03 · What You Need to Know
Why Secondary Data Still Raise Research-Ethics Questions
What Counts as Secondary-Data Research?
Secondary research involves using information originally collected for a different primary purpose. That original purpose might have been another research project, clinical care, education, administration, government services, routine monitoring, or some other activity.
Examples include analyzing medical records to study treatment outcomes, using historical student records to investigate predictors of academic performance, reanalyzing survey responses collected during an earlier study, or using an institutional database to examine patterns that were not part of the original reason for collecting the information.
Under current U.S. HHS guidance, secondary research is not limited to information that already existed before the new study was conceived. Information can also be collected in the future for another primary purpose and later or simultaneously used for secondary research. The important distinction is that the information is not being collected through an intervention or interaction specifically for the secondary study.
“Existing” Describes the Data Source, Not the Ethics Status
The mere fact that someone else collected the information first does not determine whether the people represented in those records remain relevant to research-ethics protections.
The more useful questions are: Can the researcher identify them? Is the information private? What did the original participants agree to? Does the researcher have lawful and authorized access? Does an exemption apply? What does the governing ethics framework require?
This is why “secondary analysis” should not be treated as another way of saying “no ethics approval required.”
Identifiability Is Often Central
A major distinction is whether investigators obtain information that can be connected to particular individuals.
Under the U.S. Common Rule, a human subject includes a living individual about whom an investigator obtains, uses, studies, analyzes, or generates identifiable private information or identifiable biospecimens. OHRP therefore focuses on what the secondary researcher can actually obtain and whether identity can readily be ascertained.
If investigators receive only coded data and cannot readily ascertain identities because, for example, an agreement or institutional policy prevents them from obtaining the code key, OHRP explains that the secondary research may not involve human subjects under the Common Rule definition. That conclusion is different from saying that the study is exempt human-subject research.
De-identified or nonidentifiable to the researcher
The researcher cannot readily ascertain the identities of the individuals represented in the information under the applicable framework.
Identifiable data
The researcher can identify individuals directly or can readily connect information to particular individuals through identifiers or another available mechanism.
Coded Data Are Not Automatically Anonymous
A dataset can replace names with numbers and still remain identifiable for ethics purposes. The critical question is whether the investigator can readily connect the code to individual identities.
If you possess the code key, can request it, or can otherwise readily link the records back to individuals, describing the dataset as “coded” does not necessarily make it nonidentifiable.
Conversely, OHRP recognizes circumstances in which researchers receive coded information but cannot obtain the identifying key because an agreement, institutional procedure, or legal restriction prevents access. In that situation, the secondary researcher may not be obtaining identifiable private information under the HHS definition.
De-Identification Does Not Repair Every Ethical Problem
Removing identifiers can substantially reduce privacy and confidentiality risks, but it should not be treated as an ethical eraser.
You should still ask whether the data were collected lawfully and ethically, whether secondary use is permitted, whether the dataset contains information that can become identifiable when linked with other sources, and whether the proposed analysis could harm particular groups even when individual identities are concealed.
The Philippine National Ethical Guidelines, for example, state in their guidance concerning secondary databases that researchers should conduct due diligence when doubt exists about how a database was generated and should ensure that the original data holder has a lawful basis for processing personal data.
Original Consent Can Matter
Data collected during an earlier study may have been obtained under consent conditions governing future use. Those conditions should be examined rather than assumed.
The original consent might explicitly permit broad future research use, restrict use to a particular topic, permit only de-identified sharing, or say nothing about secondary analysis. Applicable ethics and privacy frameworks determine what follows from those circumstances.
The Philippine national guidelines state that researchers using secondary data originally collected for another purpose should provide documentation that prior permissions have been secured and address participants' data privacy and consent for secondary use where applicable.
Under the revised U.S. Common Rule, there are also specific exemption pathways involving broad consent for storage, maintenance, and secondary research use of identifiable private information or identifiable biospecimens.
Some Secondary Research Can Be Exempt
Existing or secondary data can qualify for exemption under particular ethics frameworks, but the exemption is based on defined conditions rather than age of the dataset.
Under the U.S. Common Rule, exemption 45 CFR 46.104(d)(4) covers certain secondary research uses of identifiable private information or identifiable biospecimens when at least one specified condition is satisfied. These include circumstances where the identifiable materials are publicly available, where information is recorded so that subjects cannot readily be identified and investigators will neither contact nor re-identify them, and specified uses governed by other privacy protections.
Other exemptions address storage or secondary use under broad consent and can require limited IRB review.
The broader lesson is that research may qualify for exemption because it satisfies an established category, not merely because the records happen to be old.
Some Secondary Research May Not Involve Human Subjects Under a Particular Framework
This is a different route to a similar practical outcome.
Under U.S. HHS rules, if investigators conducting secondary research neither interact or intervene with living individuals nor obtain identifiable private information or identifiable biospecimens, the activity does not involve human subjects as defined by the Common Rule.
That is not technically an exemption. The activity falls outside the definition of human-subject research covered by that regulation.
Keeping this distinction clear can prevent confusing statements such as “my de-identified study was IRB-exempt” when the actual institutional determination was that the project did not constitute human-subject research.
Medical, Educational, and Administrative Records Can Still Be Private
A record's routine institutional purpose does not make it public. Medical files, student records, employee information, administrative case records, and similar sources may contain highly sensitive information collected in contexts where individuals reasonably expect controlled access.
Research use can therefore raise questions about authorization, privacy, confidentiality, data minimization, security, consent, and applicable data-protection law even though the researcher never interacts with the people concerned.
Legal Permission and Ethics Approval Are Related but Not Identical
Another common mistake is to assume that permission from the data owner resolves the ethics question.
A hospital, university, government agency, or database administrator may have authority to grant access to particular records. That does not necessarily determine whether research ethics review is required. Conversely, an ethics committee's approval does not automatically grant legal or institutional permission to access records.
Permission to access data
Concerns whether the researcher is authorized to obtain or use the information.
Research ethics determination
Concerns whether and under what conditions the proposed research satisfies the applicable ethics-review requirements.
You may need both.
Data Linkage Can Change the Risk
A dataset that appears innocuous by itself can become more revealing when combined with another source. Linking educational records to health records, demographic information to geographic information, or supposedly de-identified records to detailed external datasets can increase the possibility of re-identification.
The Philippine national guidelines specifically call for additional safeguards when secondary databases contain personally identifiable information, including circumstances in which database linkage is contemplated.
Describe planned linkages explicitly in your protocol rather than assuming that the ethics status of each dataset separately determines the ethics of the combined analysis.
The Data's Provenance Matters
Researchers should know where secondary data came from and under what conditions they were created. A technically useful dataset may have been assembled without appropriate authority, obtained through questionable means, or stripped of contextual information needed to interpret consent and access restrictions.
The Philippine national guidelines explicitly call for due diligence where there is doubt or concern regarding how a secondary database was generated.
Watch Out
“Someone gave me the dataset” is not sufficient provenance. Before secondary analysis, establish who collected the information, for what purpose, under what permissions, what restrictions apply to its reuse, and whether your access is authorized.
