Rikshospitalet Uses Patient Data for Research Without Consent
Over a thousand Rikshospitalet patients were included in scientific studies without consent. Now, researchers await the National Research Ethics Committee's (NEM) final verdict.
– It’s just another violation from Rikshospitalet, Kristopher Salvesen (36) says.
He is a former Rikshospitalet patient who had his personal data retrieved without consent.
– You get very used to it. They don’t care at all about you as a person and choose to use your private information however they want.
Salvesen remembers his friend calling one afternoon, asking him to check Helsenorge after discovering unfamiliar names inside their medical records. Staff at Rikshospitalet had accessed their private information without warning or consent.
The access was labeled as «research».
– So my friend asked me to check mine too, Salvesen says. I did, and of course I found a lot of names. Some I recognized, and some I didn’t.
– Do you remember those names?
– Yes. It was Anne Wæhre who had accessed my records the most. There were also names I didn’t recognize at the time but later understood were PhD candidates.
Repeated Exposure
Salvesen explains that Wæhre was never his treating physician at Rikshospitalet.
– What felt especially unnerving was just seeing how many times they’d gone in to look. Again and again and again, and it was all labeled as «research». At a certain point you start to feel panicked. What are they actually using my information for?
Eventually, Salvesen discovered that his information had been used in multiple scientific articles. These were published in international journals, and despite being anonymized, he says the details made him identifiable. Universitas has seen these articles.
– I think the worst part was feeling exposed all over again. These medical records contain extremely personal and private information. Not knowing where my information had gone, or who knew what about me, was very disturbing.
The worst part was feeling exposed all over again
He was also able to identify other patients from the material, which he says made him deeply uncomfortable.
– It feels very wrong to have information about my friends that I shouldn’t have.
Seeking to Bypass Consent
Concerns about patient data handling at Rikshospitalet had already surfaced years before.
In 2019, Anne Wæhre applied to the Regional Ethics Committee (REK) for permission to collect patient data without consent for a research project involving transgender children and adolescents at the National Center for Treatment Service for Gender Incongruence (NBTK).
Both REK, and later, the National Research Ethics Committee (NEM) rejected the proposal due to the sensitivity of the information involved.
In its decision (2020/61), NEM wrote:
«Access is requested to medical records containing highly sensitive information. The information was given during a time in which the patient is highly vulnerable, and was given in the firm belief that it would be protected by confidentiality.»
They concluded that using such information for research would therefore «violate an individual’s privacy and autonomy» without the patient’s own consent.
From Research to Quality Assurance
Following the rejection, Wæhre instead helped establish the Gender Incongruence Registry for Children and Adolescents (GIRCA) in 2020 as an internal quality assurance registry at Oslo University Hospital (OUS).
Patient records were subsequently accessed under the label «research».
Concerns about GIRCA were raised in 2021 when members of the Patient Organization for Gender Incongruence (PKI) discovered these violations of their privacy. PKI deputy member Anine Hartmann told Forskning.no that their members experienced the situation as invasive and offensive.
– These medical records contain detailed information about people’s mental health, identity and sexuality. For those who have undergone treatment, they also include data from surgery and images of genitalia. [...] Our members have reacted strongly to the fact that no consent was requested, she told the newspaper.
OUS maintained that the work constituted quality assurance of healthcare services, rather than research.
Again and again and again, and it was all labeled as «research»
That distinction became central to the case. Unlike research projects, quality assurance initiatives do not require approval from REK.
1.700 Children and Adolescents
Earlier this year, Vici (18) discovered through Helsenorge that staff at Rikshospitalet had accessed his medical records while he was still a minor. Neither he or his parents had been notified beforehand.
– Being subjected to research without your consent isn’t a positive experience, he says.
According to Forskning.no, around 1.700 children and adolescents were included in the projects without parental consent. The researchers again argued that the work was quality assurance. However, the Joint Research Integrity Committee at OUS later concluded that this was incorrect: the projects constituted research and involved serious breaches of research ethical standards.
Still, the committee did not conclude that the researchers had committed scientific misconduct, and the published articles were not retracted.
Vici says Rikshospitalet has never contacted him or his parents directly about the use of his information.
– I have no idea what they’ve actually used. There are definitely things I’ve said in private conversations with doctors that I wouldn’t want others to know about or use in research.
– Do you remember who accessed your records?
– That was Anne Wæhre and a PhD candidate.
Behind the Numbers
Vici was first asked to participate in a research project at Rikshospitalet during an in-person appointment in 2024.
He declined.
– I’ve heard stories where they ask very intrusive and uncomfortable questions that are not relevant to gender incongruence. I did not want to be subjected to that, so I decided not to participate.
Nevertheless, his medical records had already been accessed years before.
– It happened on four separate occasions, all between 2021 and 2023, which was before I even had my first physical appointment.
Upon realizing this, Vici remembers feeling defeated.
– It’s not a good feeling. I was frustrated that I had become just another number in their statistics.
This is about real human beings who are there for a reason and in need of healthcare
– They need to remember that this is about real human beings who are there for a reason and in need of healthcare. Behind those numbers there are people with feelings, thoughts and opinions.
Retroactive Search for Approval
In February 2025, the Patient Organization for Gender Incongruence (PKI) reported the projects to the hospital’s Joint Integrity Committee, which concluded that the researchers should have sought approval from REK before accessing patient journals without consent.
The same year, Wæhre applied to REK for retroactive approval.
REK rejected her application, concluding that the project constituted research rather than quality assurance. An appeal from OUS’s research director was later rejected as well.
At that point, staff connected to the National Center for Treatment Service for Gender Incongruence (NBTK) had on two occasions been found to have conducted research on transgender patients that did not comply with ethical standards.
Yet, none of the related scientific articles have been retracted.
Salvesen believes OUS’s research has failed the patient group it claimed to help.
– The treatment at Rikshospitalet is a dark chapter in Norwegian medical history. They have caused so much harm to so many people, including those who were treated and those who were denied treatment.
– Some people may think that it’s helping us, but it really isn’t. If you’re going to do research on a minority group, it needs to happen in cooperation with that group.
Salvesen also believes the researchers need to shift their focus.
The information was given during a time in which the patient is highly vulnerable
– I’m so sick of them researching why we’re trans. How about improving our lives instead? Take into consideration the pressures we experience daily as a minority group and direct your research there. Why we’re trans is just not that important.
Awaiting a Final Decision
In February 2026, the case was forwarded to the National Research Ethics Committee (NEM), Norway’s highest authority for reviewing and deciding appeals in research ethics cases. Their final verdict has yet to come forward.
Salvesen hopes this ruling will finally hold someone accountable.
– Right now there is zero trust in that department, and it comes down to the people working there. There has to be a public apology, and many people need to lose their jobs. I personally think the whole department needs to be restructured if we’re ever going to trust them again.
Vici also has clear expectations for the future practices at Rikshospitalet.
– You have to get the patient’s consent before doing research on them. You have to follow the proper laws and regulations.
Universitas has been in contact with OUS, Anne Wæhre and the PhD candidates.
OUS and Wæhre decline to comment while NEM reviews the case: «Vi kommenterer ikke denne saken før vurderingene som nå pågår er ferdige. Dette er ventet å skje i mai.»
Both PhD candidates write they are not the right people to comment on the OUS quality assurance case: «Dette gjelder forhold knyttet til kvalitetssikring ved Oslo Universitetssykehus, og jeg er ikke riktig person til å kommentere dette på vegne av institusjonen.»
