We report on an explorative qualitative study investigating the perspectives of research professionals from the Arab regarding privacy issues in research. Our major findings include: 1) respondents discussed a broad range of privacy issues that occur during the three major stages of the research process: before, during, and after the completion of research; 2) research professionals revealed their perceptions of patients’ concerns regarding assurances of privacy in the research setting compared with clinical care; and 3) respondents promoted the need for clarification of existing data protection standards as well as the need for training in practices involving the use of data in secondary research. The themes/sub-themes associated with these findings are shown in Table 2.
The respondents in this study expressed the idea that privacy meant control of access to information about oneself and their physical space. Several respondents discussed the intrinsic value of privacy as a prerequisite for individuals’ autonomy by controlling the image that they portray to the public; a concept that is similar to that of other commentators [22, 2]. Other respondents mentioned the instrumental value of privacy as enabling people to keep “disruptive material out of the public arena” and hence, shields them from the judgement/bias of others [23, 2].
The research professionals discussed a broad range of different types of privacy situations in the research setting (informational, physical, and proprietary). Our interest was not with assembling materials for an analysis of privacy, because, as noted in the Introduction section, the concept of privacy is complex and contested by lawyers, policymakers, philosophers, and other scholars. As such, we did not require our respondents to articulate a sophisticated analysis of privacy. Rather our interest was to determine what often gets described as threats to privacy and efforts to acknowledge and protect privacy in the research setting. The examples of privacy included informational, physical, and proprietary types of privacy.
In regard to privacy issues prior to the research, respondents brought up several circumstances that occur during recruitment efforts in which standards are lacking. Unresolved privacy issues include the methods by which potential research participants are identified and the means of initial contact. Respondents voiced a variety of opinions regarding when potential research participants are directly contacted by the research team after having accessed their medical records to determine which patients meet study criteria. Several respondents thought that researchers’ access to these records violated informational privacy. In contrast, other focus group respondents thought that such an approach does not violate privacy if an appropriate institutional affiliation existed between the prospective participants, their physicians, and the research team. These observations reveal a need to adopt common standards for data access for recruitment practices that achieve the appropriate balance between respecting privacy and enhancing participant accrual. The Health Insurance Portability & Accountability Act (HIPAA) regulations in the U.S. can serve as an example of meeting such a balance. This law permits a Privacy Officer, usually the Institution Review Board (IRB), to approve a partial waiver of consent and HIPAA privacy authorization for the purpose of identifying potential participants for research [24]. Whether Arab countries in the Middle East should adopt a similar approach requires obtaining the attitudes of the involved stakeholders.
Respondents also brought up the method of initial contact and the privacy concern that occurs when investigators approach patients in the hospital to discuss enrollment in research. Such unauthorized visits might be seen as a violation of physical privacy in the sense that patients’ physical space (sometimes referred to as a right to solitude) has been intruded. Interestingly, the methods by which initial contact is made with the potential participants are not specified in the U.S Federal guidelines and are hence guided by individual IRBs’ policies [25]. For example, several IRBs recommended that health care providers initially contact their patients to obtain their authorization to have investigators approach them for recruitment. The IRB at the University of Kentucky exemplifies this approach [26].
However, studies reveal that a variety of approaches are used in the research setting. For example, in a survey of U.S. cancer registries regarding their policies for contacting patients to participate in research, of those registries who allowed contact with their patients, 87.9% required or strongly recommended involvement of the treating physician, and a majority of the registries (82.8%) thought that such involvement only needed notification of the physician notification rather than physician permission. After the involvement of the treating physician, patients were approached more often by the investigator (60.6%) rather than by the registry staff (36.4%). Hence, the strategy used most frequently represented the least restrictive approach, which required investigators to notify patients’ physicians followed by direct investigator contact of patients [27]. In a survey of patients’ perspectives on research recruitment through cancer registries, 68% of patients said they preferred that researchers contact them directly about their interest in research participation rather than checking with their physician first and among patients who desired physician involvement, most preferred physician notification rather than a physician permission approach [28]. Further research is needed in the Middle East to examine the preferences of patients, physicians, and investigators in order to determine acceptable approaches that both protect patients’ privacy and avoid overly restrictive policies that unnecessarily impede patient accrual [27].
Finally, the setting of the informed consent process was raised as a potential physical privacy concern. For example, recruitment notices are placed in a public space asking those interested to meet in an open room or hall at a specified time. As such a meeting place typically mentions the nature of the illness being studied, the stigma that stems from such recruitment efforts can be substantial. While such a recruitment technique might be convenient for the research team, the focus groups noted that it offers no assurance of privacy. They made the point that privacy protection in research extends not just to actual participants but also to potential participants.
The respondents mentioned several privacy situations that occur during the research. One involved violations of informational privacy in which third parties would have access to research participants’ data. These would include non-research personnel required to help with translation between researchers and participants during focus group discussions and also data entry research personnel who would have access to personal information. Respondents discussed that Informed consent forms should mention the range of individuals who would have access to private information. Such transparency in the consent forms would give potential research participants the necessary information to decide whether to additionally waive their privacy rights.
Focus groups respondents also mentioned a concern with physical privacy that might occur when female research participants undergo physical exams during the research, as they might have preferences to be examined by a physician of the same gender. A similar issue occurs when female participants are approached by data collectors, who need to be of the same gender. This privacy issue, as noted by the respondents, tend to occur more often in the rural settings and is representative of cultural influences on the scope of privacy. These examples demonstrate the high value on modesty that exist in certain Arabic regions and while it is usually emphasized for women, it is important for both sexes [29]. Indeed, “whether or not a privacy invasion will have occurred in a case of “touching” will depend on the privacy norms found within the culture in question” [1, 30]. As such, we can appreciate how culture, which determines particular social norms based on beliefs, customs, traditions, manner of life and people’s relations with each other in a society, contributes to the importance and expectations of privacy. Indeed, notions about modesty vary between cultures, which may lead to differences in the scope of protections for physical privacy [29, 31].
In regard to privacy issues after research is completed, respondents mentioned an informational privacy issue regarding sharing of research participants’ data with investigators from other institutions for use in secondary research. Data sharing for further scientific research is an increasingly important topic for the pharmaceutical industry and other organizations that sponsor and conduct clinical trials [11]. Focus group respondents discussed their perspectives regarding the heightened sensitivity that many research participants might have with sharing their genetic information with third parties compared with sharing of common health information. Sharing of genetic information represents a type of proprietary privacy, insofar that genetic information relates to what constitutes a person. Several studies have shown a restrained willingness of patients to share their data with researchers from other institutions. Abou-Zeid and colleagues in their study investigating the views of Egyptian patients toward the use of blood samples for future research, 53.3% of participants were willing to share their samples to other investigators without re-contact. Corresponding results were higher for sharing of samples to other Arab countries (62.0%) compared with sharing of samples with European countries (41.8%) and with the US (37.2%) [32] . In another study involving Egyptian patients’ perspectives and attitudes towards biobanking issues, the investigators found that only 32.4% agreed to share their biospecimens with institutions abroad and only 27.8% supported such sharing with pharmaceutical companies [33]. In an Italian survey involving family members of patients attending an outpatient clinic, 86% of the participants thought it was permissible to share their biospecimens and related data with non-profit organizations, but only 30% agreed with such sharing with for-profit organizations [34]. Further studies are needed to determine the factors associated with patients’ willingness for data sharing.
The respondents debated the conditions under which data can be accessed for secondary unspecified research. They discussed re-consenting research participants for such research as well as the alternative use of broad consent that would obviate the need for re-consenting. Standards are needed in Egypt and Morocco as well as in other Arab countries specifying the conditions under which broad consent would be allowable. The use of broad consent would require strong data protection laws that regulate the collection, handling, disclosure and use of personal data as well as the privacy rights of individuals. Nearly every country in Europe and many in Latin America and the Caribbean, Asia, and Africa, have now adopted comprehensive data protection laws [35].. In 2018, the European Union’s General Data Protection Regulation went into effect [36]. Recently, there has been a trend across the Middle East to modernize data protection standards to be in alignment with international standards [37]. Egypt and Morocco recently passed data protection security laws. The Egyptian law prohibits the collection, transfer, storage, preservation, or processing of sensitive personal data unless there is written consent of the concerned person [38]. In Morocco, personal data protection is governed by Law n° 09–08 of 18 February 2009, relating to the protection of individuals with respect to the processing of personal data and has made recent efforts to align this law to that of the EU General Data Protection Regulation [39]. But, as indicated by one of our respondents from Egypt, additional efforts are needed with implementation of Egypt’s data protection law as well as further training for health care providers regarding the contents of the laws’ regulations.
The above examples demonstrate that our respondents were cognizant of a broad range of privacy concerns, although informational privacy usually dominates the discourse of privacy in research. Indeed, “there has been relatively little attention paid by philosophers to physical privacy concerns in medicine compared to informational concerns” [6]. This is unfortunate, as patients bring with them strong expectations of modesty, solitude, and bodily integrity to doctors’ offices, hospitals, and other health care settings, as well as to the research settings, as discussed by our respondents. “These expectations that they will not be needlessly touched, crowded, gawked at or imaged relate to the need for psychological comfort, dignity and security” [6].
Domination of informational privacy at the expense of other types of privacy is demonstrated in research ethics guidelines, as we previously mentioned in the Introduction. The focus on confidentiality of data after patients grant a waiver of privacy rights ignores situations that involve other types of privacy. But when patients provide informed consent to participate in research and waive some of their privacy rights they are granting researchers’ permission to access intimate aspects of their persons as well as their sensitive health information [40].
The prominence that informational privacy holds in research ethics discourse might explain why the terms “privacy” and “confidentiality” are frequently used Interchangeably. But privacy and confidentiality represent separate concepts. Such a conflation “sacrifices the important distinction that something can be private, known or felt, exclusively by an individual…but then deliberately extended into a confidential realm if it is revealed [by the patient], with restraints on use and further disclosure, to another party” [41]. Indeed, “confidentiality serves privacy” [41]. As such, informational privacy represents a right that can be violated, whereas confidentiality represents an obligation towards data security, thus ensuring informational privacy. While the relationship between confidentiality and privacy is appropriately restricted to information privacy, other types of privacy need to be considered in the research setting.
It is informative to realize that the Quran, which governs the practices of everyday life (including medical and research practices) for Muslims, provides a robust discussion of privacy [42, 43]. Islamic religious law, which is based on the “essential greatness of human beings”, recognize several human rights, one of which is the right of privacy [44]. Safeguarding and keeping of people’s “essential greatness” is dependent on the recognition and keeping of one’s privacy and when individuals keep each other’s privacy, they respect human beings’ dignity, in other words, their “essential greatness”. Islam recognizes the scope of privacy to include bodily privacy, communication and information privacy, and territorial privacy.
Several research professionals commented that patients might have a greater concern about the existence of privacy protections in research compared to the clinical setting; one respondent mentioned that patients might need “more guarantees” that privacy will be protected during research. Several studies have shown the extent of patients’ privacy concerns in the research setting. For example, in a study involving Jordanian patients, nearly 40% cited the fear of a negative impact of research on privacy as a discouraging factor towards participating in biobanking research [45]. In an Egyptian study investigating Egyptian attitudes toward biobanking, 35.9% thought that samples and data might be used in a way that would breach privacy [32]. Comparable results have been shown for patients in the U.S, as one study showed that more than 60% expressed worries about the privacy of their health information regarding participating in biobanking research [46].
The respondents remarked that patients might be more likely to waive their privacy rights for research compared with medical care if there is some compensatory benefit. In the case of clinical care, the benefit is clear — the offer of therapy and treatment. In the case of research, no equivalent offer can typically be made. Hence, potential research participants might resist access to their privacy due to a lack of direct benefit from the research. Several studies from the U.S.tend to substantiate the respondents’ claim that patients are more willing to grant permission to their privacy when there is a prospect of a benefit. For example, in one large U.S. study that investigated public opinions regarding participating in a genetic biobank, concerns about privacy were related to lower willingness to participate in a biobank. However, when respondents were told that they would receive a larger financial compensation ($200) and that they receive individual research results back, privacy concerns did not impede willingness to research participation [47]. In another study investigating the views of U.S. public towards biobanking research, willingness to participate in such research was higher if participants perceived more benefits [46]. Similar studies should be performed in the Middle East to confirm the existence of a relationship between a benefit and privacy.
Focus group respondents also expressed the concern that potential research participants’ general misunderstanding of the aims of research might also limit their participation in research. The primary aim of research is to generate knowledge to advance the health of society rather than a means to provide a direct health benefit to patients. Several of our respondents held the opinion that patients do not realize that research advances the public health of society. Accordingly, investigators need to explain to potential research participants (and also included in informed consent forms) that the benefits of research is to advance the health of society, which could serve as a justifiable reason for patients to waive their privacy rights coupled with assurances that their privacy will be protected.
Finally, the focus groups highlighted the importance of trust as another reason why potential research participants might be more hesitant to waive their informational privacy in the research setting compared with the clinical setting. Several authors cite trust as a central component of the research participant-researcher relationship [48, 49]. In a Jordanian study investigating the public views toward biobanking research, a belief in trust affected a willingness to participation positively [45]. In a large survey in the US, willingness to participate in a biobank was lower in individuals who reported lower levels of trust in the healthcare system and their researchers [46]. In low- and middle-income countries, failure to engage with communities has been recognized as a cause for erosion of trust in researchers [50].
The question of trusting the institutions supporting and monitoring the research and researchers did not arise in the focus groups. In other words, people seemed to view research participation as resting on the relationship between participants and the research team rather than resting on the more complex relationship of participants, research team, and the institutions overseeing the research study. Whether introducing more clearly the relevance of institutional support and monitoring affects people’s trust of the research team remains to be studied.
The above examples of why patients might refuse to waive their privacy rights to participate in research (e.g., lack of perceived direct benefit, misunderstanding of the aims of research, and lack of trust) need further exploratory studies with patients, as these factors affecting privacy concerns have specific implications on what changes need to be made to enhance recruitment strategies.
We realize several limitations to our study. First, this study accessed the views of respondents from only two countries in the Arab region, Egypt and Morocco, and hence might not be generalizable to other countries in the region, especially those countries with more conservative values. In a similar fashion, this study was also limited to the perspectives of investigators, clinical research associates, and members of RECs. Also, the perspectives of our respondents regarding the views of research participants regarding privacy concerns might not be equivalent to the actual perspectives of patients regarding privacy concerns in research. However, our study represents an exploratory study and hence, the respondents’ perpectives can now serve as a foundation for quantitative studies involving views of individuals involved in research and of the actual views of patients.