CG13 – Research

Practices that conduct human research need to adhere to various codes of conduct and fulfil responsibilities under federal legislation. These include:

• the Australian code for the responsible conduct of research (the Code), which was developed by the National Health and Medical Research Council (NHMRC). It promotes integrity of research and provides guidance about conducting responsible research.
• the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research (the AIATSIS Code), which was developed by the Australian Institute of Aboriginal and Torres Strait Islander Studies. If the patient sample includes Aboriginal and Torres Strait Islander peoples, the practice could refer to this code.

Practices conducting or participating in research need to collect, use and disclose data in compliance with privacy laws. Even when using de-identified patient health information, there are situations where the practice needs to obtain informed patient consent.

Human research ethics committees (HRECs) review research proposals that involve human participants in order to ensure that the proposed research is ethically acceptable and in accordance with relevant standards and guidelines. The HREC’s assessment of the research proposal includes a review of the project’s patient consent process.

There are many HRECs operating in institutions and organisations in Australia. A list of HRECs registered with the NHMRC is available here.

Information about the RACGP’s National Research and Evaluation Ethics Committee (NREEC) can be found at the RACGP website.

Ethics approval is usually required in research studies involving general practices and their patients, but there are some exceptions. The institution conducting the research or their Human Research Ethics Committee (HREC) will be able to provide advice about situations where ethics approval may not be required, and the practice’s role in this process.

The Code and consent requirements apply to all research. For example, they apply even if a member of the practice team is not conducting research themselves but is contributing to someone else’s research.

Research activities may pose potential risks for the practice and its patients. Therefore, the practice needs to understand those risks and confirm that the appropriate indemnity is in place, based on the research project’s level of risk.

The NHMRC National statement on ethical conduct in human research 2025 (National Statement) gauges research by the amount of risk it may pose to people involved in the research. The NHMRC explains levels of risk in research as follows:

Low risk research describes research, including some types of clinical trials, in which the only foreseeable risk is no greater than discomfort. Research in which the risk for participants or others is greater than discomfort is not low risk research. Research in this category carries risk of harm and is therefore considered higher risk research that requires review by a Human Research Ethics Committee (HREC).

Practices need to obtain their own advice about whether they require indemnity insurance for any research their practice is involved in.

In all cases, each of the practice’s GPs needs to ensure that their individual medical indemnity insurance covers their research activities, or purchase top-up or separate insurance cover that provides the appropriate level of indemnity required to participate in research. Failing to hold sufficient insurance cover may leave the practice’s GPs with an uninsured personal liability in the event of an adverse event for which a claim is made. The costs of defending such a claim, even where the practice GPs are not liable, may be significant.

An example of higher risk research is a clinical trial. If the practice is involved in a clinical trial, the practice will usually be indemnified by the sponsor, such as a university or a drug company, but the practice needs to make sure that the sponsor’s indemnity covers the practice’s liabilities. If it does not, the practice will need to get a separate insurance policy or indemnity.

If the research is not a clinical trial, the practice needs to determine whether it needs extra insurance to indemnify the practice for research. To do this, it is recommended that the practice discusses all potential risks with the practice team and the lead external researcher, as well as its insurance broker or indemnity insurer.

To assist with these discussions, external researchers may be able to provide a written document outlining the level of risk their research will pose to the practice and/or patients.

If the practice shares de-identified data for research or other purposes, the practice needs to enter a formal data-sharing agreement or contract with all external parties that intend to use the practice’s data. The RACGP’s Three key principles for the secondary use of general practice data by third parties provides guidance on what to consider when developing a data-sharing agreement. The practice could also obtain advice from a lawyer or Medical Defence Organisation (MDO) on what to include in the agreement.

The practice needs to ensure that it, and the external parties with which the practice has a formal agreement, comply with data management best practice. This includes:

• complying with the Privacy Act 1988 and the Australian Privacy Principles
• acting ethically with regard to general practice data
• using the data only for the agreed purposes
• ensuring the security of all data
• special consideration of data linkage (such as bringing together data related to one individual, family, place or event from disparate sources), including obtaining informed consent from the patient/s involved.

The practice needs to provide patients with information about the use of their health data by third party organisations, and provide them with opportunities to opt out of providing their data for secondary use.

Ensuring information transparency includes having processes or protocols to inform patients about the privacy and ethical principles implemented when data collected in the practice. To inform patients about how their data is collected and used, as well as how to opt out of data collection for research purposes, the practice could:

• publish information on its website, social media channels and newsletters
• explain on the patient registration form how their health information will be collected and shared, and how they can refuse consent to participate in research or opt out of data collection for research purposes
• display the information on posters throughout the practice.

In line with criteria at PP2 – Communication, the practice needs to provide information so that it is understood by the practice’s patients.

Many general practices may share de-identified data as part of large research or public health data collection programs. If the practice shares de-identified data, it needs to be confident that re-identification cannot occur. To prevent re-identifying individual patients, the practice needs to:

• separate identifiable demographic data from clinical data prior to linkage
• make sure that:
  • people involved in the linking of identifiable data do not have access to the clinical data
  • people with access to clinical data are not involved in linking identifiable data.