A federally funded demographic and environmental health survey data repository has been created, stored, and maintained by Research Institution. The Research Institution’s IRB has approved the creation of the repository. The repository includes data from a survey collected under participants’ informed consent. Informed consent does not specify whether researchers will contact patients about results that may be of interest to them. The informed consent also defines circumstances under which family members may need to be notified of relevant results.

The repository includes an extensive demographic and environmental health survey, participants’ self-report of family history information that will be stored in a data repository available for other IRB-approved research. Direct identifiers are stored separately from the data available for research and identifiers may be accessed only by the data collection and management team under terms of the original IRB-approved protocol creating the repository. The informed consent and protocol for creating the repository specify that reidentification and contact are contingent upon separate approval for specific purposes, with the exception of informing participants of results that may affect their health or have clinical relevance to them or their family members.

Max Researcher receives separate IRB approval to conduct a data mining study on these data to seek correlations between variables that might lead to additional avenues for research in environmental health. He discovers that a combination of family history of alcoholism and proximity to waste treatment facilities are significantly associated with higher than expected risk of metabolic disease.

Max Researcher decides to share limited study results with the participant’s family members since the information is clinically actionable. The information shared with participant’s family members is based on the defined language in the informed consent the participant agreed to when enrolling in the study.

Questions:

• How should informed consent handle sharing of study results?
  • Should participants be asked to specify either during the consent process or at a later time whether they would like to exercise the right NOT to be informed of study results?
  • Is there ever a case where informed consent or assent should be extended to family members so that they may also be informed of study results?
• Sharing study results introduces additional privacy risks due to additional data handling. What factors should IRBs consider when making determinations about return of results to patients? To family members?
• What policies and procedures should be in place for contacting and counseling participants, if analysis of their data reveals evidence of a health-related risk?
  • What obligations does the researcher have, if any, to inform participants of findings?
  • Are counseling resources required?
• What guidelines should researchers consider when informing participants of potential privacy risks that might have implications for family members? What are the potential tradeoffs of informing participants of possible risks to the privacy of family members?
• Should researchers have informed family members initially about the survey data repository collecting family history of health/disease?
• Would presence of genetic data (instead of family history) collected as part of initial patient contact change any of the required or recommended procedures for health or privacy?
• Given the policy gaps related to “big data,” what are the legal and privacy implications of “big data” collection and analysis?[i],[ii]
• How will anyone determine if study results are relevant to participants? Will all participants receive the same thing? Will individual choices be made so that one individual is told the results because the results have some relevance to him, but the next individual receives nothing because the findings are not significant to her? What if the findings are that some participants have a 5% greater risk than the population at large, but the absolute risk is actually 1 in 10000? Who will explain and answer questions? What if anything will the IRB do, and will it have any accountability for what it does (or doesn’t do)?