The Mystery Patient
You are fielding a patient-experience study for a hospital network. Two components. First, mystery shopping: 40 calls to clinic front desks to test scheduling scripts, in which callers will pose as patients and will not disclose that they are researchers. Second, 300 telephone interviews with recent patients. You intend to record those interviews. The ethics board approved the protocol, but the consent script says only that "responses will be recorded for quality assurance." In fact recordings will be retained 18 months, transcribed, and the transcripts - de-identified but containing free-text detail about rare conditions and clinic names - will be shared with the client. Mid-interview, a patient asks: "Who is going to hear this?"
1. Is the mystery-shopping deception justified, and what must accompany it?
Read the worked answer
Deception is justified only when three things hold: the research question cannot be answered without it, the deception is minimal, and there is a plan to correct the record afterwards. Here, testing whether front-desk staff follow the scheduling script requires an unannounced caller; if callers identify themselves as researchers, staff behaviour changes and the study measures nothing. The deception is also modest - the caller is not extracting confidential information, not recording the call unless disclosed, and not inducing anyone to break a rule.
What must accompany it: prior ethics-board approval specific to the deception (not just to the overall study); a script that limits the caller to the scheduling scenario and forbids probing for clinical advice or personal data; a prohibition on recording without disclosure, or disclosure at the end of the call if recording is needed; and a debrief. Debriefing here can be a letter to clinic managers after the field period explaining the purpose, the dates, and that no individual performance action is intended, plus an offer of the aggregate findings. If staff are likely to be disciplined on the basis of the calls, the deception becomes harmful and should not proceed.
Also check local rules: some jurisdictions require disclosure of monitoring, and a few prohibit pretext calls to health providers outright.
2. A patient asks mid-interview who will hear the recording. What do you say, and what does the answer reveal about the consent script?
Read the worked answer
Answer honestly and specifically: the interviewer, a transcription service bound by confidentiality, and the research team at the hospital network; the transcript will have names and direct identifiers removed before the client sees it; the recording is kept 18 months and then destroyed; and the patient can ask for the recording to stop or be deleted now without affecting their care. Then actually do it if they ask.
The question exposes a consent defect. "Recorded for quality assurance" does not describe retention for 18 months, transcription by a third party, or sharing with the client. Those are material facts, and a reasonable patient would want to know them. The script should say what is recorded, who hears it, how identifiers are removed, how long it is kept, and how to withdraw. If the script cannot be fixed before the remaining interviews, pause and amend the protocol with the ethics board; continuing on the old script because approval was already granted converts an administrative approval into an ethical failure.
Also revisit the de-identification claim. Free-text detail about a rare condition plus a clinic name can re-identify a patient in a small town. Review transcripts for that risk, and consider summarising rather than quoting where the combination is distinctive.
3. What should happen to the recordings and transcripts over their lifecycle?
Read the worked answer
Set the lifecycle before field, not after. Recordings should be stored encrypted, access-limited to the transcription vendor and named analysts, and deleted at 18 months by an automated rule with a log. Transcripts should be de-identified against a written standard - remove names, dates of birth, addresses, staff names, and any combination of condition plus location that identifies an individual - and reviewed by a second person before release. The client should receive de-identified transcripts under a confidentiality agreement that forbids re-identification attempts and further sharing.
Where excerpts are used in the report, apply a small-cell rule: if a quote would identify a patient in a clinic with few cases of that condition, paraphrase or aggregate it. Keep the key linking IDs to recordings separate from the transcripts, and destroy the key when the retention period ends.
Finally, reconcile the consent: if patients were told "quality assurance," that phrasing implies internal use, not client sharing. The mismatch is a compliance issue and should be corrected in the protocol and in the next consent script, with the ethics board informed.