Data Access and Stewardship

#Clarify purpose and authority

Begin by describing what information is needed, why it is needed and whose information it contains. Access for one purpose does not automatically permit use for another. Relevant requirements depend on the jurisdiction, information involved and proposed activity, so local governance and legal requirements need to be established.

Identify the organisation or role authorised to approve access and the people responsible for managing the data. Custodianship describes practical care and oversight, but it does not by itself settle legal authority. Clarify applicable organisational roles, permissions and agreements rather than assuming that possession of a dataset establishes unrestricted rights.

#Limit access and protect information

Use only the information needed for the stated purpose and restrict access to appropriate roles. Document where data will be stored, how they will move between systems and whether any other organisations will handle them. Include arrangements for authentication, access review, logging and responding to suspected misuse or exposure.

Removing direct identifiers does not always make information anonymous. Combinations of details may still identify someone, particularly when linked with other sources. Describe the protection applied and its limitations accurately. Consider whether the intended task can be completed using less detailed information or within a controlled environment without transferring copies.

#Plan for the whole lifecycle

Stewardship also covers data quality, documentation, retention and disposal. Record where information came from, what fields mean and how records have been changed. Missing, outdated or inconsistently recorded information can affect conclusions and create unequal effects across groups. Access permission alone does not establish fitness for the proposed analysis.

Agree what happens when staff leave, the activity ends or the purpose changes. Address access removal, return or deletion of copies, backup handling and applicable retention duties. Establish who responds to incidents and requests concerning personal information. Review arrangements when new data sources, recipients or uses are introduced.

#Common misunderstandings

Permission to use health information is not a blank cheque. Agreement to one activity does not automatically cover unrelated research, commercial use or sharing with additional organisations. Equally, consent is not the only possible basis for using information: other lawful arrangements may apply, depending on the setting and purpose.

Removing names does not necessarily make a dataset anonymous. Combinations of details can sometimes identify someone, especially when linked with other information. Protecting privacy therefore involves more than deleting obvious identifiers.

Access also does not mean ownership or unrestricted control. Someone authorised to view information may not be authorised to copy it, share it or keep it indefinitely.

Finally, responsible stewardship is not simply a technical security task. It includes checking whether information is accurate enough for its intended use, recording decisions and making responsibilities clear. These duties continue when information is transferred, archived or deleted.

#Questions worth asking a clinician

• What authorises your team to use my health data for this specific purpose, and does that use require my consent?
• How will you limit the health information you collect and each team member’s access to what is necessary?
• Who is accountable for checking my data’s accuracy and correcting errors before clinical or research use?
• If my data is accessed without permission or disclosed accidentally, who will respond, and how will I be informed?
• How long will you keep my data, and how will you end access and manage copies when the authorised use ends?