Secondary Data and Retrospective Research

Research using previously collected clinical records, registries, databases, administrative data, research datasets, or other existing information must meet appropriate ethical, legal, privacy, and scientific standards.

The fact that data were collected before the current study, were generated during routine healthcare, or already exist in an institutional database does not automatically exempt their research use from ethical review or other applicable requirements.

Retrospective and secondary-data research must comply with the World Medical Association Declaration of Helsinki (2024), applicable ethical and legal requirements, institutional policies, and the determinations of the responsible Research Ethics Committee or Institutional Review Board.

The 2024 Declaration of Helsinki specifically addresses secondary research involving stored identifiable or re-identifiable data and requires research ethics committee consideration and approval where consent for such secondary use is impossible or impracticable to obtain.

Scope

This policy applies, where relevant, to research using:

  • retrospective medical-record or chart reviews;
  • electronic health records;
  • hospital and clinical databases;
  • disease, treatment, birth, or other health registries;
  • administrative or insurance-related health data;
  • previously collected research datasets;
  • routinely collected laboratory or diagnostic information;
  • imaging archives;
  • surveillance or public-health datasets;
  • linked datasets from multiple sources;
  • previously collected identifiable or re-identifiable data;
  • archived information associated with human biological materials.

The ethical requirements depend on the nature of the data, their identifiability, how they were originally collected, the proposed new use, applicable law, and the requirements of the responsible ethics body.

Ethical Review

Authors must determine whether the proposed secondary or retrospective research requires:

  • full ethics committee approval;
  • expedited or proportionate review;
  • formal exemption from review;
  • waiver or modification of informed consent;
  • another determination by a competent ethics body.

Where an official determination is required, authors must not decide for themselves that ethics approval is unnecessary merely because the study is retrospective, observational, uses existing records, or involves no direct contact with participants.

ICMJE requires authors conducting human research to seek approval from an independent local, regional, or national review body and to provide supporting documentation when requested by editors.

Retrospective Research

A retrospective design does not in itself determine the ethical status of a study.

Research based on previously recorded patient information may still involve important risks relating to privacy, confidentiality, unauthorized data use, stigmatization, re-identification, or disclosure of sensitive information.

Authors should therefore ensure that:

  • the research purpose is scientifically justified;
  • access to records is appropriately authorized;
  • required ethics review has taken place;
  • only data necessary for the approved purpose are used;
  • privacy and confidentiality protections are adequate;
  • any required consent or approved waiver is properly documented.

Secondary Use of Existing Data

Data originally collected for clinical care, another research project, public-health activities, administrative purposes, or another legitimate purpose should not automatically be treated as unrestricted research data.

Before secondary use, researchers should establish:

  • the original purpose for which the data were collected;
  • whether the proposed use is compatible with the original consent or authorization;
  • whether the data are identifiable, coded, pseudonymized, or anonymized;
  • whether additional ethics review or consent is required;
  • whether contractual, institutional, repository, or data-use restrictions apply;
  • whether the proposed analysis creates new privacy or re-identification risks.

The 2024 Declaration of Helsinki requires free and informed consent for the foreseeable secondary use of identifiable or re-identifiable data. Where consent is impossible or impracticable to obtain, secondary research on stored data may proceed only after consideration and approval by a research ethics committee.

Consent and Waiver

Where the original consent adequately covers the proposed secondary use, researchers must remain within the scope of that consent.

Where new informed consent is required, it should be obtained before the proposed use begins.

A waiver or modification of consent may be used only when:

  • it is ethically and legally permissible;
  • the applicable criteria are satisfied;
  • it has been approved or confirmed by the competent ethics body where required.

Difficulty contacting former patients, the size of a database, inconvenience, cost, or the retrospective nature of the study does not by itself constitute a waiver of consent.

Authors must not report that consent was “not required” unless there is an appropriate ethical or legal basis for that statement.

Exemption from Ethics Review

If a competent ethics body formally determines that a study is exempt from ethics review, the manuscript should state this transparently.

Where applicable, authors should identify:

  • the name of the ethics committee or competent body;
  • the exemption determination;
  • the reference number, if issued;
  • the relevant basis for the determination where clarification is needed.

An exemption from ethics review and a waiver of informed consent are separate determinations and should not be presented as interchangeable.

Access to Medical Records

Access to patient records must have an appropriate ethical, institutional, and legal basis.

Being employed by the institution, being part of a clinical team, or having technical access to an electronic medical-record system does not automatically authorize the use of patient information for research.

Researchers should access only the information necessary for the approved scientific purpose.

Access rights should be appropriately controlled, and identifiable information should not be copied, transferred, or retained beyond what is legitimately necessary.

Privacy and De-Identification

Whenever possible and scientifically appropriate, secondary research should use data with the lowest level of identifiability necessary to achieve the research objective.

Researchers should use appropriate measures such as:

  • removal of unnecessary direct identifiers;
  • coding or pseudonymization;
  • secure separation of linkage keys;
  • restricted access;
  • aggregation where appropriate;
  • secure data transfer and storage.

Data should not be described as anonymous if individuals can reasonably be re-identified.

Linking different datasets may create new identification risks even when each dataset alone appears de-identified. These risks must be considered before linkage.

Detailed requirements are provided in Privacy and Confidentiality.

Publicly Available Data

The availability of a dataset on the Internet or through a public repository does not automatically resolve every ethical question concerning its research use.

Researchers should consider:

  • whether the data are genuinely intended for public research use;
  • applicable access conditions or terms of use;
  • whether individuals remain identifiable or re-identifiable;
  • the sensitivity of the information;
  • whether combining the dataset with other sources creates additional privacy risks;
  • whether ethics review is required under applicable institutional or regulatory rules.

Public availability should not be used as justification for unnecessary re-identification of individuals or disclosure of sensitive personal information.

Data Linkage

Research that links medical records, registries, genetic information, demographic data, administrative datasets, or other sources may create privacy risks greater than those associated with each source separately.

The protocol should address, where applicable:

  • the justification for linkage;
  • identifiers used for linkage;
  • who performs the linkage;
  • whether identifiers are subsequently removed;
  • access to the linked dataset;
  • re-identification risks;
  • consent and ethics approval for linkage;
  • secure destruction or retention of linkage keys.

Pediatric Records and Data

Secondary research involving data from newborns, infants, children, and adolescents requires particular attention to privacy and long-term consequences of disclosure.

Pediatric information may include sensitive data concerning:

  • developmental status;
  • congenital or hereditary conditions;
  • mental or behavioral health;
  • family circumstances;
  • genetic information;
  • reproductive or perinatal history;
  • safeguarding or social-care information.

Researchers should minimize unnecessary use of identifiable pediatric information and consider the child’s future privacy interests.

Parental permission obtained for the original collection of information should not automatically be assumed to authorize every future research use.

Where appropriate, the participant’s developing or later independent autonomy should also be considered.

Data Collected for Clinical Audit, Service Evaluation, or Quality Improvement

Clinical audit, service evaluation, and quality-improvement activities may be governed differently from research under local or institutional frameworks.

However, authors must not label an activity as “audit,” “quality improvement,” or “service evaluation” solely to avoid research-ethics requirements.

If data from such activities are subsequently analyzed or used for a research purpose, investigators should determine whether additional ethics review, consent, or institutional authorization is required.

The manuscript should accurately describe the nature of the activity and the ethical determination that applied.

Data Accuracy and Provenance

Authors are responsible for understanding and accurately reporting the origin, provenance, quality, and limitations of secondary data.

Where relevant, manuscripts should describe:

  • who originally collected the data;
  • the period of data collection;
  • the source population;
  • inclusion and exclusion criteria;
  • the original purpose of collection;
  • important changes in coding or data definitions;
  • missing data or known quality limitations;
  • data cleaning and linkage procedures;
  • any restrictions affecting interpretation.

Secondary data must not be presented as though they were prospectively collected specifically for the current study when this was not the case.

Reporting in the Manuscript

Authors should report, as applicable:

  • the source and nature of the secondary data;
  • whether the study was retrospective;
  • the responsible ethics committee or review body;
  • ethics approval, exemption, or other determination;
  • the consent arrangements;
  • any approved waiver or modification of consent;
  • relevant de-identification or confidentiality safeguards;
  • the period from which the records or data were obtained;
  • material restrictions on access or secondary use.

Statements such as “ethical approval was not required” or “informed consent was waived” should identify the appropriate basis or responsible body where relevant.

Journal Verification

The journal may request supporting information when the ethical basis for secondary or retrospective research is unclear, including:

  • ethics committee approval or exemption letters;
  • waiver determinations;
  • original or relevant consent provisions;
  • authorization for access to clinical records;
  • data-use or repository conditions;
  • documentation relating to data linkage or de-identification.

The journal should avoid requesting identifiable patient datasets when ethical verification can be achieved through less intrusive documentation.

Approval or exemption by an ethics body does not prevent the editors from independently assessing the ethical acceptability of the research. ICMJE expressly preserves this editorial responsibility.

Unauthorized access to patient records, deliberate misuse of secondary data, false claims of exemption or waiver, concealment of identifiable data use, or material misrepresentation of data provenance may result in rejection or action under the journal’s Research Misconduct, Editorial Actions, and Corrections and Retractions policies.

ISSN 2181-3353 (Print)
ISSN 2181-3353 (Online)