Ethical considerations in observational research in the age of computer, internet, and biobank

1. Ethical considerations in observational research in the age of computer, internet, and biobank K. Arnold Chan 陳建煒 , MD, ScD, FISPE Harvard School of Public Health i3 Drug Safety Academia Sinica

2. Potential Conflict of Interest • Part time employee of i3 Drug Safety • Adjunct Associate Professor, Harvard School of Public Health • Co-editor of a book, no royalty received • Public health worker Academia Sinica

3. Outline • Why I am giving this talk ☺ • As a seasoned IRB member • As an investigator • (Conflict of interest in research) • General ethical principles in biomedical research • Special considerations about observational studies conducted with large healthcare databases • The internet generation Academia Sinica

4. www.populationmedicine.org/content/default.asp Academia Sinica

5. Harvard Pilgrim IRB • Experienced IRB administrator • Competent and dedicated chair • A half-time job • IRB members from different background • Mainly deal with observational studies • Monthly meetings, supplemented by e-mail correspondence • Modest compensation Academia Sinica

6. PRIMR (www.primr.org)Public Responsibility in Medicine and Research www.primr.org/Education.aspx?id=58&ekmensel=297ded8b_52_0_58_4 Academia Sinica

7. www.hsph.harvard.edu/faculty/kinwei-chan/ Academia Sinica

8. My own experience in Taiwan Academia Sinica

9. http://www.boston.com/news/education/higher/articles/2008/10/04/top_psychiatrist_failed_to_report_drug_income/http://www.boston.com/news/education/higher/articles/2008/10/04/top_psychiatrist_failed_to_report_drug_income/ • Funding from pharmaceutical industry Academia Sinica

10. www.thecrimson.com/printerfriendly.aspx?ref=523895 • Harvard Medical School Academia Sinica

11. Different types of conflict of interest (COI) in research • Financial COI • Easiest to measure • Certainly not the only type of COI • Personal and institutional • Non-financial COI • Family / personal relationship • Academic promotion • … Academia Sinica

12. Royalty as a majors source of income for medical centers Academia Sinica

13. General ethical principles in public health and clinical research (from a U.S. perspective) • Respect for Persons / Autonomy • Beneficence / Non-maleficence • Justice • Based on these principles, specific guidelines have been developed • Intervention studies • Observational studies • Primary data collection • Utilize secondary data Academia Sinica

14. Is there a cultural component in ethical consideration? • Individual right vs. common good • Historical background • Empirical evidence? Academia Sinica

15. www.sciencemag.org/cgi/content/summary/sci;301/5630/163?maxtoshow=&HITS=10&hits=10&RESULTFORMAT=&fulltext=denmark+epidemiology&searchid=1&FIRSTINDEX=0&resourcetype=HWCITwww.sciencemag.org/cgi/content/summary/sci;301/5630/163?maxtoshow=&HITS=10&hits=10&RESULTFORMAT=&fulltext=denmark+epidemiology&searchid=1&FIRSTINDEX=0&resourcetype=HWCIT Academia Sinica

16. Example of a database study Academia Sinica

17. Three related topics in database research • Privacy • Right to be left alone • Derived from the Autonomy Principle • Confidentiality • Legal requirement • Breach of confidentiality may result in substantial damage to individuals • Financial • Social stigma and discrimination • Data security • Information Technology standard to prevent breach of data Academia Sinica

18. Ethical consideration for database research • Striking the right balance between privacy and public good. Lancet 2006; 367: 275 “… the tension between the vital need to respect the privacy of patients and the important task of medical research using large population datasets.” • Autonomy vs. Beneficence • Justice • Everyone, including study subjects, may benefit Academia Sinica

19. How to put these principles into practice? • Competent Privacy Board / Institutional Review Board / Human Subjects Committee review • Legislation to provide the legal framework • Training of investigators and research staff • Utilize Information Technology to protect confidentiality without losing efficiency • e.g. Group policy, individual policy, and audit trail • Open dialogue with all stakeholders • Investigators • Patients / consumers Academia Sinica

20. www.hsph.harvard.edu/research/human-research-administration/human-subjects-training-requirements/www.hsph.harvard.edu/research/human-research-administration/human-subjects-training-requirements/ Academia Sinica

21. http://www.hsph.harvard.edu/research/human-research-administration/human-subjects-training-requirements/http://www.hsph.harvard.edu/research/human-research-administration/human-subjects-training-requirements/ Academia Sinica

22. www.citiprogram.org Academia Sinica

23. The consumers’ view? • U.S. Consumer Reports 2000 Aug issue, P 26 • “Patients are well served if doctors and hospitals have fast access to accurate records.” • “With proper safeguards against re-identification, analysis of government, hospital, and health-related databases yields a gold mine of information on public-health trends and the effectiveness of various types of care.” • Lancet 2006; 367: 275 • “The Academy’s report points to a paucity of evidence about patients’ preferences for and attitudes towards participating in research, and calls for more involvement with the public to get a fuller and more accurate picture of their views.” Academia Sinica

24. Health Insurance Portability and Accountability Act (HIPAA) in the U.S. • Use of Protected Health Information (PHI) for research purpose • Explicitly specify data elements that are considered to be personally identifiable • Privacy Board / Institutional Review Board / Human Subjects Committee can grant waiver of individual authorization to investigators • De-identified datasets can be shared across institutions Academia Sinica

25. Institute of Medicine Report in 2009 • The committee’s conclusion is that the HIPAA Privacy Rule does not protect privacy as well as it should, and that, as currently implemented, the Privacy Rule impedes important health research. • Privacy Rule in the U.S. is a work in progress. Academia Sinica

26. IOM Recommendations I. Congress should authorize HHS and other relevant federal agencies to develop a new approach to protecting privacy that would apply uniformly to all health research. When this new approach is implemented, HHS should exempt health research from the HIPAA Privacy Rule. • → Apply privacy, security, transparency, and accountability obligations to all health records used in research. • (If national policy makers choose to continue to rely on the HIPAA Privacy Rule rather than adopt a new federal approach (Recommendation I), the committee recommends the following:) Academia Sinica

27. IOM Recommendations II. HHS should revise the HIPAA Privacy Rule and associated guidance. A. HHS should reduce variability in interpretations of the HIPAA Privacy Rule in health research by covered entities, Institutional Review Boards (IRBs) and Privacy Boards through revised and expanded guidance and harmonization. Academia Sinica

28. IOM Recommendations 1. HHS should develop a dynamic, ongoing process to increase empirical knowledge about current “best practices” for privacy protection in responsible research using protected health information (PHI), and promote the use of those best practices. 2. HHS should encourage greater use of partially deidentified data called “limited datasets” and develop clear guidance on how to set up and comply with the associated data use agreements more efficiently and effectively, in order to enhance privacy in research by expanding use and usability of data with direct identifiers removed. 3. HHS should clarify the distinctions between “research” and “practice” to ensure appropriate IRB and Privacy Board oversight of PHI disclosures for these activities. 4. HHS guidance documents should simplify the HIPAA Privacy Rule’s provisions regarding the use of PHI in activities preparatory to research and harmonize those provisions with the Common Rule, in order to facilitate appropriate IRB and Privacy Board oversight of identification and recruitment of potential research participants. Academia Sinica

29. B. HHS should develop guidance materials to facilitate more effective use of existing data and materials for health research and public health purposes. 1. HHS should develop guidance that clearly states that individuals can authorize use of PHI stored in databases or associated with biospecimen banks for specified future research under the HIPAA Privacy Rule with IRB/PrivacyBoard oversight, as is allowed under the Common Rule, in order to facilitate use of repositories for health research. 2. HHS should develop clear guidance for use of a single form that permits individuals to authorize use and disclosure of health information in a clinical trial and to authorize the storage of their biospecimens collected in conjunction with the clinical trial, in order to simplify authorization for interrelated research activities. 3. HHS should clarify the circumstances under which DNA samples or sequences are considered PHI, in order to facilitate appropriate use of DNA in health research. 4. HHS should develop a mechanism for linking data from multiple sources so that more useful datasets can be made available for research in a manner that protects privacy, confidentiality, and security. Academia Sinica

30. C. HHS should revise provisions of the HIPAA Privacy Rule that entail heavy burdens for covered entities and impede research without providing substantive improvements in patient privacy. 1. HHS should reform the requirements for the accounting of disclosures of PHI for research. 2. HHS should simplify the criteria that IRBs and Privacy Boards use in making determinations for when they can waive the requirements to obtain authorization from each patient whose PHI will be used for a research study, in order to facilitate appropriate authorization requirements for responsible research. Academia Sinica

31. Regardless of whether Recommendation I or II is implemented, the following recommendations, which are independent of the Privacy Rule, should be adopted: III. Implement changes necessary for both policy options above (Recommendations I and II). A. All institutions (both covered entities and non-covered entities) in the health research community should take strong measures to safeguard the security of health data. → HHS should also support the development and use of new security technologies and self-evaluation standards. Academia Sinica

32. IOM Recommendations B. HHS—or, as necessary, Congress—should provide reasonable protection against civil suits for members of Institutional Review Boards and Privacy Boards who serve in good faith to encourage service on IRBs and Privacy Boards. → But no protection for willful or wanton misconduct. C. HHS and researchers should take steps to provide the public with more information about health research by: 1. Disseminating research results to study participants and the public. 2. Educating the public about how research is done and what value it provides. Academia Sinica

33. A U.K. report in 2006www.acmedsci.ac.uk/index.php?pid=99&puid=62 1. Interpreting the legal framework 2. Improving regulatory processes 3. Developing good practice in research using personal data, including issues related to anonymisation and consent 4. Harnessing the opportunities of the NHS National IT programme 5. Engaging the public Academia Sinica

34. Observational studies in the age of internet and computer • Social networking sites and concept of privacy • www.patientslikeme.com Academia Sinica

35. www.patientslikeme.com Academia Sinica