Identifiability: A Useful or Decrepit Concept in Research Ethics? Sara C. Hull, PhD Faculty, Clinical Center Department of Bioethics Director, NHGRI Bioethics Core National Institutes of Health Bethesda, MD

Disclaimers/Disclosures No statement in this presentation should be construed as an official position of the National Human Genome Research Institute, National Institutes of Health, or Department of Health and Human Services. The speaker declares no financial conflicts of interest.

Overview 1. “Identifiability” as a gatekeeper 2. How well is it working? 3. Outstanding challenges

A Provocation “Medical confidentiality, as it has traditionally been understood by patients and doctors, no longer exists…[I]t is a decrepit concept.” Mark Siegler (1982) NEJM

A Charge “Rather than perpetuate the myth of confidentiality and invest energy vainly to preserve it, the public and the profession would be better served if they devoted their attention to determining which aspects of the original principle of confidentiality are worth retaining.” Mark Siegler (1982) NEJM

Current Definition of “Human Subject” (f) A living individual from whom an investigator... conducting research obtains: (1) data through intervention or interaction with the individual (2) identifiable private information 45 CFR

“Identifiablity” in the Research Regulations “Identifiable, private information” + broad exemptions added in 1981 “Major deregulation from rules in force” Intention: to distinguish “categories of research which normally present little or no risk of harm to subjects.” Motivated refinement of coding/de- identification strategies 45 CFR 46 FR (1981)

“Identifiablity” in the Research Regulations Goal: Reduce burden of ethics review “[T]he workload of IRBs will be significantly reduced” “…as will the paperwork burden on scientists whose research will henceforth be exempt.” “…less difficulty in recruiting members of IRBs” “IRBs will be able to concentrate more productively on projects which most deserve IRB attention.” 45 CFR 46 FR (1981)

Identifiability as a Gatekeeper cannot be identified/ de-identified identifiable

OHRP Interpretation: not identifiable = not readily ascertainable OHRP does not consider research involving only coded private information or specimens to involve human subjects … if the following conditions are both met: (1) the private information or specimens were not collected specifically for the currently proposed research project through an interaction or intervention with living individuals; and (2) the investigator(s) cannot readily ascertain the identity of the individual(s) OHRP Guidance 10/16/08

Role of Confidentiality Respect subjects’ individuality and privacy Protect against harm Economic, social, psychological Stigma and discrimination Promote trust Effective functioning of health, public health, and research systems Willingness to divulge information

How Well Is It Working? What is “it”? Informational privacy in research databases Oversight of research based on assumptions about informational privacy

How Well Is It Working?

CRITERIA 1. Reduce review burden 2. Prevent risks of harm De-identification Associated harms Other risks To individuals (e.g., autonomy) To groups 3. Preserve public trust

Reduce of Review Burden Prediction An enormous regulatory gap [M]ajority of research involving databanks will be excluded from the Common Rule [W]e have to hope that research institutions will [ensure] appropriate oversight.” Clayton (2004) IRB: Ethics & Human Research

Reduce of Review Burden Reality Significantly fewer studies require IRB review Creation of new oversight and governance structures Repository-specific governance e.g., Data Access Committees

Prevent Risks of Harm De-Identification Associated harms Photo Credits: digital ART 2 and Rush the Court NCAA blog

Prevent Risks of Harm Evolving research landscape GWAS* Next generation sequencing Whole exome/genome

Prevent Risks of Harm Other risks To individuals To groups

Preserve Public Trust Attitudinal data Consent parameters willingness Privacy concerns Trust in research enterprise

Outstanding Challenges Evaluate effectiveness of “alternative” review mechanisms. Address gaps Rigorous examination of actual risks to identifiability and associated harms Ongoing engagement with public and communities Input re. design and goals Buy-in to trade-offs