UAREP Focus Session 10/27/00

Bioinformatics Data: Confidentiality Issues

Jules J. Berman, Ph.D., M.D.* Program Director for Pathology Informatics Cancer Diagnosis Program National Cancer Institute *All opinions herein are Dr. Berman’s and do not represent those of

any federal agency.

The Common Rule

45CFR46 deals with protection of human research subjects and applies to Federal‑supported human subjects research. It is usually referred to as the Common Rule.

Any pathologist who reads 45CFR46 would be tempted to conclude that it must have been written by a pathologist because it contains many special allowances that apply particularly well to pathology and pathology-based bioinformatics.

Does the Common Rule apply?

Whenever you're contemplating doing research, you need to determine whether 45CFR46 applies. If it doesn’t apply, you don’t have to worry about regulations imposed by this set of federal regulation.

This means you!!!

The necessity for IRB review will apply to almost any research an academic pathologist chooses to do using tissues or pathology records.

Are you using human subjects?

Your project is exempted from 45CFR46 if you're not using human subjects.

A human subject is defined as a living subject.

That means no autopsy studies are regulated by 45CFR46 and all surg path specimens from patients who have died are ok.

45CFR46 Covers Research

Research is defined as a systematic investigation, …. designed to develop or contribute to generalizable knowledge.

So if you’re preparing a database of patient‑related diagnostic information (the kind of things a pathology department might want to do), 45CFR46 possibly may not apply.

Informed Consent

All human subject research regulated by the Common Rule requires informed consent unless

It is specifically exempted The IRB waives the informed consent

requirement.

Is genetic and bioinformatics research special? Yes and No.

There are no federal regulations at this time that distinguish genetic research from other types of human subjects research.

HOWEVER

Is genetic and bioinformatics research special? Genetic research, and genetic information

often has special risks that the researcher must understand and address when their research is reviewed by an IRB.

IRBs may be particularly sensitized to human subjects risks contained in genetic research projects.

The Infamous “E4” exemption

Even if your study is federally sponsored, and qualifies as research and uses human subjects, many pathology studies can still be exempted from 45CFR46 regulations if........

The Infamous “E4” exemption

Research is exempt from 45CFR46 regulations when "Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to subjects."

Anonymization / Deidentification

Anonymized data has no links between patient and specimen/data. It gets E4 exemption from Common Rule Regs

Deidentified information makes it extremely hard for data recipients to relink specimen data back to a particular patient. Under special circumstances, may have consent requirement waived.

Informed Consent

Human subject research regulated by the Common Rule requires informed consent

unless It is specifically exempted The IRB waives the informed consent

requirement.

When can IRBs waive consent?

45CFR46 says, “An IRB may waive the requirement for the investigator to obtain a signed consent form if either:

1. The only record linking the subject and the research would be the consent document and the chief risk would be the potential harm resulting from a breach of confidentiality.

IRB waive of consent (Contd).

2. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context.”

The “minimal risk” excuse!

"The study of existing data, documents, records, pathological specimens or diagnostic specimens," is "minimal risk”

Minimal risk applies to most of the studies done in pathology departments, including genetic studies.

The risks of the minimally risky

Usually, the risks from studies using pathology specimens fall into two categories:

1. Loss of confidentiality 2. Loss of privacy

Confidentiality versus Privacy

Confidentiality, in the realm of pathology, means that some third party learns confidential medical/research information about a patient

Privacy, in the realm of pathology and bioinformatics, relates primarily to contacting the patient with research results

Preparing for the IRB

It's the job of the pathologist/researcher to assure the IRB that the risks are minimized (and minimal, if a waiver from obtaining informed consent is sought)

This may require considerable sophistication in the field of data security (covered in our Data Mining workshop)

Refuge in Rational judgment

If you’re doing human subjects research under the Common Rule, and your research is not exempted and does not qualify for a waiver under the “minimal risk” clause, you may still get a waiver if:

The IRB believes that the value of your research outweighs the risks, and there is no way of obtaining consent.

Endgame: Getting informed consent --- My personal opinion When a patient gives informed consent,

what is the patient consenting to? Answer: The patient is consenting to the

risks. The job of the researcher who to writes a

model informed consent is to address the risks (confidentiality and privacy). The experimental aims are secondary.

Informed Consent for Genetic Research There is the presumption that consent will

apply mostly to prospective studies (because getting consent for retrospectively collected tissues is often unnecessary and logistically difficult to acquire).

Most of the consent issues of special importance for genetic research deal with privacy.

Genetic Research Consent forms should: Describe the types of information that could

result from genetic research. Clearly explain the implications and the

limitations of research. Clearly explain the possible outcomes, and

means of communicating results and maintaining confidentiality.

Genetic Research Consent forms should: Explain that unexpected findings, including

identification of medical risk, carrier status, or risk to offspring affected by genetic disease, may arise.

Explain that results may indicate that the child is not the offspring of one or both the presumed parents.

Genetic Research Consent forms should: The consent form may contain a statement

that misidentified parentage will not be disclosed.

Another example of unforeseen outcome is genetic heterogeneity in which disorders which were initially thought to be due to defects in a single allele or locus are associated with new ones.

Genetic Research Consent forms should: Disclose additional risks. Certain genetic research studies include the

possibility of adverse psychological sequelae, disruption of family dynamics, and social stigmatization and discrimination

Genetic Research Consent forms should: Indicate that whenever disclosure is

anticipated, there will be medical geneticists and/or genetic counselors involved to ensure that the results are communicated to the subjects accurately and appropriately.

Genetic Research Consent forms should: The consent form should not promise

medical breakthroughs to entice participation.

The consent form and the consent process should not contain any language or actions that might be considered coercive to potential subjects.

SEA CHANGE: HIPAA PUNISHES CONFIDENTIALITY CRACKERS Section 1177 of the Act established penalties for any person that

knowingly misuses a unique health identifier, or obtains or discloses individually identifiable health information in violation of this part. The penalties include: (1) A fine of not more than $50,000 and/or imprisonment of not more than 1 year; (2) if the offense is “under false pretenses,” a fine of not more than $100,000 and/or imprisonment of not more than 5 years; and (3) if the offense is with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of not more than $250,000 and/or imprisonment of not more than 10 years. We note that these penalties do not affect any other penalties that may be imposed by other federal programs.

References NBAC Report

NBAC = National Bioethics Advisory Commission

Asked to suggest interpretations and recommendations related to the Common Rule to the President and Congress

Report available at: http://bioethics.gov/pubs.html

NBAC Conclusion

Properly interpreted and modestly modified, present federal regulations can protect subjects’ rights and interests and at the same time permit well-designed research to go forward using materials already in storage as well as those newly collected by investigators and others.

Weird remarks from pathologists

"My research is not human subject research because I only use paraffin blocks, not fresh tissue."

"I understand that because of the CAP regulations, all my research has to be conducted with blocks that are over 5 years old"

Weird remarks from pathologists

"We anonymize the patient data that we give the researchers. We keep the links here in the pathology department so that we can re‑identify the patient if necessary.”

"This research gets E4 exemption because our subjects can not be identified.... The best thing about our study is that we continually update our records with treatment and outcome data."

Weird remarks from pathologists

"This is genetic research, and is governed by a different set of regulations from non-genetic research”

"If I don't get this E4 exemption, I will be obligated to get informed consent for this study.”

"We collect data from human specimens, so we have a legal obligation to unlink the the patient identifiers from the specimens.”

Weird remarks from pathologists

"I have a medico‑legal obligation to never send out blocks

"I have a medico‑legal obligation to never exhaust a block."

Most dubious assertion

"Because of the CAP regulations, I can discard all tissue greater than 5 years old, so that's what I'm doing."

References

The University of Mississippi has put its mpa (multiple project assurance document) on the web at:

http://www.olemiss.edu/depts/research/irb/assurance.htm

References

The Complete Common Rule document on the web:

http://www.uaf.edu/oar/irb/45cfr46.html or http://www.nih.gov/grants/oprr/

humansubjects/45cfr46.htm

References

Confidentiality brochure

http://www-cdp.ims.nci.nih.gov/policy.html