My recommendation would be for the routine collection of a relatively small set of data, including all procedures and diagnoses, along with such common physiological measures such as blood pressure, pulse and temperature on admission. For patients falling into one of the select categories of interest, such as delivery, heart attack, pneumonia, stroke and coronary artery bypass surgery, additional condition or procedure-specific information would be collected. This additional data would be keyed to the patient's problem, e.g., timing and nature of prenatal care for delivery, left ventricular ejection fraction for CABG patients. Patient confidentiality is a crucial concern as the potential harm from the disclosure of medical information is apparent. However, it may be much easier to protect patient-specific information that is stored electronically, with suitable encryption and password protection, than in paper files in doctors' offices or teaching hospitals.
Patient files turn up in used computer.
It is quite appropriate to require that researchers prepare a research protocol and specific request to use data that includes potentially sensitive patient information. Such requests should be reviewed and be subject to approval by the appropriate Institutional Review Board at the investigator's institution, and should also be approved by the agency with responsibility for the data. It is certainly reasonable that the data be given under agreements that it not be passed on to other parties, although such restrictions should not apply to aggregated data files developed from the original that do not contain any patient-identifiable data. For example, I may require sensitive information such as birthdate, admission date, and a social security number on a hospital discharge abstract file to link records either within the file or across multiple files. Such information is clearly sensitive and needs to be handled with the utmost care.