​​Norwegian

The importance of clarifying purpose 

The purpose of using health information is decisive for which rules the project must comply with, which approvals the project is dependent on and which authorities the project may have to contact.  Therefore, when starting new projects, a decision must be made as to what the purpose of the project is. You can get help deciding which category your project falls in by reading the guide below. 

This guidance on clarification of purpose must be seen in conjunction with [clarification of data sources​]. 

Projects that use machine learning and artificial intelligence should familiarize themselves with the Directorate of Health's guide before carrying out the activities addressed in this guide. ​

What is the purpose of the project? 

Research

Research projects are characterized by the fact that scientific methods are used to generate new knowledge. The legislation distinguishes between health research and other research. Health research is research that aims to generate new knowledge about health and disease. 

Within a research project, there can also be activities that have other purposes than research - such as innovation and product development. 

Health research² 

• Must have prior ethical approval from REK before the project can be implemented (Health Research Act [helseforskningsloven] § 9). 
  

• For access to health information from treatment-oriented health registers (patient record systems): Dispensation from the duty of confidentiality must be sought from REK), when consent has not been obtained from the individual (Health Personnel Act [helsepersonelloven]§ 29). 
• For access to health information from health registers that are covered by the Directorate for e-health's (Helsedataservice) decision-making authority: Dispensation must be sought from Helsedataservice, when consent has not been obtained from the individual. 
• For access to health information from other health registers: Dispensation from the obligation of confidentiality must be sought from REK, when consent has not been obtained. 
  
• For the compilation of health information from processing-oriented health registers and health registers that are not covered by the Directorate for e-health's [Direktoratet for e-helse] decision-making authority: An application must be made for exemption from the obligation of confidentiality from REK, when consent has not been obtained from the individual. 
• Must be assessed by the data protection officer. 
  
  

Other research 

• No requirement from REK for prior ethical approval. 
• In case of doubt as to whether the project is health research or other research, the project leader should contact REK to request an assessment of the submission requirements. 
• Must have a dispensation from the duty of confidentiality to process health information without consent from the individual. For applications for dispensation, what is written under the heading "health research" applies. 

• Must be assessed by the data protection officer. 

Detailss regarding research projects with partially innovative purposes 

• REK can grant a dispensation from the duty of confidentiality for the processing of health information for the development of clinical decision support tools that take place within the framework of a research project. 
  
• Must be assessed by the data protection officer. 
  

Quality assurance and quality improvement

Internal quality assurance 

Quality assurance of health care involves checking that diagnostics, treatment and other health care actually produce the intended results and evaluating whether the requirements for quality have been met. Quality assurance can provide a basis for quality improvement. 

The company's management can decide that health information from treatment-oriented health registers (patient records, etc.) in the organization must be used for internal quality assurance, cf. of the Health Personnel Act [helsepersonelloven] § 26. The information must, as far as possible, be provided without personal details. Internal quality assurance does not require consent or exemption from the duty of confidentiality. 

Quality improvement 

Quality improvement means increasing the quality of health care through changes in practice. This often requires studying different practices and outcomes for the patients. In projects where the purpose is to obtain knowledge that can be used to change practice, quality improvement will be the correct description of purpose. 

Quality surveys that are not part of research should seek access to health information for quality improvement purposes. 

• For health information from treatment-oriented health registers or other health registers, an application is sent to the Directorate of Health [Helsedirektoratet] (form). 

Quality studies 

Quality improvement is often closely linked to research. Research-based quality studies (studies that use scientific methodology) should seek access to health information for research purposes (see above, under "research"). 

Establish a quality register 

It is possible to establish a more general quality register which should be able to serve various quality improvement projects in the future. A medical quality register is a structured collection of health information where results for a defined patient group are continuously documented. 

The primary purpose of a quality register must be quality improvement, but research is an important secondary purpose. Once a quality register has been established, the register can release data to research projects (provided that the statutory conditions for release are otherwise met). 

Establishing a medical quality register does not require prior approval from external authorities. As a general rule, the establishment must be based on the consent of the patients who are included. Exceptions to the requirement for consent apply when the following conditions are met: 

• the requirement for consent means that the patient group and health care are not represented well enough for the quality register to achieve its purpose; 
• the data subject has the right to object to the information being processed (right of reservation); 

• the data controller has consulted with the data protection representative;
  
• the data controller for the quality register is a regional health organisation, health organisation, municipality, county municipality or private non-profit organization with an operating agreement with a regional health organization. 
  

​Statistics and health analyses

The purpose descriptions "statistics" or "health analyses" are used for projects that are to prepare statistics or carry out health analyses without it being natural to count the activities as research or quality improvement. 

• Must have a dispensation from the duty of confidentiality to process health information without consent from the individual. 

The application is addressed to the Directorate of Health [Helsedirektoratet] (form) for access to health information from the following data sources: treatment-oriented health registers (patient records); health registers that are not covered by the Directorate for e-health's [Direktoratet for e-helse] decision-making authority (see list here); compilation of health information from the two aforementioned data sources. 

If health information from processing-oriented health registers or other health registers is to be combined with information from health registers that are covered by the Directorate for e-Health's [Direktoratet for e-helse] decision-making authority, the application must be sent to Health Data Service. Applications are submitted by logging in to helsedata.no. 

• Must be assessed by the data protection officer ​
  

​Planning and management​

These categories may, for example, be appropriate for projects that are to survey the occurrence of disease with a view to administrative or organizational measures (i.e., measures within the health service that do not change the health care itself). For example, there may be analyses with a view to optimizing staffing routines, purchasing, or something else. 

• Must have a dispensation from the duty of confidentiality to process health information without consent from the individual. 
• The application is addressed to the Directorate of Health [Helsedirektoratet] (form) for access to health information from the following data sources: treatment-oriented health registers (patient records); health registers that are not covered by the Directorate for e-health's [Direktoratet for e-helse] decision-making authority (see list here); compilation of health information from the two aforementioned data sources. 
• If health information from processing-oriented health registers or other health registers is to be combined with information from health registers that are covered by the Directorate for e-Health's decision-making authority, the application must be sent to Health Data Service [Helsedataservice]. Applications are submitted by logging in to www.helsedata.no.  
• Must be assessed by the data protection officer. 
  

Preparedness

Clinical decision support tools include many types of aid that can help clinician make decisions in connection with clinical activities. For example, there may be summaries of knowledge that contribute to health care built  on a knowledge-based foundation or there may be algorithms that make treatment-relevant predictions. The term "clinical decision support tool" does not include tools that mainly have a mercantile purpose or perform purely administrative tasks. It is a technology-neutral term. 

• Must have a dispensation from the duty of confidentiality to process health information without consent from the individual (Directorate of Health [Helsedirektoratet], form). 
• The application is addressed to the Directorate of Health [Helsedirektoratet] (form) for access to health information from the following data sources: treatment-oriented health registers (patient records); health registers that are not covered by the Directorate for e-health's [Direktoratet for e-helse] decision-making authority (see list here); compilation of health information from the two aforementioned data sources. 
• If health information from processing-oriented health registers or other health registers is to be combined with information from health registers that are covered by the Directorate for e-Health's decision-making authority, the application must be sent to Health Data Service [Helsedataservice]. Applications are submitted by logging in to www.helsedata.no.  
• Must be assessed by the data protection officer. 
  

Product development

In some projects, the purpose of using health information will be to develop a product. This may, for example, be relevant within artificial intelligence. Please note that the regulations for the use of health information for product development are unclear. In case of uncertainty, it is therefore important to seek advice. 

Clinical decision support tool 

Clinical decision support tools include many types of aid that can help clinician make decisions in connection with clinical activities. For example, there may be summaries of knowledge that contribute to health care built  on a knowledge-based foundation or there may be algorithms that make treatment-relevant predictions. The term "clinical decision support tool" does not include tools that mainly have a mercantile purpose or perform purely administrative tasks. It is a technology-neutral term. 

• Must have a dispensation from the duty of confidentiality to process health information without consent from the individual (Directorate of Health [Helsedirektoratet], form) 

• Must be assessed by the data protection officer. 
• Clinical testing³ of the tool must be approved in advance by REK. 
  
• It must be assessed whether clinical trials must also be pre-approved by, or reported to, the Norwegian Medicines Agency [Statens legemiddelverk] (guidance) 
• It must be assessed whether the tool is to be commercialized [link to guidance for this assessment will come later]. 
  

Administrative decision support 

Purely administrative decision support tools fall outside the concept of "clinical decision support". The rules for the use of health information for the development of administrative decision support tools are unclear. Projects that will use health information to develop administrative decision-making support without the consent of the individual should consider whether an exemption from the duty of confidentiality can be applied for under the rules for "planning and management" (see above). 

Process automation 

Certain product types concern the automation of various processes (especially relevant for products within artificial intelligence). The rules for using health information for process automation are unclear. Projects that will use health information for process automation without the consent of the individual should consider whether an exemption from the obligation of confidentiality can be applied for under the rules for "quality improvement" (see above). ​