Rethinking the Importance of the Individual within a Community of Data

Abstract

The Covid‐19 crisis has underscored the importance of the collection and analysis of clinical and research data and specimens for ongoing work. The federal government recently completed a related revision of the human subjects research regulations, founded in the traditional principles of research ethics, but in this commentary, we argue that the analysis underpinning this revision overemphasized the importance of informed consent, given the low risks of secondary research. Governing the interests of a community is different from governing the interests of individuals, and here we suggest that, moving forward, the analyses of the risks of secondary research protocols be assessed from the perspective of the former.

policy and politics

The Covid‐19 pandemic has recently highlighted the public health necessity of ongoing analyses of collected health data and specimens. But some data‐sharing agreements between health care institutions and big data entities have caused consternation among patients. For example, in the fall of 2019, a whistleblower revealed a deal between Ascension Health and Google to share 50 million identified patient records under a Health Information Portability and Accountability Act business associate agreement.¹ As of this writing, the U.S. Department of Health and Human Services is investigating whether this was an appropriate use of the HIPAA mechanism.²

This brave new world of big data analytics and corresponding deals between industry and hospital systems should surprise neither researchers nor regulators. Due to a lack of more comprehensive data protection regulation in the United States,³ protecting health data privacy is largely left to the DHHS. But DHHS regulations, including HIPAA and the “Common Rule” of the human subjects research regulations, are particularly limited in their protections for participants in “secondary” research protocols (beyond those for which the data or specimens were originally intended). As DHHS continues to deliberate how to newly regulate, or apply existing regulations to, these types of data and specimen‐sharing agreements, the agency should also reconsider the balance and specification of the bioethical principles it has been applying to human subjects research regulations since The Belmont Report was published in 1979.⁴

Changing Landscape of Risks to Subjects

Respect for persons holds a place of prominence among the principles of contemporary bioethics, which served as the foundation for the Common Rule when it was conceptualized in the 1980s. But understandings of risk, benefit, and consent are being transformed in relation to the new epistemic and ethical implications of protocols for secondary research. If fully identified health information can be legally shared with massive data conglomerates like Google under a HIPAA business associate agreement to build new algorithmic tools, different methods are needed for assessing who will “benefit” from research as well as who is at risk. With the consistent prioritization of autonomy in ethical analysis of research protocols, researchers are called on to “protect the rights of individuals, small groups, and communities” simultaneously⁵—as if moral obligations to those varying cohorts can be analyzed identically.

The use of health data and biospecimens in secondary research relies on aggregates of data: statistical analysis at the intersection of genetic variation, health behaviors, environment, and outcomes across the spectrum of human diversity. For example, precision medicine requires a robust community of data to generate standards of health applicable to each individual’s genomic and environmental makeup. Individuals are seen, through that lens, as members of an aggregate data community—a data community that will then feed back increasingly tailored health interventions for individuals.

As our understanding of medicine, data, and the risks of research continues to evolve, so must the application and specification of key bioethical principles and our conception of the stakeholders to which they apply. The idea of respect for the individual participant6 is historically contingent; it no longer exhausts the ways we design and conduct research. Individuals are still needed, but their greatest value is often in aggregate. Risks still exist, but they are shifting from primarily physical to largely dignitary harms, such as privacy breaches.⁷ Thus, this reconceptualization of the question, what is research? also calls for a related reconceptualization of the question, and who is its subject?

Revisions to the Common Rule

The recent revision of the Common Rule is an excellent example of a failure to calibrate the tensions between the principles of bioethics adequately for a new generation of researchers and participants. A major area of focus in this endeavor was how to protect individual consent to secondary research with biospecimens. In particular, in the Notice of Proposed Rulemaking, regulators questioned whether all biospecimens, including those without any additional identifiers such as name, should be considered “inherently identifiable” (that is, not able to be deidentified). If so, all biospecimen research would require informed consent, or a waiver or exemption from an institutional review board. Putting forth a strong pragmatic argument driven by concerns about autonomy and nonmaleficence, regulators first contended that a “failure to acknowledge and give appropriate weight to this distinct autonomy interest in research using biospecimens could, in the end, diminish public support for such research.”⁸

But 1,480 of the approximately 1,520 comments that addressed this suggestion disagreed with the proposal.⁹ In the final rule, regulators reversed course, agreeing ultimately with commenters that the original proposal would have “allow[ed] autonomy to trump beneficence and justice.” In other words, regulators argued that the good of aiding future communities of patients by conducting such research outweighed the good of mandating individual participant consent.¹⁰ They concluded that, while they believed their original proposal to be “consistent with the majority of the public’s wishes, which reflect legitimate autonomy interests,” the fact that the majority of the commentators now disagreed with this proposal “raise[d] sufficient questions about this premise such that we have determined that the proposal should not be adopted in this final rule.”¹¹

Weighing Harms of Secondary Research

This rending of bioethical principlism in updating the research regulations suffered from several important flaws. First, a reliance on the majority of commentators was falsely populist: those who comment on a Notice of Proposed Rulemaking in the Federal Register are not a representative sample of “the public.”¹² If regulators were actually concerned about public support for research, they should have focused on the comments of participants and their advocates. Support for the proposal to require informed consent for all biospecimen research was more divided among members of the general public than among research stakeholders most affected by a more permissive regulatory climate.¹³

Second, regulators failed to assess the balance and specification of research ethics principles in light of context and evolving research protocols.¹⁴ The central reason regulators found themselves in the awkward situation of pretending that comments to the Federal Register were equivalent to votes in a democracy was not a failure of analysis. It was a failure to apply the appropriate framework for analysis. Respect for the principle of justice does not supplant the need to respect autonomy (one cannot “trump” another); instead, as Tom Beauchamp and James Childress recognized in conceptualizing the principle of justice, the balance and specification of research ethics principles needs to be reconsidered in light of new paradigms.¹⁵ Given the low‐individual‐risk and high‐community‐benefit profile of many secondary research protocols, in which biospecimens generally play a large role, to subjugate (high) community benefit to (low) individual risk at this scale is inappropriate.¹⁶ We should instead be prioritizing assessment of risk versus benefits at the community level. This shift in priority is a shift from traditional bioethical inquiry to something more like public health analysis,¹⁷ and the ethics of how to most effectively and fairly govern communities differs from the ethics of governing individuals. As Julie Ingelfinger and Jeffrey Drazen have argued, “Public health is threatened by incomplete data more than individual privacy is threatened by disease registries.”¹⁸

Last, regulators decided that the most controversial component of the new rule—concerning the inherent identifiability of biospecimens—will be excluded henceforth from notice‐and‐comment rulemaking. While the regulations went into effect in 2018, the regulators instead proposed a policy of continuing review by advisory committee every four years of whether biospecimens should be considered inherently identifiable—which allows for a potentially major reinterpretation of the regulations as written that could be presented to the public “through the use of guidance.”¹⁹ In other words, within a year of implementing the new regulations that were debated for six years, regulators might simply notify the public that they had changed their minds regarding its most controversial provision—how to regulate a vast swath of secondary research protocols—via the much lower standard of guidance release, rather than the Administrative Procedures Act’s mechanism of notice‐and‐comment rulemaking. Guidance documents describe a government agency’s interpretation of their regulations; it is not legally binding, but stakeholders are well advised to take it seriously. Notice‐and‐comment rulemaking gives the public formal notice and an opportunity to weigh in on major government rules or revisions. To switch from notice‐and‐comment rulemaking to simply issuing guidance on one of the most controversial topics in a six‐year debate is a legally questionable choice given the immense practical effect such a change would have.²⁰ The choice is also ethically questionable considering the enormous importance of secondary research with data and biospecimens to individual patients, other participants, and the communities they come from and go on to form.

In conclusion, it will be a massive undertaking for the DHHS or legislative bodies to draft or reassess existing federal regulations to adequately govern emerging secondary research relationships. DHHS regulators have consistently used the Belmont principles’ trifecta of respect for persons, beneficence, and justice to guide these decisions and found their analytic approach. But as regulators and policy‐makers assess and investigate data and biospecimen‐sharing agreements, the bioethics community must reassess the foundational application of principlism for a new age of secondary research.