UAREP Focus Session 10/27/00 w Bioinformatics Data: Confidentiality Issues w Jules J. Berman, Ph.D., M.D.* w Program Director for Pathology Informatics w Cancer Diagnosis Program w National Cancer Institute w *All opinions herein are Dr. Berman’s and do not represent those of any federal agency.

The Common Rule w 45CFR46 deals with protection of human research subjects and applies to Federal ‑ supported human subjects research. It is usually referred to as the Common Rule. w Any pathologist who reads 45CFR46 would be tempted to conclude that it must have been written by a pathologist because it contains many special allowances that apply particularly well to pathology and pathology-based bioinformatics.

Does the Common Rule apply? w Whenever you're contemplating doing research, you need to determine whether 45CFR46 applies. If it doesn’t apply, you don’t have to worry about regulations imposed by this set of federal regulation.

This means you!!! w The necessity for IRB review will apply to almost any research an academic pathologist chooses to do using tissues or pathology records.

Are you using human subjects? w Your project is exempted from 45CFR46 if you're not using human subjects. w A human subject is defined as a living subject. w That means no autopsy studies are regulated by 45CFR46 and all surg path specimens from patients who have died are ok.

45CFR46 Covers Research w Research is defined as a systematic investigation, …. designed to develop or contribute to generalizable knowledge. w So if you’re preparing a database of patient ‑ related diagnostic information (the kind of things a pathology department might want to do), 45CFR46 possibly may not apply.

Informed Consent w All human subject research regulated by the Common Rule requires informed consent unless w It is specifically exempted w The IRB waives the informed consent requirement.

Is genetic and bioinformatics research special? w Yes and No. w There are no federal regulations at this time that distinguish genetic research from other types of human subjects research. w HOWEVER

Is genetic and bioinformatics research special? w Genetic research, and genetic information often has special risks that the researcher must understand and address when their research is reviewed by an IRB. w IRBs may be particularly sensitized to human subjects risks contained in genetic research projects.

The Infamous “E4” exemption w Even if your study is federally sponsored, and qualifies as research and uses human subjects, many pathology studies can still be exempted from 45CFR46 regulations if

The Infamous “E4” exemption w Research is exempt from 45CFR46 regulations when "Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to subjects."

Anonymization / Deidentification w Anonymized data has no links between patient and specimen/data. It gets E4 exemption from Common Rule Regs w Deidentified information makes it extremely hard for data recipients to relink specimen data back to a particular patient. Under special circumstances, may have consent requirement waived.

Informed Consent w Human subject research regulated by the Common Rule requires informed consent unless w It is specifically exempted w The IRB waives the informed consent requirement.

When can IRBs waive consent? w 45CFR46 says, “An IRB may waive the requirement for the investigator to obtain a signed consent form if either: w 1. The only record linking the subject and the research would be the consent document and the chief risk would be the potential harm resulting from a breach of confidentiality.

IRB waive of consent (Contd). w 2. The research presents no more than minimal risk of harm to subjects and involves no procedures for which written consent is normally required outside of the research context.”

The “minimal risk” excuse! w "The study of existing data, documents, records, pathological specimens or diagnostic specimens," is "minimal risk” w Minimal risk applies to most of the studies done in pathology departments, including genetic studies.

The risks of the minimally risky w Usually, the risks from studies using pathology specimens fall into two categories: w 1. Loss of confidentiality w 2. Loss of privacy

Confidentiality versus Privacy w Confidentiality, in the realm of pathology, means that some third party learns confidential medical/research information about a patient w Privacy, in the realm of pathology and bioinformatics, relates primarily to contacting the patient with research results

Preparing for the IRB w It's the job of the pathologist/researcher to assure the IRB that the risks are minimized (and minimal, if a waiver from obtaining informed consent is sought) w This may require considerable sophistication in the field of data security (covered in our Data Mining workshop)

Refuge in Rational judgment w If you’re doing human subjects research under the Common Rule, and your research is not exempted and does not qualify for a waiver under the “minimal risk” clause, you may still get a waiver if: w The IRB believes that the value of your research outweighs the risks, and there is no way of obtaining consent.

Endgame: Getting informed consent --- My personal opinion w When a patient gives informed consent, what is the patient consenting to? w Answer: The patient is consenting to the risks. w The job of the researcher who to writes a model informed consent is to address the risks (confidentiality and privacy). The experimental aims are secondary.

Informed Consent for Genetic Research w There is the presumption that consent will apply mostly to prospective studies (because getting consent for retrospectively collected tissues is often unnecessary and logistically difficult to acquire). w Most of the consent issues of special importance for genetic research deal with privacy.

Genetic Research Consent forms should: w Describe the types of information that could result from genetic research. w Clearly explain the implications and the limitations of research. w Clearly explain the possible outcomes, and means of communicating results and maintaining confidentiality.

Genetic Research Consent forms should: w Explain that unexpected findings, including identification of medical risk, carrier status, or risk to offspring affected by genetic disease, may arise. w Explain that results may indicate that the child is not the offspring of one or both the presumed parents.

Genetic Research Consent forms should: w The consent form may contain a statement that misidentified parentage will not be disclosed. w Another example of unforeseen outcome is genetic heterogeneity in which disorders which were initially thought to be due to defects in a single allele or locus are associated with new ones.

Genetic Research Consent forms should: w Disclose additional risks. w Certain genetic research studies include the possibility of adverse psychological sequelae, disruption of family dynamics, and social stigmatization and discrimination

Genetic Research Consent forms should: w Indicate that whenever disclosure is anticipated, there will be medical geneticists and/or genetic counselors involved to ensure that the results are communicated to the subjects accurately and appropriately.

Genetic Research Consent forms should: w The consent form should not promise medical breakthroughs to entice participation. w The consent form and the consent process should not contain any language or actions that might be considered coercive to potential subjects.

SEA CHANGE: HIPAA PUNISHES CONFIDENTIALITY CRACKERS w Section 1177 of the Act established penalties for any person that knowingly misuses a unique health identifier, or obtains or discloses individually identifiable health information in violation of this part. The penalties include: (1) A fine of not more than $50,000 and/or imprisonment of not more than 1 year; (2) if the offense is “under false pretenses,” a fine of not more than $100,000 and/or imprisonment of not more than 5 years; and (3) if the offense is with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of not more than $250,000 and/or imprisonment of not more than 10 years. We note that these penalties do not affect any other penalties that may be imposed by other federal programs.

References NBAC Report w NBAC = National Bioethics Advisory Commission w Asked to suggest interpretations and recommendations related to the Common Rule to the President and Congress w Report available at:

NBAC Conclusion w Properly interpreted and modestly modified, present federal regulations can protect subjects’ rights and interests and at the same time permit well-designed research to go forward using materials already in storage as well as those newly collected by investigators and others.

Weird remarks from pathologists w "My research is not human subject research because I only use paraffin blocks, not fresh tissue." w "I understand that because of the CAP regulations, all my research has to be conducted with blocks that are over 5 years old"

Weird remarks from pathologists w "We anonymize the patient data that we give the researchers. We keep the links here in the pathology department so that we can re ‑ identify the patient if necessary.” w "This research gets E4 exemption because our subjects can not be identified.... The best thing about our study is that we continually update our records with treatment and outcome data."

Weird remarks from pathologists w "This is genetic research, and is governed by a different set of regulations from non-genetic research” w "If I don't get this E4 exemption, I will be obligated to get informed consent for this study.” w "We collect data from human specimens, so we have a legal obligation to unlink the the patient identifiers from the specimens.”

Weird remarks from pathologists w "I have a medico ‑ legal obligation to never send out blocks w "I have a medico ‑ legal obligation to never exhaust a block."

Most dubious assertion w "Because of the CAP regulations, I can discard all tissue greater than 5 years old, so that's what I'm doing."

References w The University of Mississippi has put its mpa (multiple project assurance document) on the web at: w ssurance.htm

References w The Complete Common Rule document on the web: w w or w cts/45cfr46.htm

References w Confidentiality brochure w