11.4 2024 Declaration of Helsinki, Ethics Review, Privacy & Copyright

2024 Declaration of Helsinki, Ethics Review, Privacy & Copyright

Current Helsinki Principles Relevant to Publication

The 2024 Declaration emphasizes scientific rigor, participant rights and well-being, fair inclusion, attention to vulnerability, community engagement, privacy, independent ethics review, informed consent, registration, and dissemination.

For publication work, four provisions are especially important:

1. The research protocol must clearly describe and justify the design and ethical considerations.
2. The relevant research ethics committee must review and approve the protocol before research begins and review amendments as required.
3. Medical research involving human participants must be registered in a publicly accessible database before recruitment of the first participant.
4. Paragraph 36 requires timely, complete, and accurate public dissemination, including negative and inconclusive as well as positive results, and declaration of funding, affiliations, and conflicts.

A manuscript should not merely insert “conducted in accordance with Helsinki” as boilerplate. Verify that the statement is appropriate to the research and agrees with the protocol, committee records, consent process, registry, and local requirements.

Research Ethics Committee Reporting

The ethics body may be called an institutional review board (IRB), independent ethics committee (IEC), research ethics committee (REC), or another local name. Report what actually occurred. Depending on the study and journal, the manuscript may need:

• committee name and location;
• approval or reference number;
• approval date;
• confirmation that relevant amendments were reviewed;
• informed-consent process;
• authorized waiver, exemption, or secondary-use approval;
• protections for privacy and confidentiality.

Do not fabricate an approval number or call a determination an “approval” if the committee classified the work as exempt. If multiple countries or sites are involved, describe the oversight structure accurately rather than implying that one decision automatically covered all sites.

Informed Consent Is Not One Universal Sentence

For capable participants prospectively enrolled in research, free and informed consent is ordinarily required and should be formally documented on paper or electronically. The 2024 Declaration recognizes circumstances requiring different processes:

• consent through a legally authorized representative for a person unable to consent;
• assent, where possible, in addition to representative consent;
• urgent research involving an incapacitated population under protocol-specified, ethics-approved conditions when consent cannot be obtained in time;
• secondary research on stored data or biological material when consent is impossible or impracticable, after ethics-committee consideration and approval.

Therefore, “written informed consent was obtained from every participant” is not a truthful universal template. Report the actual authorized process. A retrospective records study may have a waiver; fully anonymized data may fall outside some rules; identifiable secondary data may require committee approval and a lawful basis.

Consent to participate in research and consent to publish identifiable details are also distinct. A clinical case report or recognizable image may require specific publication consent under the journal's policy even when the patient received clinical care rather than participating in a trial.

Registration and Dissemination

Paragraph 35 calls for registration before the first participant is recruited. Paragraph 36 assigns dissemination obligations to researchers, authors, sponsors, editors, and publishers. Publication planning should therefore include unfavorable, neutral, and inconclusive results, not only commercially attractive findings.

A complete dissemination record may include registry results, a peer-reviewed article, plain-language results, data-sharing information, and corrections. The appropriate route depends on law, protocol, commitments, and audience. Suppressing a valid negative study because it may affect a product narrative is inconsistent with the Declaration.

HIPAA Privacy Rule

In the United States, the HIPAA Privacy Rule applies to covered entities and business associates and regulates protected health information (PHI). It is not a general privacy law governing every person or dataset.

Two HIPAA de-identification routes are:

Safe Harbor includes detailed rules and limited exceptions, including treatment of dates, geographic information, and age over 89. Do not reduce it to “remove the patient's name.” Rare diagnoses, images, narratives, and combined details may remain identifying. Also distinguish de-identification for HIPAA from the journal's separate publication-consent expectations.

GDPR

Under the EU General Data Protection Regulation, health, genetic, and certain biometric data are special-category personal data. Processing requires an Article 6 lawful basis plus an applicable Article 9 condition, along with other GDPR principles and relevant member-state law.

Pseudonymized data remain personal data when re-identification is possible with additional information. Truly anonymized data fall outside GDPR only when identification is no longer reasonably possible in context. Calling coded trial data “anonymous” is usually incorrect when a key still exists.

Publication teams should understand:

• purpose limitation and data minimization;
• transparency information;
• access controls and confidentiality;
• retention;
• processor and controller roles;
• data-subject rights and research-related conditions or derogations;
• international-transfer mechanisms.

Consent is not the only possible GDPR lawful basis, and research consent under ethics rules is not automatically the same as GDPR consent. Consult privacy specialists for the actual processing.

Copyright and Publication Agreements

Copyright questions begin with the work, owner, agreement, and proposed reuse. A traditional journal may require copyright transfer, an exclusive license, or a nonexclusive license. Do not assume every subscription journal owns all rights or that every author retains them.

Before reusing text, a table, figure, photograph, instrument, or graphical abstract, check:

1. who owns the material;
2. what the signed publication agreement says;
3. whether a third party supplied any part;
4. the license on the source;
5. whether the proposed reuse falls within that license;
6. whether permission or a required credit line is needed;
7. whether privacy or consent restrictions also apply.

Changing colors or redrawing a figure does not automatically eliminate copyright concerns. Facts and underlying data are not protected in the same way as a particular creative expression, but recreating a protected figure may still be an adaptation requiring permission.

Creative Commons and Open Access

“Open access” describes availability; the license controls reuse.

• CC BY permits sharing and adaptation, including commercial use, with required attribution and compliance with license terms.
• CC BY-NC restricts use to noncommercial purposes under the license; whether a use is noncommercial can require careful analysis.
• CC BY-ND does not permit distribution of adapted material under the license.
• CC0 is a public-domain dedication to the extent legally possible.

A pharmaceutical company should not assume that free online access authorizes commercial reprint distribution. Read the license and preserve attribution, notices, and indication of changes.

Rights Retention and Repositories

Funder and institutional policies may require deposit of an author accepted manuscript, impose a license, or support rights retention. The exact rule depends on the funder, grant, institution, journal, submission notice, and date. Plan S, NIH public-access policies, and publisher self-archiving terms should not be collapsed into one universal “zero embargo” rule.

Integrated Scenario

A retrospective multicenter study uses coded health records. One site has an ethics-approved waiver, another has a different local determination, and the data-transfer arrangement uses pseudonymized EU data. The publication should not say every participant gave written consent or that the dataset is anonymous. It should accurately report the site oversight and waiver structure, describe privacy protections, and use the legally correct term for the data.

If the team then reuses a figure from a prior article, ethics approval does not provide copyright permission. The team must separately examine ownership and license terms.