Of course, since this step requires release of identifiers, IRB approval is required before the Medical Record Numbers are provided. The most sensitive form of data release arises when the intended use is for patient contact. Authorization from the patient's primary physician is also required prior to contacting the patient. The physician can refuse to authorize patient contact for a number of reasons such as knowledge that the patient does not meet study criteria or belief that the patient would not wish to be contacted. Patients who are contacted can decline to participate with the full knowledge that their care will be unaffected by their decision.
All patients give informed consent before they participate in any research.
This system of oversight has been in place for two years. The multi-tiered oversight provides many opportunities to avoid unintended or undesired patient contact or release of information and has worked successfully. The involvement of the primary physician has improved patient comfort with studies regardless of the patient's ultimate decision to participate. Personal privacy in an information society.