Health Research and Clinical Trials

The introduction of the General Data Protection Regulation (the “GDPR”) has brought about strict new rules regarding the storage and use of personal data. GDPR recognises that special classes of personal data should be offered greater levels of protection than other classes of data; one such special class is personal health data or information.

A number of new regulations have now been brought into law in Ireland, in order to give full effect to GDPR. Among these are the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (the “Health Research Regulations”). The Health Research Regulations, which came into effect on 8 August 2018, stipulate that doctors, and other health professionals or organisations, who hold health related data or information, must obtain patients’ explicit consent before using their data for health research purposes.

The Health Research Regulations also require doctors to put in place a number of safeguards if they do process patient data for health research purposes.

What constitutes “health research“?

Regulation 3(2) of the Health Research Regulations defines “health research” as any of the following scientific research for the purpose of human health:

  • research aimed at understanding functioning, at molecular, cellular, organ system and whole body levels;
  • research specifically concerned with innovative strategies, devices, products or services for the diagnosis, treatment or prevention of human disease or injury;
  • research aimed at improving the diagnosis and treatment (including the rehabilitation and palliation) of human disease and injury and of improving the health and quality of life of individuals;
  • research aimed at improving the efficiency and effectiveness of health professionals and the health care system; and
  • research aimed at improving the health of the population as a whole or any part of the population through a better understanding of the ways in which social, cultural, environmental, occupational and economic factors determine health status.

As you will see from the above this is a very broad definition and we are of the view that most research activity undertaken by doctors will come within the scope of the Health Research Regulations. It is important to note that the Health Research Regulations make clear that any action taken to establish whether an individual may be suitable for inclusion in the above types of research will also come within the definition of “health research” itself.

What should doctors be aware of?

Where a doctor is using, or intends on using patient data, in connection with health research they should first obtain the explicit consent of the patient in question to do so. Once consent has been obtained, the doctor should then ensure that the appropriate safeguards, required by the Health Research Regulations, are put in place.

Obtaining Consent

The Health Research Regulations state that explicit consent of the patient should be obtained before the health research commences. While the Health Research Regulations do not provide a definition of explicit consent, guidance can be found in the Article 29 Working Party Guidance on Consent document, which states that the term “explicit” means that the patient must give an express statement of their consent. Consent should be freely given, informed and unambiguous. We would advise that specific consent be obtained and recorded in writing.

If you believe that the public interest in carrying out the health research outweighs the need to obtain consent you may apply to a special committee established by the Minister for Health (the “Committee”) for a declaration that consent is not required. The application will need to be made in writing and accompanied by an impact assessment.


The Health Research Regulations also require that where health research is taking place, suitable and specific measures are put in place to protect the patient’s fundamental rights and freedoms. These measures must include the following:

  • arrangements to ensure that data is not used in such a way that causes or is likely to cause damage or distress to patients;
  • appropriate governance structures, including approval of the research by an ethics committee; specification of all parties involved in the research (including any third parties who may be funding or otherwise supporting the research) and any persons with whom data is being shared; and training all individuals involved in carrying out the research in data protection law and practice;
  • processes and procedures relating to the management and conduct of the research, including carrying out an assessment of the data protection implications of the health research; data minimisation measures (e.g. anonymisation); controls to prevent unauthorised data processing; security measures; and other technical and organisational measures to ensure compliance with the GDPR; and
  • arrangements to ensure that personal data is processed in a transparent manner.

Advice to doctors

Where a doctor intends on using patient data in connection with health research they should ensure that they adhere to the requirements of the Health Research Regulations. They are required to obtain patient consent prior to undertaking such research (unless the Committee makes a declaration to the contrary) and they must ensure that the appropriate safeguards are in place when conducting such research.

Research and Clinical Trials

Aside from the legal requirements set out above, doctors should also be conscious of the conditions that they will need to meet in order to be guaranteed insurance cover in connection with research/clinical trials.

Prior to considering any request for research/clinical trial, Medisec will require confirmation that the contemplated research or trial has been approved by a recognised Ethics Committee who will have approved the standards of research; that the assessment for suitability, patient consent, for any exercise, tests and investigations are normal to General Practice. If the trial is a drug trial, Medisec will require confirmation that it conforms with Control of Clinical Trial legislation.

All information regarding the proposed research or trial must be forwarded to Medisec for approval by our GP Panel before we liaise with our underwriters, Allianz for cover confirmation. If the trial is sponsored or owned by a third party Medisec will require confirmation that the sponsor/owner has insurances/indemnity equal to the doctor.
You should be mindful not to function beyond “normal GP work” and; finally should any particular issue arise for a patient, you should refer to an appropriate specialist.
Medisec members are not covered to offer an indemnity to any third party and they are not permitted to assume any liability under any agreement.

November 2018

The contents of this publication are indicative of current developments and contain guidance on general medico legal queries. It does not constitute and should not be relied upon as definitive legal, clinical or other advice and if you have any specific queries, please contact Medisec for advice.

Share this article: