"Medical Genetics, Department of"@en . "Medicine, Faculty of"@en . "Population and Public Health (SPPH), School of"@en . "DSpace"@en . "HPRU 96:8D"@en . "University of British Columbia. Centre for Health Services and Policy Research"@en . "Baird, Patricia A."@en . "2014-09-09T19:51:02Z"@en . "1996-06"@en . "https://circle.library.ubc.ca/rest/handle/2429/50329?expand=metadata"@en . "SOME DATA ISSUES INGENETICS RESEARCH:REGISTRIES, RECORDLINKAGE AND PRIVACYPROTECTIONPATRICIA BAIRDHPRU 96:80 June 1996Some Data Issues in Genetics Research:Registries, Record Linkage and Privacy ProtectionPatricia BairdDepartment of Medical GeneticsUniversity of British ColumbiaJune 1996The Centre for Health Services and Policy Research was established by the Board of Governors ofthe University of British Columbia in December 1990. It was officially opened in July 1991. TheCentre's primary objective is to co-ordinate, facilitate, and undertake multidisciplinary research inthe areas of health policy, health services research, population health, and health human resources.It brings together researchers in a variety of disciplines who are committed to a multidisciplinaryapproach to research, and to promoting wide dissemination and discussion of research results, inthese areas. The Centre aims to contribute to the improvement ofpopulation health by beingresponsive to the research needs of those responsible for health policy. To this end, it provides aresearch resource for graduate students; develops and facilitates access to health and health caredatabases; sponsors seminars, workshops, conferences and policy consultations; and distributesDiscussion Papers, Research Reports and publication reprints resulting from the researchprograms of Centre faculty.The Centre's Health Policy Research Unit Discussion Paper series provides a vehicle for thecirculation of preliminary (pre-publication) work of Centre faculty and associates. It is intended topromote discussion and to elicit comments and suggestions that might be incorporated within thepapers for this purpose, the views in the papers are those of the author(s).A complete list of available Health Policy Research Unit Discussion Papers and Reprints, alongwith an address to which requests for copies should be sent, appears at the back of each paper.Some Data Issues in Genetics Research:Registries. Record Linkage and Privacy ProtectionRegistriesA health related registry has been defmed as a file or list that associates a name or otherspecific identifier, with a disease diagnosis, health related condition, or risk of condition(l).Usually, additional information is available on the individuals included, either in the registryitself or in the files of the parent health related organization. There are many different kindsof health related registries, including registries related to transplantation, cancer, trauma,diabetes, child abuse, birth defects, occupational exposures etc; genetic registries are oneparticular sub-set.A genetic registry is one which contains data on individuals with genetic disease or particulargenotypes and their families for the whole of a defmed geographic or administrative entity.Unique identification of the individuals on the registry is included and for ease of storage andretrieval of data, the records are usually computerized. There are many kinds of geneticregistries - for example, chromosome registries, or registries dealing with particular geneticdiseases such as neurofibromatosis or Huntington disease. In fact, in some ways the servicefiles of a medical genetics department could be looked at as a registry. Before development ofa registry is embarked on, its goals need to be very clear because if designed appropriately, itwill contain different items of information that relate to its goals. It is also worth asking atthe outset whether it is necessary to set up a registry, or whether the same goals could not bereached in some other way. The current capacities in record linkage mean that some needs forspecific registries could be met by using such methodology, although most registries containmore detail than would normally be found in a linked administrative database.One goal for which a registry may be set up is the provision of direct services to individuals.For example, individuals with a particular disease, or particular exposures, may have access tocounselling or treatment services and a register is kept to follow them. Another goal for a2registry may be to carry out research - a social goal which may not be of direct benefit to anyparticular individual in it. A registry may be established to track the prevalence and incidenceof a particular disorder over time, or to help uncover the etiology of a disorder, or tocontribute knowledge on the impact of the conditions on affected individuals and on the.health care system. If DNA or tissue samples linked to the identified individuals are kept, it isusually categorized as a bank rather than a registry. ill practice, many genetic registriescombine both service and research goals. Registries may vary widely in scope - from nationalor even international, to quite local small entities as part of a funded research project.Usually, however, unless there is some element of on-going functioning and continuity overtime, these Iatter research project related files of patients with particular conditions are notthought of as \"registries\". Another aspect is that as our understanding of genetics increases,the difference between a genetic registry and other kinds of medical databases becomes lessdistinct. For example, a cancer registry that can identify a child with bilateral retinoblastomacan thus identify people with constitutional mutations of the Rb gene.ill essence, registries provide a mechanism by which data can be made available for geneticepidemiologic studies. Information generated by such studies is helpful for planning for healthand other special intervention programs or facilities, and in estimating medical, educational orother needs. Analysis of registry data may yield valuable insights into the features andprognosis of various disorders - providing information that families, health care workers, andpolicy makers need to have.Record linkage of administrative data filesIf the definition of a registry seems a little \"blurry\", that reflects the reality. And the conceptof clearly identifiable, independent, free standing registries has become even more blurred inan era where linking data files of identified individuals kept in machine readable form is nowpossible. Data is collected routinely on individuals in the management and functioning ofmany large social institutions and services. These routinely collected administrative data existin Canada pertaining to vital events, hospital care, medical system contacts, etc. for virtuallythe whole population. Information from most of these social and health records is being3transcribed routinely into machine readable form. The techniques of record linkage by highspeed computer processing mean information from independently derived records relating tothe same persons can be brought together. Provided enough identifying data are present in thesource files to be linked, probabilistic machine linkages can be done very quickly onextremely large data sets. The files can be linked into longitudinal event and outcomehistories on individuals.Record linkage makes possible analysis of data on far greater numbers of individuals thanpreviously feasible. In the past, the labour and expense of data collection on individuals, or ofmanual linkage by clerks, did not allow truly large follow-up studies. It is only in recentdecades that they have become common in epidemiology, made possible by computerizeddata sets and automated linkage that mimics the judgement of clerks.(2) For example in the1960's, a search for induced cancer among 35,000 patients with thyroid disease treated eitherby radioactive iodine or surgery involved many field workers in follow-up, given the long lagtime for disease expression. This was expensive, labour intensive, and intrusive to the peoplefollowed.(3) The same kind of study could be done now using record linkage methodology,far more cheaply and without personal intrusion, as individuals' histories can be tracked bytheir records of contacts with various medical facilities.Many provinces in Canada are developing population based, person-specific, healthinformation systems.(4) Such databases can have multiple uses - not only regardingmeasurement of health services and development of effective policies, but also playing animportant role in epidemiological research. They could provide an increasingly powerful testbed for a range of hypotheses about the genetic factors that affect people's health. Themethodology needed to bring together fragments of individual and family health historiesscattered throughout the routine files of vital and health events is available. Record linkageallows large quantities of follow-up data to be analysed in a cost effective way, the Manitobadatabase being a very good example of what is possible. It is designed around informationproduced as part of administering that province's health care system, and documents everycontact that the population has had with hospitals, nursing homes, and physicians during the4last 25 years.(5) Many of the required elements to build such a system are available in mostCanadian provinces, some States and most European countries, so the approach could beduplicated elsewhere..Bringing together registries and administrative data setsAfter initial investment in developing such a population based health information system,additional specific analyses can be done relatively quickly and cheaply. In particular, if aregistry or other means of identifying those with a particular genetic trait of interest to geneticepidemiology exists, it would be possible to link that data with already assembledadministrati,ve and other data sets to answer research questions. As a concrete example, theManitoba linked data files go from 1970 to the present and include such routinely collecteddata as hospital administration/separation records, physician services claims, the provincialdrug insurance program, vital statistics files including births and deaths, physician registration,nursing 'home administration records. Unique identifiers permit linkage routines to be applieddirectly to the entire data bank so that multiple file and multiple year histories on individualscan be developed. This existing database could potentially be linked to the prenatal diagnosisdatabase of the Medical Genetics department, or to other specific genetic files. For example, adata file of people with a particular characteristic (such as apo E genotype) could be linked tothe population data files to evaluate outcomes in a far less expensive and less intrusive waythan following individuals by contact and doing primary data collection. The existence ofcomputerized routinely collected linked administrative files makes it practical to documenthealth outcomes over time and permit detection of long delayed harms or outcomes in a moreaccurate, less costly and less intrusive way.Computerized record linkage is able not only to build longitudinal health histories onindividuals, but to link these into family groupings and sets of individuals with commonparents (sibships). This would then allow detection of familial clustering of disorders - anaspect of interest to researchers in genetics.5Benefits, of using administrative data for researchSociety clearly has an interest in using the information in medical and administrative recordsfor research into patterns of illness or disability, and to evaluate the outcomes of treatment.Without the results of such research being available, the use of harmful procedures, or the useof harmful drugs cannot be stopped, and many improvements in medical treatment cannot bemade. Citizens rely on provincial and national government regulations to protect their safety,but these bodies can only put in place appropriate regulation if sufficient relevant knowledgecan be accumulated to guide policy. Therefore, access to information about the nature andresults of treatment is one of the essential components permitting safe care and theresponsible,use of health care resources. A substantial amount of research in Canada relies onsuch secondary uses of health information collected for administrative purposes onindividuals. Administrative data relating to health encounters are irreplaceable sources ofinformation for investigating questions of efficiency and effectiveness of medical care orquestions of public health. The linkage of such data using unique identifiershas tangible benefits for the Canadian public.More specifically, it is possible to use them in genetic epidemiological research. For example,with co-workers I carried out a study of individuals on a registry who had certain congenitalheart defects - by linkage they were able to be compared with matched healthy controls fromprovincial birth files to see how often a paternal occupation of firemen occurred in the twogroups.(6) We also did a study on life expectancy in individuals with Down syndrome, takingregistered individuals with Down syndrome and by linking these with the death files in vitalstatistics were able to get a picture of life expectancy for this condition.(7) It is important tonote that the data transfer on identifiable individuals was only one way - from the registry \u00C2\u00ADand the format received back by the researcher from vital statistics was statistical.The point is, that imaginative use of administrative databases that have already been collectedat great expense, might achieve new understanding of the links between genotype and longterm health or illness. The health of individuals and populations unfolds through time, and theongoing collection of data is needed to track this. A computerized record linkage approachcould be very useful to those interested in these long term outcomes.6Privacy concernsSo far I have focused on the benefits of epidemiological research using registry data, or usingrecord linkage of data files on identified individuals. But that is only part of what needs to beconsidered. As well as benefits, what are the harms? The existence of a registry, or a data fileof personally identified individuals opens up the possibility that the information in it could beused in a way that violates individual privacy and causes harm or stigmatization.Privacy - the right to control information about oneself - is a fundamental value in mostdemocracies, and one that needs to be respected . Recently this has been recognized in anumber of Canadian provinces through new freedom of information and protection of privacylegislation. People have a legitimate interest in keeping information about themselves private.It is readily apparent that the use of such data for research purposes raises important issues ofconfidentiality, issues that are part of the more general problems of protecting the privacy ofthe individual in the face of ever-expanding information technologies. The potential misuse ofpersonal information for commercial or even political purposes is a source of concern for allof us. Clearly, new ways of protecting privacy are called for because of new technologicaldevelopments. But in setting up the needed protections , it is important to distinguish thestatistical/research use of data sets, from commercial or administrative use of data sets . Anadministrative use can be defined as any use of personal information about an individual, in adecision-making process that directly affects that individual. Clearly, there is a fundamentaldistinction between linkage for administrative purposes - that can have a direct impact on aspecific person, compared to a linkage for statistical purposes - which by definition does notallow the targetting of a distinct person for direct action. Research uses (with stringentprotection regarding access to identified data, and only publication of aggregated non\u00C2\u00ADidentifiable information) should be distinguished from administrative and commercial uses ofpersonal data.If the personal data given by individuals to primary researchers setting up a registry were tobe linked without permission to other routinely collected administrative data files in a waythat could invade those individuals' right to privacy and invade their autonomy, it would be aserious matter. The principles of respect for privacy and autonomy are very important - these7rights are not mere legal technicalities, but some of the most deeply held values in mostsocieties, forming part of the basis for fundamental human rights.There is an inherent conflict between public interest needs and individual privacy protection.The possible social and health benefits from setting up a particular registry, or allowingresearch using administrative files, must be balanced against the potential danger of loss ofprivacy to the individuals involved. However, protection of privacy is not the only humanvalue in the balance - although it must be valued, it should not be above human life or thesafety and health of the population. Protection of privacy is not an automatic \"trump\".- itneeds to be, weighed against other important human values and needs.(8) Citizens expectgovernment to put in place policy and legislation to protect them, and to allow them to avoidharm. It is impossible to do this without the development of knowledge about the likelihoodof harm. In many cases, with careful planning it is possible to put in place processes andmechanisms so that individual privacy is protected, yet the significant public benefits of betterunderstanding of genetic contribution to determinants of health can be achieved.Necessary protections for administrative dataWhat are the protections that are in place?(9) In Canada, the data protection standardsgenerally in use for administrative health data bases include:\u00E2\u0080\u00A2 the research proposal must be reviewed and approved in advance by the ethics reviewboard of the researchers' institution for compliance with confidentiality guidelines\u00E2\u0080\u00A2 the research must be judged scientifically valid by a competent peer review process\u00E2\u0080\u00A2 required data storage and protections include:\u00E2\u0080\u00A2 encryption techniques where appropriate\u00E2\u0080\u00A2 physical security of files and tapes\u00E2\u0080\u00A2 only authorized individuals able to access identifying information;for example, through use of passwords\u00E2\u0080\u00A2 staff working with confidential data sign a formal agreement with regard toconfidentiality protection procedures8\u00E2\u0080\u00A2 individual identifiers (including personal health numbers, hospital record numbers etc.)are masked or scrambled before being released from the holder of the administrativedata set to researchers\u00E2\u0080\u00A2 publications describing the research are not in such a form as to allow identification ofindividuals\u00E2\u0080\u00A2 although policy recommendations could be derived from research findings by theresearcher, information on individuals is not fed back to administrative bodies\u00E2\u0080\u00A2 access only given after approval by the administrative data stewardsWhere there is significant justification and adequate protection in place - linkage acrossadministrative files for statistical and research purposes should continue to be permittedwithout requiring the consent of each individual involved. It should be possible to use healthand administrative data for research purposes provided that the listed conditions for protectionof data are met. However, as will be outlined later, it makes sense that policies be tailored tothe level of risk to individuals posed by doing the research.Regulations needed to deal with commercial and administrative uses of routinely collecteddata on identified individuals, differ from regulations needed to deal with statistical researchuses of such administrative files. Employers and insurers are interested in named identifyinginformation - that lS, named information that is linked to a specific individual. By contrast,the specific personal identity of people receiving treatment is not of concern to researchers;what matters is analysis of the aggregate results of many cases, which permits them to drawconclusions or suggest policies. This means that coded information which does not reveal anindividual's identity is in most cases sufficient for researchers. Coded person specificidentifiers may be needed in the data released to researchers, but these person specificidentifiers will not reveal the individual's name or identity. Such coded medical data maycontain information on all individual's diagnosis, treatment, and the results of treatment, aswell as information about some personal characteristics - for example, age, sex, income, andgeneral geographic location. However, the data are identified only by a code number, not by9the patient's name, and this does not permit the specific identity of the patient to be known. Ifcoded identifiers are assigned by data holders to each individual covered by a province'sprograms, and these identifiers are used when information about individuals is recorded invarious data files, it is possible for researchers to link the use of services over time by agiven individual without knowing the identity of the individuals involved.As mentioned earlier, it makes sense to tailor policies on access to data for research by thelevel of risk to individuals posed by doing the research. As outlined in the B.C. Ministry ofHealth Access Policy for Research uses of Linked Health Data,( 10) it is useful to think of thisrisk level ill five categories:1. No person-specific information or identifiers are included in the data made availablefor research and analysis.[Example: Researcher wants to assess if fee codes paid by Medical Sources Plan, andhospital procedure codes of those procedures recorded as carried out, are in agreement]2. Person-specific information is included but no personally identifying information suchas name, or health plan number, is included.[Example: Researcher wants to analyze data on all hip replacement patients]3. Person-specific information and identifiers are included in the data but no contact withthe individuals will occur as part of the research project.[Example: Researcher has data on a cohort of individuals who have been exposed to asuspected toxin, and wishes to link data from hospital and death records to theseknown exposure levels]4. Person-specific information and identifiers are included in the data and there is apossibility that the information could indirectly affect future treatment of thoseindividuals, though not as part of the research project.[Example: Cancer Agency has information on all women who had a positive PAP testand wishes to link this with hospital and death records to evaluate whether currenttreatment protocols should be modified]5. Person-specific information and identifiers are included and contact is planned with theindividuals in the research project.[Example: New knowledge suggests women with breast cancer having had a particular10treatment mode may benefit from an additional specific therapy. They are contacted toask if they wish to enrol in a clinical trial]Before giving permission for access to researchers for projects in the last three categories, thescrutiny and evaluation by data holders must be rigorous, the public interest value of theresearch clear, and the data protection measures suitable to the greater level of risk.It would obviously be impossible to identify all research purposes at the time of primarycollection of administrative data. If a requirement for individual consent to use personaladministrative information for secondary purposes were to be put in place, it would make itimpossible to carry out epidemiological or health services research studies yielding aggregatedata that do not identify individuals. Such an ill considered policy for the protection ofprivacy could do considerable damage through its very serious effects on both the conduct ofhealth research and the effective management of health care delivery systems. It would beregrettable if perfectly legitimate and proper concerns for the privacy of individuals shouldlead to the introduction of policies which, as a side effect, cripple our ability to understanddisease processes, long term effects of medications , and health care in an increasinglysophisticated way, to the general benefit of citizens. Governments and holders ofadministrative data files can store and release data with coded person-specific labels that areadequate for most research uses, yet that do not make possible the identification, and thus riskthe privacy, of the individuals themselves. (1 I)Nor should time limits be imposed on the storage of administrative data that would makeimpossible not only the longitudinal.analysis of trajectories of health and illness , but also theinvestigation of questions in the future which we can now not even imagine. Linked dataextending over generations could be important in understanding genetic disease, and data onpatterns of health and illness over long periods of time, together with other social data, mayilluminate many disease processes that are currently unclear. For these reasons, blanketrestrictions on the preservation, linkage, and use of administrative data would go far beyondwhat is necessary to protect individual privacy, and would be contrary to the public interest.Regulation should be designed with societal needs as well as protection of privacy in mind, asit may very well in most cases be feasible to achieve both goals.11Necessary protections for registry dataThe above listed recommendations for data protection are relevant to administrative data setswhere information is routinely collected in the usual course of functioning of large societalsystems. The situation is somewhat different with regard to genetic registries. Here the.researchers setting up such registries have an ethical requirement to ask individuals for theirpermission to be included. To give informed consent, potential registrants need to know whatprotections there will be for the data held, who will have access to it and under whatcircumstances, whether it will be linked with other data sets, how long it will be kept, andhow destroyed. In the United States, it is possible for a researcher to get a certificate ofconfidentiality to protect the data in a genetic registry. It protects researchers from being,compelled to reveal information and protects identities of subjects from being subpoenaed andrevealed to insurance companies or to employers.(12) To give an ethically valid informedconsent to be in the registry, individuals need to have a good understanding of the risks andbenefits related to that.Protections for merging registry and administrative dataIdentified data from a genetic registry could be merged with administrative data sets.As discussed earlier, unless the researcher has permission from subjects in the registry to dothe linkage, any results from such linkage to administrative files should only be released instatistical terms to researchers outside the administrative data holders. For example, if aregistry gave a list of 150 identified individuals with a particular genotype to administrativedata holders - administrative data holders could release information that 120 of these had hadhospitalizations for heart attacks. If however, written permission for the linkage had beengiven by all 150 registry subjects, which individuals had hospitalization could be released. Inother words, unless individual consent is given, personally identifiable data on individualsshould move only one way with regard to administrative data sets - to administrative data setholders, never from them. If movement is to be two way, it requires informed consent.This is relatively new territory for genetic epidemiology and we need to move cautiously inorder to achieve a balance between the important societal interest in using individual-level12information to develop and improve knowledge of disease processes and health, and the needto protect individuals' privacy. With sufficient thought and care in developing policies for thecollection, preservation, and use of such data, both objectives can be met.Most researchers, in fact, strongly support the development of guidelines and policies to makeclear and specific the terms of access to and use of data, and the uses that are and are notpermitted. Researchers recognize that otherwise there is a very real risk that those responsiblefor administrative data sets in particular may, from a generalized sense of vulnerability, gobeyond any legislative requirements and simply refuse access regardless of the legitimacy andvalue of the proposed use. Or, when the rules are unclear, they may impose requirements forthe deletion of data elements or the destruction of whole data sets \"just in case\", throwingaway both research and managerial information. In additiion, unless protections are clearly inplace, individuals may simply refuse to participate in any registry or data set used forresearch.To summarize, privacy is a fundamental value in society. In view of the rapidly increasingcapabilities of computer and information technology, as well as of identification of genotypesassociated with various traits, there is a growing need for protection of privacy. As well asthe individual right to privacy, however, there is a legitimate need of society to develop andimprove policies with respect to health and illness. It is important to fmd a proper balancebetween protecting the privacy of individuals, and allowing research that enhances knowledgeof the determinants of ill health, or the effectiveness of medical interventions. Striking thisbalance must take into account the means of safe guarding privacy and therefore, the relativeprobabilities of individual harm and social benefit.Privacy concerns and population DNA samplingI have focused so far on privacy and access concerns with regard to registries and with regardto computerized data files of identified individuals. What are the implications of privacyconcerns for population DNA sampling?13When a sample of a person's DNA is obtained - whether by plucking hairs, by finger prick toobtain blood, or scraping the cheek to get cells from inside the mouth, an enormous amountof genetic information on that individual is present in the sample. The long term stability ofDNA means questions can be answered about that sample that weren't even envisaged when itwas obtained. It could be tested for a wide variety of genes in the future .This means taking and keeping DNA of a person, differs from taking specific informationabout the self - such as testing urine for glucose, or examining blood for a white blood cellcount. It is different because it is in essence taking a part of the self that can later beexamined in a multitude of ways including testing for genes related to conditions where social,stigmatization may be an issue. If personally identified research DNA samples were to beused to later test for genes when the individual had not given consent for these specifictestings, this would destroy that individual's personal right to privacy, and invade theirautonomy. A striking example of DNA being retained for large numbers of people is in themany collections of tissue blocks existing in pathology departments of hospitals worldwide.Additional issues include how the DNA sample should be perceived. Is it part of the person?Is it information about a person? If a DNA sample is perceived as an extension of a body ofan individual then each examination, and each test of that DNA can be viewed as a medicalact which inevitably must involve obtaining permission of the individual for each of thoseacts.(l3) Thus, when a sample is obtained for one purpose and is stored, it must bequestioned whether it is in fact possible to obtain informed consent for all other potentialfuture uses. Asking for permission for unrestricted use of the DNA creates the problem that itis hard to see how truly informed consent can be given if it is not known what will be done .In my view, it should be the case that if additional testing, other than the specific uses thatpermission was given for, is to be done on personally identified samples, then further consentof the subject is necessary. Specifically, I do not think it is possible to give a truly informed,and therefore ethically based consent to an open ended \"any future use the researcher deemsappropriate.\"14I bring up this issue about permission for future uses because the fact that DNA samples cannow be taken in a non-invasive way has led to discussion of the ways that population healthsurveys might be used to help elucidate the genetic components of common diseases . Forexample, it may be feasible to look at relationships between genotypes and particular diseasecategories on apopulation basis. It has been suggested that DNA samples might be ,taken inthe context of a survey and then banked, along with information about the identities of thesubjects, so that the samples could be used in further research . As knowledge is increasingvery rapidly, the DNA samples may be more usefully examined in a few years - for exampleto see if those with particular genotypes are more likely to developparticular diseases. DNAsamples must be personally identified if the consequences of having particular genes are to be,known - as health consequences have to be allocated to the correct individual.This kind of suggestion needs to be approached with great caution. If tests were to be run inthe future on the DNA that is held from a population sampling survey, some identifiedindividuals would be found to be at high risk for particular disorders. Would they all beinformed? Or would they only be informed in cases of a serious disorder and when there issomething that can be done about it? What ethical questions are raised by not informinganyone? Interpretation of the genetic information about a person's genotype may be verydifficult, and may mean such genetic information may not be usefuL Although therelationship of a genotype to an actual disease is very clear for some single gene diseases,these are relatively rare; multifactorial disorders are much more common. The identificationof a mutant gene may not mean the person will show that disorder: that will depend oncomplex interactions with the rest of the individual's genetic background, and with theenvironment, which may include the chemical, social, and emotional environment. In addition,the information may not be wanted by an individual - for example, if it simply puts theperson into a higher statistical risk group when there is nothing he or she can do to avert thisrisk. Clearly, disclosure for informed consent to having a DNA sample taken and kept forpossible future testing of an unknown nature is very complex and perhaps impossible.(l4)Individuals could be faced with choices both the researcher and themselves were unaware thatthey may have to face . Knowledge regarding genetic status is also not limited to that15individual - inevitably that knowledge has consequences for family members as well andthese individuals may not have given permission. Informing individuals of a risk statusbecause of genotype creates a category of people who are not ill but know they aresusceptible to a particular condition. Knowledge of increased risk status in itself could be.harmful to their self-image, relationships, and health.The potential for invasion of privacy and for harm is great with DNA sampling. Thisunderscores the need to obtain appropriately informed consent for any use of the DNAsample. Asking for permission for a blanket unrestricted use of DNA creates the problem thatit is impossible to see how consent can be truly informed if it is not known what will befdone . However, rather than setting rigid rules, circumstances and opportunities may need tobe considered as the future unfolds, with the potential for harm to individuals always bornein mind. Perhaps ways could be found in some situations to treat tests on banked DNAsamples analogously to administrative data, with masked identifiers allowing the ability totrack statistically in population based administrative data sets for outcomes of havingparticular genotypes.SummaryIn summary, I have described various categories and functions of registries, in particulargenetic registries. I have outlined how data in such registries may be related tn existing largeadministrative data files by computer based record linkage in order to carry out geneticepidemiology studies. As well, I have described how record linkage could be employed tomine the information valuable for developing policy or understanding disease that is containedin these administrative data files. I discussed the benefits of such studies stressing that theymust only be carried out in a context of protecting the privacy of individuals. Finally, I haveoutlined some implications of privacy concerns for population DNA sampling.16References1. Hook, EB. Genetic Registers: types, goals, methods and limitations. Chapter in Registersfor the Detection and Prevention of Genetic Disease, edited by AEH Emery, and lR Miller.Symposia Specialists, Miami. 1976.2. Newcombe, HB. Handbook of Record Linkage. Methods for Health and Statistical Studies,Administration, and Business. Oxford University Press, New York. 1988.3. Dobyns, BM., Sheline, GE., Workman, lB., et al. Malignant and benign neoplasms of the,thyroid in patients treated for hyperthyroidism. Journal of Clinical Endocrinology andMetabolism. 38:976-998, 1974.4. Chamberlayne, R., Green, B., Barer, M., Hertzman, c., Lawrence W., and S. Sheps.Creating a population-based linked health database: a new resource for health services andpolicy research. 1996. (Subrhitted)5. Health and health care. Experience with a population-based health information system.Edited by NP. Roos and E. Shapiro. Medical Care, Vol. 33 (12) Supplement, 1995.6. Olshan, AF., Teschke, K., and PA. Baird. Birth defects among offspring of firemen.American Journal of Epidemiology, 131(2):312-321, February 1990.7. Baird, PA., and AD. Sadovnick. Life expectancy in Down syndrome adults. The Lancet,pp.1354-1356, December 1988.8. Letter from Dr. Martin B. Wilk, Former Chief Statistician of Canada, to Ms. A. Cavoukian,Assistant Information and Privacy Commissioner, Province of Ontario. April 1992.179. How can personal privacy be protected? Position paper approved by Canadian InformationHighway Advisory Council, Ottawa. Issue #10, March 25, 1995.10. B.C. Ministry of Health. Access policy for research uses of linked health data. December1995. (Final approval pending)11. Letter from Dr. RG Evans and Dr. PA Baird to DK Martin, Secretary, Tri-CouncilWorking Group on the Ethics of Research Involving Humans. January 1995.12. Earley, CL., and LC. Strong. Certificates of confidentiality: a valuable tool for protecting,genetic data. American Journal of Human Genetics, 57:727-731, 1995.13. Knoppers, 8M., and C. Laberge. DNA sampling and informed consent. Canadian MedicalAssociation Journal, 140:1023-1028, 1989.14. Baird, PA. Identifying people's genes : ethical aspects of DNA sampling in populations.Perspectives in Biology and Medicine, 38(2) Winter 1995."@en . "Report"@en . "10.14288/1.0048453"@en . "eng"@en . "Unreviewed"@en . "Vancouver : University of British Columbia Library"@en . "Centre for Health Services and Policy Research (CHSPR)"@en . "Attribution-NonCommercial-NoDerivs 2.5 Canada"@en . "http://creativecommons.org/licenses/by-nc-nd/2.5/ca/"@en . "Faculty"@en . "Some data issues in genetics research : registries, record linkage, and privacy protection"@en . "Text"@en . "http://hdl.handle.net/2429/50329"@en .