[Obstacles in Secondary Analysis of Routine Data From Primary Care]

Routinely recorded data from everyday ambulatory medical care are urgently needed for health services and systems research, but this faces major limitations in Germany. In 2018, European General Data Protection Regulation (GDPR) and new German Federal Data Protection Act (FDPA) become effective. Via simulated real-life scenarios it may be possible to find out if access to and utilization of routine data for research becomes easier or faces additional obstacles.

General practitioners, information scientists, data trustees and privacy protection experts create concepts, processes and standards for lawful handling of routinely recorded data for secondary research and study their feasibility in 2 scenarios (anonymous and pseudonymous data utilization). From the point of view of technical assessment and privacy protection, technical and organizational obstacles are presented as well as the legal framework.

Outdated software interface, insufficient maintenance by software vendors, burdens associated with organization and cost as well as poor IT standards place obstacles to systematic and longitudinal use of healthcare routine data. Future pan-European law for privacy protection will allow research utilization of ambulatory data in principle. However, there are persisting conflicts between individual (fundamental right of privacy protection) and public interests (research for quality and efficiency of public spending; European market's free exchange of goods and services). This becomes evident especially when using routine data via pseudonymization.

Neither insurmountable hurdles by privacy protecting law nor a threat from Big Data are currently the major obstacles to secondary utilization of routine data but real-life problems at the technology and operational level. GDPR and FDPA that have become into effect in May 2018 have improved European legal unity and transparency of patients' interests. Tension between privacy protection of data on an identified or identifiable person and scientific utilization and exchange of such data in public interest necessitates additional legal clarification. One possible solution, an advanced and ready-to-use software interface, awaits implementation.