1. De-Identified Data: Ethics and Regulation Translational Research Ethics – Applied Topics (TREATs) Bioethics and Subjects Advocacy Program Indiana Clinical and Translational Sciences Institute December 22, 2016
Peter H. Schwartz MD, PhD
Indiana University Center for Bioethics
Indiana University School of Medicine
Philosophy Department, IUPUI

2. TREATs Translational Research Ethics – Applied Topics
Offered by the Bioethics and Subject Advocacy Program (BSAP), Indiana Clinical and Translational Sciences Institute (CTSI)
“News you can use.”
30 minutes
Web streaming/ Archived on BSAP home page
Thanks to BSAP faculty and Chris Caldwell, Regulatory and Knowledge Support (RKS), Indiana CTSI.

3. Two Great Websites
Office for Human Research Protections: Common Rule: Coded Private Information or Specimens Use in Research, Guidance (2008)
Health Insurance Portability and Accountability Act (HIPAA), Privacy Rule

4. Private Information Private information includes
information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record), and
information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place.
From: Coded Private Information or Specimens Use in Research, Guidance (2008).

5. Coded Information Coded means that:
identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and
a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.
From: Coded Private Information or Specimens Use in Research, Guidance (2008).

6. Individually identifiable information
Information is individually identifiable when it can be linked to specific individuals by the investigators either directly or indirectly through coding systems.
(as defined in Common Rule, 45 CFR (f))
Private information must be individually identifiable in order for obtaining the information to constitute research involving human subjects.
From: Coded Private Information or Specimens Use in Research, Guidance (2008).

7. HIPAA Health Insurance Portability and Accountability Act (1996)
From IU training (2013):
Protected health information (PHI): Any information about a person’s health.
Personally Identifiable Information (PII): Any data about a person that could potentially identify them.
De-Identified information: Health information that is not individually identifiable.

8. Protected Health Information
Information that relates to:
the individual’s past, present, or future physical or mental health or condition,
the provision of health care to the individual, or
the past, present, or future payment for the provision of health care to the individual, and that identifies the individual or for which there is a reasonable basis to believe can be used to identify the individual.

9. De-Identification
…[T]he Privacy Rule provides two de-identification methods:
a formal determination by a qualified expert; or
2) the removal of specified individual identifiers as well as absence of actual knowledge by the covered entity that the remaining information could be used alone or in combination with other information to identify the individual

10. De-Identification (A) Names;
(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for …
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
(D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses;
(G) Social security numbers;
(H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers;
(K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and
(R) Any other unique identifying number, characteristic, or code; and

11. De-Identification
A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that:
(1) Derivation. The code or other means of record identification is not derived from or related to information about the individual… ; and
(2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification

12. Is the study Human Subjects Research?
Studies are not human subjects research, according to common rule (45 CFR (f)) if two conditions met:
the private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and
the investigator(s) cannot readily ascertain the identity of the individual(s) to whom the coded private information or specimens pertain because, for example: …
Coded Private Information or Specimens Use in Research, Guidance (2008)

13. Is the study Human Subjects Research?
Intervention includes both physical procedures by which data are gathered (for example, venipuncture) and manipulations of the subject or the subject's environment that are performed for research purposes. Interaction includes communication or interpersonal contact between investigator and subject.

14. Is the study Human Subjects Research?
This guidance applies to
existing private information and specimens, or
private information and specimens to be collected in the future for purposes other than the currently proposed research. The following are examples of private information or specimens that will be collected in the future for purposes other than the currently proposed research: (1) medical records; and (2) ongoing collection of specimens for a tissue repository.”

15. Is the study Human Subjects Research?
(1) Does the activity involve research? If yes, proceed to question (2). If no, 45 CFR part 46 does not apply to the activity. 
Research means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalizable knowledge. Activities which meet this definition constitute research for purposes of this policy, whether or not they are conducted or supported under a program which is considered research for other purposes. For example, some demonstration and service programs may include research activities.

16. Is the study Human Subjects Research?
(2) Does the activity involve human subjects? If yes, proceed to question (3). If no, 45 CFR part 46 does not apply to the activity.
If the investigators are not obtaining either data through intervention or interaction with living individuals, or identifiable private information, then the research activity does not involve human subjects. Therefore, no assessment of the research activity using the third question below regarding exemptions is required because the exemptions provided for under 45 CFR (b) apply only to research involving human subjects.

17. Is the research exempt?
(3) Is the activity exempt under HHS regulations at 45 CFR (b)? If yes, 45 CFR part 46 does not apply. If no, 45 CFR part 46 does apply.
With respect to research involving private information and specimens, the exemption that is most frequently relevant is "Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.“
HHS regulations 45 CFR (b)(4):

18. Is the research exempt? Key questions:
whether the data or specimens are existing at the time the research is proposed to an institutional official or IRB for a determination of whether the research is exempt, and
how the data or information is recorded by the investigators. This exemption would not apply if the investigators, having obtained identifiable private information or specimens from existing records or specimens, record the data or information in a coded manner, since the code would enable subjects to be identified through identifiers linked to the subjects.

19. Example 1
An investigator obtains only coded information on the treatment outcomes of patients treated for arthritis with Drug A versus Drug B from the patients’ treating physician. The only involvement of the treating physician is to provide coded information to the investigator. The investigator and the treating physician enter into an agreement prohibiting the release of the key to decipher the code to the investigator under any circumstances, until the individuals are deceased.
In this example, the investigator is not conducting human subjects research because the investigator cannot readily ascertain the patients’ identity.

20. Example 2
An investigator obtains individually identifiable information on the treatment outcomes of patients treated for arthritis with either Drug A or Drug B by viewing patients’ existing individually identifiable medical records at the clinics where the patients were treated. The investigator records the patients’ treatment outcomes in a coded manner that could permit the identification of the patients.

21. Example 2
In this example, the investigator is conducting human subjects research because the investigator is obtaining identifiable private information from patients’ (and now subjects’) medical records. The study would not be exempt under 45 CFR (b)(4) since the investigator is recording the information in a coded manner, thus allowing the subjects to be identified indirectly through identifiers linked to the subjects.

22. Example 3
An investigator obtains individually identifiable information on the treatment outcomes of patients treated for arthritis with either Drug A or Drug B by viewing patients’ existing individually identifiable medical records at the clinics where the patients were treated. The investigator records only patient age, sex, diagnosis, treatment, and health status at the end of 6 months of treatment so that the investigator cannot link the recorded information back to the patients.

23. Example 3
In this example, the investigator is conducting human subjects research because the investigator is obtaining identifiable private information from patients’ (and now subjects’) medical records.
However, the study would be exempt under 45 CFR (b)(4) since the investigator records the information in such a manner that subjects cannot be identified either directly or indirectly through identifiers linked to the subjects.

24. Overview

25. Ethics Research ethics: Benefit/ Risk ratio Consent Justice
Individual interest in being asked for consent:
Choose whether to expose self to burden, risk
Physical risk
Privacy / Confidentiality
Decide whether to support research being conducted

26. Ethics Research ethics: Benefit/ Risk ratio Consent Justice
Individual interest in being asked for consent:
Choose whether to expose self to burden, risk
Physical risk
Privacy / Confidentiality
Decide whether to support research being conducted

27. Privacy and Confidentiality
How de-identification protects privacy/ confidentiality:
Researcher reviewing your data does not know who you are. (I.e. protection against embarrassment.)
Harder for bad guys to steal your data (I.e. protection against theft.)

28. Protection against Embarrassment
Types of data:
Individually identifiable; Name / address included
Individually identifiable, but requires effort to identify you. E.g. MRN, Social security number.
Coded: Key held by own group, but stored separately
De-Identified: Key held by other group
De-Identified: Key destroyed
Never identified: Collected anonymously
Dates

29. De-Identification (A) Names;
(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for …
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older;
(D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses;
(G) Social security numbers;
(H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers;
(K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers;
(N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers;
(P) Biometric identifiers, including finger and voice prints;
(Q) Full face photographic images and any comparable images; and
(R) Any other unique identifying number, characteristic, or code; and

30. Protection against Embarrassment
How embarrassed are you about information in your electronic health record?
Diabetes? Foot fungus? Depression? Erectile dysfunction?
Applies to clinical care too. Your cardiologist can see your diagnosis of depression, ED.
Advocacy for patients having “granular control” of their electronic health data, even when used for clinical care.
“Aspiring to Awesome” project Regenstrief – IUCB
Worse in research than clinical care?
Reconsidering privacy in the modern world.

32. Protection against Bad Guys
Types of data
Individually identifiable; Name / address included
Individually identifiable, but requires effort to identify you. E.g. MRN, Social security number.
Coded: Key held by own group, but stored separately
De-Identified: Key held by other group
De-Identified: Key destroyed
Never identified: Collected anonymously

33. Protection against Bad Guys

34. Protection against Bad Guys
Do any protections work?
In terms of harm to you personally, which are you more worried about, your financial information or your health information?
Examples:
Medical data breaches
Negative personal impact of those breaches

35. Ethics, again Individual interest in being asked for consent:
Choose whether to expose self to burden, risk
Physical risk
Privacy / Confidentiality
Decide whether to support research being conducted

36. Choosing whether to support research
Why does it matter if my information is de-identified or not? My information aids the research either way.
People are able to answer surveys about which types of research they feel strongest about supporting, and even some types of research they may oppose.
E.g. people who favor heart disease research over cancer research, since heart disease is in family.
But, if this research imposed almost no burden on them (using their data), do they care which one it is for?
Knee jerk answers, vs. reflection (public deliberation).

37. Opposition to certain kinds of research
How common is this? E.g. cloning? Stem cells?
Knee jerk vs. reflection
Havasupai tribe: De-identifying data doesn’t help, if it still includes ethnicity.
Group harm vs. Individual harm
Hard cases make bad law.

38. Conclusion Play by the rules. Think about the ethics.
Pay attention, there will certainly be change.

39. Questions? Comments? Critiques?
Request a consultation on this or any research ethics topic from BSAP (using the Translational Research Ethics Consultation Service (TREX)) at: Or

40. 410 West 10th Street, Suite 3100
Indianapolis, Indiana
USA
Tel: (317)
Fax: (317)