Principles of Human Subjects Protections Applied in an Opt‐Out, De‐identified Biobank

Abstract

BioVU, the Vanderbilt DNA Databank, is one of few biobanks that qualifies as non‐human subjects research as determined by the local IRB and the federal Office of Human Research Protections (OHRP). BioVU accrues DNA samples extracted from leftover blood remaining from routine clinical testing. The resource is linked to a de‐identified version of data extracted from an Electronic Medical Record (EMR) system, termed the Synthetic Device (SD), in which all personal identifiers have been removed. Thus, there is no identifiable private information attached to the records. The Belmont Report enumerates the importance of the boundary between practice and research, and three principles: Respect for Persons, Beneficence, and Justice, which constitute the essential ethical framework by which IRBs and ethics committees judge the risks and benefi ts of research involving human subjects. BioVU was developed by designing and implementing new procedures, for which there were no previously established methods, which are consistent with the principles of the Belmont Report. These included special oversight and governance, new informatics technologies, provisions to accommodate patients’ preferences, as well as an extensive public education and communications component. Considerations of core principles and protections in the practical implementation of BioVU is the focus of this paper. Clin Trans Sci 2010; Volume #: 1–7

Introduction

There are a growing number of DNA biobanks across the country and around the world. These generally rely on sample collection and information capture protocols that fall within the scope of human subjects research as defined by US regulations and by the local ethics committee or Institutional Review Board (IRB). BioVU, the Vanderbilt DNA Databank, represents one of few biobanks with an operational protocol that makes its nonhuman subjects research as determined by the local IRB and the federal Office of Human Research Protections (OHRP). The Code of Federal Regulations, 45 CFR 46.102 (f), defines a “Human Subject” as a living individual about whom an investigator conducting research obtains either data through intervention or interaction with the individual, or identif able private information, even in the absence of intervention or interaction, or an individual who is or becomes a participant in research. BioVU accrues DNA samples extracted from blood remaining from routine clinical testing after samples have been retained for 3 days and are scheduled to be discarded. Thus, there is no intervention or interaction with individuals for research purposes. The resource is linked to a de‐identified version of data extracted from an Electronic Medical Record (EMR) system, called the Synthetic Derivative (SD), in which all personal identif ers have been removed. Thus, there is no identifiable private information attached to the records. A full description of this resource has been published elsewhere. ¹

Academic medical institutions have long performed research that involves data and/or tissue derived from humans, but is not human subjects research as defined by the regulations. We and others have observed that some members of the lay public are unaware of the federal definitions and believe that existing tissues (e.g., stored surgical pathology specimens) are not (and should not) be used for research without explicit consent. ² This belief contradicts the current actual practice of research permitted by the Code of Federal Regulations Title 45, Part 46, (the “Common Rule”) Subpart A 46.101(b)(4), which provides an exemption from the regulations for human subjects research studies that involve “…the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects.” Although not a use of “existing tissues” the BioVU model relies on subsequent OHRP guidance on “Research Involving Coded Private Information or Biological Specimens” ³ that states: “This guidance applies to existing private information and specimens, as well as to private information and specimens to be collected in the future for purposes other than the currently proposed research. The following are examples of private information or specimens that will be collected in the future for purposes other than the currently proposed research: (1) medical records; and (2) ongoing collection of specimens for a tissue repository.” Despite the fact that BioVU falls outside the coverage of the Common Rule, Vanderbilt has chosen to publicize its use of residual samples and to permit patients to opt out of such use, a practice for which there was effectively no precedent.

The Belmont Report, published in 1979, is a foundational document for modern research ethics. It enumerates the importance of the boundary between practice and research, and three principles: Respect for Persons, Beneficence, and Justice, which constitute the essential ethical framework by which IRBs and ethics committees judge the risks and benefits of research involving human subjects. In the Belmont Report, Respect for Persons “incorporates at least two ethical convictions: first, that individuals should be treated as autonomous agents, and second, that persons with diminished autonomy are entitled to protection.” Beneficence is embodied in the rules “(1) do not harm and (2) maximize possible benefits and minimize possible harms.” “Justice is the principle of the fairness of the distribution of the benefits of research, relative to those who bear its burdens.”

BioVU was developed by designing and implementing new procedures and components that are consistent with the principles of the Belmont Report but for which there were no established methods. These included special oversight and governance, new informatics technologies, provisions to accommodate patients’ preferences not to be included in the research program, as well as an extensive public education and communications component. We expect that the BioVU model would not be generalizable or transportable to many sites and situations. Further, other models might be more appropriate in different settings or among different population groups. The intent of this paper is not to make comparisons. Rather, consideration of core principles and protections in the practical implementation of BioVU is the focus of this paper.

Methods

In the formation of BioVU, the program designers received input from the Medical Center Ethics Committee, the Medical Records Committee, an institutional operations oversight committee established specifically for BioVU, and a Community Advisory Board also established specifically for the project, as well as initial review and on going oversight of the resource and its use by the IRB. The principles and their application described here were discussed at length by all groups.

Boundaries between practice and research

One foundational principle of the Belmont report is preserving the boundary between clinical care and research. This distinction is particularly relevant for BioVU, given that notification for the program is provided in patient registration forms that are part of the health care practice environment. A common, central registration form was used so as to not disrupt logistics or other patient flow procedures by introducing a separate research informational form. Text in this Consent to Treatment/Agreement to Pay form—that every patient at Vanderbilt University Medical Center (VUMC) signs annually—was altered and expanded to explain that research on tissues might be conducted. Patients are explicitly notified of the DNA Databank in these forms under the “Research” subparagraph:

I understand and agree that any specimens or tissues normally removed from my body by VUMC in the course of any diagnostic procedures, surgery, or medical treatment that would otherwise be disposed of may be retained, used for educational purposes or research, including research on the genetic material (DNA) or other information contained in those tissues or specimens.

The text serves to distinguish health care from research related practices and functions that may involve data or tissues. The intention of preserving this boundary between practice and research was also supported by the systematic removal of all identifying information from the records used in BioVU for research. Both project staf and ethical oversight committees understood that the information contained in the Consent to Treatment form is not always read in its entirety by patients, and sometimes not read at all. For this reason, the text present in this document is supplemented by other methods of communication.

Respect for persons

The principle of Respect for Persons was an essential component of the design for BioVU. While the most common application of this principle (e.g., a separate research informed consent document and consent process) is not employed in this program, respect for persons, including autonomy, and voluntariness were clear objectives in implementing the provisions listed below:

• 1Despite the IRB's determination (and OHRP's confirmation) of the project did not involve human subjects as defined by federal regulation such that efforts either to inform about the project or to seek their permission were legally required, there was consensus by the IRB and BioVU planners that the individuals from whom DNA and records could be derived have the right to be notified of the program. As implemented, this notification is provided primarily via registration forms wherein documentation of patient notification is obtained via signature. These notif cations are provided at least annually. The forms are provided both in English and Spanish, languages spoken by an overwhelming majority of the patients in the Vanderbilt catchment area.
• 2Patients have been given the right not to participate. Specifically, individuals can opt out of having their DNA included in the biobank at any time by checking a box placed conspicuously on the Consent to Treatment form described above (see Figure 1 , opt out). As shown, the box to opt out is directly above the signature line. If an individual chooses to opt out, the opted‐out status is permanent, and is kept confidential as part of the demographic data stored in the operational EMR. Individuals can opt out at any time, preventing future usage of their tissue and tissue‐derived data.
• 3To enhance the number of individuals who are aware of the BioVU program, educational materials have been implemented through various print materials and distribution channels. These include explanatory full color brochures ( Figure 2 ), posters, and newspaper advertising and articles. One purpose of the newspaper advertising is to provide some opportunity for individuals to be exposed to the program prior to coming in for their visit. The brochure is specifically intended to represent key information components in an understandable format, including: (1) program description and rationale, (2) operational protocols for obtaining and handling DNA, (3) restrictions on usage, (4) privacy, (5) the right to choose not to be included, (6) research‐clinical boundary, (7) oversight, and (8) handling common misconceptions. The program brochure has written readability of grade level 3.9 according to the Flesch–Kincaid Grade system level, and is distributed along with the treatment consent form annually as well as made available on counters in waiting areas in outpatient clinics. A toll free number, which is also included on the brochure, can be called if a patient has additional questions or prefers to speak with program staf personally. A printed community newsletter is also planned. An empiric observation is that many patients read the brochure while waiting for outpatient appointments.

Figure 1.

Opt‐out portion of Consent to Treatment/Agreement to Pay form.

Figure 2.

Part of BioVU brochure.

In addition to these communications ef orts, an ongoing series of research eforts involving assessment of patient attitudes inform program development and operations. These have included patient surveys, exit interviews, and focus groups. There have been 16 separate IRB approved protocols conducted to guide the development, design, and utility of BioVU. Data collected from these eforts have been published ⁴ and are reviewed by the advisory bodies routinely for incorporation into project planning. Significantly, we have consistently found that when asked explicitly, an overwhelming majority of patients choose to have their records and samples included in the program. Similar acceptance of widespread favorability for DNA biobanking has been reported by others ⁵ , ⁶ as well as support for opt‐out models ⁷ , ⁸ .

Beneficence

The principle of benef cence has been honored by minimizing the risk of harm to individuals while maximizing benefit to the broader society. One form of potential harm is the inadvertent or intentional re‐identification of the identity of individuals whose samples and/or data are contained in the research resource. BioVU includes the linkage of DNA samples to a de‐identified version of the EMR called the SD. To minimize the risk of harm, the SD provides a de‐identified copy of data from Vanderbilt Medical Center's inpatient and outpatient EMR systems, reformatted into a separate database structure for secondary research purposes. The current SD user interface contains a search mechanism that allows researchers to extract sets of records of interest based on various structured data fields (e.g., reimbursement codes and laboratory values) and unstructured data fields (e.g., the words contained in clinical narratives and discharge summaries, in a fashion similar to Internet search engines such as Google). The current SD search relies on a simple, “cross‐sectional” search through the chronologically ordered clinical data contained within the SD data repository. The retrieval and review functions provide real‐time results for simple and complex queries. To maximize benefit (i.e., its utility for a broad variety of research), the data resource preserves the sequence of clinical events but employs date shifting, so that dates contained in the data are never the actual dates of a clinical event, but the chronological order and date intervals are retained. Algorithms shif the dates by a time period that is consistent within each record, but dif ers across records (e.g., if the date in a particular record is April 1, 2005 and the randomly generated shift is 45 days in the past, then the date in the SD is February 15, 2005, while another individual's record would be shif ed systematically by a different number of days). Importantly, as new entries are accumulated in the EMR system, the scrubbing process described below is applied to new additions and the SD is thereby updated.

The SD data resource facilitates research with and without the associated biobank samples. Researchers contemplating the feasibility of a clinical trial can easily determine the number of cases of a particular disorder that exists, what patterns of therapy have been, and the occurrence of intended and unintended effects of treatment. As of this writing, more than 315 searches of the resource by 32 users have occurred. The creation and maintenance of the associated DNA biobank is supported as an institutional research resource that is availability to all faculty who have IRB‐reviewed and approved studies (see below). In addition, the terms of use of the resource require a redeposit of genetic information generated in a research study back into a genomic database; this will also help to maximize benefit. All protocols are reviewed by a committee of investigators and other experts to ensure the scientific quality of the research projects undertaken, with the goal to promote the resource in terms of improvements to generalizable knowledge, and to facilitate these enhancements to knowledge in an effcient way, with samples and data that have already been collected.

To date the resource has supported genome‐wide association studies of approximately 15 different disease conditions and physiologic traits such as variability of cardiac conduction. ⁹ , ¹⁰ Other work underway is identifying adverse drug effects as documented in the de‐identified clinical data, and correlating susceptibility to those adverse effects with genome scans. The long‐term benefit of these ef orts will be improvement in health care services, expansion of the knowledge base of clinically important human genetic variation for a coming era of “personalized medicine,” and reduction of avoidable suf ering caused by adverse effects of therapy across a broad range of human diseases. In this context, benefits of the resource will accrue for society, though not directly or immediately to the individuals from whom the materials and information are derived.

Several approaches are employed to further minimize harm to individuals:

• 1There is extensive oversight for the program. Although not generally mandated for studies that do not involve human subjects as defined by the Common Rule, the Vanderbilt IRB determined that “given the seminal nature of the proposed work and its potential broad impact upon the local community, the Committee agreed that additional safeguards are warranted.…” and that “The IRB will … maintain oversight for the specimen repository.” This includes oversight of all changes to the protocol, including the Data Use Agreement signed by users of BioVU, communication materials, exclusions, and other procedural elements. The IRB, with its institutional jurisdiction to review and approve research, will also review and approve protocols seeking to access BioVU; verification of IRB approval will be made by program staff before access will be granted to an approved investigator. The BioVU project itself is on an annual continuing review cycle. In addition to the IRB, the following other groups, as shown in Figure 3 , provide guidance to BioVU: a Community Advisory Board, an Operations Oversight Board (OOB), an external Ethics Advisory Board, and the Medical Center Ethics Committee. The OOB reviews all studies seeking access to the resource in addition to the review conducted by the IRB. An external scientific advisory board will convene in the upcoming year.
• 2A key characteristic of BioVU (and essential to the IRB's approval of it) is the ef ective de‐identification of the medical data. The SD is designed to be structurally compliant with the “Limited Data Set” provisions of the HIPAA Privacy Rule (Sec. 164.514) by removal or permutation of 17 data elements and any other unique identifying number, characteristic or code, specified as person‐identifiable by the Rule. Because the resource contains the full text of clinical documents, there is a possibility of “inferential re‐identification,” particularly of individuals who are celebrities or for whom there is a widely publicized set of characteristics that might be recorded in the EMR (e.g., “This 82‐year‐old retired astronaut …”) The IRB, which also serves as Vanderbilt's Privacy Board, reviewed the effectiveness of the computer system that removes identifiers and determined that the de‐identification process is suf cient to ensure that the resource does not involve “human subjects” as defined by the regulations. In addition, users must submit a project proposal that undergoes IRB review, and must sign a Data Use Agreement, which requires that “in the event the Data Recipient becomes aware of any personally identifiable health information unintentionally missed by the de‐identification process, such that the personally identifiable health information is retained in the Data Set received by Data Recipient, [the user agrees] to report all such occurrences only to BioVU program staf and/or the privacy of ce for quality assurance purposes, and not to any third party.” A simple online mechanism has been developed to fulfill this reporting requirement. However, we are well aware that the removal of identifiers does not completely remove re‐identification potential. Quantitative risk assessment models are under development to provide a statistical basis for likelihood of re‐identification potential when data are being sent to public databases such as dbGaP. ³ , ¹¹
• 3To support security equal to or greater than that which is required by federal regulations and the OHRP guidance Research Involving Coded Private Information or Biological Specimens, the samples are coded by a Research Unique Identifi er (RUI). ¹ The RUI is a 128‐character code derived from the Medical Record Number (MRN) generated by the Secure Hash Algorithm (SHA‐512, National Security Administration). SHA‐512 produces a string of characters (RUI) that is unique to a particular input and has the property that is not possible to infer or compute the MRN that generated it. No link between the RUI and the MRN is maintained, unlike “Trusted Broker” systems, such as that served by a formal data management center which maintains links to data but prohibit the release of the key to the investigators, as permissible by OHRP guidelines. ³
• 4A percentage of samples are randomly excluded and discarded. The rationale for random exclusion is to make it impossible to infer which individuals’ DNA samples might be in the bank by knowing who has opted out. Because of this exclusion, it will never be known with certainty that any particular individual has a sample included in the databank.
• 5Upon IRB acceptance, users may interact with the database query system to select records of interest. To reduce residual re‐identification potential, the system returns a clinical data set to an approved investigator only if the numbers of matching records exceed a specified minimum set. The number returned is parameter driven and can be modified on the basis of quantitative real‐time assessments of risk of re‐identification. All search outputs are tracked and audited. The methodology for audit is currently to match search output (which is stored in a system log file) to the stated phenotype description approved by the IRB. A random selection of investigator‐initiated searches is validated by audit trail analysis. Search criteria that do not relate to the study description are flagged by staff for follow‐up with the personal information. At a minimum, one search for each study and one search per investigator are audited. User access accounts are project‐specific, rather than person‐specific, enabling a basis for comparison of the search statements and records returned with the project approval granted by the IRB.
• 6A Data Use Agreement, which details the accepted and prohibited uses of the data, is signed by all users. For example, users agree “not to identify the information contained in the Limited Data Set by any means, including using Star Panel [the Operational EMR system] or other information together with the Data Set, or to contact any individual whose information is contained in the Limited Data Set.” Institutional penalties similar to those employed for intentional breeches of confidentiality of clinical data will be enforced and users are made aware of these provisions, including the sanctions for privacy and information security violations.

Figure 3.

BioVU oversight structure.

Justice

Another key principle considered was justice, which addresses who receives the benefits of research and bears its burdens, in the sense of “fairness in distribution” or “what is deserved.” In this regard, it is known that a traditional consent or opt in model may exclude large segments of the population. ¹³ , ¹⁴ , ¹⁵ , ¹⁶ This is unfortunate from both an ethical and scientific standpoint. In part for this reason, some have advocated an opt‐out approach for many “low‐risk” studies. ¹⁷ With BioVU, sample acquisition is inherently unbiased, other than by the availability of a left over blood sample after clinically indicated testing. All patients aged ≥18 years with an outpatient laboratory draw and who have a signed consent to treatment form and who have not made a formal indication to opt out are potential inclusions in BioVU. Specifically, all samples from individuals who have diagnostic testing requiring a blood draw have an equal likelihood of being included. There are no health or demographic related exclusions. In addition, the large sample size enabled by this approach allows new types of research previously not feasible, including those on less common diseases and conditions or those focusing on minority demographic populations. The implication of this BioVU feature from the perspective of justice is that the diseases are amenable to research in direct proportion to the proportion of individuals who are receiving health care for those diseases and conditions.

Results

As of December 7, 2009, there are over 73,000 samples collected to date, with an average DNA yield of ∼120 ugs per sample. The cost per sample including all processing, collection, storage, labor, and program management is less than $25 per sample. At this pace of accrual, and assuming pediatric sample collection is initiated in early 2010, the resource will reach 200,000 samples by 2013 ( Figure 4 ). There have been 34,444 individuals who have opted out, representing approximately 5% of patients seen since BioVU began. These numbers are consistent with expectations from prior patient attitude surveys. ² Complaints have been relatively few, and these issues have been addressed via an 800 number hotline, which is staffed by patient services representatives with training in the design and operation of the biobank. Callers may also speak with senior institutional representatives associated with BioVU. This ability to discuss concerns with patients who call with complaints was sufficient; further follow‐up was not required in any case to date. The biobank is currently comprised of a sample that is representative of our overall patient population (see Table 1 for demographic composition of BioVU records). Many relatively difficult to research demographic populations are represented; for example, samples from 542 individuals over the age of 89 are included in the repository. The average record size for BioVU records is 145 kb, which is approximately 12 pages of text. There are 14,537 unique ICD‐9 codes represented in the database, and an average of 25 medications in each record. Select rare disease counts are provided in Table 2 for illustrative purposes. Over 250,000 brochures have been distributed to date. In the creation of the SD, 1.7 million patient records have been de‐identified and as discussed above, 72,000 of these have associated DNA samples to date.

Figure 4.

Accrual projections.

Table 1.

Demographic characteristics of BioVU.

Demographic characteristic	% in BioVU*
Gender
Male	42
Female Race/ethnicity	58
African American	11
Asian	1
Caucasian	85
Hispanic/Latino	1
Other	1
Age
<20	1
20–29	11
30–39	13
40–49	16
50–59	21
60–69	20
70–79	12
80–89	5
>89	1

*Percentages represent the percentage of all banked samples (73,014 as of December 7, 2009) with this information present in the record.

Table 2.

Select examples of rare disease counts.

Example rare disease	# in BioVU
Bell's palsy	141
Cushing's	129
Spina bifida	77
Acromegaly and gigantism	57
Peyronies disease	57
Meningioma	52
Wilson's disease	36
Narcolepsy without cataplexy	17
Ehlers‐Danlos syndrome	9
Pica	9
Tourette syndrome	9
Pick's disease	7
Microcephalus	6
Stiff‐man syndrome	5

Discussion

The BioVU model is still a work in progress. Some advantages, however, are already apparent. First, it is capable of generating a larger number of biobank samples at considerably lower cost than traditional prospectively consented cohort models. This allows cost savings to be passed on to investigators and to funding agencies. As noted above, the scale of the resource will also allow research that could not otherwise be conducted on rare diseases and some minority demographic populations. The resource uses byproducts of routine care—blood that would otherwise be discarded—to obtain genetic samples. By also using the information byproducts of the health care system, the SD is cost‐effective to generate and contains information that is rich in phenotypic attributes. The chronology of events and longitudinal nature of the data are preserved by the methodologies employed.

By design, one corollary benefit of de‐identifying patient records for the purpose of creating a biobank that does not include human subjects as defined by the common rule is that the frequency with which identified individual patient charts are viewed by researchers under a more traditional IRB Waiver of Consent is substantially reduced, therefore increasing privacy protections. The existence of such a resource may reduce the frequency with which the IRB will be asked to grant exempt status for retrospective medical record review research using identified patient charts. The existence of the resource provides the IRB with an alternative data resource to direct researchers to whenever identifiable data is not necessary for a proposed research protocol.

Disadvantages of the model include the implementation time required to assess the acceptability and feasibility of such a model and obtain the ethical and regulatory approvals. In addition, the design explicitly precludes recontact with any individual, and no ability to obtain any information other than that contained within EMR. For example, environmental exposures of many types are not represented. Also, family structures are generally poorly represented in the EMR and so are not available for this work. Paradoxically, an unanticipated benefit of the program has been to highlight such deficiencies, and to put in place mechanisms to improve the information content of the clinical EMR. Many individuals receive care outside of the local institution's health system, and this additional clinical information is not available for research purposes. Further, because dates have been shified, it is impossible to conduct research that relies on an accurate relationship to known dates (e.g., affective disorders associated with a natural disaster such as a hurricane or a seasonal event such as a holiday).

Conclusion

There are numerous DNA biobanks across the country and internationally that rely on a traditional human subjects approach to sample collection and information capture procedures. BioVU represents one of the few biobanks with an operational protocol that does not involve human subjects as defined by regulation. BioVU accrues DNA samples extracted from blood remaining from routine clinical testing. By design, BioVU is based upon the ethical principles described in the Belmont Report, but not the traditional application of those principles. BioVU is a resource that reflects the diversity of the population, thereby promoting a just distribution of the benefits of research while minimizing the risks to individuals. This paper is intended to inform other institutions considering initiating a biobank regarding procedures that can be employed to help protect the rights and welfare of patients, but preserve the ability of such a resource to effciently propel genomic research. Some authors have asserted that people receiving the benefits of health care have an obligation to participate in research. ¹⁸ Consistent with this, studies have shown that “altruism” and a desire to play a part in scientific advancement is of en a motivational factor for participating in research. ¹⁹ , ²⁰ W e suggest that if individuals have such an obligation to participate in research, then donating tissues and information to a de‐identified data and tissue resource such as BioVU—at the exact time that the individual is receiving benefits of health care—satisfies this obligation in a societal sense.

Conflict of Interest

The authors report no conflicts of interest related to the content of this paper.