A new feature of the NHS research ethics approval process is the Confidentiality Advisory Group (CAG). For those unfamiliar with CAG, it is a specialised independent body that provides expert advice to the Health Research Agency (HRA) and the Secretary of State for Health on non-research use of patient data. It aims to safeguard patients and public interests by facilitating appropriate use of confidential patient information beyond direct patient care. The NHS medical record is considered the most comprehensive in the world, with all of the combined patient data representing significant potential and possibilities for new treatment, medico-technological innovations and ground-breaking research. In this context, CAG is positioned as a much-needed safeguard of public interest to assess the valid use of the data including who can access this data when, why and whether consent is required and assess attendant risks.
For researchers conducting research in health and social care settings that require access to personally identifiable records without direct patient or servicer user consent, a CAG review is now part of the review. Researchers are now expected to outline the process and rationales in an application as to why access to identifiable personal data without consent is required.
However, it is the implementation of this idea I want to reflect on. It appears in setting up CAG, the HRA and the Department of Health (DoH) have engaged with Research Ethics Committees (REC) about the role of CAG, and not so much with users of this service, namely researchers, many of whom have expressed dismay at what a ‘CAG’ is. Most researchers conducting observational qualitative studies requiring National Health Service (NHS) Research Ethics Committee (REC) review, find out about CAG either after submitting a REC application and receiving an REC recommendation that approval is subject to CAG review, or from colleagues who have had the former experience alerting others to consider applying for both REC and CAG review simultaneously to avoid delays.
The application for a CAG Review on the IRAS platform is easily missed. There is no information on the IRAS pages alerting researchers applying for REC review that they could be required to submit for CAG review either.
A CAG review is based on what is referred to as a “precedent set criteria,” a list of situations where a CAG review is required. However, this information is not available on CAG or IRAS forms. Neither does the form or page indicate that for this to be completed you have to clearly state in your submission under which criteria your application falls under. To find the criteria one has to visit the CAG website where a list of “precedent set criteria” can be found. For qualitative and ethnographic research, it is set criteria 10 which attends to concerns of “exposure to confidential information when observing practices and procedures in a privileged area within Health and Social Care settings.” Confidentiality plays an important role in research, and ensuring participants and the public are assured their involvement and personally identifiable data are treated as strictly confidential plays a significant role in generating new knowledge and bringing about better understanding of people’s experiences.
While crucial to ethical review, for ethnographic research, the focus on confidentiality as an ethical concern is not new. It is adequately addressed in existing procedures within IRAS which requires researchers to outline if confidential information is collected, how and where, and how such confidential information is managed. If the concern is mostly about researchers hearing about confidential patient or service user information without their consent, it is impossible to obtain consent from everyone whose data is discussed in healthcare settings later on anyone who enters spaces where observations take place. Researchers have managed this by strict confidentiality and anonymity of information obtained in these spaces, discussing in general terms what is observed and not personally identifiable data. It appears there is a misunderstanding about the nature of qualitative observation research and what researchers would do with such information. This is in keeping with the long-standing critiques of the IRAS and REC systems focussing on clinical trials and neglecting other forms of research. There is an assumption that observational studies attending privileged spaces may collect identifiable personal data and use these in their research or for commercial purposes. On the contrary, the focus of qualitative observation research is on practices and organisational cultures and experiences of people (staff, patients and service users) within them. Therefore, it is difficult to see what the new CAG criteria add to these existing processes for observational research.
Beyond these misconceptions, another issue is the submission process. Once completed, the form and collated documents have to be emailed in to a separate email account managed by the HRA. A system that somehow undermines a process the HRA has worked to refine in recent years to ensure a single submission point for an ethics review. At times working through this process felt like trying to find my way through a dark room. Those not familiar with the process may potentially have to apply several times before an application is considered valid for review. All this requires additional administrative efforts and takes valuable time from the research, and it can result in delays. Delays we know are costly for both the researcher and the funders. The process felt unnecessarily complicated and onerous.
While the aims and goals of CAG are for the most part commendable in light of growing interest to mine NHS data for research, its relevance for qualitative observational research remains to be seen. This is not to suggest that ethnographers should not be asked to reflect on the ethical implications of being in privileged spaces during research in health and social care settings. But to consider, if the issue as currently understood within CAG is an ethical issue that we should be focusing on.
With time we may, as we did with the IRAS system, all come to terms with CAG and how it works. However, there is need for the HRA to refine the application process, engage with a wider audience about what CAG is and how it works and consider ways in which CAG applies to significantly different models of research.
What’s CAG got to do with it? Reflections on the Confidentiality Advisory Group
by Shadreck Mwale May 7, 2025A new feature of the NHS research ethics approval process is the Confidentiality Advisory Group (CAG). For those unfamiliar with CAG, it is a specialised independent body that provides expert advice to the Health Research Agency (HRA) and the Secretary of State for Health on non-research use of patient data. It aims to safeguard patients and public interests by facilitating appropriate use of confidential patient information beyond direct patient care. The NHS medical record is considered the most comprehensive in the world, with all of the combined patient data representing significant potential and possibilities for new treatment, medico-technological innovations and ground-breaking research. In this context, CAG is positioned as a much-needed safeguard of public interest to assess the valid use of the data including who can access this data when, why and whether consent is required and assess attendant risks.
For researchers conducting research in health and social care settings that require access to personally identifiable records without direct patient or servicer user consent, a CAG review is now part of the review. Researchers are now expected to outline the process and rationales in an application as to why access to identifiable personal data without consent is required.
However, it is the implementation of this idea I want to reflect on. It appears in setting up CAG, the HRA and the Department of Health (DoH) have engaged with Research Ethics Committees (REC) about the role of CAG, and not so much with users of this service, namely researchers, many of whom have expressed dismay at what a ‘CAG’ is. Most researchers conducting observational qualitative studies requiring National Health Service (NHS) Research Ethics Committee (REC) review, find out about CAG either after submitting a REC application and receiving an REC recommendation that approval is subject to CAG review, or from colleagues who have had the former experience alerting others to consider applying for both REC and CAG review simultaneously to avoid delays.
The application for a CAG Review on the IRAS platform is easily missed. There is no information on the IRAS pages alerting researchers applying for REC review that they could be required to submit for CAG review either.
A CAG review is based on what is referred to as a “precedent set criteria,” a list of situations where a CAG review is required. However, this information is not available on CAG or IRAS forms. Neither does the form or page indicate that for this to be completed you have to clearly state in your submission under which criteria your application falls under. To find the criteria one has to visit the CAG website where a list of “precedent set criteria” can be found. For qualitative and ethnographic research, it is set criteria 10 which attends to concerns of “exposure to confidential information when observing practices and procedures in a privileged area within Health and Social Care settings.” Confidentiality plays an important role in research, and ensuring participants and the public are assured their involvement and personally identifiable data are treated as strictly confidential plays a significant role in generating new knowledge and bringing about better understanding of people’s experiences.
While crucial to ethical review, for ethnographic research, the focus on confidentiality as an ethical concern is not new. It is adequately addressed in existing procedures within IRAS which requires researchers to outline if confidential information is collected, how and where, and how such confidential information is managed. If the concern is mostly about researchers hearing about confidential patient or service user information without their consent, it is impossible to obtain consent from everyone whose data is discussed in healthcare settings later on anyone who enters spaces where observations take place. Researchers have managed this by strict confidentiality and anonymity of information obtained in these spaces, discussing in general terms what is observed and not personally identifiable data. It appears there is a misunderstanding about the nature of qualitative observation research and what researchers would do with such information. This is in keeping with the long-standing critiques of the IRAS and REC systems focussing on clinical trials and neglecting other forms of research. There is an assumption that observational studies attending privileged spaces may collect identifiable personal data and use these in their research or for commercial purposes. On the contrary, the focus of qualitative observation research is on practices and organisational cultures and experiences of people (staff, patients and service users) within them. Therefore, it is difficult to see what the new CAG criteria add to these existing processes for observational research.
Beyond these misconceptions, another issue is the submission process. Once completed, the form and collated documents have to be emailed in to a separate email account managed by the HRA. A system that somehow undermines a process the HRA has worked to refine in recent years to ensure a single submission point for an ethics review. At times working through this process felt like trying to find my way through a dark room. Those not familiar with the process may potentially have to apply several times before an application is considered valid for review. All this requires additional administrative efforts and takes valuable time from the research, and it can result in delays. Delays we know are costly for both the researcher and the funders. The process felt unnecessarily complicated and onerous.
While the aims and goals of CAG are for the most part commendable in light of growing interest to mine NHS data for research, its relevance for qualitative observational research remains to be seen. This is not to suggest that ethnographers should not be asked to reflect on the ethical implications of being in privileged spaces during research in health and social care settings. But to consider, if the issue as currently understood within CAG is an ethical issue that we should be focusing on.
With time we may, as we did with the IRAS system, all come to terms with CAG and how it works. However, there is need for the HRA to refine the application process, engage with a wider audience about what CAG is and how it works and consider ways in which CAG applies to significantly different models of research.