Privacy vs progress: patient confidentiality in personalised medicine

The privacy of patients taking part in clinical trials has always been considered a top priority, but only a few years ago it was an issue that caused relatively few problems. It has now become a hot topic, as concerns over privacy and the lack of a clear and consistent regulatory framework make pharmaceutical companies hesitant about sharing data as part of collaborative studies.

"In the past, data were relatively simple to manage," says Pierre-Yves Lastic, associate vice-president and chief privacy officer for global integrated healthcare company Sanofi. "A sponsor had a contract with an investigator who gave informed consent forms to patients who then agreed to let their data be used in trials. The problem now is that clinical trial data are increasingly used for more than one purpose. For example, you may want to pool data from clinical trials to make a comparative analysis across different compounds or treatments. That means extending the informed consent agreements, which not all patients of regulatory authorities will accept.

"In many areas, such as cancer and neurodegenerative diseases like Alzheimer's, there has been no real progress for 30 years, so companies want to join forces in a more collaborative process, which means sharing data to find treatments that they could not develop on their own. Such a use of data is not covered by informed consent, so you need to anonymise the data."

Private affairs

Lastic's role at Sanofi shows how the issue of privacy has rapidly grown in importance. He was first asked to look at it in regard to the company's R&D activities in 2005, and it was expected to make up at most 10% of his job. Now he oversees a team of privacy officers looking not only at R&D, but also many other areas of Sanofi's business. One of the key issues Lastic encounters is the difficulty with anonymising clinical trial data for collaborative research.

"If you anonymise the data so that it is impossible to identify the patients, you can end up removing so many indirect identifiers that the data are no longer useful for research," he explains. "If you remove too many dates, for example, you may not have the traceability that is required in regulatory inspections. Leave in too many dates and it may be possible to link a patient to a hospital, a date and physical characteristics that make it possible to identify an individual's medical data.

"The problem is increased with the move to personalised medicine, which is based on factors like genetics and environment, and so requires medical records that have a complete profile of a patient."

The industry is seeing a paradigm shift to personalised medicine and collaborative clinical research, and the rules governing the privacy of patient data have yet to catch up.

Regulatory jungle

Regulators are well aware of the need to address data privacy. The European parliament is in discussions over an update to the Data Protection Directive, and the European Medicines Agency has just released a draft policy on the publication of and access to clinical trial data. It categorises different types of data as commercially confidential, open access and controlled access, and suggests degrees of protection for each. It notes that protection of personal data is a fundamental right of European Union citizens, so recommends that such data be sufficiently de-identified.

For Lastic, one problematic element in this policy is the recommendation that clinical trial data be made public as soon as a drug is released onto the market.

"The problem here is similar to that in the area of clinical research, but the data are even more public," he says. "Patients don't consent to this in the first place, so the data would have to be anonymised to prevent the identification of patients, but not so much that it becomes useless. We are in the midst of discussions to find the right compromise between anonymisation and traceability, but it is a very fine line.

"The problem is less serious if you have a very large database, as would be the case for research into cancer. But in the case of rare conditions, it would be much easier to identify patients so that data could more easily be used to discriminate against those people. If they had a psychological disease, there could be discrimination from neighbours, employers or insurance companies."

There are many strong opinions colouring the debate over privacy, and difficult discussions will be had if the right balance is to be found between the need for privacy and the need to pursue medical research in key areas.

"With severe diseases like cancer, there is perhaps more emphasis on the need to share data, but there is a need to ensure that the data are not used by commercial organisations for purposes that have not been approved by the patients," says Lastic. "It is likely that countries will make political decisions that will allow this kind of collaborative research.

The future of the regulatory regime is unclear, which makes many pharmaceutical companies unsure about how to remain compliant and do right not only by the regulators, but also by the patients taking part in trials.

"It is hard to foresee the outcome of these discussions, but one thing is for sure - companies engaging in clinical trials are taking a very cautious approach," explains Lastic. "They fear lawsuits and the potential damage to their image. So, each project is analysed very closely by ethics committees."

Best of both worlds

The pharmaceutical industry is asking itself how best to serve patients and has to decide whether protecting the privacy of patient data in collaborative clinical studies is more important than accelerating research into much- needed therapies for serious diseases. This is not a simple question to answer, and
much depends on how regulators view the same question. Whatever the answer, the industry wants to know what is required of it.

"Companies want clarification of the situation as it is hard to operate without it," says Lastic. "In the next few years, the issue of privacy will be clearer, but currently the regulations are not clear enough - that is holding back or slowing down research projects and is frustrating, not only for pharmaceutical companies, but also for patients who want progress to be made in treatments for serious diseases."

The issue is made more complex by the fact that there are various approaches to data protection in different countries; achieving compliance is a very complicated task.

"The US regulations tend to be less restrictive on patient data protection than in Europe, which is the most strict, along with countries like Canada," says Lastic. "But the US also has a very strong civil rights movement, which will have a say in the debate. Asia is generally closer to the more permissive model of the US."

Much needs to be done to give pharmaceutical companies a clear picture of how to use patient data in an effective way and remain compliant with regulations across different jurisdictions, and to give them the confidence to use patient data in a way that maximises the effectiveness of clinical trials, while respecting the privacy of patients taking part in any given study.

"My message to pharmaceutical companies would be that we need to find a sensible compromise between protecting fundamental patient rights and developing important new treatments," says Lastic. "Issues around data protection should not stop research in important areas like cancer and neurodegenerative disease. So, perhaps it is governments that need to act."

What is certain is that pharmaceutical companies need to make their voices heard in the debate on privacy, as it will have a dramatic effect on how clinical trials are conducted in the years ahead.