Regulatory Approaches for a Retrospective Multicentre

Multinational Study on Data: An Example Conducted in France,

Ireland and England

Candice Houg

1,2 a

, Thomas Lihoreau

1,2 b

, Martina Hennessy

, Kristina Mouyabi

Rachel Benamore

, Jean Palussiere

, Julien Behr

and Lionel Pazart

1,2 g

Centre Hospitalier Universitaire de Besançon, Centre d'Investigation Clinique,

INSERM CIC 1431, 25030, Besançon, France

Tech4Health network - FCRIN, France

Wellcome-HRB Clinical Research Facility, St James’s Hospital and School of Medicine Trinity College Dublin,

Dublin, Ireland

Department of Radiology, Oxford University Hospital Trust, Oxford, U.K.

Department of Interventional Radiology, Bergonie Institute, Bordeaux, France

Department of Radiology, University Hospital of Besançon, Besançon, France

Keywords: Retrospective Study, Study on Data, Regulatory Approach.

Abstract: Retrospective studies are studies that easily provide data on a population. As the data are already available in

the medical records, the collection and analysis of the results is faster. These studies are particularly valuable

in the post-marketing clinical follow-up of medical devices. They allow manufacturers to easily and

proactively obtain safety and performance data. The regulatory procedures associated with this type of study

also appear to be much less burdensome than a prospective study. We propose to illustrate the procedures

through a multinational retrospective study conducted in France, England and Ireland.

1 INTRODUCTION

A retrospective study is a study that “investigates

outcomes specified at the beginning of a study by

looking backwards at data collected from previous

patients. Patients are enrolled after the clinical event

of interest or exposure has occurred: this is usually

conducted by review of the medical notes.

Retrospective studies may be either cohort or case-

control studies and have four primary purposes: (1)

either as an audit tool for comparison of the historical

data with current or future practice, (2) to test a

potential hypothesis regarding suspected risk factors

in relation to an outcome, (3) to ascertain the sample

https://orcid.org/0000-0002-8028-276X

https://orcid.org/0000-0001-8417-6609

https://orcid.org/0000-0002-2153-5288

https://orcid.org/0000-0001-7186-2677

https://orcid.org/0000-0001-6118-8543

https://orcid.org/0000-0001-8236-7153

https://orcid.org/0000-0002-9104-0862

size and data required for a prospective study or trial,

or (4) to investigate uncommon or rare events (e.g.

graft infection), where the size of a prospective study

would be prohibitively large and take too long to

conduct” (Powell & Sweeting, 2015). The data in

retrospective studies comes from data that has been

entered into a clinical database, medical records and

not collected for the purpose of the research, resulting

in possible missing data and poor data collection. The

level of quality of the information and data collected

could then be criticized and considered as lower than

in a prospective study. In contrast, these studies are

easier to set up in regulatory terms and in practice and

normally quicker in getting the results than

prospective study.

Houg, C., Lihoreau, T., Hennessy, M., Mouyabi, K., Benamore, R., Palussiere, J., Behr, J. and Pazart, L.

Regulatory Approaches for a Retrospective Multicentre Multinational Study on Data: An Example Conducted in France, Ireland and England.

DOI: 10.5220/0010971800003123

In Proceedings of the 15th International Joint Conference on Biomedical Engineering Systems and Technologies (BIOSTEC 2022) - Volume 1: BIODEVICES, pages 289-293

ISBN: 978-989-758-552-4; ISSN: 2184-4305

289

Here we present the regulatory approaches of a

retrospective study conducted in France, Ireland and

England.

2 RETROSPECTIVE STUDY

INTEREST

Retrospective study can be conducted to define

characteristics of a population before developing or

introducing a procedure, a device, a drug etc. as an

“historical” cohort to replace a control group in a

controlled trial. This could be a real opportunity to do

without a prospective control group in study where

the risks/benefits with the current care are already

known, or in cases where standards of care could

differ from centres, doctors, patients in order to get

the actual data for each centre; so to complete the

possible lack in knowledge of the practices

Retrospective studies are also conducted in the

framework of post marketing investigations for drugs

and post market clinical follow-up for devices

(PMCF), when a new scientific question occurs, and

when data could be available in the medical records.

PMCF studies are studies carried out following the

CE marking of a device and intended to answer

specific questions regarding the safety or clinical

performance (e.g. residual risks) of a device when

used in accordance with its approved use in

accordance with its approved CE labelling. The

European Medical Device Regulation (EU MDR)

2017/745 strengthens studies post CE mark.

Manufacturers have to evaluate their device during

the whole life cycle of the product, i.e. even after the

CE marked product in accordance with the EU MDR

2017/745. The number of retrospective studies could

therefore multiply in the next few years, since they

make it possible to easily obtain data on the device,

provided that these data are well transcribed in the

patients' medical records. We can also add the

development of data science, big data, and of the

medical records access for the use in research

purposes, all in that in the general framework of

General Data Protection Regulation (https://eur-

lex.europa.eu/eli/reg/2016/679/oj).

We will use the example of a retrospective study

conducted to better describe a population with

iatrogenic pneumothorax. This population will then

be used as a historical cohort for a study with a new

device on the same targeted population. As the

literature is not sufficiently developed on the subject

and recommendations diverge, we decided to conduct

this study in 3 different countries in order to

consolidate the literature. This study aims to describe

current practices through retrospective data

collection, not focus on the evaluation of one device

or another. We will define how this retrospective

study is handled in each of the countries concerned.

On another side we well noticed that EU MDR

2017/745 is the regulation under which any

investigation on a medical device will apply from

May 2021.

3 FRANCE

In France, this research, evaluating current practices,

is classified as research outside the Jarde law. It

corresponds to the research cited in paragraph II 3° of

article R1121-1 of the public health code (Legifrance,

2021): “ Not considered to be research involving the

human person within the meaning of this title is

research with a public interest objective of research,

study or evaluation in the field of health conducted

exclusively on the basis of the use of personal data

processing mentioned in I of Article 54 of Act No. 78-

17 of 6 January 1978 as amended relating to

information technology, files and freedoms and which

falls within the competence of the ethical and

scientific committee for research, studies and

evaluations provided for in 2° of II of the same

article.”

Retrospective studies must be conducted under

the responsibility of a data controller. The regulatory

approaches in France for retrospective study appear

to be very light. These studies do not require the

authorisation of the competent authority and the

opinion of the “Comité de Protection des Personnes”,

the committee responsible for evaluating studies

under the Jardé law. On the other hand, the favourable

opinion of a local ethics committee (institution or

region) is recommended and may be indispensable for

the publication of articles about the said research. The

documents to be prepared and the time needed for the

evaluation of local ethics committees depend on the

organisation of the committee. In our recent example,

the study was submitted to the research ethics

committee of the University of Burgundy Franche

Comté (https://www.ubfc.fr/recherche/cer-ubfc/).

The time to obtain a first opinion was 3 months

including a period of holidays. Some hospitals also

have their own research ethics committees.

The General Data Protection Regulation (GDPR)

provides a framework for data processing (EUR-lex,

2016). The GDPR has been implemented in French

law by the law of 20 June 2018 on the protection of

personal data. The main development of the law of

20 June 2018 is the expansion of the powers of the

Commission Nationale de l'Informatique et des

Libertés (CNIL) (https://www.cnil.fr/), which is now

the authority responsible for the application of the

GDPR in France. The CNIL has adopted five

ClinMed 2022 - Special Session on Dealing with the Change in European Regulations for Medical Devices

290

reference methodologies (RM) to simplify the

procedures for accessing health data. These

methodologies provide a framework for the

processing of personal data in the context of health

research. When setting up a study, the sponsor must

certify to the CNIL that the study complies with one

of the corresponding reference methodologies. In the

opposite case, the sponsor must file an application for

authorisation with the CNIL.

If studies do not respect a reference methodology,

the data processor must declare the study to CNIL for

authorisation. Submission to CNIL is through the

Health Data Hub (https://www.health-data-

hub.fr/depot) who will transmit file to the “Comité

d’Expertise pour les Recherches, les Études et les

Évaluations dans le domaine de la Santé” for

assessment of:

- The purpose and methodology of the

research

- The need for the use of personal health data

- The ethical relevance

- The scientific quality of the project

- If applicable, the public interest character of

the project.

And then the file will be transmitted to CNIL for final

approval.

Retrospective study respects RM004 (Legifrance,

2018) when data collected are the only required for

the research purpose and are scientifically justified.

This is the principle of relevance, adequacy and

limited in conformity with GDPR. Data on geocode,

social security number, religious views, and data

relating to offences must not be collected and

analysed. The storage and archiving of data must

respect the legal delay and lastly patients must be

informed according to article 13 and 14 of GDPR and

the patient have the right to object to the use of his

data at any time.

Patient information can be:

(1) In some institutions, when patients are

admitted at the hospital (both inpatient and

outpatient), they are directly informed that

their data may be re-used for research

purposes, unless they object: systematic

patient information. When a new study

emerges that requires the re-use of these

patients' data, the institution should publish

information of the study as for example on the

institution's webpage and information on their

rights in accordance with the GDPR. In this

way, the patient can object to the re-use of

their data.

(2) Sending an information note and opposition

form to the patient’s home. The patient

information note must contain all information

according to article 13 and 14 of GDPR. This

is based on the “silence means assent”

principle. If patient contacts investigator or

sends the opposition form he cannot be

included in the study as he objects to the reuse

of its data. In the opposite case, patient data

can be reused.

For this second option, the vital status of the

patient must be identified to ensure that they are still

alive before the documents are sent home. For this,

the initiator is responsible for ensuring the vital status

of each patient. The information can be found in the

patient's medical record, but this is not always

updated when the patient dies and even more so when

the patient dies elsewhere.

A simple way to find the vital status of a person

is to use the MatchID application for France

(https://deces.matchid.io/). MatchID is a project

initiated at the Ministry of the Interior which uses the

nominative files of deceased persons (deceased since

1970) collected by INSEE, the national statistics

office. The INSEE files of deceased persons are

established from information received from the

municipalities: death certificates. MatchID does have

some limitations:

- INSEE cannot guarantee that the files of

deceased persons are free of errors or

omissions. The information reported in

MatchID are deaths of which INSEE is

aware.

- Persons without an NIR number (born

abroad and without affiliation to a Social

Security organisation) and some persons

who died abroad will not be identified in

MatchID.

- Recently deceased persons may not be found

in MatchID (delay in transmission of

information by the family to the town hall,

then from the town hall to INSEE, then

import of data by MatchID).

On the other hand, the use of anonymised

personal data makes it possible to evade data

protection regulations and thus to use the data freely,

since it is impossible to trace the identity of the person

through anonymization.

4 IRELAND

In January 2021, the Health Research Regulation was

amended by the Minister of Health (Irish Statute

Regulatory Approaches for a Retrospective Multicentre Multinational Study on Data: An Example Conducted in France, Ireland and

England

291

Book, 2021). This amendment deals with the consent

challenge for retrospectives chart reviews studies.

Retrospective chart reviews are defined by:

- low risk study carried out by a controller

- on personal data only

- where that personal data has already been

obtained by that controller for the purposes

of the provision of health care to an

individual by the controller.

Explicit consent will not furthermore apply for

studies when:

- it has been approved by a Research Ethics

Committee (REC)

- where the REC, as part of that approval, is

satisfied and states in writing that the

required data protection risk assessment

carried out by the controller indicates a low

risk to the rights and freedoms of the data

subjects whose data will be accessed and

used in the study.

In order to be coherent with GDPR, notices and

posters must be displayed in public areas of the

controller’s organisation where patients attend for the

provision of health care.

This means that retrospective study needs to be

submitted to local or Joint RECs which is different

from the National Research Ethics committee –

NREC (https://www.nrecoffice.ie/). Research Ethics

Committees are local committees attached to

hospitals or universities. Whereas NREC is the

national committee involved in study on medicinal

products or medical devices. Last experience for our

study, we submitted to the research ethics committee

of Saint James hospital and Tallaght University

Hospital (https://www.tuh.ie/Departments/TUH-

Research-and-Ethics-/). The evaluation time for this

study was approximately 2 months. This low risk

retrospective study was associated to an “expedited

review”.

It is also possible to apply for an exemption from

consent where explicit patient consent is required.

This must be fully justified, it must be demonstrated

that the public interest in health research significantly

outweighs the public interest in requiring the explicit

consent of the research participant. A strong

argument will be required in order for the consent

exemption to be granted. This application must be

submitted to the Health Research Consent

Declaration Committee (HRCDC)

(https://hrcdc.ie/apply). For that, the HRCDC form

must be completed and accompanied by a Data

Protection Impact Assessment. HRCDC meets each

month to review project and can except a formal

decision letter within 5 working days after the

meeting.

Based on our experience with the retrospective

study on pneumothorax, we had to submit to Saint

James Hospital, in addition to the Research Ethics

Committee:

- a research application form to the research

and innovation office

- a form to the Clinical Research Facilities

Department, as the study will be conducted

through this department.

The patient data in our example study will be

anonymised for Ireland. Thus no patient consent is

required and no application to the HRCDC was

necessary.

5 ENGLAND

Studies limited to working with retrospective data

may be classified as research if the results are deemed

generalisable. If classified as research, the study must

apply for approval from the Health Research

Authority (HRA). The following tool allows to define

whether the project is classed as research or not:

http://www.hra-decisiontools.org.uk/research/.

The decision is based on whether participants are

randomised to different groups, whether the study

requires a change to patient care or whether the

findings are generalisable or transferable. Following

the answers selected, the tool can advise whether it is

necessary to apply for HRA approval. In the case of

our study, we completed the tool and did not find the

project to be classified as research however the

organisation’s R&D office felt the results could be

considered generalisable. We were then able to

contact the HRA Queries Line to seek further

clarification - queries@hra.nhs.uk.

In order to obtain approval from the HRA, the

applicant must register and fill in the Project Filter

form on the Integrated Research Application System

(IRAS) (https://www.myresearchproject.org.uk/).

This initial form determines which other authorities

your study needs to be reviewed by based on your

answers to the project filter questions. The IRAS

system allows a study to be submitted to both the

ethics committee (where applicable), the competent

authority and the HRA for approval.

Where explicit patient consent is not being sought

and the information required for the study is deemed

to meet the definition of personal data, an application

must be made to the Confidentiality Advisory Group

(CAG) through IRAS. This application is considered

alongside the application to the HRA.

ClinMed 2022 - Special Session on Dealing with the Change in European Regulations for Medical Devices

292

Where the study is not classified as research, the

impact and level of risk of sharing the data must be

assessed by the organisation who will complete a

form called a Data Protection Impact Assessment

(DPIA). A DPIA is an important tool for negating risk

and demonstrating compliance with GDPR; as there

is no standard document template for a DPIA, the

questions posted in the DPIA are unique to each

organisation. Following completion of the DPIA, this

document is then reviewed by the Caldicott Guardian,

a senior person responsible for protecting the

confidentiality of people’s health and care

information and making sure it is used properly. The

Caldicott Guardian will check that all processes

described within the DPIA are in-line with the

Caldicott Guardian Principles.

A Privacy Notice is in place on the Oxford

University Hospitals NHSFT website outlining the

how a health record is used and in what circumstances

it may be shared and with whom. New guidance is

also emerging which advises organisations to publish

a Data Access Register (DAR) to allow patients to

view how data has been used by the organisation and

for what purpose under more specific terms.

6 CONCLUSION

As we can see from the example of these three

countries, there is no harmonised regulatory approach

for retrospective studies. Although the opinion of an

ethics committee seems to be required to start the

research, the additional procedures remain specific to

each country, or even to each health organisation

(case of the Saint James Hospital).

It is therefore important to have a point of contact

in each of the countries where the study will be

undertaken in order to carry out the correct regulatory

procedures and to comply with national and/or local

regulations.

ACKNOWLEDGEMENTS

This study has received funding from EIT Health

(https://eithealth.eu/): ID 20186.

REFERENCES

Irish Statute Book, electronic I. S. (2021). S.I. No.

18/2021—Data Protection Act 2018 (Section 36(2))

(Health Research) (Amendment) Regulations 2021.

Office of the Attorney General. https://www.irish

statutebook.ie/eli/2021/si/18/made/en/print

Legifrance. (2018). Délibération n° 2018-155 du 3 mai

2018 portant homologation de la méthodologie de

référence relative aux traitements de données à

caractère personnel mis en œuvre dans le cadre des

recherches n’impliquant pas la personne humaine, des

études et évaluations dans le domaine de la santé (MR-

004)—Légifrance. https://www.legifrance.gouv.fr/jorf/

id/JORFTEXT000037187498

Powell, J. T., & Sweeting, M. J. (2015). Retrospective

Studies. European Journal of Vascular and

Endovascular Surgery, 50(5), 675. https://doi.org/

10.1016/j.ejvs.2015.07.005

Regulatory Approaches for a Retrospective Multicentre Multinational Study on Data: An Example Conducted in France, Ireland and

England

293