Breakthroughs in genomics research hold the potential for significant and wide-reaching clinical, scientific, and societal benefit. However, advances in genetic sequencing and testing—especially the ability to easily share vast amounts of genomic information—have disrupted traditional notions of identifiability and have introduced new considerations regarding the risks and benefits inherent in genomics research. The revised Common Rule calls for periodic assessment of identifiability standards for information and biospecimens—meaning the current definitions of “human subject” and “identifiable” will be re-evaluated in the coming years. It is critical that IRBs and researchers are equipped with strategies to prepare for these changes.

On May 10, PRIM&R hosted a webinar, Forward-Looking Strategies for IRBs in the Genomic Age: Preparing for Shifting Concepts of Identifiability, to provide expert input on these complex and timely issues. The panel consisted of Jiayan Chen, JD, a partner at McDermott Will & Emery, LLP, and Suzanne Rivera, PhD, MSW, vice president for research and technology management at Case Western Reserve University.

After the webinar, Ms. Chen and Dr. Rivera responded to some of the attendee questions time didn’t permit us to address live. We’re pleased to share those responses with the readers of Ampersand.

Have you thought about unique issues relating to the use of children’s genetic information in research?

Suzanne Rivera (SR): Many IRBs already have established approaches for considering the unique issues posed by enrolling minors in research when the information to be derived or created will have implications for them as adults. For example, it’s common with longitudinal studies that begin in childhood to seek permission from parents to enroll the minor child, but then, when the subject reaches 18, to obtain consent from them to continue in the study (or have the option of withdrawing at that time). Because genetic information can have implications for a person’s healthcare and reproductive choices, IRBs often require that studies involving a child’s genetic information include a plan for how to convey clinically relevant information to the subjects once they become adults.

On your Catch-22 slides, you discussed rights to access info under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in relation to Clinical Laboratory Improvement Amendments (CLIA). What if an institution is not a covered entity?

Jiayan Chen (JC): An institution that is not a covered entity (for example, because it does not engage in standard transactions under HIPAA) or business associate under HIPAA may nonetheless be subject to similar patient access rights under applicable state laws that are more stringent than and not preempted by HIPAA, or the laws of other countries (such as the General Data Protection Regulation, which has an extraterritorial reach). Whether a similar conflict with CLIA would arise under such laws will depend on the extent and nature of the access rights under such laws and the particular circumstances.

You mentioned studies conducted under a waiver of consent; in today’s environment, can you provide examples of genomic research that can be conducted under a waiver of consent?

JC: Whether an IRB would issue a waiver of the informed consent requirement (and, as applicable, the HIPAA authorization requirement) for a particular genomic research study is a highly fact-intensive query that depends on factors that may include but are not limited to the number of subjects, the nature of their involvement (including any proposed intervention or interaction), and the ability of researchers to obtain consent. Generally, examples of genomic studies that may be potential candidates for IRB waiver of informed consent include:

• A proposed study that seeks to use hundreds of identifiable tissue samples that are left over from clinical and diagnostic use, and that have been stored for longer than the minimum period of time required under applicable law and accreditation standards (for example, more than ten years). The study proposes to sequence the samples and store the resulting sequencing data with patients’ phenotypic data for a research database that could be accessed by approved investigators for future research studies.
• A proposed study that seeks to use leftover identifiable samples and data from a prior research study that was conducted several years ago, in which subjects had provided specific informed consent only for the particular research study in which they participated, where the new study relates to an entirely different therapeutic area and subject matter, and where it may be impracticable for investigators to locate and re-contact all of the subjects to obtain new informed consent.

In addition to the safeguards and subject protections that you’ve discussed, are there any steps you would recommend for investigators themselves and IRB members?

SR: Investigators and IRB members can take proactive steps to learn more about privacy and security risks and the ethical issues that apply to use of genomic information. IRBs are supposed to assure that investigators have some training in human research ethics prior to approval to conduct studies with human subjects. Very often, that’s general training on history and the Belmont Principles. But we all could do better about developing and providing training opportunities on how to create a quality data-security plan, for example. I have found that the IT departments on most campuses have a few people who are knowledgeable about data security and can be great resources for the IRB.

Do you foresee challenges in meeting HIPAA de-identification standards as institutions and commercial entities continue to gather large amounts of information from different sources? You mention the “mosaic” concern. How should institutions protect against that?

JC: Careful and comprehensive upfront due diligence to understand the other data sets that may be used by an anticipated de-identified data recipient will be increasingly important as the sources of health and other data potentially available to any given investigator (such as from wearables, social media, commercial data aggregators, and government databases) continue to proliferate. In certain cases, an entity may have access to de-identified or even identifiable data regarding the same individuals whose data is in the de-identified data set that is being made available for use in a research study. In addition to identifying and incorporating these and other relevant assumptions into the development of any statistical de-identification opinion, firewalls, access and role restrictions, and other safeguards may be necessary or appropriate to maintain the de-identified nature of the data that is proposed for use in a research study. An investigator or other member of a research team using de-identified data, for example, may need to be restricted from certain other operations of an institution that require the use of identifiable data relating to individuals whose data is also included in the de-identified data set. The nature and extent of the necessary safeguards will depend on the particular facts and circumstances.

What should be done to educate specimen donors and potential research subjects about the ways in which their information might be used for research?

SR: That is a piece of the puzzle that we typically don’t spend enough time thinking about. In our lifetimes, we have seen very effective public education campaigns that have changed attitudes and behavior around smoking, drunk driving, domestic violence, littering, and wearing of bicycle helmets. Ideally, the research community and the federal government would put a concerted effort into educating the public about the value of specimens and data to answer important scientific questions that could benefit everyone. This sort of campaign could help people to feel more trust in the researchers, and also a sense of pride about contributing to the common good by participating in research.

Right now we hold institutions accountable if a researcher misbehaves with specimens or data, but what are the punishments for the investigator?

SR: It’s true that the Common Rule does not have a dedicated section on investigator accountability. Through the assurance process, institutions accepting federal dollars for research have been held accountable for their researchers’ noncompliance. You may have heard of cases where universities had to send back millions of dollars to the granting agency when noncompliance was discovered. While the FDA rules require individual investigators to sign a 1572 form, we don’t have a corresponding requirement for researchers not covered by the FDA. The Secretary’s Advisory Committee for Human Research Protections (SACHRP) actually suggested way back in the Advance Notice of Proposed Rule Making (ANPRM) stage of the Common Rule update that a new section on investigator accountability be added, but that suggestion never made it into the draft changes to 45 CFR 46. Of course, IRBs do have authority to suspend or terminate study approval, and research institutions can withdraw an investigator’s privileges to conduct research.

---

PRIM&R thanks Ms. Chen and Dr. Rivera for sharing their expertise.

The recording of this webinar is available for individuals to purchase in PRIM&R’s online store. If you would like to purchase the webinar for group viewing, please download the order form (PDF) and send it to registration@primr.org.