List of biobanks

Transcription

>> Good afternoon everybody, good morning to our folks in Hawaii. Thank you for joining us for our webinar today. I'm Samantha Smith with the Division of Education and Development of OHRP. And also with the Education Division here is Lannette Myers, who is quietly running the technical end of our webinar today. Say hello, Lannette. >> Hello. >> I'm extremely pleased today to introduce our guest speaker. Carol Weil is a lawyer and medical ethicist by training who has worked in the Department of Health and Human Services for over 20 years. She served as senior councel to the inspector general from 1994 to 1999, followed by a 10 year stint with us right here in the Office for Human Research Protections working on a broad spectrum of human subject compliance and guidance issues. She came to the NCI, the National Cancer Institute, in 2010 where she oversees ethical and regulatory policy implementation pertaining to clinical trials and research biorepositories. Carol's topic today will focus broadly on current ethical and regulatory controversies involved with the collection and storage and research use of biospecimens. She will touch on informed consent framework, privacy concerns, the identifiability of genomic data, different models of data sharing, and the return of research results. But before we move on to these hot topics, I'm going to take some time to review some important regulatory issues that come up in the context of biospecimen research. This is a very brief overview of some of the most important considerations and it isn't meant to be exhaustive, but hopefully it will help provide a useful framework. How do the HHS regulations at 45 CFR 46 apply to this kind of research? I would like to thank my colleague Julie Kaneshiro in our policy division for sharing her slides with us today. Before we dive into the regulatory information, we would like to know a little bit about you and your area of interest. So we're going to launch a little poll right now and we would like to know what your primary role at your institution is, or your primary role in life. We are launching a poll right now. And we know that we can't list all of the possibilities. But unfortunately unfortunately we could only list a few, but let us know if your main role is as a researcher, study staff member, IRB member, an advocate for patients or research participants or maybe you are associated with a pharmaceutical or biotech company. I see a lot of folks are voting right now. Give you another couple of seconds. Click that button. Now we're going to close the poll. Let's take a look at what folks said. Well, it looks like most folks here are IRB members or research study staff. That's great. It's good to have you all here. And thanks for sharing that information with us. So there's a lot of confusion out there about whether and how the regulations apply to biospecimen activities. We're going to go over some questions that I hope will help you determine whether our regulations apply to what you are doing. Our regulations cover non exempt human subjects research. And to determine if the regulations apply to a specific project, you will want to ask these questions, in order. If it is research and it's human subjects and it's not exempt, then our regulations would apply. We'll go over each of these terms next. First of all, most of you know already that the regulations define research as a systematic investigation designed to develop or contribute to generalizable knowledge. Let's take a look at a specific scenario that's relevant to our topic today. So let's say an investigator has access to lots of really cool and interesting biopsy samples and wants to use these for future cancer research. I want to know what you think. Is collecting leftover specimens research? We're going to launch a poll. I want you all to vote and as many of you astute viewers will know, the answer at OHRP is often it depends. But it's not the answer for this particular quiz. We want you to make a firm stand, whether it is yes or no, is it research? Okay. Let's see. I would like for you guys to vote. Only 65 percent of you have voted. I will give you another second. Okay. We're going to close the poll now. Let's see what people said. Oh, I see that we have an astute group today. I'm glad to hear that. My brief regulatory overview will be more than you all probably need. Yes. In fact, OHRP's view is that this is research. The investigator is basically creating a repository when she collects tissues for future research use. And that activity would meet the regulatory definition of research. Okay. So we're seeing these questions again. Let's go back to these questions. We know it's research. So the next question we want to ask is, are human subjects involved? So who is a human subject? First, the easiest part is if you've got someone with a pulse, well, they're living and that's the easiest part of this. If you are dealing with a cadaver you are not doing human subjects research. There are two ways with living individuals that one can become a human subject. Intervening or interacting with someone to get data about them would make them a human subject. Also, obtaining individually identifiable private information about them would make them a human subject. Whether you are intervening or interacting is a pretty easy thing to ascertain. But whether you are obtaining individually identifiable private information is a bit harder to figure out, especially in the case of biospecimens. What is individually identifiable private information? What if the data is coded in some way? The key is whether the investigator can readily ascertain the identity of the subject, and that answer will depend on several factors. I can't go into detail here because we don't have time, but we have helpful guidance on our website about this. Let's look at another example. The investigators in this study have gotten some exciting specimens from collaborators who obtained them from participants in another research study. No investigators in this new study have access to the key. We're going to launch a poll now and do a little quiz. What do you think? Is this human subjects research? We want you to express yourself. You guys are pretty quick on the draw. And I see that we have a very astute audience today. Okay. We know a bunch of you still haven't voted. 50/50 chance. Okay. We're going to close the poll now. Let's take a look. Ooh, it was close there for a bit. And then the yeses took over. So actually this is an example of research that does not involve human subjects so long as the investigators have not interacted or intervened with the individuals and there are so called "firewalls" in place that prevent the investigators from being able to readily associate those data with the individuals. This comes from our guidance on research involving coded private information and biological specimens. My guess is that the people who said yes probably were just not sure that there was a "firewall" in place and were just thinking about a code that maybe could be broken. Okay. So how are such "firewalls" put in place? Well, this slide lists some examples of ways that this can be done, including formal agreements, IRB policies and procedures and legal prohibitions that would prevent the investigator from associating the data with the individuals. So now we're back to our questions. And now we know we're dealing with human subjects research. We next need to find out if the activity might be exempt from regulations. Exemption 4 is the one that most often applies to human subjects research with biospecimens and existing data and exemption 4 applies if either of these things is true. If you are looking at data that are publicly available, such as census data or other data that's available to anyone on the web or the information is recorded by the investigator so that subjects can't be identified directly, or through identifiers linked to the subjects. The example of this, a classic example would be going into a medical record and only recording data without identifiers. Now we know that we are dealing with human subjects research and the regulations will apply if it's not exempt. So another issue that comes up in the context of biospecimen research is informed concept. What if you're doing a project and you want to get informed consent to use leftover or extra specimens for future research, but you're not exactly sure what that future research might entail. Can you ask for permission to use the specimens in this way? The answer is that yes, you can. But what you explain to the participants in the original informed consent procedure matters a great deal. The information from the original informed consent procedure has to be sufficient to meet the requirements, all of the requirements, in the regulations under 116. So typically, the vaguer you are in the original informed consent document, the less likely it is that the original consent procedure is going to meet the regulatory requirements under 116, when your future research project is fleshed out. However, in future projects, you would still want to go back and ask the questions that we've just gone over. It's possible that the new project may not meet the regulatory definition of human subjects research. It's also possible that the IRB might see fit or waive or alter informed consent requirements. Okay. So now we know we're doing non exempt human subjects research and the regulations will apply. But if you are doing research in which there are multiple institutions involved, each doing a different activity, there's still one more question to consider, and that's engagement. And at this stage, I know a lot of you are going to be surprised because you didn't even know we were dating. We don't have time to cover engagement in any detail here. But I just want to point out that when there is a non exempt human subjects research study, someone is engaged but it is possible that the activities of one or more players in the research enterprise may not constitute engagement. Okay. For more information about engagement, we have a helpful guidance document to help you through. So here's a list of resources that we hope will be helpful to you when you are wrestling with a question about biospecimens. But now, it is my distinct pleasure to turn it over to Carol Weil. I certainly am looking forward to hearing what she has to say. Please pause for a moment while we switch microphones. >> Thank you, Samantha, for that great regulatory background, which I really appreciate because today I'm going to be focusing more on ethical and policy issues than the regulatory ones, so it's wonderful to have that as a segue into the issues that I'm going to be discussing. Before I begin, I need to make a disclosure that while I work at the National Cancer Institute, this presentation reflects my own thoughts and opinions and is not at all intended to reflect any official opinions of the NCI, the NIH or the Department of Health and Human Services. If you are facing issues with tissues at your IRB or your institution, you are definitely not alone. Research with biospecimens in our genomic era is more critical than ever because today's breakthroughs in our understanding of disease are largely based on understanding germline and somatic variants in the genomic architecture of disease. Mutations occur at the molecular stage. And biospecimens are where the molecules are! So biospecimen analysis is really the horse driving the medical research cart in this era of precision medicine or personalized medicine as it's sometimes referred to. Collecting tissue and then sequencing it for signs of genomic variation holds out hope for understanding the biology of disease and developing drugs and diagnostics for treatments and cures. For example at the NCI, we are developing umbrella screening protocols which allow patients to be biopsied and then have their tissues sequenced in order to be placed in treatment arms in clinical trials with drugs or therapies that have been associated with their own known genetic mutations. So it's really important for us going forward as a research community to deal with the multiple and ethically complex tissue issues, including how to obtain consent, how to protect privacy and prevent the identifiability of tissue samples, and when appropriate, how to return incidental findings and other research results. Research biobanks involve a lot of different components. Sometimes these components occur in separate institutions or locations and sometimes they occur altogether. These include the collection process, where the tissue is obtained from the tissue donor. The storage facility, where tissue is stored. And perhaps a separate data storage facility, it may be a virtual storage facility, not even with a physical location. Finally, biobanks have standard operating procedures or procedures for governance and operations that pertain to the functioning of the biorepository. And in terms of the privacy and consent issues that arise, these questions listed in the slide - e.g., where are human subjects involved?, is IRB review or informed consent needed?, is HIPPA compliance required?, what are the relevant state and local laws?, whether or not there are specific institutional rules at different sites involved in the biospecimen collection process?, and whether there are international regulations are at issue if tissue is being distributed to different researchers in different countries?.... All of these questions have to be considered at each phase of the biospecimen research process, the collection, storage, also the downstream research use of tissue. It is the case that th more that you can accomplish up front the fewer issues you will face downstream. So, for example, if you are going to obtain broad consent for future research uses of the tissue, at the time of collection, it's a lot more likely that researchers downstream will be able to use identifiable tissue, without re-contacting the donors for any additional consent or without the need to seek IRB approval for waiver of consent for secondary uses. We know from Section 116 of the common rule that Samantha talked about that consent must be both informed and voluntary. The voluntary part really isn't so hard to implement in the biospecimen research context. We need to clarify the difference between let's say mandatory biopsies that are essential for determining enrollment eligibility in a treatment trial, for example, and optional biospecimen studies which are completely separate from the study purpose and are not required in order to enroll, but this isn't complicated and we have been doing that in consent forms for awhile. But the "informed" part of consent is getting tougher and tougher in the genomic era. How do you inform people of all of the consequences of enrolling in a genomic study, the possible incidental findings, the identifiability risks, if they are consenting to optional studies all of the possible future uses to which their tissue may be put? There are a number of emerging models of consent that I'm going to speak about. These include specific consent, broad consent, blanket consent and also dynamic consent. Specific consent means that consent is required for each and every use of biospecimens in specific studies. So while this might arguably be most protective of autonomy it involves a tremendous amount of re-contact and is not very practical for most biorepositories. Also, many research participants might find it inconvenient to be re-contacted frequently for every single study for which their tissue is going to be used. Dynamic consent harnesses internet technology es and modern communication strategies to inform and engage participants on an iterative basis. It providess consent opportunities for specific studies like specific consent, but requires a very active patient population who is willing to weigh in via the World Wide Web continuously for each research use. There's a danger of information overload and critics argue that it can be needlessly time consuming and may not actually increase autonomy so much as the perception of autonomy because people are getting so deluged with information that they really may not be understanding everything they get. This type of model may also be beyond the technical and financial capabilities of smaller biorepositories in many research institutions. Broad consent for future research, which was discussed in the ANPRM, proposes that consent be obtained at the time of collection of the tissue and that this consent be broad enough to cover future research uses of biospecimens within a certain framework. For example, all future use of the biospecimens pertaining to a particular set of encounters, ie particular hospitalizations or even to any biospecimens collected from a donor at any time by a particular community hospital or other institution. So broad consent does apply to a particular framework for future research use, but it is not absolute and there can be disallowances, either by individuals for specific types of research, for example, if an individual says I'm comfortable donating my tissue for broad future research uses but I really don't want my tissue used for stem cell research or for cloning or other specific types of research. In contrast blanket consent for future research is an absolute construct. Blanket consent applies to all future uses of research without any restriction. It's really more of a theoretical construct. I don't know any institution that actually uses this form of consent. But it is out there as sort of the end of the spectrum for consent modeling. So now I would like to do some polls of my own with you. Let's see if we can get a preference for which type of consent you as a biospecimen donor would prefer to use from these four models that I discussed. I know that you are all a very educated population when it comes to human subject research so this isn't in any way a public type of poll, but I think it would be interesting to see what all of you with your knowledge and background would consider your preferred type of consent in, say, a clinical trial if you were asked to donate your tissue to optional future research uses or to a research biorepository. Would you prefer consent for a specific use, the dynamic consent model, the broad consent for future research model, or the theoretical construct that I talked about, blanket and unrestricted consent. So we're getting up to to high 60s now. And looks like we have a majority so far for broad consent for future research. So I think that I'll stop the poll now and that's interesting because that's probably the model that is most widely debated right now in the research community and I don't know if that's why all of you are finding it most preferable because you have heard about it the most or actually something that you feel would meet your needs personally as a biospecimen donor. Let's do a second poll, a workability poll. I want to see among those four types of consent models, which do you think would work best at your own research institution. that's great. We're actually getting an even higher percentage for the very same answer which is broad consent for future research. I'm glad to see that what those of you in the know out there would prefer individually as a tissue donor is in fact what you also think would work best at your institution. Now I'm going to switch gears a bit and move from consent to a discussion of HIPAA and privacy. When you are talking about issues with tissues you absolutely can't escape HIPAA. One of the first things to note about HIPAA is that it was not intended primarily as a research regulation. HIPAA was intended to promote patient privacy at covered entities, which are institutions that deliver or insure health care. So unlike the Common Rule or the FDA human subject protection regulations, the HIPAA rule is not designed primarily with research in mind. And embedded within HIPAA is a recognition that the research community has legitimate needs to create, access and use protected health information. This website that's at the bottom of your slide here is an NIH website that I wanted to reference for you because it has a lot of very useful information about the applicability of HIPAA, particularly in the context of biorepository and biospecimen research. I'm sure this topic is familiar to many of you, so I will just go through it briefly. But HIPAA limits the use and disclosure of a category of information that's known as Protected Health Information or PHI by identifying 18 categories of information, including names, Social Security numbers, email addresses that are protected from disclosure without explicit authorization from the patient or research participant . Probably the most useful information in this set in terms of biospecimen research are dates and that provides the sort of the largest challenge for researchers who are trying to comply with HIPAA is how to get medical information that includes dates, because when you are doing research with biospecimens you often need to get medical information about the individual from whom the specimen is obtained, including follow up data about disease recurrence or future procedures, if any, and also past medical information about drugs that were used and other treatments and therapeutics. So that's probably the hardest piece of the HIPAA puzzle for people doing biospecimen research. Before we leave the screen, I also want to note that the P in Protected Health Information stands for "protected" and not "privacy" as people sometimes think. A lot of the information that's included within the ambit of Protected Health Information really is not very private. Things like telephone numbers and license numbers, information that we all probably have out in the public domain in various ways. So even though this information does not seem very private in terms of reality, it is considered within the scope of Protected Health Information in HIPAA. So one way that the biospecimen research community can make use of Protected Health Information without violating HIPAA is to use Limited Data Sets, and Limited Data Sets are data from which direct identifiers within HIPAA, among those 18 identifiers, things like name and Social Security number have been removed but the really useful pieces of HIPAA information like dates are still permissible. Limited Data Sets still contain Protected Health Information and require protection, they are not de identified data. But Limited Data Sets are authorized in HIPAA for certain limited purposes, including medical research. They include health or demographic data sets that HIPAA permits to be used for specified reasons including medical research, public health surveillance, or health care operations. Limited Data Sets in HIPAA may only be received or disclosed in conjunction with Date Use Agreements (DUAs). DUAs obligate recipients of data to abide by data security standards and to protect against unwarranted disclosure of the data in limited data sets. They set forth the specific permitted uses for disclosure of the data that are consistent with the research aims of a particular study. So the Data Use Agreement will specify how the Limited Data Set information will be protected and require the recipient of data to agree not to contact any individuals in the Limited Data Sets, not to attempt to re-identify that data. Data Use Agreements are often combined with Material Transfer Agreements in biospecimen research. And the NCI Best Practices document, which is available on the NCI website, describes operational details for use of Limited Data Sets, Data Use Agreements and Material Transfer Agreements as well as examples of these documents and appendixes. Before we move on from HIPAA, I want to make note of the HiTech amendments to HIPAA, which were recently promulgated in regulation this year. HiTech has some very profound and I think happy implications for the collection of research specimens in clinical trials. Initially when HIPAA was enacted it precluded the coupling of a conditional authorization for the use and disclosure of PHI with an unconditional authorization of PHI within the same study. The purpose of this limitation was to help participants separate out the use and disclosure of information related to required interventions in a clinical trial, such as a collection of biospecimens in order to determine enrollment in a particular arm or whether or not enrollment in the trial at all was appropriate....Toseparate those kinds of uses of information with the use and disclosure of information that isrelates to optional studies for which tissue might be used, or for the creation of a research biorepository that was optional to participate in. Now, this was a noble idea to keep separate the conditional from the unconditional requirements in order to make people aware that they were separate. But what it meant as a practical matter was that sick people trying to enroll in clinical trials were often faced with very cumbersome procedures in multiple forms simply in order to enroll. So the HiTech statute, which was enacted in 2009 as part of a broad legislative effort to deal with financial recovery from recession, the ARRA Act.... The HiTech statute established that research institutions can issue compound authorizations for clinical trial interventions coupled with an authorization for tissue collection and banking for optional substudies or for participation ina research biorepository. The HiTech regulations were not finalized until this year and they were made effective on March 26th of this year. So as of March, institutions can now have a single form for consent, authorization for disclosure of PHI for clinical trial related biospecimen collection, and authorization for disclosure of PHI for research biorepository, which is a much more practical approach. The other major change brought by HiTech is that it clarified that research authorizations need not be study specific. Hitech reversed the Department of Health and Human Services' original stance about what it meant to require that research authorizations have to have a "specifically described purpose" as the legislation stated. We call these sorts of reversals clarifications in the federal government. So initially HHS interpreted that statutory requirement "specifically described purpose" to mean that an authorization had to be study specific and could not be for broad future research uses. But in the preamble to the HiTech final rule, HHS acknowledged that its original interpretation, which was based on a concern that people would not have enough information in an authorization for broad future research use, to make a truly informed decision about future research studies, they recognized that this approach was encumbering important secondary research uses of tissue, and they further claimed that this was not required by the informed consent standards in 45 CFR 46. So HiTech effectively then acknowledges that the ability of research participants to authorize broad future research uses of their tissue at the time of collection is an acceptable research practice and it gives research institutions flexibility in determining how to describe future research purposes in such a manner that it will be reasonable for participants to expect and understand how their tissue can be used in the future. I think these changes are very promising for biospecimen research moving forward And it's interesting to contemplate what effect, if any, the HiTech direction will have on the revisions to the Common Rule that have been proposed in the AMPRM. There are many proposals in that document pertaining to secondary research uses of tissue and given the many efforts and discussion about harmonizing regulations among federal agencies and the sister agencies of HHS in this area, and again speaking quite personally here, one can hope that the final revisions to the Common Rule will recognize the value of broad consent as a research option and make that option user friendly. So I want to turn now to a bit more of a philosophical discussion about the difference between our concepts of identifiability and privacy. We often tend to use these words interchangeably in the biospecimen research context but they are really very nuanced concepts and mean quite different things. I'm a movie buff, so I always like to put pictures of movies in my presentations if I can. For those of you that don't know movies, this is a picture of Meryl Streep and Alex Baldwin from the movie It's Complicated. I put it here because I think that trying to decipher the differences between identifiability and privacy in this subject area is really quite complicated. What we do in the biospecimen world is to try to preserve the status of de-identification. We're trying to prevent unauthorized disclosure of someone's identity, an unauthorized re-identification from de identified samples and data. Privacy is a much richer legal concept than that, though. And even a political concept, in fact. It has its roots in constitutional law and reflects fundamental rights such as who one can marry and whether the NSA can monitor your phone calls or your email. So in consent forms, when we tell people that we're doing our best to protect their "privacy" and we use that really loaded political term, what we really mean is that we only have a limited number of people who have access to your information, people who can readily identify you. Even though we use the term "privacy", we're not dealing with those richer fundamental rights concepts and political concepts. And to some extent I think the rhetoric about privacy in consent forms suffers from improper association with the concept of privacy rather than identifiability. Now there are some who point out that all genomic data may theoretically be identifiable. But notice that identifiability does not necessarily violate individual privacy. If a researcher can identify that a particular person in her dataset was say, also a subject in another GWAS study, based on a matched sample from that study's data, has that violated that participant's privacy? We need to really think about what participants are concerned about. Is it that someone can actually identify they were a subject in another study or something more personal, more potentially damaging such as access to information that would enable employers or insurers to know that they have an increased risk of disease? We really need to do more empirical ELSI (stands for: ethical, legal and social implications of) research in this area to figure out what people are really concerned about and implement policies that protect against that eventuality. So we wrestle with concerns about the identification of research participants who donate their tissue for research, in the very practical and operational sense. First biobanks have to decide what employers need access to data and who needs to hold the key to the code so that they can re-identify. Who needs to get an MTA material transfer agreement or a Data Use Agreements and then finally we have what I call the age of the genome problem that increasingly we see a number of studies where scientists have been able to identify people from allegedly and supposedly "de identified" genomic or gene expression data. The first of these studies was in 2008 when Homer and colleagues proved that one can uniquely identify an individual from pooled or aggregated DNA data using a matched sample. Then in 2012 Schadt and colleagues figured out how to identify individuals from RNA expression data by inferring SNP or single nucleotide polymorphism geneotype information as an intermediary step. In other words, these researchers translated RNA expression data into unique genetic information that could then identify live individuals. Then finally in January of this year, Melissa Gymrek and colleagues found that male surnames could be identified by profiling short tandem repeats on the Y chromosome. They were able to identify specific males by investigating genealogy databases and combining metadata like age and state of residence so that they could triangulate identity using y chromosome data, the genealogy data and public metadata. So what all of these studies lead us to question is, is privacy really there anymore? Or is it an elusive concept that we really cannot guarantee in the genomic era? The US population aged 18 to 75 is less than 250 million. For 90% of these adults no other person has the same date of birth, zip code and gender combination. What that means is that for 90% of U.S. adults, the combination of date of birth, gender and zip code, information that's not hard to get ahold of, is a unique identifier, that combination of information. No one else shares that information for 90% of adult individuals. Nearly all of the rest - that 10% - have just one or two who happen to share their combination of information. So just one more data point, something like last school grade completed and you can practically identify everybody. So what does that mean for biospecimen research going forward? The [indiscernible] "Omics" research technology that's employed today, genomics, gene expression analysis, epigenomics make medical research far more data dense and also more generalizable across disease states. Increasingly researchers want access to multiple disease data in order to conduct their GWAS studies. We have increasing numbers of GWAS or genome wide association studies that examine thousands of SNPs to identify genetic variants that contribute to many different disorders or conditions. To facilitate sharing of genomic and phenotypic or clinical symptom data, from these studies, the NIH created dbGap or the database of genotypes and phenotypes with a two tiered system for sharing data. Open access, the first tier, for data available to the public without restriction, and then controlled access for data that must be requested by researchers and is reviewed for consistency with the informed consent forms under which the data were obtained before being distributed to researchers. It is quite common at NIH for researchers to make multiple requests for controlled access data in dbGap for different types of data for multiple studies in order to conduct their GWAS investigations. As a practical matter this means the data are being used and reused for multiple study purposes and distributed to a wide range of researchers for diverse purposes across the globe. In such an environment as data gets massaged by more and more people for different multiple research projects,[indiscernible] it becomes harder and harder to ensure de-identification or privacy. So is DNA a unique identifier? Well, maybe yes but maybe not. Just a couple of months ago an article in the science times pointed out that DNA and identity are really not as intertwined as we once thought and that most people have multiple genomes floating around inside them from mutations and remnants of pregnancies in the case of women and twins, also, may pass some of their genomic information to each other. One reaction to all of this discussion back and forth about whether or not privacy is really elusive in today's genomic era is: Who Cares? What's all the fuss about? Who cares that my samples can be linked to data that enables someone to learn some random fact, like that I participated in a cancer trial. Or that I was in a GWAS study. Amy McGuire, a researcher at Baylor University, conducted a randomized trial of three data sharing consent options in a genomic study where tissue was being collected. The first arm required public data release asa condition of participation in the genomic study. A second arm allowed people to choose between public data sharing and controlled access data sharing which is limited to approved researchers as we discussed. And a third arm provided three options, public access, controlled access and no sharing at all. So individuals were randomized to one of those three arms and then after the study they were debriefed and offered the opportunity to switch. In other words they were informed about the three different models, told that different people had been randomized to one of those three and then asked if they were given the option what they would choose. McGuire's study showed that a small majority, 53%, actually preferred Public Access, the broadest possible sharing of data. But if you combine the people that chose Public Access and controlled access, well, that figure jumps to over 80%. So a high majority were comfortable with some form of data sharing, either public or controlled. And that gives us some comfort that most research participants, at least in this one study, seem to be comfortable with allowing researcher access to their tissue. I want to say a bit about a draft NIH genomic data sharing policy that was just published in the Federal Register in September. The new genome data sharing policy extends the scope of the GWAS data sharing policy, the policy for data sharing in GEnome Wide Association Studies which required that all genomic data from these studies be submitted to dbGap the NIH database for genotypes and phenotypes, to be stored in either public or controlled access databases which require committee review prior to release and researchers having to request access. There is a 60 day comment period to provide input on this draft regulation, which is almost up and so I would encourage any of you who are interested to send your comments in. And an appendix at the back of the policy lists examples of the types of research covered by the policy. Essentially it includes all array based or high throughput genome technologies, including transcriptomic, epigenomic and gene expression data. The draft gene data sharing policy includes an expectation that informed consent for prospectively collected or generated data will explicitly address not just the issue of future research uses of tissue, but also the issue of whether data will be shared through open or controlled access. I think we are gravitating toward a best practice in the biospecimen collection arena where we inform people about the types of data sharing that are going to apply in a study and offer them the chance to accept or reject controlled or open access. One issue to contemplate is whether or not the growth of commercial and social websites that are now available for the public has changed our climate at all in the biospecimen research arena. The explosive popularity of communication tools like FaceBook and Twitter may reflect a kind of a cultural shift toward greater acceptance of open source data sharing in the medical research context. In this environment, it seems plausible that public interest in sharing research data might increase if we could effectively communicate the potential to advance medical progress through wide spread 'omics' data sharing. There are a number of models surfacing now for open sharing of medical data. Genetic Alliance has a site called Reg4All which allows individuals to share their personal medical information and genetic information. Sage Bionetworks is an organization that has a paradigm called Portable Legal Consent. These platforms offer people an opportunity to learn and share medical information in a collaborative and informal environment that is very patient centric. So one has to question whether, in an era where we can go on line to do banking, order aspirin and toothpaste from drugstore.com, use eBay to buy things that we might fancy, and my personal favorite use Netflix to rent movies, people are becoming far more computer saavy and comfortable with the idea of sharing their personal financial information and other facts about themselves. In addition, people may incrdasingly be more comfortable with the idea that websites may be tracking them. In this environment, does that change how people feel about the protection of their medical data? Several private organizations and companies are conducting studies that encourage people to share their own personal genetic and other medical data. One is the Personal Genome Project, which takes place out of Harvard and aims to enroll 100,000 research participants to share their genomic sequencing information on line. To date, more than 1,000 people have shared their DNA sequences, medical information and other personal information through this project. 23andme, I'm sure most of you have heard about. It's a direct to consumer genetic profiling company, which provides genotyping as well as ancestry information to registrants for a fee. And Portable Legal Consent, as I referenced earlier, aims to create the world's largest cohort of people gathering data about themselves and donating it to a public data base for medical science. Members create a profile and can update their information any time with medical records, genomic information and even environmental information. Recruitment for Portable Legal Consent was actually approved by the Western IRB in April of 2012 and participants are informed that research using their information will be openly shared and they watch a video explaining the potential for economic or social harm. Patientslikeme perhaps epitomizes most distinctly the empowerment of data sharing. Over 170,000 patients use this website to share resources, experiences and support all for free. And I love these quotes from the Patientslikeme website because they really explain how people see data sharing, not as something that is cause for concern or that creates a risk of harm, but something that actually can provide a sense of empowerment and also a sense of comfort and community. "Because of PLE we're better able to recognize warning signs and keep things in perspective, in short PLM empowers us." "I joined because I didn't want to feel alone anymore and knew that I could be helpful by sharing my experience." So people not only gain from being able to access information on a site like this, but also gain comfort from the sense of altruism and being able to share their own information. So we need to recognize that being able to share data is not just an issue of privacy risk, but also a sense of empowerment and can have positive benefits for many research participants. We really need to do a lot more empirical work in this area to determine what kinds of people are the so called information altruists, that's a term that Kohane coined in a 2005 article where he spoke about certain people who are just less fearful about the potential misuse of their medical data and will donate for research, even when they don't expect any personal benefit. We need to figure out the underpinnings of this concept of information altruism and its relative impact across disease and population communities and the extent to which it is motivated by known and trusted researchers as some studies suggest, or perhaps whether it's a more global phenomenon which. simply reflects general trust in the the research community at large and possibilities that research holds for disease cures. And are information altruists the same as early adapters? The people who just tend to be more comfortable with use of technology, the ones who were willing to charge credit online or use apps that require private information?. We need to figure out all of these different pieces of the puzzle and understand what kinds of data sharing arrangements will be best for which populations and most reflective of participant preferences in different types of studies. We know that some people, the patientslikeme folks, see data sharing as a form of empowerment and comfort rather than a risk and see the ability to give and receive data as giving them a sense of control. But in many cases those people also want to control how and when data is released. They want more of a say in the study design. We need to find out who the members of these different groups are, the information altruists, early adapters and see how these pieces of the pie fit together. Regardless of where they stand on the type of consent process they prefer, or the degree of data sharing they will tolerate, all people who donate tissue are entitled to respect, transparency and choice about who can access their data and we must put more emphasis on community education and improved scientific literacy before the consent stage so we really are getting consent from people who know and understand what it means to donate research tissue before they reach the consent stage process. People don't always appreciate these issues in the consent context, particularly clinical trial participants who are undergoing the stress of illness and who are receiving complex information about their own disease at the same time. Many studies have shown that consent forms are really poor vehicles to convey the nuances of biospecimen donation, including what data is shared and with whom. Amy McGuire at Baylor found that people looked at consent form language about data sharing and some interpreted the identical language to mean that their data would be shared only with researchers at Baylor while others assumed that language meant it would be shared with researchers outside of the institution. So there really is a lot of nuance that is not able to be explained during the consent process. Jennifer Klima and her colleagues at the Nationwide Children's Hospital in Columbus, Ohio found that parents who gave permission in a genetic study for their children's tissue to be used in research didn't understand that the stored tissue itself contained their children's DNA. So in a survey she asked these parents, they said yes to the question is your child's tissue being stored in a biobanking, but no to the question is your child's DNA being stored because they didn't appreciate that agreeing to storing the tissue they were actually also authorizing the biobank to store DNA. So we really do need to find some alternative to the consent process for developing a better understanding about biospecimen donation and for helping people make sound choices. I think the organ donor model where there is much more public service and media input may be a better model than just relying on consent. The NCI conducted a think tank on the identifiability of specimens and omic data a year ago. I love this quote from Misha Angrist a participant at our think tank. He's a geneticist at Duke and also a human subject in the personal genome project so he really comes from these issues from both the human subject as well as the professional researcher perspective. He believes that the main ethical issue in this debate is that of data control rather than data privacy. If we involve people in decisions about how their date is shared, we don't need to worry so much about protecting privacy at all cost because providing 100% protection (which is not feasible anyway) won't be the intended goal. goal. To the extent that we can better foster community engagement and involvement in decisions about research biorepositories, privacy concerns become less of a focus. [indiscernible]. So this is a very lively debate, the balance between restricting access to researchers or whether to punish wrongful re-identifiers who illicitly obtain access to research data. Some argue for criminal penalties for like the angry ex spouse in a custody case or a disgruntled ex employee who illicitly obtains stigmatizing or impactful genetic information without permission and in order to cause harm. How can we, and should we, restrict data access on the front end to avoid possible misuse of publicly accessible data? If we make everything controlled access that's a huge burden on the system. Besides there may be malicious researchers out there attempting to get data in order to be the first to publish or who don't want to jump through the proper IRB hoops. Understand that I don't really think that's a huge problem. I don't believe OHRP has had any compliance cases involving researchers who were wrongful re-identifiers, but it seems possible this researcher misconduct could occur in this area. One thing that the think tank break out group discussed were issues of liability and blame. This is still a very contentious area where there's no real consensus. Some have suggested capping liability for researchers and research institutions in the event of data breaches. Some argue there should be a cost like HIPAA imposes, some argue for criminal penalties and fines for malicious actors like hackers. One issue to consider is the relationship between the risk of identifiability and the risk of harm. What are the potential down sides of identifiability and why are people concerned about it if in fact they are concerned about it. This again gets back to the fact that identifiability is not necessarily equivalent to privacy. So thoughts about this led to the idea that rather than having identifiability trigger levels of access to public or researchers, what if access models were tied to something different like participant fears or concerns. So for example we might focus on the nature of a study. We might have more restricted data sharing for depression studies then for cholesterol studies, which are less stigmatizing. I now want to turn, I know we're coming to close to the end of our time, I want to turn to the discussion of disclosing research findings to tissue donors, which is a very complex area. I think in part because it involves so many different subissues that get conflated in the discussion. First of all, there is the issue of disclosing aggregate study outcomes. Which is probably the least controversial of these issues. Disclosing diagnostic discrepancies like finding a diffuse carcinoma in a healthy volunteer tissue sample and what to do with that. Disclosing incidental findings like perhaps a BRCA1 finding in a child's tissue sample donated in an asthma study that involved whole genome sequencing, something that you wouldn't expect in the course of a specific study, and then finally disclosing medically significant or personally meaningful information as a research benefit. So with respect to aggregate study results this 2008 study by Sara Hull at NIH and the recent article by Tomlinson in the Hastings Center report point out this is really an area where research participants feel strongly that they would like to receive data and in fact Tomlinson goes so far as to say biobanks have an obligation to provide ongoing information about research projects in lay language. That's not nearly as controversial as the issue of disclosing individual research results which can include two categories, incidental findings which are the findings that one does not expect in terms of the research purpose and which go beyond the aims of the study, and disclosing research results that one might expect but that one did not design the study to disclose to individuals for clinical purposes. It's important to keep in mind in this area of disclosing research results that the principle of autonomy and the ethical issue of returning results implies both a right to receive and a right to decline receipt of information, a right to know and not to know. Now in our legal system if you have a right, there's always a corresponding duty on the part of some person or corporation or government entity to protect it. So if we perceive that there is a right to research results, someone should have an [indiscernible] obligation to satisfy it. Right now the discussion in our community has focused mostly on the ethical duty to act as a good samaritan when one is in possession of incidental or research information that could be helpful to a tissue donor. At this point to my knowledge no one has strongly advanced the claim that there is an absolute legal obligation to disclose such information. But, if there is a right to know this information, then there needs to at some point be a discussion about where the duty lies to ensure that right. There is a developing consensus, I say that somewhat hesitantly, certainly there are many that still disagree, but there is a developing consensus that we should return incidental findings and research results in certain limited instances. That is, if we are going to consider there to be a limited ethical duty to return research results and incidental findings, we need to ensure that results that are returned are (1) medically significant, (2) clinically actionable and (3) are offered to research participants who have been informed about the possibility of these findings and who have agreed to accept them. The National Cancer Institute conducted a workshop on return of research results in 2008. And I want to just briefly highlight some of the conclusions of that workshop. One, that biobanks should have operating policies on what should be disclosed to individuals with plans for ascertaining analytical validity which in the United States certainly would include CLIA lab confirmation before any results can be returned to individuals for a clinical purpose, and a process for disclosure with appropriate ethical review. Second, that policies on disclosure of research findings to individuals should be communicated during the consent process and also documented in the consent form. The last bullet is a website that just brings you to the summary of the 2008 workshop, if you would like to get ahold of that. And finally, who is best situated to deliver appropriate clinical findings to research participants if we are going to presume an ethical duty to return results? In certain cases it might be a biorepository, though probably not likely. But if you have a rare disease biobank run by researchers in collaboration with individuals or where the research community and the research participant community is very tightly bonded, it might be appropriate in that case to use the biorepository to return results. A primary care physician, well, that person might likely need education about what these results mean, but it could work in certain cases. What about a physician at the institution where the biospecimen was collected? Again, we can run into problems with the Clinical Laboratory Improvement Amendments or "CLIA" - if the research result was not conducted in a CLIA approved lab. The institution where the specimen was collected will need to reassess the research findings in a CLIA approved setting. Finally it is always useful to involve genetic counselors with this type of information because they are not only so knowledgeable about the implications of genomic findings but also uniquely trained to offer information and provide guidance in an appropriate manner. Some of the things to consider in the context of returning research results are what who has an ongoing fiduciary relationship with the research participants and would be in the best position to convey findings and to also be able to track and keep in touch with the research participants? Also who has authority to return the results, that's the analytical validity issue that in the United States again we have CLIA that needs to be dealt with. And finally biobanks and institutions need to consider how they're going to fund the return of research results, whether or not that is going to impede funding of additional research and how to navigate that balance. And biobanks and institutions need to plan for how they're going to communicate these findings and processes for tracking individuals, making sure that they have contact information, having policies for what kinds of efforts they're going to make to track people down, whether they're going to communicate by letter or in a telephone call and the like. So all of these things are issues that need to be considered before before a biorepository or a medical institution decides to have a policy for returning research results. [indiscernible]. So that concludes my presentation. I think that I'm a little over time, so I will simply say thank you very much for listening, have a wonderful afternoon and I hope that you found this presentation helpful.