Data protection-compliant broad consent for secondary use of health care data and human biosamples for (bio)medical research: Towards a new German national standard

Abstract

Background: The secondary use of deidentified but not anonymized patient data is a promising approach for enabling precision medicine and learning health care systems. In most national jurisdictions (e.g., in Europe), this type of secondary use requires patient consent. While various ethical, legal, and technical analyses have stressed the opportunities and challenges for different types of consent over the past decade, no country has yet established a national consent standard accepted by the relevant authorities.

Methods: A working group of the national Medical Informatics Initiative in Germany conducted a requirements analysis and developed a GDPR-compliant broad consent standard. The development included consensus procedures within the Medical Informatics Initiative, a documented consultation process with all relevant stakeholder groups and authorities, and the ultimate submission for approval via the national data protection authorities.

Results: This paper presents the broad consent text together with a guidance document on mandatory safeguards for broad consent implementation. The mandatory safeguards comprise i) independent review of individual research projects, ii) organizational measures to protect patients from involuntary disclosure of protected information, and iii) comprehensive information for patients and public transparency. This paper further describes the key issues discussed with the relevant authorities, especially the position on additional or alternative consent approaches such as dynamic consent.

Discussion: Both the resulting broad consent text and the national consensus process are relevant for similar activities internationally. A key challenge of aligning consent documents with the various stakeholders was explaining and justifying the decision to use broad consent and the decision against using alternative models such as dynamic consent. Public transparency for all secondary use projects and their results emerged as a key factor in this justification. While currently largely limited to academic medicine in Germany, the first steps for extending this broad consent approach to wider areas of application, including smaller institutions and medical practices, are currently under consideration.

Keywords: Broad consent; General data protection regulation; Research ethics; Secondary use of healthcare data.