Use of Data from the Electronic Medical Record in Research Opportunities & Pit Falls Kristin West

Overview of Presentation EMR Data for Research Role of IRB/Privacy Board Front Door Consents Genomic Data -- When is de-identified data identifiable? Unintended Consequences – Business Associates & Research Collaborators

The View from the Trenches

Accessing Data for Research Role of the IRB IRB as Privacy Board Whose IRB? Rise of Central IRBs Informed Consent & HIPAA Authorization The Power of the IRB – Waivers! Reviewing records & caps

Front Door Consents Recruitment – Partial Waiver of HIPAA Authorization Cold Calls – Does the average person know what an IRB is? Answer: Front Door Consent

Front Door Consent Method for recruitment & collecting biospecimens Increase study awareness Increased recruitment can mean increased funding Examples: MD Anderson, Emory

Front Door Consent – Logistical Issues Comprehension – can 8 th grade reading level be achieved? Memory – What did I sign? Multiple calls Revocation? Future Research

Genomic Data Data on the complete genetic material contained in an organism. Genome-wide Association Study – scanning markers across complete sets of people’s DNA to find genetic variants that are associated with a specific condition or disease.

New NIH Policy Final NIH Genomic Data Sharing Policy 8/28/ /final-nih-genomic-data- sharing-policy 8/28/ /final-nih-genomic-data- sharing-policy

NIH Genomic Data Policy Scope: NIH-funded research that “generates large-scale [>100 subjects] human or non-human genomic data, as well as the use of these data for subsequent research.” Includes “genome-wide association studies (GWAS), single nucleotide polymorphism (SNP) arrays, and genome sequence, transcriptomic, metagenomic, epigenomic, and gene expression data.”

Required Consent Elements Investigators must obtain participants’ consent to use their genomic data for “future research purposes and to be shared broadly.” “The consent should include an explanation about whether participants’ individual-level data will be shared through unrestricted- or controlled-access repositories.”

Consent also Required for De- identified Data “For studies proposing to use genomic data from cell lines or clinical specimens that were created or collected after the effective date of the Policy, NIH expects that informed consent for future research use and broad data sharing will have been obtained even if the cell lines or clinical specimens are de-identified.” Room for possible exceptions in the case of “compelling scientific reasons.”

De-identified... “Investigators should de-identify human genomic data that they submit to NIH-designated data repositories according to the standards set forth in the HHS Regulations for the Protection of Human Subjects to ensure that the identities of research subjects cannot be readily ascertained with the data.” “Investigators should also strip the data of identifiers according to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The de- identified data should be assigned random, unique codes by the investigator, and the key to other study identifiers held by the submitting institution.”

... or Not? “Although the data in the NIH database of Genotypes and Phenotypes (dbGaP) are de-identified by both the HHS Regulations for Protection of Human Subjects and HIPAA Privacy Rule standards, NIH has obtained a Certificate of Confidentiality for dbGaP as an additional precaution because genomic data can be re-identified. ”

What about old specimens? “For studies using data from specimens collected before the effective date of the GDS Policy, there may be considerable variation in the extent to which future genomic research and broad sharing were addressed in the informed consent materials for the primary research. In these cases, an assessment by an IRB, privacy board, or equivalent body is needed to ensure that data submission is not inconsistent with the informed consent provided by the research participant. NIH will accept data derived from de-identified cell lines or clinical specimens lacking consent for research use that were created or collected before the effective date of this Policy.”

NIH Genomic Data Sharing Policy Implications of policy on broader use of genetic information? Can genetic information ever truly be de- identified? Does possible re-identification of genetic information make de-identification impossible?

Unintended Consequences – Business Associates You hire them and they want your data! Contract with Business Associate and Business Associate agreement permit Business Associate to de-identify data and/or create limited data set and use it for its own purposes. “What did that authorization say?"

Business Associates Sample Clause: “Covered Entity also understands and acknowledges that Business Associate may use, sell, rent and otherwise disseminate the XXXXX Data in aggregated, de-identified form for any purpose, or in the form of a Limited Data Set for public health, research or health care operations purposes, or in the form of analyses of such de-identified or Limited Data Set information, in its sole discretion, and that Covered Entity will not be entitled to any compensation for such use of XXXX Data.”

Unintended Consequences -- Research Collaborations Who is monitoring data transfers? From the formal to the very informal Is transfer covered by informed consent/authorization? Do you have appropriate data transfer agreements in place? Do your collaborators have appropriate data safeguards?

Unintended Consequences – Research Collaborations Big Data Sets – if you create them they will come. Chose your collaborators carefully. If you prepare data for litigation, be prepared to have to provide it to multiple parties. Examples: The C8 Project; Accutane Litigation

Questions ? Kristin H. West, J.D., M.S Assoc. VP for Research Admin. & Director, Office of Research Compliance Emory University Ste , 1599 Clifton Rd., N.E. Atlanta, GA (404)