software developers are not research ethics experts. Objective In our study, we wanted to learn how experts who check and approve studies that use special computer programs to keep information safe and private feel about using these tools. We did two studies with experts to make guidelines on how to talk about the software to make it easy to understand.Materials and Methods We talked with experts to get their thoughts on the good and bad things about using this software and what information is needed. Using their ideas, we made a form and a guide for researchers to ask for approval to do studies using this software. We improved these forms by getting feedback from a group of experts.Results We had 11 experts in two discussion groups, and they had 13 ideas about the good and bad things and what information is needed. Then, 17 experts gave feedback, with 13 finishing all three rounds of providing feedback. Most experts agreed that this privacy software reduces risks, but there is a small chance of unexpected problems when using existing data. Most (84.6%) thought that the risks for people in these studies were not higher than what people face in their daily lives with technology. So, studies using existing data without talking to people directly can be seen as low risk.Conclusion We found that experts do not always agree on the risks of using existing data in research. This matters because it can affect decisions by review boards, and different groups might think differently about similar studies. Also, our study showed that the big risks and benefits of this privacy software affect society more than individual people. Some important benefits were in allowing more research and helping manage data responsibly. The main risks were mistakes or problems with the software. This shows that we need to think about public health ethics along with traditional research ethics, especially when it is hard to get permission from people for studies that only use their existing data. Finally, we found good communication between privacy experts and software makers is important for making tools to keep data private. Privacy is a complex issue that requires careful attention, and privacy should be included in the beginning when making software. Sadly, privacy experts are often forgotten during this process. Our study suggests that including the privacy experts in making these tools and deciding how to share information is important. We made a form and guide that researchers can use to talk to their review boards when they use this software. This can make sure data is managed responsibly, especially since many software makers are not experts in research ethics.