Evolving Approaches to the Ethical Management of Genomic Data

Abstract

The ethical landscape in the field of genomics is rapidly shifting. Plummeting sequencing costs, along with ongoing advances in bioinformatics, now make it possible to generate an enormous volume of genomic data about vast numbers of people. The informational richness, complexity, and frequently uncertain meaning of these data, coupled with evolving norms surrounding the sharing of data and samples and persistent privacy concerns, have generated a range of approaches to the ethical management of genomic information. As calls increase for the expanded use of broad or even open consent, and as controversy grows about how best to handle incidental genomic findings, these approaches, informed by normative analysis and empirical data, will continue to evolve alongside the science.

Old but persistent challenges

From the inception of the Human Genome Project (HGP), the National Human Genome Research Institute (NHGRI) at the NIH has been committed to the support of research addressing the ethical and societal aspects of genetics and genomics. Through its Ethical, Legal, and Social Implications (ELSI) Program, NHGRI allocates 5% of its annual extramural research budget to support studies on these issues [1]. No other area of biomedical research has sustained such a high level of commitment - backed by dollars - to the examination of ethical issues; the field of genomics is, in this way, unique.

Since 1990, NHGRI’s ELSI Program has supported studies by academic investigators from many disciplines, including genetics and genomics, bioethics and philosophy, the social sciences (e.g., psychology, sociology, political science, economics, communication studies, and history), health services, public policy, and law, [2] (also see: http://www.genome.gov/17515635). These studies, and others conducted without NHGRI support, have led to the publication of thousands of papers, ranging from examinations of ethical issues in genetic and genomic research and clinical translation, to analyses of legal, public policy, and broader societal issues that the emerging technologies raise more generally [3].

Few ethical issues are capable of easy resolution, so it is unsurprising that many of the same issues that were hotly contested 20 years ago are still debated today. However, as the age of genetics (with its primary focus on single-gene disorders, traditional linkage analyses and targeted resequencing) has evolved gradually into the age of genomics (focused first on SNP chip microarray technology, and now, increasingly, on whole exome and whole genome sequencing), a few issues stand out as especially challenging. These issues - which can be classified under the broad rubric of the ethical management of genomic information - are the subject of this review.

Why the ethical management of genomic data is so challenging

Plummeting sequencing costs, along with ongoing advances in bioinformatics, now make it possible to generate an enormous volume of genomic data about vast numbers of people. Depending on the cost calculation method used, the cost of sequencing the first human genome was somewhere around $300 million (see: http://www.genome.gov/10002192); today, it is less than $8,000 (see: http://www.genome.gov/sequencingcosts), and prospects for the “$1,000 genome” and even cheaper genomes are within sight [4]. Data from genome-wide association studies (GWAS), from whole genome and whole exome scans, and from other high-throughput technologies are proliferating [5, 6]. Although the ethical challenges associated with the management of information have always been present in the field, the greater comprehensiveness and informativeness of today’s genomic data now makes these challenges even greater, as was recently recognized in a report by the Presidential Commission for the Study of Bioethical Issues [7].

First, unlike targeted genetic data of 20–30 years ago, or even the more comprehensive (but often not very informative) SNP data of 10 years ago, the whole exome and whole genome sequence data now being generated will eventually be able to reveal many of a person’s specific health risks - even if the data emerge from research or diagnosis related to a specific condition [8]. The growing informational richness of genomic data not only facilitates the range of questions it can be mined to help answer, but magnifies its potential for misuse.

Second, because of its comprehensiveness, genomic information – even when stripped of traditional identifiers – has, at least in some sense, the potential to re-identify the individual from whom it was obtained [8]. This characteristic, coupled with the data’s overall richness, amplifies concerns about who should be able to have – and control -access to it. Until recently, it was thought that re-identifying a sample or data from which traditional identifiers had been removed required a reference sample or data from the same person available for comparison [9], However, we now know that it is possible, in some cases, to identify the source of a sample or data by consulting genetic genealogy databases (readily available on the Internet) that link Y chromosome short tandem repeat (STR) data to particular surnames, and then combining that information with other publicly available data (e.g., information about age, state of residence, or facts contained in obituaries) [10]. Although the actual extent of this previously under-appreciated risk is still unknown, the risk will almost certainly grow in the future, as more people are sequenced and as the genetic genealogy industry grows. Indeed, the Advance Notice of Proposed Rulemaking (ANPRN), a pending set of revisions to the Common Rule (the regulations that apply to all U.S. federally funded research conducted with human subjects) explicitly recognizes the potential for re-identification inherent in all genomic data (see: http://www.gpo.gov/fdsys/pkg/FR-2011-07-26/html/2011-18792.htm).

Finally, the complexity and frequently uncertain meaning of the information being generated today through whole genome analyses, compared to the more limited (and thus often more easily interpreted) information typically derived through earlier, more targeted genetic tests, enhances the possibility that the information, if shared, will be misunderstood [8]. This is creating new challenges for researchers and clinicians, who must increasingly decide which, if any, individual findings they should offer to return to those whose samples they have analyzed [11, 12]. Incidental findings (findings unrelated to the disorder that initially motivated the research or testing) are inevitable – not merely possible - in GWAS and in whole genome and whole exome scans, and as will be discussed later, these present particular challenges [8, 13–16].

Although concerns about the ethical management of research and clinical data are by no means new to the field, the transition over the past 20 years from a narrowly “genetic” orientation to today’s much more comprehensive “genomic” one has been accompanied by shifts in the way the information is being conceptualized and managed. It is thus useful to step back and review systematically the events that have steered the course of these developments and the new challenges emerging as a result.

Pre-genomic approaches to the management of data

The genetic studies and test protocols that dominated the field 15–20 years ago were generally highly targeted, and tended to view the risks to participants or patients (apart from the physical risks associated with blood drawing) as straightforwardly informational [17–19]. Thus, consent materials in use prior to the mid-2000s, if they mentioned non-physical risks at all, tended to focus on the potential for breach of privacy, with insurance and employment usually listed as the two areas of main concern [20–22]. Data security measures of the time were, by today’s standards, remarkably “low tech,” often consisting of little more than coding samples and data and storing samples and data in locked freezers and cabinets. Still, consent forms, if they addressed the issue at all, typically described the risk of a security breach as low; at the time that assessment seemed reasonably accurate, predating as it did the development of massive, web-accessible genomic databases and expanded data sharing norms.

Early consent forms rarely addressed the issue of whether individual findings from studies would be returned to participants [20, 21]. The usual default presumption was that they would not be [23], because most findings emanating from studies of the time interrogated only limited regions of the genome, so the likelihood of generating incidental findings (apart from occasional evidence of undisclosed adoption or misattributed paternity [24]) was relatively low.

Another feature of early consent forms was their characteristically narrow scientific scope [8, 20, 21]. Most described only the immediate study for which samples were being collected or the specific disease being analyzed; although the possibility of sharing with close collaborators working on the same disease was sometimes mentioned, obtaining broad consent to an unspecified range of future uses was the exception, not the norm. Often, consent documents were simply silent about plans for any future sharing, and in such cases, the absence of an explicit prohibition against sharing was generally interpreted (or, at least over time came to be interpreted) as tacit permission to share [23].

In 1994, long-percolating concerns among bioethicists about the practice of using stored, linkable samples without obtaining new consent from those from whom they had been obtained culminated in the publication of a highly influential paper that recommended against continuing this practice [25]. Following this recommendation, consent documents gradually began to be written with greater specificity about whether, with whom, and for what purposes, samples and data would be shared. In practice, however, the recommendation was often interpreted as applying only to prospectively collected samples. Thus, as was recently called to public attention in a best-selling book, archived samples collected under widely varying and sometimes questionable consent conditions – and cell lines derived from such samples - are often still being used today [26] (Box 1).

Box 1. Henrietta Lacks.

The Immortal Life of Henrietta Lacks, a best-selling book by Rebecca Skloot (Fig I) published in 2010, told the story of the woman who provided the cancer tissue sample used to create the HeLa cell line in the 1950’s. Henrietta Lacks, a poor African American woman from the tobacco fields of Virginia, had never been told that her sample had been taken for research, much less how important it eventually became to the research community. After she died, her surviving family members continued to live in poverty, lacking access even to basic health care. The family’s reaction to the discovery years later about how their mother’s cells had been and were still being used was partly one of pride, but mainly one of suspicion and anger about her never having been told what would be done with her now-immortalized sample.

Figure I.

Cover for the popular book, “The Immortal Life of Henrietta Lacks.” Jacket Cover copyright © 2011 by Crown Publishers, an imprint of the Crown Publishing Group, a division of Random House, Inc., from THE IMMORTAL LIFE OF HENRIETTA LACKS by Rebecca Skloot. Used by permission of Crown Publishers, a division of Random House, Inc.

The movement toward broader sharing and expanding genomic applications

The field of genomics has long been distinguished by steadfast adherence to the principle of broad data release. This commitment, first enshrined in the 1996 “Bermuda Principles” and subsequently reaffirmed, is aimed at maximizing the pace of research and ultimately, its benefit to society [27].

As targeted genetic research began to give way to research with a more genomic focus, the expectations regarding broad data sharing - and rules to enforce them - were gradually extended to apply not only to the data produced in large, community resource projects, but to genomic data more generally. The introduction of SNP chips and the development of improved statistical methods in the early 2000s, which suddenly made studies of common, complex conditions more tractable, contributed to this trend [28]. GWAS of common disease accelerated in the 2000s and quickly overshadowed the previous focus on single gene disorders. To be adequately powered, however, such studies typically required larger sample sizes (or datasets) than any single researcher could amass. This circumstance, along with improvements in informatics technology that made it cheaper and easier to share large amounts of data, provided further momentum for sharing, and set the stage for the 2008 adoption of the NIH GWAS Data Access Policy. That policy requires the deposition of summary-level information and aggregate genotype data in the open access portion of the NIH Database of Genotypes and Phenotypes (dbGaP), and the deposition of individual-level data (genotypes and phenotypes) in the controlled access portion of the database (see: http://grants.nih.gov/grants/guide/notice-files/NOT-OD-07-088.html). Under the policy, controlled access data are made available to any qualified researcher following review and approval by an NIH Data Access Committee (DAC) [29].

Two other developments occurring in the late 2000s helped further “pave the way” for expanded data sharing by (at least temporarily) helping to quell lingering concerns of some institutional review board (IRB) members about the associated risks. One development was the enactment of the Genetic Information Nondiscrimination Act (GINA) (see: http://www.eeoc.gov/laws/statutes/gina.cfm), which was initially greeted, at least by some, with optimism that it would “put to rest” public worries about possible misuses of genomic information, thus making protocols that relied on the use of shared data or incorporated plans for broad data sharing more ethically acceptable [30]. The second was the issuance by the Office of Human Research Protections (OHRP) of guidance reaffirming a previously-stated position that research using only de-identified materials falls outside the definition of “human subjects research” and thus outside the protections outlined in the Common Rule (see http://www.hhs.gov/ohrp/policy/cdebiol.html). This guidance provided some (again, at least temporary) reassurance to IRBs that protocols involving the use of de-identified, archived samples or data, without re-consent, rested on firm ethical (or, at least regulatory) footing. It also bolstered the confidence of institutional officials charged with certifying the appropriateness of the data generated by investigators at their institutions for deposition into dbGaP.

The trend toward broader sharing of data has been accompanied by a trend toward broader sharing of samples, often through large biorepositories [31]. The new sequencing technologies make it possible to conduct genomic studies with much smaller quantities of material, increasing researchers’ willingness to share more of the valuable sample resources they have acquired.

Yet, today, a sense of discomfort remains among many IRB members, many bioethicists, and increasingly, many researchers, about the proliferation of genomic information across society and its concomitant potential for misuse. Reinforcing this unease has been the virtual explosion of genomic data occurring over the past two decades - in settings often far removed from research laboratories and clinics. DNA-based information is now used routinely in the criminal justice system, to establish paternity and other family relationships, to identify disaster victims in both military and civilian settings, to identify matches for bone marrow transplantation, and for a host of other applications [32–34]. New private sector activities based on genomic information have also arisen. 23andMe and other companies offering “direct-to-consumer” genetic tests have come into being [35–37], and growing public fascination with genealogy has given rise to a new industry in DNA ancestry testing [38, 39]. The availability and use of genomic information across society are, indeed, becoming ubiquitous.

Renewed concerns about identifiability and the trend toward broad consent

Alongside these developments, the past several years have seen a flurry of papers suggesting the existence of previously under-appreciated ways that various types of genomic data might potentially be re-identified [10, 40–42]. Correspondingly, a growing sense has emerged that participants in genomics research should be informed more explicitly that their information may be shared - even if their consent to each and every new use is not necessarily legally required. This has ushered in a trend toward the more frequent use of broad informed consent, and over the past five years, consent forms have increasingly been drafted to describe explicitly the possible downstream deposition of genomic (and sometimes clinical) information into public databases, where it can be shared with multiple researchers for use in many types of studies [43, 44]. Consent forms also increasingly seek express authorization for the distribution of samples to secondary researchers, as more researchers come to recognize the benefits of collaboration and as biobanks and biorepositories expand [45, 46].

Research participants vary in their receptivity to broad consent [47–49]. Although some reportedly prefer this approach [50], others - especially from populations that have historically suffered research abuses – have been less amenable [51, 52]. Indeed, although by no means universal, a sense of unease persists among many in the public about the inability to control future uses of their (or their family members’) genomic samples and data; this was demonstrated in two recent lawsuits challenging the research use of stored blood spots from state newborn screening programs without parental consent (Box 2) [53–56] Dashing some early hopes that GINA would significantly mitigate public concerns about the potential misuses of genomic information, evidence suggests that most people, if they are aware of GINA at all, view it as of likely limited effectiveness [57].)

Box 2. The newborn screening litigation.

In 2009, several parents in Texas filed a lawsuit when they became aware that blood spots collected from their newborn children through Texas’ newborn screening program were being used for research without parental consent or generally without the awareness of the public. In settlement of the lawsuit, the state agreed to destroy some 5 million stored newborn screening blood spots. Newborn blood spots being retained in Minnesota were ordered destroyed after that state’s Supreme Court, in response to a lawsuit filed by disgruntled parents. The court held that the retention of the blood spots violated the state’s Genetic Privacy Act, a law that requires informed, written consent for the collection, storage, use and dissemination of any genetic information. The newborn screening programs in Texas and Minnesota were not atypical, in that few states’ programs mandate parental consent for newborn screening or inform parents that the samples will be retained after being tested.

Figure I.

Messaging for public awareness campaign on state newborn screening program. Photo copyright © 2010 by Zazzle, Inc. Used by permission of Zazzle, Inc. and Citizens’ Council for Health Freedom.

It is important not to overstate the realistic current risk that someone who has provided a genomic sample or data for study will be identified by a random member of the public and then suffer tangible harm. Most genomic data today (especially those linked to clinical information) are shared through controlled access databases such as dbGaP, which have established procedures to restrict access to qualified investigators. Nevertheless, the recent study showing that some genomic data (specifically, Y chromosome STR markers) can be linked to surnames and, in conjunction with other public information, used to identify certain individuals [10], is a reminder that no method of de-identification is perfect [58]. In the (currently, relatively few) studies that have involved the deposition of sequence data that includes data on the Y chromosome in open access databases, the identification risks (at least to people in certain parts of the world – especially those with uncommon surnames or included in published pedigrees that have other data, such as age information, attached) may be greater than earlier appreciated.

Proposals for “open consent,” re-thinking current consent paradigms, and the “Citizen Science” movement

With growing recognition of the potential to re-identify individuals through their genomic data, some have suggested that continuing even to try to take measures to reduce this potential are misguided [59]. The Personal Genome Project (PGP) is premised on this view [60]. That project requires participants to forego any expectation of privacy in their genomic and personal health data; these data are shared openly over the Internet, for anyone to see. Before being accepted for participation in the PGP, volunteers must pass an “enrollment exam” demonstrating their understanding of genetics and of the risks entailed by participation [60].

PGP researchers themselves acknowledge that the participants in their project are highly self-selected and that the more pragmatic solution for the public at large will likely entail a two-fold approach: maximizing efforts to prevent re-identification while simultaneously informing prospective participants of the inherent limitations of those efforts more candidly than has often been done in the past [61]. This approach seems aligned with what most people actually expect; recent survey data show that most in the public are not willing to allow unfettered access to their genomic and phenotypic data, yet are realistic about the limits to which their identities can be protected and willing to accept something short of an absolute guarantee [62].

As was starkly illustrated in a recent lawsuit between university researchers and an American Indian tribe [63, 64] (Box 3), the key here may be improved transparency. Moving into the future, this may require placing less emphasis on technical “fixes” to informational risks (e.g., developing better firewalls or de-identification algorithms), or on checking to see whether the precise wording used in a 10-year old consent form is technically “adequate” to permit a particular newly-contemplated use of samples or data, or the deposition of data in public databases. Researchers may instead need to consider, for example, whether a proposed change in a project’s data release plan, or the discovery after a project’s inception of previously under-appreciated risks, should prompt them to communicate the proposed change or new risks and reiterate (where appropriate and feasible) the possibility of withdrawal - even if re-consent is not technically required. Researchers may also need to reconsider whether asking people for permission to have their genomic samples or data used in an unspecified, potentially unbounded, range of future studies, by as-yet unknown investigators in far-flung places, can lead to consent that is truly “informed” [65–68].

Box 3. The Havasupai case.

In 2010, a large settlement was reached between Arizona State University and the Havasupai Indian tribe, in a lawsuit involving a genetic study of diabetes. Samples taken from tribal members were used to study not only diabetes, but other topics (schizophrenia and population relatedness) that the tribe found objectionable. Although the language in the consent form for the study was quite broad, the focus of discussions with the tribe had been on diabetes. Had these other topics been clearly brought out during discussions about the research, the tribe’s willingness to participate would have diminished. Apart from the lessons this case provides about the importance of transparency, it illustrates the personal, cultural, and often spiritual significance that can be attached to blood or other biological materials. It also demonstrates the importance of making sure that a study is collectively, not just individually, acceptable when conducting research with American Indian tribes (which are sovereign nations) and with some other groups,

Figure I.

Havasupai Indian woman. Photo by Grand Canyon NPS / CC-BY-2.0. From Wikimedia Commons.

Some have suggested that in the new era of genomics, we may simply be “asking too much” of informed consent [69]. In recognition of this, the efficacy of tiered consent [49, 70], “opt-out mechanisms” [71], and innovative new approaches to community engagement [72] and research governance [73, 74] are now being explored with renewed vigor; however, much more work in this area remains to be done [75, 76].

A “health information altruist” model has recently been proposed, in which research participants agree to make samples or data available for a wide (potentially unlimited) range of studies, but in which they are actively involved as research “partners” and thereby retain in various respects a measure of control [77]. The goal of this model, and of other emerging “Citizen Science” models, is to speed the pace of discovery while more affirmatively showing respect for participants’ contributions to the research [78–81]. Reciprocity is an important feature of many such approaches, which often contemplate providing participants with extensive ongoing feedback about individual research findings.

Although some have lauded approaches of this type as the “wave of the future” [78, 79, 81], their generalizability to a range of populations and to the full panoply of possible research designs remains to be determined [82]. For example, a “health information altruist” model may be very well suited to certain highly educated people in particular cultures who are highly trusting of the biomedical research establishment and have little reason to worry about how the information from the study of their samples will be used. It may be completely unsuited to some others, who have little understanding of science or appreciation for genomic research, or who have historically experienced research abuses. Such a model may be well suited to certain epidemiologic studies, but unsuited to some small family studies that involve the potential for the discovery of information (such as information about certain neurological or psychiatric disorders, or information about family relatedness) that could potentially be stigmatizing – either to themselves or to others to whom they are closely related. The model may also be unworkable for some community resource projects.

Uncharted waters: Approaching the management of genomic incidental findings

One of the most contentious ethical issues in genomics research today relates to the management of the incidental findings that whole genome and whole exome studies inevitably uncover. Although genomics has already started to be introduced into the clinical care arena [83], most genomic data are still generated in research settings, where only a very limited ethical duty to offer individual results to participants (as distinct from aggregate findings) has traditionally been recognized [84]. Increasingly, however, researchers and bioethicists are re-thinking this, especially in cases where the research uncovers information that may be clinically actionable or have significant personal utility [85, 86]. Growing evidence suggests that many research participants desire, and in fact expect, to receive individual research results, regardless of whether they can do anything with the information [87–90], and some have suggested that withholding information that may have clinical (or even merely personal) utility is unduly paternalistic [79].

Others, however, have insisted that bombarding people with more information than can realistically be digested, especially when its significance is uncertain, is counterproductive [11, 91]. A number of practical issues have also been raised, including the inability of most clinicians to understand information of this type well enough to help patients interpret it, and the scarcity of genetic counseling resources [92–96].

The fact that much genomic research today is done using samples and data obtained from biorepositories and biobanks complicates the situation [13, 14, 46]. For example, what, if any, duties are owed by secondary or tertiary researchers, who have likely had no direct contact with the person who provided the samples or data, and who more often than not will be working with de-identified material [97, 98]? Must they notify the researcher (or clinician) who originally collected the sample so the participant or patient can be re-contacted - and if so, how many years into the future does this duty extend? Should the duty to re-contact extend to cases in which people were told during the recruitment process that they would never be re-contacted [99, 100]? What if they had never even been told that their sample or data might be made available someday for other researchers to study, much less of the possibility that important health-related information might eventually be found? Research to examine these and related questions [7], much of it supported by NHGRI’s ELSI Program, is currently underway.

Concluding remarks

Bioethicists consulted by genomics researchers, clinicians, IRBs, and others are often asked to provide “model” consent language or other definitive guidance to help navigate safely through a range of challenging questions related to the responsible management of information in the new genomic era. Surely by now, it is thought, consensus must have been reached on at least the major issues. However, such calls for simple, straightforward solutions miss the point that while many of the ethical quandaries represent new variations on old themes, they continue to resist easy resolution. While much normative and empirical research is underway to address these complex questions, new issues will inevitably arise as we advance still further into the genomic age, opening up yet other areas of debate and avenues for exploration.

• Ethical, Legal, and Social Implications (ELSI) in the genomic era

• Frameworks and policies to meet ELSI challenges

• Privacy concerns and the limits to consent

• Transparency and engaging patients in genomic research