Berman JJ, Moore GW, Hutchins GM. Internet Autopsy Database.
Human Pathology 28:393-394, 1997
EDITORIAL: INTERNET AUTOPSY DATABASE.
Jules J. Berman, Ph.D., M.D.
G. William Moore, M.D., Ph.D.
Grover M. Hutchins, M.D.
In his October editorial in Human Pathology, Dr. Wagner stated the need for a national autopsy database (1). Such a database would be a powerful asset for epidemiologic research, outcomes analysis, and vital statistics. Moreover, autopsy records, unlike almost all other hospital records, are directly linked to tissue archives suitable for scientific research in numerous fields, including toxicology, medical genetics, and traditional morphologic studies (2,3).
The importance of a national autopsy database is particularly urgent at this time, as autopsy rates continue to decline. How can pathologists and healthcare administrators justify the expense of an autopsy when there is no mechanism to collect, organize, and analyze autopsy data? This question seems especially relevant when one considers that virtually all that we think we know regarding causes of death in the United States derives from death certificate data. Although the unreliability of death certificate data is the subject of worldwide complaint and derision, death certificate data are used because aggregate autopsy data are unavailable (4,5). Furthermore, currently pending U.S. federal legislation may sharply restrict the archival storage of human tissue and the use of such tissue for medical research (6,7). This fact alone is a compelling reason to demonstrate that a national autopsy database is a feasible and valuable public health resource.
In the 1970s, The College of American Pathologists (CAP) established an autopsy committee charged with "standardizing" the autopsy and establishing a "national autopsy databank" (8,9,10). The problems faced included:
1. How can the autopsy be standardized?
2. How can the data from the autopsy be abstracted into a database record?
3. How can these database records be assembled within an institution, and merged with the data from other institutions?
4. How can the privacy of patients be preserved?
5. Who will have access to the data?
6. How will the data be distributed?
As a preliminary attempt to solve these problems, we introduced the Internet Autopsy Database (IAD), sponsored by The Johns Hopkins Medical Institutions Department of Pathology, in November, 1995. The IAD can be visited on the World Wide Web at:
The entire database is available to anyone in the world, and every record in the database can be downloaded. The IAD consists of over 49,000 abstracted autopsy records contributed by over a dozen medical institutions, and has been described in two recent publications (11,12). Patient identifiers have been removed by a brokered double encryption method that makes it impossible for any single person or institution to link a patient or institutional name with an IAD autopsy record. Autopsy records in the IAD contain demographics (age, race, sex, and year-of-autopsy) and diagnostic terms (topography and morphology codes for all diagnoses determined at autopsy).
One of the most important issues facing anyone who wishes to assemble anatomic pathology databases is that of patient confidentiality. How do you merge data from multiple institutions while maintaining patient privacy? Currently, under the U. S. Code of Federal Regulations, confidentiality maintained by anonymizing the specimens (removing all links between the patient name and the specimen) is sufficient for research purposes (13). Tissue anonymization has come under attack by legal experts and ethicists, who argue that persons contributing tissues and personal data may have certain rights regarding the selection of studies and the disposition of the results of studies in which their tissues and personal data are used (5,6). The emerging paradigm for patient confidentiality is informed consent, in which patients must approve any intended use of their tissues and personal data. The requirement of prior informed consent for the storage of tissues and for all studies employing tissues threatens an end to tissue archives and an end to retrospective studies, the bread and butter of the research pathologist. Tissue archives are maintained so that the tissues are available for studies unimagined at the time that the tissues were obtained. Therefore, it is impossible to obtained specific informed consent for studies conducted on tissues that were collected decades or centuries in the past.
In the IAD, personal identifiers are removed by a brokered double encryption method that makes it impossible for any single person to link a personal or institional name with an IAD autopsy record. However, with the cooperation of four entities (the scientist, the IAD administrator, the institutional contributor (Institutional Review Board, IRB), and the patient's heirs and assigns, the linkage can be reconstituted (reversible anonymization) (12). Various legislative proposals are now pending that will determine legally binding confidentiality measures for persons interested in using stored human tissue for research. We are hopeful that any legislation will:
1. Exclude restrictions on tissues obtained before the passage of the law (so that pathologists may continue to perform retrospective studies on existing paraffin tissue archives).
2. Permit pathology departments to continue archiving tissues, if patients sign a general consent form permitting their tissues to be archived. Presumably, archival consent would be included in the consent form for all biopsy procedures, and would also be included in autopsy consent forms.
3. Continue to permit the public use of anonymized anatomic pathology data.
4. Accept as legally valid the acquisition of informed consent for tissue studies via a brokered decryption of anonymized linkages, performed with the approval of the contributing institution's IRB and the patient (or the patient's heirs and assigns).
Pathologists interested in deriving informational value from tissue and report archives face many formidable tasks, not the least of which is the conversion of free text reports into a form that can be collected as data within medical datasets (14,15,16). Making full use of pathology data requires us to acquire skills in the areas of computer programming, computational linguistics, database analysis, statistics, epidemiology, outcomes analysis, administration, law, ethics and molecular biology. If pathologists do not participate in and support these efforts, our accumulated data will be taken from us (a phenomenon that is already occurring) and used by workers with limited understanding or appreciation of our data.
1. Wagner BM. The future of environmental and toxicologic pathology
(Editorial). Human Pathol 27:1003-1004, 1996.
2. Kleiner DE, Emmert-Buck MR, Liotta LA. Necropsy as a research
method in the age of molecular pathology. Lancet 346:945-948, 1995.
3. Steel CM. Necropsy as a research method.
Lancet 346:1368-1369, 1995.
4. Cameron HM, McGoogan E. A prospective study of 1152 hospital
autopsies. 1. Inaccuracies in death certification.
J Pathol 133:273-283, 1981.
5. Kircher T, Nelson J, Burdo H: The autopsy as a measure of
accuracy of the death certificate. N Engl J Med. 313:1263-1269, 1985.
6. U. S. Senate 1416, H.R. 2690: The Genetic Privacy and
Non-Discrimination Act of 1995. November 15, 1995 (Senate);
November 29, 1995 (H.R.). U. S. Senate 1360. The Medical Records
Confidentiality Act of 1995: October 24, 1995. U. S. Senate 1898.
The Genetic Confidentiality and Non-Discrimination Act of 1996:
June 24, 1996.
6. U. S. Senate 1416, & H.R. 2690. The Genetic Privacy and
Non-Discrimination Act of 1995, November 15, 1995.
U. S. Senate 1360. The Medical Records Confidentiality Act of 1995.
U. S. Senate (1996), Bill 1898.
7. Clayton EW, Steinberg KK, Khoury MJ, Thomson E, Andrews L,
Kahn MJ, Kopelman LM, Weiss JO. Informed consent for genetic research
on stored tissue samples. JAMA 274:1786-1792, 1996.
8. Peery TM. The autopsy data bank. A proposal for pathologists
to contribute to the health care of the nation. Am J Clin Pathol
69 (Suppl): 258-259, 1978.
9. Carter JR, Nash NP, Cechner RL, Platt RD. Proposal for
a national autopsy data bank. A potential major contribution
of pathologists to the health care of the nation. Am J Clin Pathol
76 (Suppl): 597-617, 1981.
10. Kircher T, Carter JR, Sinton E. The national autopsy databank.
Pathologist. 39:22-26, 1985.
11. Moore GW, Berman JJ, Hanzlick RL, Buchino JJ, Hutchins GM.
A prototype international autopsy database: 1625 consecutive fetal
and neonatal autopsy facesheets spanning twenty years.
Arch Pathol Lab Med 120:782-785, 1996.
12. Berman JJ, Moore GW, Hutchins GM. Maintaining patient
confidentiality in the public domain internet autopsy
database. J Amer Med Informatics Assn (JAMIA), Symposium
Supplement, pp. 328-332, 1996.
13. U. S. Code of Federal Regulations, 45 CFR Subtitle A
(10-1-95 Edition), part 46.101 (b) (4).
14. Berman JJ, Moore GW. SNOMED-Encoded surgical pathology
databases: a tool for epidemiologic investigation.
Modern Pathology 9:944-950, 1996.
15. Moore GW, Berman JJ. Automatic versus manual SNOMED coding:
quantitating the differences. Am J Clin Pathol 101:253-256, 1994.
16. Moore GW, Berman JJ. Automatic SNOMED Coding. Journal of the
American Medical Informatics Association (JAMIA), Symposium Supplement
1994 and the Proceedings of the 18th Annual Symposium for Computer
Applications in Medical Care (SCAMC), pp. 225-229, 1994.
1. U. S. Senate 1416, H.R. 2690. The Genetic Privacy and
Non-Discrimination Act of 1995. November 15, 1995 (Senate);
November 29, 1995 (H.R.).
2. U. S. Senate 1360. The Medical Records Confidentiality Act
of 1995. October 24, 1995.
3. U. S. Senate 1898. The Genetic Confidentiality and
Non-Discrimination Act of 1996. June 24, 1996.
4. U. S. Code of Federal Regulations, 45 CFR Subtitle A
(10-1-95 Edition), part 46.101 (b) (4).
Information obtained 11/7/96, 3:30 PM, from U.S. Senate Document
Room, 1-202-224-7860. (U.S. Senate 1-202-224-3121.)
INFORMED CONSENT ISSUES RELATING TO THE INTERNET AUTOPSY DATABASE
To the Editor:
The Internet Autopsy Database (IAD) is a public domain collection of information abstracted from over 49,000 autopsy facesheets (lists of Final Anatomic Diagnoses) (4,5). The purpose of the database is to provide a growing international repository of autopsy data that can support studies in the fields of epidemiology, pathogenesis, and molecular biology. Each database record contains basic demographic data (e.g., age and gender of patient, year of autopsy and geographic region), and clinical autopsy findings translated into SNOMED compatible terms. Patient identifiers, institution identifiers and autopsy record identifiers have been stripped from the records, to assure patient anonymity.
Current legislation details the circumstances that would require a U.S. federally funded researcher to obtain informed consent from each patient (or patient's estate) before conducting research on that patient's stored tissue. Obviously, users of the IAD cannot obtain consent from a patient they cannot identify, and who was autopsied at an institution they cannot identify. Currently, retrospective studies on anonymous tissue are specifically exempted from informed consent restrictions, as follows:
"Research, involving the collection or study of existing
data, documents, records, pathological specimens, or
diagnostic specimens, if these sources are publicly available
or if the information is recorded by the investigator in such
a manner that subjects cannot be identified, directly or
through identifiers linked to the subjects."(6)
IAD materials are rendered anonymous as follows, so that neither the investigator, the IAD systems operator, nor the contributing institution alone can trace the identity of patient records published in the IAD. First, the contributing institution is asked to strip or encode patient identifiers from their submitted records. In this manner, the IAD systems operator cannot know the identity of the patient. The IAD systems operator then provides a new, encoded identifier for each record before the record is published on the IAD. The record that appears is anonymous to the institution that provided the autopsy, to the IAD systems operator, and to anyone retrieving the autopsy record from the IAD Web page. If a researcher wishes to retrieve the tissue on a certain block, he/she must send an e-mail to the IAD systems operator, identifying the IAD autopsy record of interest and his/her research objective. The systems operator decodes the record and restores the original record code provided by the contributing institution. The systems operator then forwards the institutionally coded record to the institution. At this point, the institution might decide to do nothing, preferring not to become involved in the researcher's project. Or, the contributing institution could use its institutional code to link back to the original patient autopsy number, retrieve the tissue block in question, and establish a collaboration that maintains patient confidentiality, i.e., the researcher need never learn the identity of the patient, the contributing institution need never learn the results of the scientific study and the systems operator need never learn either the results of the study or the identity of the patient.
Some countries define the hospital (i.e., non-forensic) autopsy in a manner that clarifies the rights of researchers. The Council of the Royal College of Pathologists of Australasia endorses the following definition:
"An autopsy has been described as a post-mortem examination
of the body of the deceased for the purpose of scientific
interest in determining the cause of death and other
information that may be obtained that might aid medical
Since the recognized purpose of the autopsy (in Australia) is to advance science, the consent for autopsy carries with it an implied consent for the research use of autopsy tissues. This does not mean that all research use of autopsy tissue has blanket institutional approval, but does mean that informed consent is not an issue for the investigator.
The legal issues of confidentiality for autopsy material in England seem to favor the researcher's interests over the interests of the patient's estate. Under British law, the person who sues for breach of confidentiality must be the confider, and therefore, breach of confidence becomes moot when the patient (confider) dies. British coroners have broad discretion over the disposition of autopsy data, and although issues of tort are different from ethical issues, it would seem that British researchers utilizing autopsy tissue, anonymous or otherwise, are unlikely to face legal restrictions (2).
New efforts that would greatly restrict the use of stored tissues for genetic research are under consideration in the U.S.A. In particular, the NIH-DOE joint working group on ethical, legal, and social implications of human genome research (ELSI) is reaching a consensus that informed consent (from the patient or his estate) for studies on stored tissues should be required for all non-anonymous tissue study and for prospective anonymous tissue studies (1).
The definition of "anonymous" used by both ELSI and the NIH-DOE workshop specifies that a specimen is anonymous if it is impossible under any circumstances to identify the individual source (1,7). Under this definition, compliance with informed consent is logically impossible. In order for a researcher to prove that informed consent was obtained for a tissue specimen, the informed consent document, including the patient's name, would have to be produced. Thus the act of producing the consent document for a tissue specimen establishes the patient's identity and invalidates the tissue's anonymity. On the other hand, if it is impossible to link a patient with a tissue, then it is impossible to notify the patient of results that might have medical consequences for that patient.
We propose a practical definition for anonymity, in which no person or institution, acting alone, may link a tissue sample with a patient. This definition would mean that a researcher and one or more persons or institutions could work in tandem to link a tissue with a consent form (hence, the patient's identifiers). The linkage between tissue and patient identifiers can be conducted in such as way that no individual or institution has access to the data associated with the identifiers. The IAD uses doubly encoded identifiers and an intermediary (IAD systems operator) who guards the identity of the contributing institution and the researcher, unless a collaboration is sought. In our opinion, this kind of arrangement is the only workable scheme that maintains patient anonymity while permitting the use of consent forms and extending the possibility of intervention in medical situations wherein a patient may choose to acquire knowledge uncovered by a researcher.
Legal guidelines for the use of stored tissue samples for research, particularly genetic research, may vary greatly among countries and among local governments within countries. The IAD is constructed in such a way that patient confidentiality is maintained, and tissues are made available to researchers at the discretion of the institution that provided the autopsy report. Both researcher and contributing institutions must act in accordance with their own ethical and legal environments, and in many cases, this would require obtaining approval through their respective Institutional Review Boards (IRB). A global cooperative effort such as the IAD demonstrates the complexity of patient consent issues, but provides a novel mechanism for sharing a wealth of clinical materials.
Jules J. Berman, Ph.D., M.D.
G. William Moore, M.D., Ph.D.
Grover M. Hutchins, M.D.
1. Clayton EW, Steinberg KK, Khoury MJ, Thomson E, Andrews L, Kahn MJ, Kopelman LM, Weiss JO. Informed consent for genetic research on stored tissue samples. JAMA 1996;1786-92.
2. James DS, Leadbeatter S. Confidentiality, death and the doctor. J Clin Pathol 1996;49:1-4.
3. The Royal College of Pathologists of Australasia. Autopsy and the use of tissues removed at autopsy. Med J of Australia 1994; 160:442-5.
4. Moore GW, Berman JJ, Hanzlick RL, Buchino JJ, Hutchins GM. A prototype national autopsy databank: 1,625 consecutive fetal and neonatal autopsy facesheets spanning twenty years. In press, Arch Pathol Lab Med, in press.
6. U. S. Code of Federal Regulations, 45 CFR Subtitle A (10-1-95 Edition), part 46.101 (b) (4).
7. Summary of Meeting, 18th meeting of the NIH-DOE joint working group on ethical, legal, and social implications of human genome research. December 5-6, 1994.