Three independent central requirements to the advance assessment of research projects are relevant in this case.
1. Duty of secrecy
The first requirement is related to access to personal data subject to secrecy (patient data/health information). The treatment of such information is as the main rule dependent on the consent of the patient to which the information applies. There are several exceptions. One exception, which is particularly relevant, is dispensation from the duty of secrecy in connection with research. These rules have been unchanged at least for the last ten years. Subsections 1 and 2 of the Medical Practitioners Act of June 13, 1980 no 42 section 36 on “Anonymity – research” read at that time:
“Medical practitioners may without regard to the pledge of secrecy communicate information that would otherwise be subject to secrecy concerning physical conditions or illness if individual characteristics have been deleted or changed so that the anonymity of the person concerned is protected. The Ministry may decide that information may or must be communicated for the purposes of medical research, and that this may be done without regard for the pledge of secrecy.”
See otherwise the Medical Practitioners Act section 31 (the main rule on secrecy) and the corresponding provisions in the then applicable Dentists Act of June 13, 1980 no 43 sections 31 and 36, as well as the Public Administration Act sections 13 and 13d. The Public Administration Act is unamended, whereas the provisions of the Medical Practitioners Act and the Dentists Act have been repealed but reenacted in sections 21 and 29 of the Health Personnel Act. Any dispensation from the duty of secrecy must be applied for in advance. Consent was previously given by the Norwegian Board of Health, but after January 1, 2002, this authority has been delegated from the Ministry of Health and Care Services to the Directorate for Health and Social Affairs.
It is a fact that Sudbø’s and Reith’s oral cavity project implied the collection and processing of sensitive patient information subject to secrecy. The Commission has not found any indications that any participant’s consent or dispensation from the duty of secrecy exists or that other relevant exemptions have been complied with. This means that this data processing is contrary to the then prevailing set of rules.
In this context it should be noted that research institutions and the like of course are not free to release patient information to researchers. This follows from the fact that patient information is subject to secrecy. Thus this is not only of importance to those who obtained unauthorized access to information subject to secrecy, but also for those who released patient information.
2. Personal data protection
Another requirement is related to the processing of personal data and creation of personal data registries in general. The main rule here is that such data processing requires a notification to or licence by the Data Inspectorate. A notification of application for a licence can also be sent via the personal data representative, if the research institution has one, in practice that will often mean the Norwegian Social Science Data Services (NSD).
It is a fact that Sudbø and Reith by collecting patient information from various institutions created a personal data registry with information that was partly highly sensitive. This data processing probably required a licence, a fact the Commission has received confirmation of from the Data Inspectorate and the NSD. There are no grounds to believe that Sudbø or Reith has applied to the Data Inspectorate or the NSD for such a licence.
3. Ethical assessment
A third requirement which is primarily a research-ethical requirement, but which increasingly is becoming a legal requirement, is the principle that medical or health research projects are to be assessed in advance by a regional research ethical committee (REC). This has been the system in Norway since the establishment of
the committees in 1985, but nevertheless such that the duty to submit for advance assessment gradually has been tightened up.29
It is a fact that Sudbø’s PhD project was never submitted to REC-South (which would have been the correct body), not by Reith either. At its inception in the 1980’s it seems that mainly it was only invasive studies, i.e. studies in which one exposes patients or other research participants to some form of intervention/influence, which was comprised by a research-ethical obligation to submit. The Commission therefore found reason to put the question of whether Sudbø’s PhD project ought to have been submitted for research ethical approval.
In that connection, the Commission made an inquiry to REC-South to have clarified which rules existed in 1994 when the project was started. REC-South then stated on a general basis, without having been sent either the project description or other documents, that:
“if the fact is that in this study, “register data was collected and linked with patient data” and that “biological samples were analyzed and telephone calls were made to patients for supplemental information on the use of tobacco where data were lacking”, then there is no doubt that the study should have been submitted to REC (Regional Committee for Medical Research Ethics). For a study with registry data it would suffice to have the approval of the Data Inspectorate, but where patient data, patient journals, biological data from patients, contact with patients per telephone to obtain information, etc., were concerned, it is obvious that it should have been submitted to REC.”
This fact must be seen in the light of the fact that far from all medical research projects of this type were submitted to the Regional Committee for Medical Research Ethics at that time, when probably also a justified doubt about the extent of the obligation to submit prevailed.
Failing compliance with the type of formalities we discuss here was hardly particularly unusual at that time. This is probably related to the fact that the set of rules was not well known. Improvements have probably taken place here by an increasing awareness of the set of rules among researcher, research institutions and regulatory bodies. It is likely that there is a certain connection here with discussions relating to formalities and the applicable set of rules in the wake of the BioBank Act which came into force on July 1, 2003, the Nylenna committee’s report from December 2004 (NOU 2005:1), the proposed enactment of the ethical committees and a national dishonesty committee, and the consultations that have been held in connection with these proposals for legislation. However, the Data Inspectorate in 2004 discovered that only one out of 30 medical and health research projects had routines that ensured that the legislation on personal
data was complied with, and 11 out of 28 projects did not comply with the licence requirements. The obligation to delete was seldom observed, and in close to half of the projects the requirements as to consent were not fully met.30
The duty to submit
It may be asked who was responsible for the formalities applicable to Jon Sudbø’s PhD project being in order.
In his statement to the Commission, Jon Sudbø asserted that he considered it to be his supervisor’s duty and responsibility to ensure that the formalities were in order. There may be something to be said for this point of view, since it is relatively usual that the main supervisor assumes the responsibility for and/or calls attention to the need of advance approval. On the other hand, it will often be natural to involve a research fellow in such a process, particularly where an independent project in which the fellow acts as the de facto project manager, is concerned. Then it will normally be the fellow who has the best knowledge of the project, through the closer proximity to it, even if it is the main supervisor who signs the application as such and other documents related to the project.
Sudbø however points out that most of the time up to 1999 was spent on method development, and this was work that allegedly did not require any form of approval by public bodies, and that it was a project that he alleges was ordered by Reith, and which was not comprised by the original application to the Cancer Society. On this basis, Sudbø denies that he was to be considered the project manager. It is true that Sudbø admits that in parallel with this, clinical material was collected, but this took place under the auspices of his supervisor, and then it must be natural to require that the supervisor assumes the responsibility to ensure that the research project complies with the set of rules – particularly in a situation in which Sudbø by his supervisor was ordered to work with an entirely other project which he experienced as demanding.
The compliance with the set of rules to which a research activity is subject, and the principles related to good research practice, is nevertheless also to be an important part of the researcher education. In this respect, Jon Sudbø ought to have been aware of whether these factors had been complied with or not. In line with the views accounted for in section 3.7, the Commission finds that a fellow as the main rule must have a certain independent responsibility to make sure that important factors like approvals, licences and other formalities (e.g. participant’s consent) are in order. This is particularly so where the fellow has such an independent position as in this case, where he probably is the only one who had the full daily control of the project. This responsibility is a personal and independent responsibility applicable regardless of the supervisor’s and institution’s independent responsibility.
Here is to be noted, although the Commission has not found reason to pursue the matter, that Jon Sudbø, having completed the PhD project, as far as the Commission can see, did not take care of notification to relevant bodies such as the Regional Committee for Medical Research Ethics, the Norwegian Social Science Data Services, and the Directorate for Health and Social Affairs in connection with other research projects, including projects in which he was a supervisor. One exception exists: the so-called PROTOCOL study, see sections 4.3 and 5.3. On the other hand, Sudbø in the protocol for the stated study and other articles demonstrates a good knowledge of the formal requirements relating to this type of research in Norway, as regards participant’s consent and advance assessment of research projects, among other things.
One problem, which is hardly unique in this case, seems to be a more or less unintentional and unfortunate mix of the role as a clinician (treating health staff) and researcher, in which the clinician’s access to patients and patient data for research purposes is unlawfully exploited, without the formalities being in order. It is of course a positive thing that clinicians carry on research, but the combination of different roles requires openness and awareness as regards the set of rules for the respective roles in order to avoid an unfortunate mix of roles.
The main supervisor, Albrecht Reith, states that he was not aware of these rules and requirements about an ethical advance assessment and licence by the Data Inspectorate, etc. For that reason he did not see it as his task to provide for an advance assessment either. In the Commission’s view, the main supervisor normally has an independent responsibility to ensure that formalities of this nature are in order before the fellow starts the research itself, either by taking care of it himself or by instructing the fellow to bring it in order. Sudbø has stated that he has difficulties in following the Commission’s considerations relating to the mix of roles as a clinician and researcher.
Furthermore, it must be a responsibility for the research institutions to ensure that research projects are assessed in advance and otherwise satisfy other formal requirements. However, the Commission has got the impression that the institutions , neither the Radiumhospitalet nor the University of Oslo, have seen it as their task to check that research projects are in fact initiated and implemented in accordance with statutes, regulations or work instructions. The Commission has got the impression that the education as well as the practicing of this has not been as good as it should be at the Radiumhospitalet.
On the other hand, the Radiumhospitalet in the last 10-20 years has issued increasingly better instructions and the like as regards research on patients and patient material, i.a. with special intranet sites and a support office for clinical research (www.klinforsk.no). Nevertheless, it appears to the Commission that there has been a lack of efficient routines and internal control at the institution which could have contributed to ensuring that statutes and work instructions in fact were known among the employees and were complied with. In other words, the problem was the implementation and practicing itself of external
regulations and internal instructions. Sudbø’s PhD project was never submitted to the Radiumhospitalet’s Protocol Committee, for example. The guidelines from 1998 state that the Protocol Committee “shall evaluate all types of clinical research projects wanted to be performed at the Radiumhospitalet and which in one way or another involve patients or patient material. The Protocol Committee may also on its own initiative bring up cases which have not been submitted to the Committee if it may seem as if it should have been submitted.” No one seems to have seen it as their responsibility to take care of any submission to the Protocol Committee.
Reference is further made to the fact that the research fellow was not required to submit documentation that the formalities were in order when he presented his thesis in 2001. It ought to be a simple and not very burdensome matter to require the submission of a protocol from the Regional Committee for Medical Research Ethics, licence from the Data Inspectorate, dispensation from the duty of secrecy, etc., together with a statement that research-ethical rules and guidelines have been complied with. The Commission has not found any reference to such rules in the PhD regulations or research fellow contract.
Although an advance assessment had not necessarily prevented other breaches of good research practice, such a review would nevertheless, in the Commission’s view, have been quality assuring and awareness raising. The lack of advance assessment increases the risk of breach of the patients’ integrity and is a threat to the population’s trust in research. Furthermore, it is difficult for institutions to safeguard completely against dishonest researchers sidestepping the system and omitting to comply with formal rules and instructions. The system must necessarily be based on a certain degree of trust.
In spite of the Commission’s limited basic material, it is nevertheless evident to the Commission that such obvious effects are linked to the institutional culture and system at the time as regards the institution’s and employed researchers’ attitude to the formalities, as for example the protection of personal data, that one must be able to characterize this as a system failure. The Commission has been informed of which measures are now prevailing, and has got the impression that this is a “problem area” which the management at the Rikshospitalet-Radiumhospitalet MC takes seriously. It seems as if this is an ongoing area of concentration with reinforcement and implementation of several good measures.