Part One of Seven-Part Blog Series by Guest Blogger Patrick Taylor
The recent Apple-FBI controversy has highlighted the fact that our government, obligated to protect our privacy in some contexts, actively undermines it in others. The same internal conflict of interest is responsible, at least in part, for the U.S. government’s recent proposal to revise longstanding regulations to protect people who participate in research.
The proposals emerged last September, 2015, and were hailed as the first major reworking of the regulations in several decades, four years after an Advance Notice of Proposed Rulemaking buried somewhat different approaches to the same desired adverse privacy effects in a tome of hundreds of pages. It’s a safe bet that few if any members of the public not professionally involved ever read them. The feds gave themselves four years to consider and devise the current proposal, but they gave the public about four months to consider it and with no evident structured interaction with public opinion.
That is odd for proposals purportedly justified by obedience to the people’s will, and commitment to partnership with research volunteers, who currently, outside clinical trials, are effectively data-cows unfed by any reciprocal benefit, even knowing the results of research to which they contributed.
More disturbing, once the proposal is understood, is that there are few comments that involve patients and participants speaking for themselves. It’s not unpredictable that agencies regulating scientists’ research methods would rely on academic research surveys of undeliberated preferences of a tiny fraction, rather than soliciting all citizens’ engaged deliberation in a transparent conversation about the meaning of policy choices. Not surprising – but not necessary either. The United Kingdom by tradition combines the expertise of extraordinary public servants with active public consultation. Here, with the proposed revisions to the Common Rule, barriers to citizen penetration include specialized background knowledge that is assumed, legal grammar and vocabulary, and publication in the Federal Register, which most citizens will not know exists, let alone regularly read.
You deserve to know about what the proposals mean, and to form your own opinion. Otherwise the process of adopting them will mimic too well the inattention to individual patient views that define the consent proposal itself.
Here, lack of public comment should not be interpreted as a ringing endorsement of indifference to moral questions arising in research by each and every person who did not file a public comment and thus by the nation. Not when surveys and analyses consistently showing that Americans believe that “scientists do not pay enough attention to moral values.” Nonparticipation means that the process has been ineffective in engaging the public about what is occurring.
This is the first of seven posts written with the sole intention of making the most controversial and game-changing proposal accessible to the general public. Professionals will also find new causes for concern. I came to the problem believing that consent of the governed is essential, suspicious when government introduces individual consent to unmitigated risks over effectively eliminating privacy risks through legislative and private innovation, and recognizing that individual consent over one’s own data is but one means by which consent may controls.
The proposals were embodied in a Notice of Proposed Rulemaking (“the NPRM”), a formal method of soliciting written comments from the public, and were accompanied by explanatory government “commentaries”. The NPRM is a complex document, including proposals as diverse as requiring institutions, if they are federally funded, to apply federal regulations to all research, and claiming to reform the consent process to make it more efficient, promising that as revised it will enhance autonomy and respect.
I will focus on what could be described as the most ultraefficient proposed consent of all, a one-size-fits-all-give-away-the-store consent that will become effectively the only choice available to you to govern researchers’ access to your medical records and other health data held by providers and payers, given its free pass to avoid IRB review of consent matters. Note, not just hospital records but the records of every clinical provider of every type — physicians, psychotherapists, marriage counselors, alcohol treatment facilities, nursing homes, and so on — through the vast, if somewhat fragmented continuum of care that is our health care system. And not just for every person who participates in research. The government’s goal is to seek this consent from everyone who seeks care. That, eventually, means all of us. Even if you never participate in research you should care, just as you probably care about the outcome of the Apple-FBI controversy even though you are neither an FBI agent nor a terrorist.
What is at stake is the very meaning of consent, in what will become the law of the land. But also what rules government has to follow in giving out your medical information. Federal research grants may, and with genomic data must, require the clinical data accessed in the research to be filed with the government or various repositories, in which the terms of your consent become the terms on which distribution to others is possible. The proposed consent will give the government unencumbered freedom to disseminate patient information broadly. In fact, the government is counting on getting that authority because, although the commentaries do not discuss it, the National Institutes of Health has already committed itself to freely share these patient records with drug companies to identify possible drugs for the companies, which would sell them for profit.
The proposed regulations claim they extend a consent requirement into new areas, particularly banked clinical tissues and data to be used for research. True, but in enabling consent they have disabled choice. Forget about consent as we know it, which respects the limits of individual conscience, and recognizes some role for the individual’s views in how tissues and data may be used. For all practical purposes all permutations of consent for that research are eliminated except one for tissue and databanking, and one category for one-off research uses of clinical data. The first would be a written consent to anybody doing any research on “banked” data and tissues, with no limit in the consent, nor any promise about government or other constraints on the number and diversity of purposes to which the data and tissues will be put, or the number, identity, affiliation, or qualifications of researchers, or their history of misusing or divulging confidential patient information. The proposed regulations do not show us this consent, but rather permit the government to draft it later, free of the notice and comment process and specially immunized from the careful scrutiny by specialized ethics review boards that research consent always legally requires. But its terms are clear enough from its description and consents required by companion policies.
The second permitted consent is a category. It is described nonspecifically as an oral consent, a written consent meeting IRB approval, and an opt-out process, administered by clinical providers at the point of care. It will cover research for single-purpose studies drawing directly from clinical records, and must be as broad as all possible studies. It shares defects with the first consent. But it spells huge trouble for availability of clinical data for important research. Here’s why.
Clinical consents are individual for each health care provider, of which there are roughly 6000 hospitals and 700,000 physicians in the country, not to mention all the other professionals and institutions involved in health care. Hospital medical staffs rule the creation of clinical consents, while IRBs will rule over their sufficiency as substitutes for research consents. Each is idiosyncratic in its own way. Outside academic medical centers, the two have little to do with each other. In addition, one may expect IRBs to be hostile to the idea of treating a clinical consent as adequate if it leaves out most of the elements they require for research consent. The clinical providers collecting it are in no position to answer patient questions about hypothetical research in which they have no role, let alone all future research by anyone, and without such answers it is impossible to comprehend what it means or the risk it actually entails.
Somehow all those new consents must spontaneously harmonically converge with an approval by the full range of IRBs that will ever come to review the c0nsent — despite the well-known variability of IRBs and medical staffs. Wow. This is even more remarkable than the legendary room full of monkeys that randomly type the entire works of Shakespeare.
Unfortunately, the NPRM has received much less press attention than the Apple-FBI standoff, although actually the stakes and sweep are far higher. The Apple-FBI conflict is thus far only one case, in one trial court, involving judicially-mediated oversight, not a no-holds-barred free-for-all in the name of research. Though of course people believe the FBI would abuse a favorable decision, a trial court’s decision has no precedential weight, and it is a long way from the Supreme Court and establishing the law of the land.
In contrast, the NPRM, if adopted, will be the same as a law. The law will act first on institutions doing federally funded research. But then it has ripple effects, across all providers, and finally across all of us. Ultimately, it will divide us into two groups: those who have given up all health privacy, including any aspect of their entire medical history and agreed that scientists can do anything they want , and give it to anyone they want to with no laws restricting what the recipient does with it; and those who refuse to sign or aren’t asked, and are thereby excluded, from any research that would have required their clinical data, their genomes or tissue or blood samples, which means virtually all cutting edge research into new cures, like the Precision Medicine Initiative.
In the blogs that follow, I will address fundamental questions affecting patients like you and me quite directly, and by the end I think you will want to do something about it. We will be looking at whether the proposed rule changes keep their promises. Will they enable us to create an opportunity to say no to all research uses of our health data? Do they increase patient control over their data or destroy it? Do they increase privacy protection or punch holes in it? Is there a punishment for patients who refuse? Do they harm anybody, and if so who? Who do they advantage and who is left out? Are they the right solution to a political problem? Will they work? What are they really for?
Next blog we’ll go right at the promises issue: what medical data are subject to consent before they are used for research if the regulations are adopted. You may be amazed at the answer.
