1. www.mwe.com Boston Brussels Chicago Düsseldorf Frankfurt Houston London Los Angeles Miami Milan Munich New York Orange County Paris Rome Silicon Valley Washington, D.C. Strategic alliance with MWE China Law Offices (Shanghai) © 2012 McDermott Will & Emery. The following legal entities are collectively referred to as "McDermott Will & Emery," "McDermott" or "the Firm": McDermott Will & Emery LLP, McDermott Will & Emery AARPI, McDermott Will & Emery Belgium LLP, McDermott Will & Emery Rechtsanwälte Steuerberater LLP, McDermott Will & Emery Studio Legale Associato and McDermott Will & Emery UK LLP. These entities coordinate their activities through service agreements. This communication may be considered attorney advertising. Previous results are not a guarantee of future outcome. Presentation hosted by TCM, DED, and MCCC: Data Sharing: Select Legal Considerations Jennifer S. Geetter 202-756-8205 jgeetter@mwe.com Does not constitute legal advice

2. www.mwe.com2 Pieces of the Puzzle Does not constitute legal advice. Operational Considerations Pipeline Pressures Regulatory Developments Health Reform

3. www.mwe.com3 Puzzle Piece: Regulatory Developments Does not constitute legal advice. Regulatory Developments Common Rule Advanced Notice of Proposed Rule Making (August 2011) – Proposed Rule Anticipated in October 2013 HITECH Final Rule (January 2013) Increasing scrutiny and criticism of the FDA for marketed drug safety issues leading to new focus on data integrity in “real time” Recent guidance on a number of important topics, including new FDA informed consent guidance (2012) and FDA regulation of medical “apps” (2013) New guidance or rule-making possible that could impact de- identification, data sharing, privacy in a genomic age and other innovation related topics Stage Three Meaningful Use Standards – focus on public health and data-banking capabilities

4. www.mwe.com4 Puzzle Piece: Pipeline Pressures Does not constitute legal advice. Pipeline Pressures Slow-downs in product developing; in some cases, no or few new drugs for disease state areas in several years Increasing focus on comparative effectiveness and other demonstrations of value from payors Increasing emphasis on personalized medicine, genomics Increased globalization

5. www.mwe.com5 Puzzle Piece: Health Reform Does not constitute legal advice. Health Reform Focus on (1) controlling costs; (2) increasing access; and (3) improving quality Standard health care economics will not translate in all cases in the new environment Mimicking private models for certain health reform initiatives Electronic health records – databanking and interoperability Comparative effectiveness/pharmacoeconomics

6. www.mwe.com6 Puzzle Piece: Operational Considerations Does not constitute legal advice. Operational Considerations Public demand for point of care research opportunities Research as a competitive advantage/centers of excellence Research as a physician-recruiting tool “All shapes and sizes” research opportunities An IRB is not enough Increasingly diverse array of organizational and team participants in research studies, research infrastructure and research initiatives

7. www.mwe.com Competing Public Priorities  Significant public concern about privacy  Secrecy, privacy and confidentiality – Used interchangeably? – Consistent meanings?  Disagreement about default settings -- Model 1: Very restricted access with a presumption of non-disclosure -- Model 2: “Rules of the road” emphasis with a presumption of balancing confidentiality with socially useful uses and disclosures  Strong public demand for biomedical innovation  On-going push/pull relationship with health information informed by the need at the time 46705825 v.1 Does not constitute legal advice.

8. Promise of Big Data  By Whom?  How to Solve Problems?  Which Problems?  When?  Who Pays?  How do we measure success? www.mwe.com46705825 v.1 Does not constitute legal advice.

9. 9  A covered entity may not use or disclose protected health information (PHI), except as: – Expressly permitted or required by the Privacy Rule, or – As authorized (in writing) by the individual who is the subject of the information Covered entity – A health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with a health care transaction. Protected health information – Individually identifiable health information that is: transmitted by electronic media, maintained in electronic media; OR transmitted or maintained in any other form or medium Individually identifiable health information - Information collected from an individual that is (1) created or received by a health care provider, health plan, employer or health care clearinghouse; AND (2) relates to the past, present, or future physical or mental health or condition of any individual, the provision of health care to an individual; or the past present or future payment for the provision of health care to an individual; AND (i) that identifies that individual OR (ii) with respect to which there is a reasonable basis to believe the information can be used to identify the individual. HIPAA 46705825 v.1 Does not constitute legal advice.

10. 10 Looking at research through “genomic glasses”  Long standing concerns about confidentiality of genetic information (from clinical, research, law enforcement and other encounters)  Concerns include risks that are different in kind and different in degree  Focus on genetic privacy is migrating from the margins (genetic exceptionalism model) to the center (genetic centric model) as the role of genomic information in research and clinical care increases exponentially  October 2012 report from the Presidential Commission for the Study of Bioethical Issues entitled “Privacy and Progress in Whole Genome Sequencing.” – Looks at privacy and data sharing issues attendant to WGS – 12 recommendations across five themes: (1) data protections simultaneous with data access and sharing; (2) data security and access to secure databases; (3) different consent models; (4) facilitating WGS progress; and (5) maximizing public benefit  Report underscores the need to review research rights and protections with an eye toward genomic-informed concerns and considerations 46705825 v.1 Does not constitute legal advice.

11. 11 What is Future Use?  Future use is a use or application of data or biological materials (an “Asset”) that has previously been collected for some prior, primary source  Primary sources include: – Payor data – Medical records/clinical data – Previous research records  NOTE: Future use qualifies as clinical research when it involves a “subject”  Post-approval registries and post-marketing studies 46705825 v.1 Does not constitute legal advice.

12. 12 Final Rule Provides More Flexibility  Section 164.508(b)(4) does not change – Impact: An authorization for a research study may condition access to study- related treatment on the signing of an authorization for that study BUT…  Section 164.508(b)(3)(i) and (iii) are amended – Impact: A covered entity may combine conditional and unconditional authorizations into a single authorization, provided that certain conditions are met Research: Compound Authorization Forms 46705825 v.1 Does not constitute legal advice.

13. 13 Final Rule Provides More Flexibility  Section 164.508(c)(1)(iv) does not change – Impact: An authorization for a research study must still set forth the purpose for each requested use and disclosure.  Department interpretation of Section 164.508(c)(1)(iv) is amended – Impact: A covered entity may obtain upfront authorization for future, unspecified uses and disclosures provided that certain conditions are met 1.Does not just apply to biobanking – applies to any “research related” activities Research: Future Unspecified Use 46705825 v.1 Does not constitute legal advice.

14. 14 Finding the Right Balance SPECIFICITY AS TO FUTURE USES RESEARCH PARTICIPANT’S WILLINGNESS TO AUTHORIZE “Reasonable” for participant to understand Describe the “purposes” Satisfy elements of a valid authorization Balance Point 46705825 v.1 Does not constitute legal advice.

15. 15 New, Uncertain Challenges  IRB comfort level with unspecified, future use?  How can an entity gauge IRB comfort upfront?  Need for a decision grid – PHI sensitivity – Type of PHI involved – Recipients – Biospecimen involvement – Recipient identity – Disease state parameters  Research participant comfort level – you can access but will they say yes?  What does the new template informed consent-authorization look like?  What policies and procedures should an entity prospectively develop to demonstrate thoughtfulness and care? 46705825 v.1 Does not constitute legal advice.