Ethics Challenges in Sharing Data from Pragmatic Clinical Trials

Abstract

Numerous arguments have been advanced for broadly sharing de-identified, participant-level clinical trials data, and trial sponsors and journals are increasingly requiring it. However, data sharing in pragmatic clinical trials (PCTs) presents ethical challenges related to: the use of waivers or alterations of informed consent for some PCTs and corresponding limitations of informed consent to guide sharing decisions; the potential for data sharing in PCTs to present risks not only for individual patient-subjects, but also for health systems and the clinicians within them; sharing of data from electronic health records instead of data newly collected for research purposes; and researchers’ limited capacity to control sensitive data within an electronic health record and potential implications of such limits for meeting obligations inherent to Certificates of Confidentiality. These challenges raise questions about the extent to which traditional research ethics governance structures are capable of guiding decisions about PCT data sharing. This paper identifies and examines these ethical challenges for PCT data sharing. We suggest several areas for future empirical scholarship, including the need to identify patient and public attitudes regarding PCT data sharing as well as to assess the demand for PCT data and the correspondingly likely benefit of such sharing. Further conceptual work is also needed to explore how requirements to respect patient-subjects about whom data are shared in the context of PCTs should be understood, particularly in the absence of informed consent for initial research activities, and the appropriate balance between promoting the generation of socially valuable knowledge and respecting autonomy.

Introduction

Numerous arguments have been advanced for broadly sharing deidentified, participant-level clinical trial data.^1,2 Broad sharing and reuse of data can, it is hoped, promote transparency and reproducibility in research, better honor trial participants by increasing the knowledge generated from their contributions, and shield future participants from unnecessary risk by avoiding redundant trials—benefits which collectively can improve patient care and health outcomes.^3,4 Consequently, trial sponsors and journals are increasingly establishing policies to encourage—or even mandate—sharing clinical trials data, and numerous platforms have emerged to support it.^5–8

The growing momentum for clinical trials data sharing has been accompanied by a concurrent rise in pragmatic clinical trials (PCTs), which aim to generate high-quality evidence to support “real-world” treatment decisions, and to do so more efficiently and at a lower cost than through traditional explanatory trials.⁹ To achieve these goals, PCTs are often embedded into clinical care settings, using protocols that incorporate study interventions into routine clinical workflows.¹⁰ Embedding PCTs into clinical care can avoid the need for separate research infrastructure and data collection systems, while providing a broader, more representative study population.

While both expanding the sharing of clinical trials data and increasing the implementation of PCTs share common goals—namely, accelerating the efficient generation of socially valuable knowledge to improve stakeholder decision-making, care quality, and health outcomes—data sharing in the PCT context presents some particular ethical challenges. First, PCTs are often conducted with a waiver or alteration of informed consent.¹¹ Yet arguments for clinical trials data sharing largely presume that any information shared will be from those who have made an informed and voluntary decision to participate, and, relatedly, that informed consent processes can therefore be used to communicate to prospective participants about how their data will be used and shared, and to align decisions about such sharing with their values and preferences.^7,12 Second, when PCTs are embedded into health systems, data sharing may present risks not only for individual patient-subjects, but also for health systems and clinicians within them.^13–15 The embedded nature of PCTs also means that data that might be shared are not newly collected for research purposes, but rather are from the electronic health record (EHR), about which patient-subjects may have different expectations regarding permissible sharing and use as compared to data from explanatory clinical trials.^16,17 Third, PCT researchers may have limited capacity to control sensitive data within an EHR, which presents potential repercussions for their ability to meet obligations inherent to Certificates of Confidentiality required for some federally sponsored research in the United States.¹⁸

These challenges raise questions about the extent to which traditional research ethics governance structures are capable of guiding decisions about PCT data sharing. This inquiry is particularly timely as funders, journals, and other stakeholders implement policies requiring sharing PCT data. This paper identifies and examines several key ethical challenges for PCT data sharing. Specifically, we begin by assessing the aforementioned challenges related to waivers and alterations of informed consent, the embedded nature of PCTs, and certificates of confidentiality. We then introduce two areas where future scholarship is needed to guide the development and implementation of policies to promote the ethical sharing of PCT data: empirical data on patient and public attitudes; and assessing the likely benefits of PCT data sharing.

Waivers and alterations of informed consent

Among the arguments commonly offered in support of clinical trial data sharing is that doing so honors the commitment of trial participants.^1–3,19 On this view, trial participants, through the informed consent process, agree to assume risks and burdens in the interest of advancing clinical knowledge. This assumption of risks and burdens creates a social contract, which is violated if society is not able to make full use of data generated from these participants, including through sharing to enable other researchers to replicate study findings or conduct further analyses.⁴ Proponents of this view often also assert that data sharing is consistent with the preferences and expectations of trial participants (an argument that is repeated throughout the compiled public comments on the 2019 Draft NIH Policy for Data Management and Sharing).²⁰

Moreover, policy guidance and related scholarship regarding sharing data from clinical trials generally emphasize the role of informed consent to fulfill the ethical obligation to respect those whose data are shared.^{1,3,4,7,21,22} As described by the National Academy of Medicine in its 2015 landmark report on clinical trials data sharing, “for most prospective trials…the informed consent process provides an opportunity to obtain participants’ approval for planned data sharing and to be transparent about potential future data sharing.”¹ Similarly, the Final NIH Policy for Data Management and Sharing “strongly encourages” researchers proposing to generate scientific data derived from human participants to plan for how data management and sharing will be addressed in the informed consent process.⁷

These two assumptions—that sharing clinical trials data aligns with the preferences of trial participants and that informed consent processes can fulfill the ethical obligation to respect those individuals whose data are shared—are both challenged when considering trials conducted with waivers or alterations of consent.^23,24 Waivers or alterations of consent are permissible under the Common Rule if an Institutional Review Board determines that “[t]he research involves no more than minimal risk to the subjects; the waiver or alteration will not adversely affect the rights and welfare of the subjects; the research could not practicably be carried out without the waiver or alteration; and whenever appropriate, subjects will be provided with additional pertinent information after participation.”²⁵ Both the nature of the interventions and design considerations of many PCTs (e.g., cluster randomization in trials that are determined to be of minimal risk) may reasonably satisfy these regulatory criteria.²⁶ However, patients’ views of the acceptability of waivers and alterations in PCTs may be inconsistent with those regulations.^27–30 Moreover, the use of waivers or alterations challenges the presumption that sharing clinical trials data necessarily advances participants’ preferences and expectations for ensuring their contributions are maximized, given that the participants may not have willingly assumed the risks or burdens related to the initial research, much less those resulting from subsequent sharing of data from it. While any research qualifying for a waiver or alteration of consent should involve no more than minimal risk from the research activities themselves, sharing data from PCTs, like sharing data from clinical trials more generally, present additional risks of potential harm to research subjects, perhaps especially from threats to privacy.^1,3 This is true even when data are de-identified, given the rise in technological advances and data interoperability that make it increasingly possible to re-identify individuals.⁷ While the potential for harm resulting from reidentification is unclear and arguably may be quite minimal, this potential might nevertheless vary based upon the nature of the research question and the sensitivity of the collected data.

This potential for harm notwithstanding, the use of waivers or alterations of informed consent within PCTs do not necessarily render subsequent data sharing ethically impermissible. As noted in comments on the NIH’s data sharing policy offered by the Secretary’s Advisory Committee on Human Research Protections, standards governing both patient data and research practices generally permit downstream research uses of de-identified or anonymized data.³¹ Moreover, strong arguments have been offered within related contexts (e.g., research using clinical data) as to why such sharing may be ethically justifiable even without prospective specific research consent, provided reasonable efforts are made to protect privacy and confidentiality.^32–38 A shared theme of these arguments is that there are legitimate reasons to restrict individual privacy and autonomy-based rights so as to enable the sharing, aggregation, and analysis of data to promote socially valuable research to serve the common good—reasons that could similarly apply to sharing data from PCTs. By extension, it might be argued that in the absence of consent there might be an increase in the obligation to maximize the likelihood that research data produce social value, so as to most fully justify the research-related risks (again, presuming reasonable controls to protect privacy and confidentiality). In any case, the prevalence of waivers and alterations of consent for PCTs suggests the need for future normative exploration into how to best fulfill the ethical obligation of respect when sharing patient-subject data from PCTs, including whether different obligations and corresponding research processes should exist for data obtained from PCTs conducted with waivers or alterations of informed consent, or, alternatively, whether the move towards broader sharing might limit the permissible scope of waivers or alterations of consent. For example, as two of us suggest elsewhere, waivers or alterations of consent in PCTs might require researchers to implement other mechanisms for fulfilling the ethical obligations of respect for persons, such as engaging patients and communities in research design and execution.³⁹

The embedded nature of PCTs

Sharing of EHR data

The deliberate embedding of research into ongoing clinical care—a characteristic feature of PCTs—means that PCT data may include data from the patient-subjects’ EHR, rather than being solely comprised of limited research data elements.^40,41 EHR data differ from traditional research data in important ways, including greater site-level heterogeneity in data definitions and a relative lack of investigator control over data collection, which can impact the validity of subsequent analyses, particularly if data are shared with those who lack the contextual knowledge to ensure they are used and interpreted appropriately.⁴² For some PCTs, the primary data for enrolled patients includes every encounter, medication and procedure,⁴¹ with corresponding implications for the feasibility of protecting privacy, even if data are de-identified. Furthermore, the scale of embedded PCTs may be orders of magnitude larger than for many conventional clinical trials, with potentially hundreds of thousands of patient-subjects included in them—bringing a corresponding increase in the risk from data breaches.⁴¹ These issues have been identified as presenting challenges for implementing data sharing policies, which were largely developed for explanatory clinical trials, within PCTs.^14,41,43 At the extreme, the protections required when using EHR data may mean there is no defined dataset that could be shared, rendering conventional approaches to data sharing infeasible. For example, as described in the resource sharing plan for the Active Bathing to Eliminate (ABATE) Infection trial (NCT02063867), analyses involved detailed confidential medical information from over half a million patients, along with proprietary data about participating institutions.^13,14 According to the investigators, the detail and volume of these data effectively precluded protection against re-identification by comparison with external data sources. Consequently, the ABATE investigators never took possession of the relevant data, and all study analyses were conducted behind the health system partner’s firewall.⁴⁴

Potential burdens and harms of sharing for clinicians and health systems

The embedded nature of PCTs means that PCT data may include information that could identify not only individual patient-subjects, but also health systems and the clinicians within them, which would be uncommon for data from conventional clinical trials. For example these data may include information about the number and size of facilities; practice volume; formulary structure; and about supply chains and vendors.⁴¹ The nature of both the data collected and the characteristics of the participating institutions may make traditional approaches to de-identification, such as removing or altering explicit identifiers, insufficient to prevent reidentification.^14,15 Redacting or masking additional data elements that could enable re-identification through data linkage may mitigate reidentification risk,^13,14 although this presumably might also reduce the value of those data for future research purposes. At the health system level, concerns have been raised that data sharing might result in disclosure of proprietary business data—data that competitors are not required to make public. This in turn has raised concern that this disclosure risk could disincentivize health systems from willingness to participate in socially valuable research.¹⁵

Concerns have also been raised that data about health systems or clinicians might cause harm if they are interpreted out of context, or are used to make inappropriate comparisons.^13,41 These concerns echo those articulated elsewhere about the risks of clinical trial data sharing more generally, including the risk that poorly executed secondary analyses by unskilled analysts or those with private agendas (including market competitors) could mislead patients and clinicians about appropriate treatment decisions.³ Yet sharing PCT data creates a new layer for this challenge, namely, that poorly executed comparisons might misrepresent not only the value of certain treatments, but also the quality of specific clinicians or health systems. This risk might arguably be exacerbated for PCT data derived from EHRs, as EHR data present distinct challenges for data quality and consistency. For example, coding varies across practice sites—even within sites that are part of a single corporate entity—meaning that appropriate interpretation and standardization of data elements may require engagement of local data experts.⁹

While the likelihood of poorly constructed or misleading secondary analyses is uncertain, experience from reporting requirements in non-research contexts offers some evidence to support clinician- and institution-level concerns. For example, prior efforts related to public reporting of quality data demonstrate how biased analyses can inappropriately threaten institutional reputations. In 2001, a Denver Post article misrepresented data regarding a hospital’s average mortality rate for open heart surgeries, inappropriately asserting that the rate was nearly twice that of the national average, while failing to incorporate considerations of case mix or complexity analysis (and subsequently refusing to publish rebuttals from cardiac surgeons to contextualize the misleading narrative).⁴⁵ Importantly, the literature examining early efforts at publicly reporting clinician- and institution-level quality information is also replete with examples of unintended and negative consequences related to data sharing. Notably, the use of cardiac surgery health care report cards in New York and Pennsylvania was associated with provider-level selection behavior that resulted in some surgeons turning away the most severely ill patients in an effort to avoid lower publicly reported ratings associated with poorer outcomes, along with an increase in racial disparities in access to cardiac surgeries, presumed to be the result of clinicians selecting patients based on risk profile.^46,47 Similar concerns have been raised for reporting in interventional cardiology.⁴⁸

While these risks for health systems and clinicians related to the sharing and/or potential misuse of what may be considered to be proprietary data may not be decisive considerations in decisions about PCT data sharing, they nevertheless suggest the importance of mechanisms aimed at ensuring that any subsequent analyses resulting from shared data are presented with the appropriate context, including both the use of risk adjustment, and accurate understanding of the data elements. They also suggest the importance of considering potential unintended consequences related to sharing, including that such sharing might inadvertently disincentivize health system participation in PCTs, particularly by systems serving high-need populations.

Clinician-specific concerns

Specific concerns have been raised about the appropriateness of sharing data about clinicians, since clinicians, particularly those in cluster-randomized trials, may not have made a prospective decision to participate in the PCT. Relatedly, as discussed elsewhere, clinicians may in some cases themselves be PCT research subjects and face the potential for research-related burdens or harms, including those of ranking or reputation.^49,50 Data sharing may therefore subject clinicians to reputational risks, including the risk of unjustly being labeled as of poor quality.⁵¹ While an influential ethical framework for embedded health research asserts that clinicians have an obligation to contribute to continuous learning activities (such as embedded PCTs), questions have been raised about the appropriate extent and limits of those obligations, including risks related to disclosure of sensitive information, particularly when clinicians have not consented to participate in the research activity.^51–53

Arguments about the appropriate scope of clinician obligations to contribute to PCTs—including limits on those obligations related to data sharing and privacy—share common features with arguments regarding obligations to contribute to quality improvement. For example, a working group convened by the Hastings Center argued that clinicians have an ethical responsibility to participate in quality improvement because of the special responsibility they have to serve the interests of their patients—a responsibility, the group argued, that extends to participating in activities that present no more than “minimal incremental risk” to clinicians, relative to the normal work situation.⁵⁴ Notably, while they argued for the importance of ethical protections for quality improvement activities, including confidentiality protections for clinicians and their data, they reject the claim that clinicians might legitimately opt out of an activity that might reveal that they are “incompetent.”⁵⁴ Extending this analysis to the PCT data sharing context might suggest that while clinicians have obligations to participate in PCTs, these obligations are subject to standards of reasonableness, including that such participation does not subject the individual to more than minimal incremental risk, and that reasonable steps will be taken to protect data confidentiality.

Certificates of confidentiality and ability to control sensitive data

Recent changes in federal policies governing Certificates of Confidentiality (CoC) inadvertently create potential conflicts between the ethical goals of sharing research data and protecting privacy.¹⁸ As part of the 21^st Century Cures Act, CoCs are now automatically issued for all NIH-funded research that collects or uses “identifiable, sensitive information”. This marks a departure from previous CoC policy, under which investigators applied for a CoC only when conducting research involving sensitive or stigmatizing information, or in which disclosure of private information could result in civil or criminal liability.^18,55 CoCs prohibit disclosure to any person not connected with the research study of “any information, document, or biospecimen” that contains identifiable, sensitive information that “was created or compiled for the purposes of research.” Permissible disclosures are limited to a narrow range of conditions, including “for the purposes of other scientific research that is in compliance with applicable Federal regulations governing the protection of human subjects in research”.

CoC policy reflects the importance of protecting the confidentiality of research data, particularly sensitive or stigmatizing information, to mitigate the understandable reluctance individuals might have to participate in research that might place them at risk of civil or criminal liability.¹⁸ Such concerns seem especially apt for recent research efforts directed at the opioid crisis, such as those through the NIH Helping to End Addiction Long-term (HEAL) Initiative. Yet, as described elsewhere, the automatic issuance of CoC’s may cause significant problems given stakeholders’ lack of knowledge about their requirements such as the obligations for researchers, including those with whom data are shared.⁵⁵ As Wolf and Beskow have argued, if researchers do not fully understand obligations regarding CoCs, they are unlikely to effectively convey those obligations to other researchers with whom they share data.⁵⁵ This concern may be particularly acute in the PCT context, given uncertainty regarding researchers’ legal obligations for research conducted without explicit consent, and for pragmatic research that populates the EHR with research data, which may be unprotected by the CoC.¹⁸ This could then be exacerbated by any subsequent data sharing.

Patient and public attitudes related to PCT data sharing

As described earlier, arguments for clinical trial data sharing often present sharing as consistent with the preferences and expectations of research participants. While the universality of these preferences may be contestable, some empirical evidence certainly supports this claim. For example, a large-scale survey of clinical trial participants’ attitudes towards sharing trial data found that an overwhelming majority of participants generally viewed the benefits of sharing as outweighing the risks, and were willing to share their data.⁵⁶ According to the study authors, these data rebut arguments from commercial trial sponsors and other stakeholders aimed at restricting data sharing, based on the claim that such restrictions better respect the preferences and values of those about whom data are shared.

To date, no similar studies have evaluated patient or public views regarding PCT data sharing. Consequently, whether these findings are consistent with the preferences and values about whom data are shared remains unknown. Several features of PCTs—and the nature of their enrolled populations—prompt caution in extrapolating prior findings from explanatory trials to this context. This is arguably especially true for PCTs using waivers or alterations of informed consent, in which patient-subjects may be unaware that they are included in research—and therefore cannot, as has been argued for explanatory trial participants, be assumed to share a commitment to its value, nor a corresponding willingness to assume some degree of added risks or burdens to support that end.

In addition, research in related domains, such as conducting research with EHRs without consent, indicates that, while patients and members of the general public are supportive of EHR research, this support is not universal, and a majority of individuals generally prefer to be asked permission at least once.^57–60 Relatedly, a 2020 US national survey found that half of respondents disagreed with the statement that people have an ethical obligation to allow their health information to be used for research.⁶¹ Collectively, these findings suggest there may not yet be broad support for widespread PCT data sharing among patients or the general public, particularly for data collected without consent for such sharing. If so, this would undercut arguments that data sharing reflects the values and preferences of those about whom data are shared. While stakeholder preferences alone are not determinative of ethical decisions, understanding public views on PCT data sharing can inform policy decisions that demonstrate respect for those whose data are shared, while supporting the development of trustworthy governance approaches.

One final note on patient and public attitudes: prior empirical work has largely examined data sharing preferences regarding consent and individual autonomy without exploring how people weight those preferences against other relevant attributes, such as the downstream implications for research and health outcomes—despite these tradeoffs being central to data sharing policy decisions. To best inform policy decision-making about the ethical and feasible design of PCT data sharing systems, future empirical work should therefore explore not only first-order attitudes regarding sharing, but also how individuals weight privacy interests against other considerations, such as social value.

Assessing the likely benefits of PCT data sharing

A key unexplored question relates to the anticipated benefits gained from that sharing. Arguments for the broad sharing of PCT data are premised on the expectation that such sharing will yield social value—social value that, in some cases, may be sufficiently high to justify sharing of those data without consent.

Whether this expectation will be realized remains unknown. However, studies exploring the outcomes of data sharing in explanatory trials suggest some clues. For example, the “SPRINT Data Analysis Challenge,” which aimed to inform the debate over data sharing spurred by the International Committee of Medical Journal Editors’ 2016 proposed data sharing plan, provided access to data from a trial funded by the National Heart Lung Blood Institute, and challenged analysts to identify a novel biologic or clinical finding using those data.⁶² An accompanying editorial in the New England Journal of Medicine, which co-sponsored the challenge, argued that, while it supported the proof of concept that clinical trial data could be used by other investigators to produce new findings, whether those findings would in turn “advance the art or change how we treat patients,” and whether they were worth the time, resources, and effort needed to generate them, “may be in the eye of the beholder.”⁶³ Similar skepticism as to whether the “juice is worth the squeeze” regarding the value of investing resources to facilitate the widespread sharing of clinical trial data has been raised in response to other assessments of the resultant value from prominent data sharing platforms, including Yale’s Open Access Data Project, and the Clinical Study Data Request platform now supported by the Wellcome Trust.⁶⁴ For example, an early assessment of proposals for secondary data use made to the Clinical Study Data Request found that only 5.3% resulted in publications, motivating the Journal of the American Medical Association editors to observe that, “despite the theoretical and ethical imperatives [for sharing], the effect of actual use and output has been limited.”^64,65

Nonetheless, recent evidence suggests that secondary use of shared data may be accelerating. A 2021 report describing requests for data from prominent clinical trial data sharing platforms and the rates of dissemination of research findings from those data requests found that approximately one-quarter of all approved requests resulted in peer-reviewed publications, preprints, or conference abstracts—potentially rebutting arguments that the opportunity costs required for developing and maintaining the infrastructure to facilitate widespread sharing of clinical trial data may not be a worthwhile investment of scarce research resources.⁶⁶ Regardless, no studies have yet examined the potential uptake of or demand for data shared from PCTs, which may differ from that for explanatory trials, given differences in the nature of PCT data, and the impact of any alterations or removal of data elements intended to protect institutions from the risk of deductive disclosures on the value of those data for future analyses. Future work is therefore needed to understand the demand for PCT data, and the likelihood that sharing will generate additional social value.

Looking ahead

This discussion suggests several insights for policy decisions regarding PCT data sharing. First, future empirical work is needed to assess patient and public attitudes regarding PCT data sharing. Importantly, this work must prioritize understanding how individuals weigh trade-offs central for policy decision-making, including the relative weight of advancing knowledge to improve health against protecting individual autonomy. Second, additional empirical research should evaluate the demand for PCT data, to inform assessments about how to tailor data sharing requirements to best ensure that shared data will, in fact, yield societal benefits so as to justify the investment required to broadly share those data. Third, concerns about the importance of ensuring understanding of data context given the heightened challenges for data quality and validity in PCTs offers support for proposals to encourage involvement of the initial PCT investigators or the health systems in which the PCT was conducted to mitigate the risks that data sharing leads to biased or misleading conclusions.

Additional insights are suggested related to the limitations of existing policy proposals to manage the benefits and risks of PCT data sharing. For example, earlier proposals have called for the use of data enclaves to mitigate concerns about biased, poorly executed, or misleading comparisons.^14,15,41 Other suggested strategies include reducing the risk of reidentification through data linkage to protect clinician and institution privacy, such as by removing or altering additional data elements, beyond explicit identifiers.^14,41 While these proposals seem reasonable to mitigate risks to clinicians and institutions, further work is needed to address other ethical concerns, including how we should understand requirements to respect patient-subjects about whom data are shared in the context of PCTs, particularly in the absence of informed consent for initial research activity, and the appropriate balance between promoting the generation of socially valuable knowledge and respecting individual autonomy. Further work is needed to explore these issues, to guide the ethical implementation of PCT data sharing.