CRIS Blog: Appropriate use of healthcare records for research – the CRIS position

The Clinical Record Interactive Search (CRIS) system has been developed for use within the NIHR Maudsley Biomedical Research Centre.  It provides authorised researchers with regulated, secure access to anonymised information extracted from South London and Maudsley NHS Foundation Trust (SLAM) electronic clinical records system.

CRIS has been used by researchers for over 10 years now and has supported somewhere between 150 and 200 research papers, as well as helping to transform the way in which SLaM learns from its clinical practice (see examples below). The wider use of healthcare records, particularly in the commercial sector, rightly attracts attention on a regular basis – most recently in The Observer.

The issue here is anonymity and the likelihood of a person’s health records being tracked back to them from a large database, even when personal identifiers, for example,  name, date of birth and address have been removed. Removal of identifiers is unlikely to ever be sufficient to provide absolute anonymity because there will be unique combinations of other features in the record which might still be used, for example,  dates of particular events, combinations of illnesses or medications, if someone had a mind to identify someone from this information.

When we set up CRIS at the NIHR Maudsley BRC in 2008, we were aware of this challenge. We run all records through a pipeline that recognises identifiers (e.g. a patient’s name, address, date of birth etc.) and then both removes fields in the database containing this information and blanks it out in any text fields. However, we also have a wider security model governing the use of information, realising that de-identification would never be enough.

This security model includes:

• protocols governing who has access to CRIS data (in summary, applying the same requirements as would be expected for someone needing to access patient records for clinical purposes),
• requirements for data to remain on SLaM’s network and within its NHS firewall at all times (rather than allowing downloaded data to be held by commercial or non-commercial partners),
• ensuring that all projects are scrutinised by a dedicated Oversight Committee, which has been led by SLaM service users since its inception, and which reports directly to SLaM’s Caldicott Guardian.
• In addition, a SLaM-affiliated member of staff is required on all approved projects as a guarantor for the appropriate use of data.

We have published details of our data security, as well as the performance of our de-identification model which we continue to keep under review through regular audits.

CRIS has been used from time-to-time in commercial partnerships. These are naturally subject to the standard approval processes for any CRIS research. In addition, the data are generally accessed by King’s College London/Trust staff rather than directly by commercial agencies. We have tried to ensure that these result in open-access publications and list past and current collaborations on the CRIS site.

Examples of how CRIS research has been making a difference to mental healthcare in SLaM

• Having been used to demonstrate the health inequalities faced by SLaM service users and through continuing work to identify underlying reasons for these, CRIS is supporting major Trust initiatives to improve physical health monitoring in routine mental healthcare.
• An extensive programme of CRIS-supported research has highlighted the large numbers of medications being taken by people with dementia at the time of their diagnosis. This has led to the development of our Medichec site/app to support better prescribing.

Rob Stewart is Professor of Psychiatric Epidemiology and Clinical Informatics, and leads Clinical and Population Informatics in the NIHR Maudsley Biomedical Research Centre. He has been Academic Lead for the Maudsley’s Clinical Record Interactive Search (CRIS) platform since its development in 2007-8.