Use of Genetic Biomarkers for PCOR

Max Researcher, at the Prestigious University’s Genomic Research Institute, plans a study of gene networks within the human genome thought to be involved in metabolic regulation.[i],[ii] The National Human Genome Research Institute fund Max’s study and the Institute as part of a broad coalition of U.S. universities and research institutes conducting genomic sequencing to further the study of an array of diseases. Max’s study will compare the genes across individuals to identify potentially significant variations that may shed light on mechanisms and risks for metabolic syndromes (e.g., increased blood pressure, insulin regulation, fat storage patterns) associated with serious conditions like heart disease, stroke, and diabetes.[iii],[iv],[v] Max will recruit and collect blood and saliva samples from participants that will allow her to test for genetic biomarkers of interest and combine data from these genetic samples with genetic data obtained from the coalition database; she may collect additional data types (e.g., clinical, environmental). No data whatsoever from HIPAA covered entities are used in this study. Participants volunteer for the study on the basis of responding to public advertising.

Max obtains approval for the study through the University Research Institute’s IRB. Under the terms of the federal grant, coalition members must share all  data collected under grant funding in order to support each other’s research and further the public good (e.g., biomarkers, loci for certain diseases). Therefore, Max will share and obtain data from the other members of the coalition, and sets up data use agreements with these organizations (DUAs). The DUAs clearly outline the consequences for using or sharing the data inappropriately or outside of the bounds defined in the agreement. Patients consent to the study with the understanding that their data will be used for multiple research studies over time. They will not be contacted to renew consent because the IRB judged re-use of the data to be minimum risk since any direct identifiers associated with the data will be removed, and they will not need to provide additional samples. However, the informed consent will inform the participants of any potential risks related to reidentification. For example, Max may have limited ability to protect genetic records from law enforcement in certain situations.

Questions:

• What types of laws, policies or governance structures could be established to address re-identification issues?
• Should consent forms include information about reidentification risk? Is it feasible to include this type of information in consent forms given the technical complexity of the subject?
• How do you allow individuals the opportunity to control what types of research is conducted with their data?[vi]
• By what methods should data be deidentified to minimize risk of reidentification?
• Is it feasible to include DUA’s clauses where data subjects are the third-party beneficiaries should patient data be deliberately re-identified by researchers?
• What potential group and individual harms exist even when data is de-identified?[vii]
• Is the possibility of reidentification considered new information since it could lead to an accidental/unauthorized disclosure? If so, should participants be contacted and informed or the potential risk,or even re-consented?  Should the DUA even include considerations and subsequent steps for this kind of risk of reidentification?
• What additional data may need to be collected for research that in tandem with genetic biomarker data (clinical, environmental or otherwise) might increase the risk of reidentifiability?
• Should the biospecimen samples be destroyed once researchers collect the data of interest? Is this helpful to protect individuals?