Research Ethics
Navigating
Consent & Privacy in Research
Overview
Whether you are a PA student working on your first capstone project, a practicing PA exploring a QI initiative, or an educator supporting research, this lesson covers consent and confidentiality in research.
The process of navigating research ethics can feel complex at times. There are layers of legal requirements, ethical considerations, and practical realities that take time to sort through. Be patient with yourself as you learn and apply these concepts to your work.
As PAs, we work closely with patients, manage sensitive information, and increasingly participate in research and QI projects. That access comes with responsibility.
However, the reality is that any project involving human participants or their data carries ethical obligations. Without appropriate safeguards, even well-intentioned work can compromise privacy, expose people to harm, or damage the trust our profession has built.
In this lesson we explore the practical aspects of informed consent, confidentiality, and data privacy. Understanding how to obtain meaningful consent and protect sensitive data is not just an REB requirement-it is part of being a thoughtful, competent clinician-researcher.
-
Explain what makes consent valid and informed in health research
Distinguish between identifiable, de-identified, and anonymized data
Apply privacy protection and confidentiality principles in your research
Determine when consent is required and when it may be waived
Recognize your legal and ethical responsibilities when handling personal health information
Lesson Outline:
Lesson Exercises
Additional Resources
Why this matters for PAs
As occupy a unique position in healthcare. We work directly with patients across all the continuum of care, facilitate care through a complex local, hospital or complex health system, and coordinate patient care between different healthcare providers within the interprofessional patient care team.
This frontline perspective gives us insight into workflow inefficiencies, systemic roadblocks, and gaps in care delivery that others may not see.
Unlike health policy roles or administrative positions that can be disconnected from the realities of delivering patient care, our hands-on patient work means PAs experience firsthand how these systems and workflows actually function or fail to function in the real-world.
Here is a scenario that happens more often than you might think:
You are collecting data for a research project and approach a patient you have been treating. They agree to participate. But consider this: do they actually feel they can decline? Even if you are careful and professional, the power dynamic in your clinical relationship can influence their decision. This is not about being deliberately coercive. It is about recognizing that our roles carry inherent influence that can affect voluntary consent.
Similarly, a retrospective chart review might seem straightforward and low-risk. But if you are not careful about how you handle the data, you could unintentionally breach confidentiality. A survey might appear harmless, but without proper consent, you could be violating ethical and legal standards. These situations are not always clear-cut, and that is exactly why understanding consent and confidentiality matters so much.
The bottom line is this: informed consent and privacy protection demonstrate how we, as regulated health care professionals, show respect for the people who trust us with their care and their information. Getting this right protects patients and strengthens the credibility of PA-led research.
By developing a foundational understanding of these concepts, you are not only protecting participants, but also strengthening the professionalism and integrity of our profession.
What Is Informed Consent?
In clinical practice, consent is usually task-focused. We obtain permission for an assessment, a procedure, a test, or a treatment.
In research, consent takes on a different character. Consent involves researcher and participant entering an ongoing dialogue and relationship of transparency, built on trust.
. In research, however, consent is about entering a relationship of transparency and ongoing dialogue. It's not a single transaction; it's a sustained ethical commitment.
4 Tenants of Valid Consent
According to the TCPS 2, valid consent must be:
Informed: The person has enough clear information to understand what the research involves
Voluntary: The decision is made freely, without pressure, coercion, or undue influence
Ongoing: Consent is not a one-time event. People can withdraw at any time without consequences
Documented: Unless waived by the REB, consent should be recorded in writing, verbally, or electronically
What Participants Need to Understand
Before someone agrees to participate in your research, they need to know:
The purpose of the study and what you are trying to learn
What participation involves (time commitment, tasks, procedures)
Any potential risks or discomforts they might experience
How their information will be protected
That they can withdraw at any time without it affecting their care or relationship with you
Whether there is any compensation, benefit, or cost involved
Consent Tip 💡
Always include a line in your consent form explaining what will happen to the participant's data if they withdraw midway. Ethically, participants have the right to know whether their data will be destroyed, retained, or used in anonymized form.
Consent & Vulnerable Populations
Some groups need extra care and protection when it comes to research. This is not about being patronizing. It is about recognizing that certain circumstances can affect a person's ability to freely consent or fully understand what they are agreeing to.
These groups include:
Children and adolescents
People with cognitive impairment or mental illness
Patients in hospitals or long-term care facilities
Communities with historical reasons to mistrust healthcare systems (and rightfully so)
When working with these populations, you may need to:
Obtain consent from a legal substitute decision-maker (as permitted by law)
Use plain language or culturally appropriate materials
Have someone neutral (not part of the clinical team) conduct the recruitment
Explain in your REB application why including this group is necessary and how you will protect them
These are requirements designed to ensure that vulnerable people are not taken advantage of in research. Additionally, these safeguards honour the principle of Respect for Persons (see previous lesson) by providing extra layers of protection for those who may not have full capacity to consent.
Confidentiality vs. Privacy
These terms are often used interchangeably, but they mean different things. Understanding the distinction will help you protect participant information more effectively:
Privacy is a person's right to control how their information is collected, used, and shared. It belongs to them.
Confidentiality is your responsibility to protect the information they give you. It is what you do with that information.
The two overlap, but they are not the same. You can breach confidentiality without meaning to: leaving files on a shared drive, storing data on your personal laptop, discussing cases in a public hallway or elevator. These might seem like small oversights, but they can have serious consequences. Protecting confidentiality requires planning, attention to detail, and a commitment to doing right by the people who trust you with their information.
As a PA, you are already bound by provincial privacy laws (like PHIPA in Ontario or PHIA in Manitoba). When you take on the role of researcher, you take on additional responsibilities. REBs will ask you to explain exactly how you will protect participant data, and more importantly, you need to be able to follow through on what you promise.
Questions to Answer Before Your REB Submission
Think through these questions carefully before you submit your application:
Where will the data be stored? (Be specific—do not just say "securely")
Who will have access to it?
How will you control and track access?
Will the data be encrypted? If not, why not?
When and how will you destroy the data when the project is complete?
The Distinction:
Confidentiality is process-bound (how you handle information); Privacy is person-bound (what rights the participant retains).
Identifiable, De-identified vs. Anonymized Data
This is an area where many well-meaning researchers make mistakes. Taking out names and health card numbers does not automatically make data safe to use without consent. De-identified data is not the same as anonymized data. REBs understand this distinction, and you need to as well.
If you can link a dataset back to a person by combining things like date of birth, visit dates, or rare diagnoses, you are still working with identifiable information. This matters because it determines whether you need consent and how carefully you need to handle the data.
Understanding the Differences
Identifiable Data
Includes direct identifiers like name, health card number, email, or address.
Consent required
De-identified Data
Identifiers removed, but someone could still figure out who the person is with enough effort (for example, by combining age, diagnosis, and location in a small community).
Consent required unless the REB grants a waiver
Anonymized Data
All identifiers removed and no realistic way to figure out who the person is, even indirectly.
Consent often not required
True anonymization is rare. Most datasets are de-identified, not anonymized. De-identified data can still be used ethically, but it requires careful handling and usually needs consent or a waiver from the REB. Do not assume your data is anonymous when it is actually just de-identified. That distinction matters.
REB Tip 💡
In your REB submission, describe not just what identifiers you’re removing, but how you will limit re-identification risk.
This is especially important if you are working with a small patient population, rare conditions, or specialized clinical settings where combining details might make someone identifiable.
When Consent Can Be Waived
(and When It Can’t)
Sometimes obtaining consent is not practical or feasible. For example, if you are reviewing thousands of charts from the past five years, it might be impossible to contact every patient. In these cases, the TCPS 2 allows REBs to waive the consent requirement. However, this is not automatic. You need to justify it, and the REB needs to approve it.
Your Project Must Show That:
The research poses minimal risk to participants
Waiving consent will not harm participants or violate their rights
The study cannot reasonably be done without the waiver
Participants will be informed afterward if appropriate (this is called post-disclosure)
Example
A PA is conducting a chart review of surgical outcomes from the past five years. The REB grants a consent waiver because contacting hundreds of former patients is not feasible, the data is de-identified, and the project poses no risk to participants.
Consent waivers are not automatic. You need to justify them clearly in your REB application. If you plan to publish or present your findings, make sure the waiver is documented and that you understand the conditions under which it was granted.
Actionable Data Protection Practices
Data security is not something you figure out later. It needs to be part of your planning from the very beginning. REBs will ask how you are protecting participant data, and you need to have clear, specific answers.
Here is what you should be doing in every project involving human data:
What You Should Be Doing
Use approved storage platforms like REDCap, OneDrive for Business, or secure hospital servers. These are designed to protect sensitive information.
Do not store data on USB drives, personal cloud accounts, or your laptop. These are not secure and can be lost or stolen.
Limit access to only the people who absolutely need it. Not everyone on your team needs access to raw data.
Encrypt files and use password protection. This adds an extra layer of security.
Have a clear plan for when and how you will destroy the data. Do not just say "securely." Specify the method and timeline.
Data protection does not end when your project is complete.
If you plan to share your data with other researchers or publish a protocol, you need to explain how long you will keep the data, who is responsible for it, and what will happen to it eventually.
Final Thoughts
Consent and confidentiality are not administrative hurdles. They reflect respect for the people who participate in research. As PAs, we work closely with patients and their data, which creates both opportunities and responsibilities.
Informed consent requires clarity, voluntariness, and ongoing communication. Privacy protection requires planning and attention to how data is collected, stored, and shared. These considerations need to be embedded in your project from the beginning.
When uncertain, consult your REB. Maintain boundaries between your clinical and research roles. Be transparent with participants about what you are doing and why. Ethical research means respecting people as individuals with rights and autonomy, not just as data sources or subjects.
Lesson Summary
Informed Consent builds trust and honours autonomy. It must be clear, voluntary, ongoing, and documented.
Privacy and Confidentiality are both ethical and legal responsibilities. Plan your data handling carefully to prevent breaches.
Data Types Matter: De-identified data is not the same as anonymized data. Understand the difference and handle data accordingly.
Consent Waivers are possible for minimal-risk projects where obtaining consent is not practical, but you need REB approval.
Data Protection requires planning from the start. Decide where data will be stored, who can access it, and when it will be destroyed.
References
Canadian Institutes of Health Research. (2005). CIHR best practices for protecting privacy in health research. https://cihr-irsc.gc.ca/e/29072.html
Canadian Medical Protective Association. (2016). Consent: A guide for Canadian physicians (4th ed.). https://www.cmpa-acpm.ca/en/advice-publications/handbooks/consent-a-guide-for-canadian-physicians
Canadian Medical Protective Association. (n.d.). Informed consent: Tips for physicians. https://www.cmpa-acpm.ca/en/education-events/good-practices/physician-patient/informed-consent
Canadian Medical Protective Association. (n.d.). Privacy and confidentiality: Fulfilling professional obligations. https://www.cmpa-acpm.ca/en/education-events/good-practices/professionalism-ethics-and-wellness/privacy-and-confidentiality
Government of Canada. (2022). Tri-Council policy statement: Ethical conduct for research involving humans (TCPS 2 – 2022). Secretariat on Responsible Conduct of Research. https://ethics.gc.ca/eng/policy-politique_tcps2-eptc2_2022.html
Government of Canada. (2022). TCPS 2 – Chapter 3: Informed consent. Secretariat on Responsible Conduct of Research. https://ethics.gc.ca/eng/tcps2-eptc2_2022_chapter3-chapitre3.html
Government of New Brunswick. (2009). Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05. https://laws.gnb.ca/en/showfulldoc/cs/P-7.05/20121030
Government of Newfoundland and Labrador. (2008). Personal Health Information Act, SNL 2008, c. P-7.01. https://assembly.nl.ca/Legislation/sr/statutes/p07-01.htm
Nova Scotia Legislature. (2010). Bill 89: Personal Health Information Act, 3rd reading, 61st General Assembly, 2nd session. https://nslegislature.ca/legc/bills/61st_2nd/3rd_read/b089.htm
Office of the Privacy Commissioner of Canada. (n.d.). Overview of PIPEDA. https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/r_o_p/
Ontario Ministry of Health. (2004). Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A. https://www.ontario.ca/laws/statute/04p03
Panel on Research Ethics. (2022). TCPS 2: CORE-2022 – Course on research ethics. Secretariat on Responsible Conduct of Research. https://tcps2core.ca/welcome
Lesson 2
Self-Knowledge Quiz
Answer 3 questions to help you check your understanding of key concepts from this lesson. Once you submit, you will receive immediate to help reinforce what you’ve learned.