A good starting point is to map the recruitment pathway from beginning to end:
- who will search for potential participants?
- what information will they see?
- where will it be held?
- who will be able to identify the people found by the search?
- who will contact them?
These questions matter because data protection law is only part of the picture.
Where confidential information is being accessed or shared to identify or contact potential participants, there needs to be an appropriate confidentiality legal basis, as well as a data protection one.
One important clarification in the report is that research can sometimes form part of an individual's care.
This can be the case where research is testing a treatment, diagnostic procedure or preventative measure relevant to that patient and offering the choice to take part in a research study is intended to be in their interests as a possible care option.
Where somebody is directly involved in providing, supporting or advising on that care through research, they can have a legitimate relationship with the patient.
Implied consent may then provide a basis under the common law for accessing the information needed to identify and contact that person about the research care option, but only where the conditions and safeguards set out in section 4.1 of the report are met.
This means the access must be:
- necessary for the person’s current or future care through research
- limited to the information needed
- transparent
- consistent with the patient’s reasonable expectations
- supported by appropriate governance and safeguards
But the boundaries matter. The fact that the research offers a potential care option does not automatically mean that everyone involved in identifying or contacting potential participants has a legitimate relationship with the patient.
For example, sponsor or Contract Research Organisation (CRO) staff, research delivery teams, digital intermediary staff or others supporting recruitment would only be able to rely on this route if they are directly involved in providing, supporting or advising on the person’s care through research.
Nor does giving somebody an honorary research contract or letter of access, by itself, establish a legitimate relationship with the patient.
If they are not genuinely involved in providing, supporting or advising on the person's care, another confidentiality route will be needed.