Guidance

Approval standards and guidelines: ethical assessment

Updated 2 August 2024

Approval standard: ethical assessment

When must this standard be met

This standard must be met for all applications requesting to process protected data.

Standard

1. All applications must include an ethical assessment and where ethical issues are identified, detail how such risks will be accepted or mitigated in the protocol and UK Health Security Agency (UKHSA) data application form (see approval standards and guidelines: scientific protocol). It is not acceptable to only provide information on how or from whom the ethics approval will be sought or has been obtained.

2. Any and all, real or perceived conflicts of interest relating to the project including, but not limited to, commercial interests and restrictions on the freedom of the applicant or applicants, must be declared.

3. Where an application is made to process confidential patient information for research, the application must demonstrate a favourable NHS Research Ethics Committee (REC) review by the Health Research Authority (HRA) in addition to meeting the requirements set out in the approval standards and guidelines: confidential patient information. The application must include:

• all correspondence from the HRA which shows the scientific protocol and any other study materials have been independently assessed and a favourable opinion has been obtained
• all correspondence from the HRA which shows that any amendments to the study materials have been assessed and are accepted

4. Where a research application is made to process (1) confidential data that is not related to participants that have been identified because they have a condition that was diagnosed and/or treated by the NHS or (2) data that has been de-personalised, the application must demonstrate there has been an independent ethical assessment by the sponsor. The application must include:

• all correspondence from the sponsor which shows that the scientific protocol and any other study materials have been independently assessed and a favourable opinion has been obtained
• all correspondence from the sponsor, which shows that any amendments to the study materials have been assessed and are accepted

5. Where the application involves processing data to contact the data subject, their representative (also called a personal consultee) or a registered health professional about the data subject, the application must include all communications that will be used, such as letter templates, also in accordance with standard 3 of the approval standards and guidelines: confidential patient information.

6. All application documents submitted to UKHSA must be current, and concordant with versions of the study documents which receive ethical approval. Where the documents are updated to reflect changes in the methods or other aspects of the project, the ethical assessment must also be reviewed.

7. The application must demonstrate the anticipated benefits and/or impacts of conducting this project to public health or the public good, and identify who will be beneficiaries. It must demonstrate the proposed processing is worthwhile and will have beneficial effects that outweigh the risks posed by the project (see approval standards and guidelines: scientific protocol).

Guidelines

Completing an ethical assessment

When reviewing an application for protected data, UKHSA considers whether the project has been be designed and will be delivered within the principles and standards of ethical practice.

To address this, all applications for protected data must include an ethical assessment of the planned processing and address how any ethical issues will be managed or mitigated.

This assessment should be included within the scientific protocol and must include, as a minimum, consideration about:

• compliance with data protection, regulatory or other legal requirements when processing the data
• the risks of the proposed processing to the rights and freedoms of the data subject, such rights and freedoms are detailed from Article 15 to Article 22 of UK GDPR
• conflicts of interest
• the pathway to impact for any results or outputs (what you will do to make beneficiaries aware of the project and its outputs, so that impact can be achieved)

Where ethical issues are identified, these must be included in the data application form (section F1.1) as well as the scientific protocol.

Other ethical considerations will be project-specific and depend upon factors, such as the method of data collection, the level of identifiability of the data, whether there will be direct contact with data subjects and if the national data opt-out must be upheld.

For example, where it is intended that there will be public or patient participation, the ethical assessment should take account of matters relating to adequate safeguards in place to protect the participant, service, and organisation from harm (such as vulnerability and capacity to participate), as well as partnership, collaboration and how outputs will be communicated.

Appropriate consideration should be taken when projects involve vulnerable groups such as the very old, children, or those with mental illness, and other forms of research which do not involve full disclosure to participants. The dignity, rights, safety and wellbeing of participants must be the primary consideration in any project.

A non-exhaustive list of ethical issues that may arise are outlined below. These are for example only and any ethical assessment should be appropriately tailored to the specific project.

Examples of ethical issues arising in data projects

Ethical issues that may arise in data projects include:

• social and clinical value of the project
• scientific validity of the methods, including any bias which may arise
• whether the project team has the necessary skills and experience to carry out the proposed processing
• risks to the health, safety and wellbeing of research participants or data subjects
• trade-offs, such as between optimising outcomes and avoiding discrimination against a specific group
• reputational risk to the sponsor, or any research sites
• informed consent
• upholding dissent, including the application of the national data opt-out (see approval standards and guidelines: upholding patient objections under the national data opt-out)
• measures to ensure the confidentiality and security of personal data, including handling of data breaches, upholding data subject requests and Freedom of Information Act (FOIA) requests
• handling of incidental findings or outliers
• controls placed on data processors (see approval standards and guidelines: engaging a data processor for further information)
• statistical disclosure control
• sub-licensing for third party use
• algorithm neutrality

When conducting the ethical assessment, applicants may draw from the data ethics framework which guides appropriate and responsible data use, or from sector specific best practice, such as the UK Policy Framework for Health and Social Care Research.

It is further recommended that a multi-disciplinary approach is taken to peer review and that the communities at the heart of the project are engaged to ensure it is appropriately and meaningfully designed (‘with’ and ‘by’ the public, rather than ‘for’ or ‘about’ them; patient and public involvement or PPI) and to help capture all potential ethical issues. The HRA provides an overview of PPI and guidance on 4 principles for meaningful involvement of patients and the public in health and social care research.

External resources relevant to ethical practice in health and social care projects

The following is a non-exhaustive guide of useful external resources about good ethical practice and research integrity:

Data Ethics Framework

This guides appropriate and responsible data use in the public sector. It helps public servants understand ethical considerations, address these within their projects, and encourages responsible innovation.

UK Policy Framework for Health and Social Care Research

This policy framework sets out principles of good practice in the management and conduct of health and social care research in the UK.

Understanding artificial intelligence ethics and safety

Guidance for everyone involved in the design, production, and deployment of an AI project for considering ethical issues at every stage.

HRA: What approvals and decisions do I need?

Information on what constitutes research including a decision tool to determine if a particular project is research, and the research project types which require HRA approval, HRA REC approval, or both, with some signposting to other approvals which may be required.

Singapore Statement on Research Integrity

A global guide to the responsible conduct of research and represents the first international effort to encourage the development of unified policies, guidelines and codes of conduct, with the aim of fostering greater integrity in research worldwide.

Montreal Statement on Research Integrity in Cross-Border Research Collaborations

Responsibilities for research collaborations which cross national, institutional, disciplinary and/or sector boundaries and the special challenges this can present for the responsible conduct of research.

European Code of Conduct for Research Integrity

This provides a European comprehensive framework for self-regulation across all scientific and scholarly disciplines and for all research settings. Guidance to help researchers meet their professional responsibilities in the practical, ethical and intellectual challenges inherent to research.

HRA: Research tissue banks and research databases

Information for those planning to create a research database or a research tissue bank (‘biobank’); it covers ethical approval for programmes of research versus individual project-specific ethics approval.

UKRIO: Code of Practice for Research

Reference tool to support researchers and research organisations in the conduct of research through key principles of the highest quality and standards. It is applicable to all types of research and can assist in fulfilling the requirements of regulatory, funding and other bodies and ensure that important issues have not been overlooked.

The Embassy of Good Science: Your platform for research integrity and ethics

Help for anyone seeking support in handling day-to-day research practices and dilemmas; resources, community contacts, training, issues and ‘hot topics’ by theme and more.

Independent assurance of ethical assessment for health research

Standards 3 to 6 apply specifically to research applications and must be met where applicable to the project, in addition to standards 1, 2 and 7.

The UK Policy Framework for Health and Social Care Research is statutory guidance which sets out the high-level principles and responsibilities, applicable in all health and social care research, that underpin high-quality ethical research in the UK.

It includes 15 principles:

• safety (of those involved)
• competence (of those managing and conducting the study)
• sound scientific and ethical conduct
• patient, service-user and public involvement
• integrity
• quality and transparency
• having a protocol in place
• legality (ensuring all relevant legislation is followed)
• an analysis of benefits and risks before the project starts (to ensure any foreseeable risks and burdens are mitigated and outweighed by the anticipated benefits)
• approval (ensuring all relevant approvals are obtained)
• making information about the research publicly available
• ensuring the findings of the research will be accessible
• ensuring participants are afforded respect and autonomy (and where explicit informed consent is obtained, refusal or withdrawal is honoured without consequence),
• having insurance and indemnity in place (adequate to cover any liabilities which may result from the project design)
• respecting the privacy and confidentiality of participants

These principles underscore the interests of patients, service users, and the public and supporting high-quality research through proportionate, assurance-based management.

The framework and supporting operational guidance are underpinned by legislation which requires REC review of certain research proposals, including those that include the processing of confidential patient information.

Applications requesting to process confidential patient information must include evidence of favourable opinion from an HRA NHS REC . This confirms to UKHSA that the REC has concluded that the research will be ethical and worthwhile, and any risks, burdens or intrusions will be minimised for the people taking part in the research.

To submit an ethics application to the HRA use the Integrated Research Application System (IRAS).

Local processes for obtaining for ethics approval should be followed when requesting to process (1) confidential data that is not related to participants identified because they have a condition that was diagnosed by the NHS or (2) de-personalised data. At a minimum, this should involve peer review by an objective individual or committee which represents the sponsor, against an agreed checklist assessing risk, ethical issues and governance arrangements.

Where there is any doubt of the process which should be followed researchers should consult their sponsor’s representative.

In circumstances where the proposed processing is considered high risk following a local ethical review, UKHSA reserves the right to require review by the HRA.

When conducting, or collaborating in research using UKHSA data, researchers based outside of the UK must comply with the legal and ethical requirements existing in the UK.

Amendments

Where a project has received ethical approval, applicants should ensure that any subsequent alterations to the project are proportionately reviewed and the application can demonstrate an updated favourable opinion has been obtained, where applicable.

The HRA offers guidance on and examples of what constitutes a substantial amendment (requiring formal submission to and approval by the REC) or non-substantial amendment (not requiring formal submission but notification only) which can be found on the HRA website.

Where ethics approval was obtained through the applicant’s own organisation, they can advise on the amendment process to follow.

Where an amendment is needed, the application will be incomplete as the amendment approval will then need to form part of it. UKHSA will provide feedback about the evidence which must be supplied to complete the application and you will be invited to resubmit. Resubmissions will be handled as new applications.

Document versioning

Applications will not be reviewed by UKHSA where version control does not align.

Information on best practice in document management can be found in section 9.5 of the UK Policy Framework for Health and Social Care Research (2022).

Informed consent

See the ‘informed consent’ section of the approval standards and guidelines: confidential patient information for the relevant guidance, and standard 3 which relates to informed consent.

Pathway to impact

Researchers have a duty to publish the findings of all clinical research involving human participants, to help maximise the worth and value of the project. The National Institute for Health and Care Research (NIHR) advise researchers to ‘plan for impact’, with research impact defined as, ‘the demonstrable contribution that research makes to society and the economy, of benefit to individuals, organisations and nations’.

Understanding and maximising the anticipated impact is also best practice for all types of projects, as it establishes why a project is important and the processing of UKHSA data necessary.

All applications must demonstrate how impact will be achieved when processing UKHSA data. The following questions may be useful in prompting thinking about the anticipated impact:

• what are the key outputs?
• who will these outputs be of most use to?
• how will you make potential users aware of your outputs?
• how will you make your outputs easy for users to access, understand and adopt?
• what is the impact you are seeking to have?
• how will you evidence impact of your project?

For further information see the ‘pathway to impact’ section in the approval standards and guidelines: scientific protocol , and standard 2 which relates to ‘pathway to impact’.