Foreword

The accreditation process collects data — about facilities, about clinical practices, and indirectly about patients. ASF’s standards development process also generates data: through pilot testing, through public consultations, through field observations by surveyors. This policy answers a question that arises naturally from those activities: at what point does data collection by an accreditation body become human subjects research, and what ethical obligations follow from that?

The answer matters in both directions. Treating ordinary accreditation survey activity as human subjects research would create an unmanageable ethics review burden. Treating data collection that genuinely constitutes research as if it were merely quality improvement would bypass protections that exist to prevent harm to patients, communities, and indigenous populations. This policy draws the boundary as carefully as the available frameworks allow.

The policy is grounded in the Declaration of Helsinki, the Belmont Report, the CIOMS International Ethical Guidelines, the CARE Principles for Indigenous Data Governance, GDPR, and Georgian data protection law. It applies to ASF’s own activities and to the data collection activities of accredited facilities where those activities intersect with the accreditation process.

1. The Central Question

ASF accreditation involves the systematic collection of data about facilities and — through patient tracers and the Patient Voice survey — about individual patients’ experiences of care. ASF’s standards development involves evidence review, pilot testing, and field consultation that generates data about clinical practice. The central question this policy answers is: when does this data collection constitute human subjects research requiring ethics review, and when is it quality improvement or professional practice evaluation that does not?

The distinction matters because research involving human subjects — particularly patients — is subject to mandatory ethics review, informed consent requirements, and data protection obligations that go beyond those applicable to quality improvement. Getting this boundary wrong in either direction creates problems: treating quality improvement as research creates unnecessary bureaucratic burden; treating research as quality improvement bypasses protections that exist to prevent harm.

2. International Framework

• Declaration of Helsinki (WMA, 1964; revised 2013) — the foundational ethical principles for medical research involving human subjects; applies to any research involving identifiable human data [1]
• Belmont Report (1979) — three principles: respect for persons, beneficence, justice; grounds the US Common Rule and informs international practice [2]
• CIOMS International Ethical Guidelines for Health-Related Research Involving Humans (2016) — the most directly applicable international guideline, covering research in LMIC contexts and multi-site studies [3]
• GDPR (EU 2016/679) — governs processing of personal data including health data as special category data; applies to ASF as a French-registered entity [4]
• Georgian Law on Personal Data Protection (2024 revision) — applies to ASF’s data processing in Georgia [5]

3. Quality Improvement vs Human Subjects Research

ASF applies the following decision framework, derived from the CIOMS guidelines and the US Common Rule, to distinguish quality improvement (QI) from human subjects research (HSR):

4. Patient Voice — Ethical Requirements

The Patient Voice survey — the QR-based patient satisfaction and safety feedback system embedded in every ASF-accredited facility — collects self-reported patient experience data. The ethical requirements for this data collection are:

• Collection is anonymous: no identifiable personal data is collected through the Patient Voice survey
• Participation is voluntary and this is stated on the survey interface
• The survey is not conducted at the point of clinical decision-making
• The results are provided to the facility as aggregate data and to the Patient Voice Council as anonymised input
• The raw data is not sold, shared with third parties, or used for any purpose other than quality improvement at the accredited facility and aggregate reporting in the ASF Annual Activity Report

4b. Indigenous Data Sovereignty

The CARE Principles for Indigenous Data Governance (2020) — Collective Benefit, Authority to Control, Responsibility, Ethics — establish that indigenous communities have rights over data about their members, their lands, and their health. These principles have been endorsed by the International Indigenous Data Sovereignty Network and are increasingly recognised in research ethics frameworks globally [6].

Where ASF accreditation or standard development involves facilities that serve predominantly indigenous populations, any data collected in the course of accreditation surveys or pilot testing that relates specifically to indigenous community health practices, traditional medicine, or community-specific health patterns is subject to indigenous data sovereignty principles. This means: the community’s leadership (not only the facility’s management) should be informed of any data collection that will produce community-identifiable findings; community representatives should be offered the opportunity to review and respond to any published findings before publication; and ASF will not publish disaggregated data identifiable to a specific indigenous community without that community’s prior informed consent.

4c. Pilot Testing in Conflict-Affected Settings

ASF’s Crisis category facilities operate in active conflict or post-conflict environments. Pilot testing a draft standard in such a setting raises specific ethical questions: facilities may feel coerced to participate if accreditation is perceived as necessary for operational funding; staff may be under conditions of extreme stress that affect their ability to give genuinely informed consent; and the consequences of a standard criterion that turns out to be unworkable in a conflict context may be immediately life-affecting rather than abstractly quality-affecting.

ASF applies the following additional requirements to pilot testing in Crisis category settings: participation must be genuinely voluntary, with explicit confirmation from the facility leadership and, where possible, from a representative of the facility’s staff; pilot findings from conflict settings are reviewed by the Revision Panel with specific attention to whether criteria proved workable under conditions of resource scarcity and active stress; and no Crisis category pilot finding is used to validate a criterion for Standard category facilities without a separate Standard category pilot.

4d. Sharing Accreditation Data with National Health Ministries

National health ministries may request access to ASF accreditation data for health system planning, regulatory purposes, or public reporting. The following applies:

• ASF’s published accreditation status for each facility (accredited, conditionally accredited, not accredited) is public information, available in the Public Accreditation Registry, and may be shared freely with any party including health ministries.
• Criterion-level survey findings are confidential to the accredited facility and to ASF. ASF will not share criterion-level findings with a health ministry without the facility’s explicit written consent, unless required by a court order or applicable law.
• Anonymised aggregate findings — criterion-level pass rates across all facilities in a country, without individual facility identification — may be shared with national health ministries and published as open data, subject to the condition that no individual facility can be identified from the aggregate.
• Any systematic data sharing arrangement with a national health ministry must be documented in a written data sharing agreement specifying the data elements, purposes of use, retention period, and security requirements. Such agreements are disclosed in the Annual Activity Report.

5. Evidence Review in Standards Development

ASF’s evidence review process draws on published peer-reviewed literature. ASF does not conduct primary research as part of standard development — it synthesises existing evidence. The evidence review therefore does not require ethics committee approval. However, Revision Panel members are required by the Code of Conduct and the Methodology Manual to cite evidence accurately, to acknowledge its limitations, and not to present the evidence base as stronger than it is.

Where a standard criterion is based on evidence of Low or Very Low certainty (GRADE levels 3 and 4, using the GRADE naming convention), this must be stated in the criterion’s evidence note. A criterion based on expert consensus in the absence of direct evidence is labelled as such.

6. Publication Ethics for ASF-Authored Research

Where ASF staff, Council members, or surveyors publish research that draws on ASF accreditation data, the following requirements apply:

• Authorship: Authorship must comply with the ICMJE authorship criteria (substantial contribution to design or analysis; drafting or critical revision; approval of final version; agreement to be accountable). Honorary authorship is prohibited.
• Conflict of interest: Any author with a financial, professional, or personal interest that could bias the findings must declare it in the publication. The existence of an ASF employment or Council relationship is always declared.
• Journal selection: Publications using ASF data are encouraged to be submitted to open-access journals consistent with ASF’s open science commitment (ASF-IP-001-v1, Section 8). Where a subscription journal is used, authors should seek to deposit a preprint in an approved repository (medRxiv, Zenodo) before or simultaneously with submission.
• Facility consent: Any publication that could identify an individual facility from its findings must obtain the facility’s written consent before submission.
• Data sharing: Underlying data should be made available in anonymised form as a supplementary file or in a public data repository, consistent with the journal’s data sharing policy and the data protection requirements of this policy.

References

1. World Medical Association. Declaration of Helsinki — Ethical Principles for Medical Research Involving Human Subjects. Geneva: WMA; 2013.
2. National Commission for the Protection of Human Subjects. The Belmont Report. Washington DC: DHEW; 1979.
3. Council for International Organizations of Medical Sciences. International Ethical Guidelines for Health-Related Research Involving Humans, 4th edition. Geneva: CIOMS; 2016.
4. European Union. Regulation (EU) 2016/679 (General Data Protection Regulation). Brussels: EU; 2016.
5. Georgia. Law of Georgia on Personal Data Protection (amended 2024). Tbilisi: Parliament of Georgia; 2024.
6. Carroll SR, et al. The CARE Principles for Indigenous Data Governance. Data Science Journal. 2020;19(1):43.