StATS: Secondary Uses of Data (August 2, 2004)
Mark Barnes gave a seminar on August 2, 2004 on Secondary Uses of Biologic Materials and Medical Data by Researchers and Commercial Research Sponsors. Here are my notes taken at that seminar.
There are a broad range of regulations and agreements that apply to secondary uses:
Any contract you might sign with a commercial sponsor of the research.
The Health Insurance Portability and Accountability Act (HIPAA) places criminal sanctions on researchers who disclose protected health information to the wrong people.
The Common Rule (45 CFR Part 46) applies to any research conducted by an institution receiving funding from the NIH if that institution has signed a FWA.
Voluntary accreditation standards for IRBs
State laws and litigation
International Committee of Medical Journal Editors ICMJE standards
Industry standards (PhRMA)
Be careful because state laws often have something to say about HIV testing, mental health records, and genetic testing. These state laws will often apply above and beyond any federal laws.
But you are also constrained by your own ethical concerns.
Some of the legal constraints in health care do not apply to a commercial sponsor. If they are free to disclose information or use it in ways that you would not consider appropriate, you place yourself and your instituation in a very difficult position. Before you give your data to a commercial sponsor, you should impose contractual constraints on commercial sponsors to limit their use of data/tissue?
Can there be informed consent to future uses? The are two extremes on this issue:
Subjects cannot agree to a future research project about which they have not been, and cannot be, informed.
Subjects should be permitted to "donate" their own data/materials for future uses.
You need to disclose the operation of the data/tissue repository, the specific types of research to be conducted, the conditions under which the data/specimens will be released to investigators, and procedures put in place to protect the privacy of the data/specimens.
The IRB will ask what constitutes a new or different study?
There are both patient privacy concerns and property rights concerns.
Do subjects have the right to revoke their consent to future uses? Note that if the data has been de-identified, then it is effectively impossible to remove the data.
NCI informed consent allows patients to check yes or no to three questions (see web link).
Commercialization of data/materials
Sometimes universities and companies can make money by patenting and licensing technologies derived from tissues. Even data alone might have commercial value. Asking a research subject to waive their commercial rights is exculpatory language, which is forbidden in the federal regulations. There have been several examples of litigation over commercialization of research products.
Greenberg v. Miami Children's Hospital. Miami Children's applied for a patent on some work derived from research performed by volunteers. Some of these volunteers were upset because they freely sacrificed their time and endured many inconveniences, risks, and discomforts. They did this because they wanted to help other patients with disease and not to enrich Miami Children's Hospital. The court held that failure to gain consent of patients on Canavan's disease on the commercialization of research products represented unjust enrichment.
Washington University v. Catalona. Bill Catalona wanted to take specimens and information from patients he recruited while working at Washington University when he left for Northwestern University. He sent a letter to all his patients (without clearing it first with Washington University) asking them to sign a consent statement allowing him to keep their tissues and to continue treating them.
Tilousi v. Arizona State University. Members of the Havasupai Indian tribe donated blood samples that were taken during a diabetes study and later used them without permission and without adequate IRB oversight in unrelated studies of schizophrenia, inbreeding, and theories regarding the migration of humans to North America, resulting in 23 scholarly papers and 15 publications.
HIPAA requires compound authorization.
Most Clinical Trial Agreements protect the proprietary information from the company but do not impose a requirement in return on the company to protect confidential information from the patients. If your informed consent promises privacy and confidentiality, and you do not seek restrictions in the CTA, then you are misrepresenting
De-identification removes the right of revocation and prevents tracing.
Data/materials collected during standard of care potentially falls under a different standard.
It's more important than ever to have clear and understandable informed consent forms because if you are sued, it will be scrutinized by a judge and/or jury with a typical lay person's understanding of the issues.
If you store records of your own practice in a separate location, then be careful. Even if you do nothing "researchy" with the data right away, you should submit a general databanking protocol to the IRB with continuing review every year. The protocol would describe how you will store the records, what information will be stored, and what security measures you will implement to insure privacy. You should specify in braod terms how you think the data will be used, though you might not know enough to specify the proposed research in any great detail. Perhaps more important would be to state the things that you would NOT do.
Hold, store, catalog, replenishing, You will need prospective consent. Security and privacy protections. Before you do launch a specific study, you promise or pledge to come back to the IRB for approval first.
The consent form would explain the purpose of the databank, what the risks are, and describe the categories of future use.
I agree to the use of my data for the study of this disease.
I agree to the use of my data for the study of all diseases.
I agree to be recontacted at a later data to provide further information.
Tissue banking has to acknowledge the possibility of genetic testing, which has a different set of professional and legal standards.
It will probably be an expedited review. Then when you decide later to use these records for research, you would submit another protocol to the IRB describing the proposed use.
Further questions (August 3, 2004)
How does an IRB handle adverse event reports (AE)? A committee of FDA and OHRP is working on consistency of reporting of AEs. Committee has to do "triage" on AE reports. The full IRB would only review serious AEs that are related to the drug/device. Especially critical is a review of any AEs that are not mentioned in the informed consent form.
Registry studies can raise some serious ethical concerns. Registry studies represent surveillance after approval of a device/drug. One important justification is to monitor for side effects, something that is always difficult to do well during the efficacy testing of the drug. Sometimes though, these databases are used for marketing rather than research. Be cautious of studies of an uncertain or unlimited duration. Make sure that the the registry does indeed serve a reasonable scientific purpose? You need a promise to never use the data for marketing purposes and that company will never contact your patients directly.
This page was written by Steve Simon while working at Children's Mercy Hospital. Although I do not hold the copyright for this material, I am reproducing it here as a service, as it is no longer available on the Children's Mercy Hospital website. Need more information? I have a page with general help resources. You can also browse for pages similar to this one at Category: Privacy concerns.