The authors draw on their experience delivering multiple studies funded by the National Institute for Health and Care Research and government bodies, in which they have served as chief investigators, co-investigators and delivery researchers across qualitative and mixed-methods projects on NHS workforce behaviour, organizational culture and collaboration between healthcare providers. They are careful to frame the piece as a reflective commentary rather than a systematic audit: the patterns they describe have not been quantified nationally, but they emerge repeatedly from the lived experience of running organizationally sensitive research inside the health service. The focus is on England’s NHS, although the underlying architecture, including the Integrated Research Application System known as IRAS and approval by the Health Research Authority, operates UK-wide, meaning many of the same risks apply in Scotland, Wales and Northern Ireland.

The core problem, the authors argue, is a mismatch of design. Existing governance treats the participant as a patient, the site as a treatment facility, and transparency as a safety mechanism. That logic makes sense for a drug trial, where a local principal investigator needs to know which patients are enrolled so they can respond to adverse events. It makes far less sense for a survey of staff experiences of unprofessional behaviour, where the organization itself is the subject of scrutiny rather than merely a gateway to patients. Yet many NHS research and development departments still apply the most stringent clinical interpretation of the rules to workforce studies, requiring named local principal investigators, senior leadership sign-off and detailed site documentation that can reveal exactly who is being studied, where, and why.

The mechanisms of exposure are varied and often invisible to ethics committees. Distributing a full local information pack to every participating site exposes all included sites to each other. Research passports issued to external researchers list every organization involved. The NIHR Research Delivery Network portfolio, which exists to track study progress and is often a prerequisite for sites to access infrastructure and funding, can make participating sites identifiable through the Open Data Platform and other publicly visible systems. Even where a research team has scrupulously protected confidentiality in its own communications, the act of portfolio registration itself can broadcast an organization’s involvement to any interested party, including potentially its own leadership and staff.

The consequences for data quality are direct. Participant information sheets routinely assure staff that their organization will not be identifiable in publications, and research ethics committees approve those assurances in good faith. But where sites require senior leadership sign-off before a study can be set up locally, people within the host organization may learn that the study is happening, what it is investigating, who the local principal investigator is, and which categories of staff are being recruited. If staff suspect their employer is aware of a study on bullying or patient safety, the rational response is to self-censor in interviews or surveys. Research demanding a high degree of psychological safety, or posing reputational risk to organizations, is particularly vulnerable, because these are precisely the topics on which employees moderate their answers when they feel under institutional surveillance. The result can be under-reporting and guarded accounts that obscure the very behaviours researchers are trying to understand.

The burden of the system is also measurable. A recent survey of 252 health services researchers found governance processes widely perceived as disproportionate, inflexible and ill-suited to non-interventional and qualitative work. In a striking audit, Petrova and Barclay found that a single low-risk NHS study required 89 individuals to approve it and generated 491 exchanges outside formal systems such as IRAS. Some NHS trusts decline workforce studies altogether, citing capacity problems in their research and development units. For an under-pressure R&D department, a low-risk interview study about sensitive organizational issues may demand many of the same local processes as clinical research while offering little treatment innovation, minimal recruitment numbers, no local funding and potential reputational discomfort, creating a structural disincentive to take part.

Change, however, is underway. From March 2026, the Health Research Authority introduced a new governance pathway for studies involving NHS and social care staff as participants. It streamlines site set-up, limits the visibility of participating sites within IRAS, reduces the need for local site authorization in many cases, allows chief investigators to act across sites without local principal investigators, and clarifies that research passports are not required for studies conducted remotely. The reforms were not designed explicitly around confidentiality, but the authors argue they may partially mitigate the risks while cutting administrative burden. A replacement for IRAS, called the Plan and Manage Health and Care Research system and hosted on gov.uk, is also being piloted, though early experience suggests site R&D departments will need training to process study modifications under the new platform.

The commentary goes further, setting out six prioritized recommendations. These include a dedicated Health Research Authority pathway for sensitive organizational research; removing or reducing local principal investigator requirements in low-risk staff studies in favour of a minimal site contact with no access to participant identities; binding national guidance limiting local re-review of matters already assessed centrally, with an escalation route where it is ignored; pseudonymized, restricted-access or delayed-disclosure options for portfolio and Open Data Platform listings so sites can access funding without public exposure; waiving local sign-off entirely for low-risk, staff-only studies already approved nationally; and co-designing future reforms with researchers and R&D departments, with confidentiality protection treated as an explicit evaluation criterion alongside administrative burden.

The authors are careful not to swing the pendulum too far. Site visibility serves legitimate functions, from evidencing that a study has an authorized host to allowing funders to monitor public resources and providing a route for urgent safety escalation. Their proposals would preserve these functions through secure central records, role-based access, audit trails and named site contacts, while limiting disclosure to what is genuinely necessary. Waiving local sign-off would apply only to clearly defined low-risk studies with no patient intervention or clinical contact, and portfolio pseudonymization would retain auditable mapping for authorized oversight bodies. Accountability, they stress, need not depend on revealing participant identities.

The stakes extend well beyond research logistics. Sensitive workforce studies underpin efforts to tackle bullying, unprofessional behaviour and patient safety failures across the NHS, and they depend on honest accounts from staff who fear reprisal. If governance processes designed for clinical trials continue to undermine the confidentiality those studies promise, the result will be delayed research, declining participation and self-censored data, all at a cost to publicly funded science and ultimately to patients. The authors conclude that meaningful progress has begun, but that fundamental tensions between transparency, oversight and confidentiality will only be resolved through governance explicitly designed for organizational research, co-designed with the people and departments who must deliver it, rather than adapted once again from the world of clinical trials.

Subject of Research: Confidentiality risks in NHS research governance for healthcare workforce studies

Article Title: Research governance in England needs improvements to ensure participant and site confidentiality in healthcare workforce research

Article References: Aunger, J., Ferguson, J., Karaagac, E. A., Spence, T., Maben, J., Patnaik, A., Mannion, R., Zhao, Y., Proudlove, N., Bodenham-Chilton, H., & Walshe, K. (2026). Research governance in England needs improvements to ensure participant and site confidentiality in healthcare workforce research. Health Research Policy and Systems, 24(1), Article 81. https://doi.org/10.1186/s12961-026-01538-6

Image Credits: AI Generated

DOI: 10.1186/s12961-026-01538-6

Keywords: NHS, research governance, confidentiality, Health Research Authority, IRAS, workforce research, research ethics, health policy, qualitative research, bureaucracy, patient safety, NIHR