Big data, ethics, and regulations: Implications for consent in the learning health system

Big data holds great promise in enabling information collected in the clinic to be utilized for research, policy, and future care in a virtuous cycle. Many institutions are thus attempting to arrange themselves as “learning health systems” (LHS), defined by the Institute of Medicine as a healthcare system “in which knowledge generation is so embedded into the core of the practice of medicine that it is a natural outgrowth and product of the healthcare delivery process and leads to continual improvement in care.”¹ The stakes for high‐functioning LHS are high: $750 billion per year is estimated to be spent on the provision of healthcare that is “unnecessary, unproven, or wrong.”² Challenges to data use and translation are particularly pointed in specialties such as cancer, where rapid dissemination of new approaches far outpaces the regulatory review process, and a high proportion of patients are treated on‐protocol or off‐label.³

Current disparate structures for informed consent in clinical care and research pose major challenges to LHS. Despite scholarly calls for integration of these two pillars of the healthcare enterprise, recent regulatory revision and guidance on the topic has not been as flexible as some LHS advocates had hoped. In addition to streamlining regulatory burden, cultivating the transition of patients to participants to big data to clinical knowledge will not only require thoughtful normative frameworks but also empirical validity with explicit emphasis on patient perspectives. There is still much work to be done to reframe and advance this debate.

Our current health system is founded in an assumption that research must be separated from clinical care because researchers work in pursuit of generalizable knowledge — as opposed to the best interests of the patient — and, as such, research participants require additional protections. Certainly, there are many egregious cases of inappropriate conduct prior to the enactment of regulatory protections in the 1980s where this caution proved warranted.⁴ But we have since moved to a system where participants are protected so zealously from risk in research that it may in fact be compounding risk in clinical care — for example, in situations where researchers cannot adequately compare two standard of care interventions due to regulatory burden. While there are certainly some types of trial designs and risk levels that warrant heightened scrutiny, there is irony in the tension between providing the best clinical care and being able to study what that standard should actually be. This tension can lead to both overreliance on regulatory exceptions that are poorly understood⁵ and a lack of transparency regarding learning activities.² All the while, empirical evidence suggests that many patients expect some form of consent for research, and are even sometimes uncomfortable with deidentified research.⁶

It is thus complex to establish best practices for the ethics and regulation of LHS. The main proposed ethics framework, by Faden et al., recognizes a contribution to continuous learning as a bedrock ethical obligation for researchers, clinicians, and patients alike.⁵ Under this framework, practitioners and institutions would adopt a duty to “feed information into the system that increases our knowledge.”⁵ Patients would also have a duty to contribute their own experience and information to research relative to the burden such learning would impose. Under this paradigm, contributing deidentified medical records for review or providing interviews to improve the healthcare experience would likely be considered ethically obligatory for patients, whereas being randomized to a clinical trial of a new drug would not.⁵ Recognizing a duty to contribute to learning would also, Faden et al. argue, transform the informed consent process in some cases. If a learning activity might “have a negative impact on the quality of care or impose burdens above and beyond what they would otherwise experience,” informed consent would be sought. But if the learning is perceived to have little effect on interests or rights of patients, such as aggregate big data work, it might not.⁵

Some scholars have seconded this reconsideration of consent practices in particular for low‐risk, low burden, research on medical practice (an integral component of a LHS).⁷ But others have critiqued this assumption of participating in a LHS without specific consent as — at least as of yet — ethically unfounded.⁸ In addition, recognition of such a duty to contribute to learning runs counter to past empirical research indicating that patients generally do not recognize such an obligation.⁹

The transition to a functioning LHS will thus also have to come to terms with under what circumstances informed consent will be required, and under what circumstances it will be assumed that engagement in a LHS is adequate if there is notice that such learning will occur. Some have suggested that such notice must involve explaining not only that the patient has entered a LHS but also where to access more information and how to voice concerns.¹⁰ But these lines should not and will not be entirely up to the administrators, clinicians, researchers, and ethicists: both patients — and the regulators who protect them from becoming unwitting participants — must play a critical role.¹¹

One of the most important components of the transition to LHS from a patient perspective will be for such systems to engage in conscious efforts to build and maintain their trust.^{6, 12} But normative proposals have not yet fully dispensed with how to address the increasingly blurry distinction between clinician and researcher while still maintaining the trust of the patients served.¹³ Empirical work has found that in addition to trust, patient “awareness, knowledge, and understanding of health information technology,” as well as attitudes toward health information privacy and electronic medical records, all influence this delicate balance.¹² Sociodemographic factors such as education level and age also appear important.¹² Survey participants have expressed expectations for formal opt‐in consent,¹² and a substantial minority (35%) have reported they believe it is necessary to obtain consent each time for secondary research use of data.⁶ Whether these attitudes evolve after greater understanding, deliberation, or cultural transformation of the broader healthcare environment remains to be seen.

From a regulatory perspective, further challenges arise due to inconsistent regulations or interpretation thereof across federal agencies and offices governing research. One study of IRB members found that members struggle to categorize research on medical practice as needing or not needing IRB review and oversight: “They characterized the central challenge as a balancing act, between, on one hand, making information fully transparent to patients and providing adequate oversight, and on the other hand, avoiding a chilling effect on the research process or harming the physician–patient relationship.”¹⁴ Interviews of leaders of LHS have confirmed similar concerns.²

An excellent case‐in‐point is the recent regulatory debate over revisions to the “Common Rule” governing federally funded human subjects research. Over 6 years (2011–2017) stakeholders — including regulators, researchers, institutions, and advocacy organizations — vigorously debated whether to change the regulations to require informed consent for research with all human biospecimens (collected in the clinic or research protocol).¹⁵ The regulations in place since the 1980s only required consent for research with identified specimens (as well as data), but concerns had been raised — notably during public response to the popular 2010 book, The Immortal Life of Henrietta Lacks ¹⁶ — that research on any type of biospecimen without consent was disrespectful of the autonomy of the person from whom the sample was derived. Ultimately, regulators decided not to require informed consent for deidentified research for human biospecimens, but will revisit how they define these terms periodically going forward.¹⁵

However, the revisions did create new categories of exemptions from regulatory consent and review requirements for the storage or maintenance and secondary research use of identifiable private information and biospecimens. Previously, IRB review and specific informed consent (or a waiver) had to be obtained for all research with identifiable data or specimens. But going forward, researchers may obtain “limited IRB review” and broad consent from contributers in this situation.¹⁷ Theoretically, these exemptions will make some LHS activities easier to accomplish because practitioners can secure limited review and broad consent when a patient enters the system, which will then follow their data and specimens through any number of secondary research protocols. Being able to keep these data and specimens identified will also enable the continued collection of clinical correlates after initial donation. Some LHS advocates had also supported an exclusion from the regulations for some quality assurance and quality improvement activities — but regulators declined to offer a blanket judgment on whether certain quality assurance/improvement activities met the definition of research.¹⁷

Thus, while some progress has recently been made, a gap still exists between the theoretical ideal and pragmatic and regulatory reality regarding informed consent for a LHS: who must request it, what types of learning require it, where waiver is appropriate, when we still need it, and how to administer such a system. To close this gap will not only require the commitment of healthcare professionals but also the input of patients and willingness of regulators. We have yet to fully achieve the optimal level of engagement needed to translate clinical intervention into big data back into knowledge for optimizing clinical intervention.

Faden et al. called for a new ethical balancing of priorities based on invasiveness of research.⁵ Empiric scholars have noted that while regulators often focus on the sensitivity of data, type of use is more often cited as a concern among providers and patients and might therefore be a better metric for regulatory involvement.^{18, 19} Future empirical and normative work is still clearly required to transition from a healthcare system supported by separate pillars of research and clinical care to one where learning from big data is foundational.

Conflict of interest

None.