Presentation hosted by TCM, DED, and MCCC: Data Sharing: Select Legal Considerations

1. Presentation hosted by TCM, DED, and MCCC: Data Sharing: Select Legal Considerations Jennifer S. Geetter 202-756-8205 jgeetter@mwe.com Does not constitute legal advice

2. Does not constitute legal advice. Regulatory Developments Pipeline Pressures Operational Considerations Health Reform Pieces of the Puzzle OPPORTUNITIES PRESSURES UNCERTAINTIES SYNERGIES www.mwe.com

3. Does not constitute legal advice. Regulatory Developments Puzzle Piece: Regulatory Developments • Common Rule Advanced Notice of Proposed Rule Making (August 2011) – Proposed Rule Anticipated in October 2013 • HITECH Final Rule (January 2013) • Increasing scrutiny and criticism of the FDA for marketed drug safety issues leading to new focus on data integrity in “real time” • Recent guidance on a number of important topics, including new FDA informed consent guidance (2012) and FDA regulation of medical “apps” (2013) • New guidance or rule-making possible that could impact de-identification, data sharing, privacy in a genomic age and other innovation related topics • Stage Three Meaningful Use Standards – focus on public health and data-banking capabilities www.mwe.com

4. Does not constitute legal advice. Pipeline Pressures Puzzle Piece: Pipeline Pressures • Slow-downs in product developing; in some cases, no or few new drugs for disease state areas in several years • Increasing focus on comparative effectiveness and other demonstrations of value from payors • Increasing emphasis on personalized medicine, genomics • Increased globalization www.mwe.com

5. Does not constitute legal advice. Health Reform Puzzle Piece: Health Reform • Focus on (1) controlling costs; (2) increasing access; and (3) improving quality • Standard health care economics will not translate in all cases in the new environment • Mimicking private models for certain health reform initiatives • Electronic health records – databanking and interoperability • Comparative effectiveness/pharmacoeconomics www.mwe.com

6. Does not constitute legal advice. Puzzle Piece: Operational Considerations • Public demand for point of care research opportunities • Research as a competitive advantage/centers of excellence • Research as a physician-recruiting tool • “All shapes and sizes” research opportunities • An IRB is not enough • Increasingly diverse array of organizational and team participants in research studies, research infrastructure and research initiatives Operational Considerations www.mwe.com

7. Does not constitute legal advice. Competing Public Priorities • Significant public concern about privacy • Secrecy, privacy and confidentiality • Used interchangeably? • Consistent meanings? • Disagreement about default settings -- Model 1: Very restricted access with a presumption of non-disclosure -- Model 2: “Rules of the road” emphasis with a presumption of balancing confidentiality with socially useful uses and disclosures • Strong public demand for biomedical innovation • On-going push/pull relationship with health information informed by the need at the time www.mwe.com 46705825 v.1

8. Does not constitute legal advice. Promise of Big Data By Whom? How to Solve Problems? Which Problems? When? Who Pays? How do we measure success? www.mwe.com 46705825 v.1

9. A covered entity may not use or disclose protected health information (PHI), except as: Expressly permitted or required by the Privacy Rule, or As authorized (in writing) by the individual who is the subject of the information HIPAA Does not constitute legal advice. Individually identifiable health information - Information collected from an individual that is (1) created or received by a health care provider, health plan, employer or health care clearinghouse; AND (2) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual; or the past present or future payment for the provision of health care to an individual; AND (i) that identifies that individual OR (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Covered entity – A health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with a health care transaction. Protected health information – Individually identifiable health information that is: transmitted by electronic media, maintained in electronic media; OR transmitted or maintained in any other form or medium 46705825 v.1

10. Does not constitute legal advice. Looking at research through “genomic glasses” • Long standing concerns about confidentiality of genetic information (from clinical, research, law enforcement and other encounters) • Concerns include risks that are different in kind and different in degree • Focus on genetic privacy is migrating from the margins (genetic exceptionalism model) to the center (genetic centric model) as the role of genomic information in research and clinical care increases exponentially • October 2012 report from the Presidential Commission for the Study of Bioethical Issues entitled “Privacy and Progress in Whole Genome Sequencing.” • Looks at privacy and data sharing issues attendant to WGS • 12 recommendations across five themes:(1) data protections simultaneous with data access and sharing; (2) data security and access to secure databases; (3) different consent models; (4) facilitating WGS progress; and (5) maximizing public benefit • Report underscores the need to review research rights and protections with an eye toward genomic-informed concerns and considerations 46705825 v.1

11. What is Future Use? Future use is a use or application of data or biological materials (an “Asset”) that has previously been collected for some prior, primary source Primary sources include: Payor data Medical records/clinical data Previous research records NOTE: Future use qualifies as clinical research when it involves a “subject” Post-approval registries and post-marketing studies Does not constitute legal advice. 46705825 v.1

12. Does not constitute legal advice. Research: Compound Authorization Forms Final Rule Provides More Flexibility • Section 164.508(b)(4) does not change • Impact: An authorization for a research study may condition access to study-related treatment on the signing of an authorization for that study BUT… • Section 164.508(b)(3)(i) and (iii) are amended • Impact: A covered entitymay combineconditional and unconditional authorizations into a single authorization, provided that certain conditions are met 46705825 v.1

13. Does not constitute legal advice. Research: Future Unspecified Use Final Rule Provides More Flexibility • Section 164.508(c)(1)(iv) does not change • Impact: An authorization for a research study must still set forth the purpose for each requested use and disclosure. • Department interpretation of Section 164.508(c)(1)(iv) is amended • Impact: A covered entity may obtain upfront authorization for future, unspecified uses and disclosures provided that certain conditions are met • Does not just apply to biobanking – applies to any “research related” activities 46705825 v.1

14. Does not constitute legal advice. Finding the Right Balance Balance Point RESEARCH PARTICIPANT’S WILLINGNESS TO AUTHORIZE • “Reasonable” for participant to understand • Describe the “purposes” • Satisfy elements of a valid authorization SPECIFICITY AS TO FUTURE USES 46705825 v.1

15. Does not constitute legal advice. New, Uncertain Challenges • IRB comfort level with unspecified, future use? • How can an entity gauge IRB comfort upfront? • Need for a decision grid • PHI sensitivity • Type of PHI involved • Recipients • Biospecimen involvement • Recipient identity • Disease state parameters • Research participant comfort level – you can access but will they say yes? • What does the new template informed consent-authorization look like? • What policies and procedures should an entity prospectively develop to demonstrate thoughtfulness and care? 46705825 v.1