Biobanking,Consent,and Certificates of Confidentiality: Does the ANPRM Muddy the Water?

“Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators,” 76 Fed. Reg. 44512 (July 26, 2011) [hereinafter ANPRM] (to be codified at 45 C.F.R. pts. 46, 160, and 164 and 21 C.F.R. pts. 50 and 56).

The Common Rule is codified at 45 C.F.R. pt. 46, subpart A. Promulgated by HHS, the Rule applies to research conducted by the Department of Agriculture, Department of Energy, National Aeronautics and Space Administration, Department of Commerce, Consumer Product Safety Commission, International Development Cooperation Agency, Agency for International Development, Department of Housing and Urban Development, Department of Justice, Department of Defense, Department of Education, Department of Veterans Affairs, Environmental Protection Agency, National Science Foundation, Department of Transportation, and the Central Intelligence Agency. While the Food and Drug Administration has concurred with the Federal Policy, it has not adopted the policy in its entirety and maintains changes from the policy in its IRB and informed consent regulations. See “Protection of Human Subjects; Informed Consent; Standards for Institutional Review Boards for Clinical Investigations,” 56 Fed. Reg. 28025 (June 18, 1991) (to be codified at 21 C.F.R. pts. 50 and 56).

See ANPRM, supra note 1, at 44519.

See McGuire A. L. , “Identifiability of DNA Data: The Need for Consistent Federal Policy,” American Journal of Bioethics 8, no. 10 (2008): 75–76

Wolf L. E. , “Advancing Research on Stored Biological Materials, Reconciling Law, Ethics, and Practice,” Minnesota Journal of Law, Science & Technology 11, no. 1 (2010): 99–156.

See ANPRM, supra note 1, at 44519, 44524.

See ANPRM, supra note 1, at 44519–44520.

The ANPRM suggests use of check boxes to allow participants to say no to a limited number of types of research that may be objectionable. Id.

See, e.g., Nietfeld J. J. Sugarman J. Litton J.-E. , “The Bio-Pin: A Concept to Improve Biobanking,” Nature Reviews Cancer 11, no. 4 (2011): 303–308.

See Wolf , supra note 3, at 118–125 (discussing the Havasupai case)

U.S. Health and Human Services, Office for Human Research Protections, “Guidance on the Genetic Information Nondiscrimination Act: Implication for Investigators and Institutional Review Boards,” March 24, 2009, available at <http://www.hhs.gov/ohrp/policy/gina.html> (last visited April 17, 2013).

Potential research participants have identified that their greatest concern, and thereby their main reason for nonparticipation in biospecimen research, relates to the confidentiality of their health-related and genetic information. Goddard K. A. B. , “Biobank Recruitment: Motivations for Nonparticipation,” Biopreservation & Biobanking 7, no. 2 (2009): 119–121, at 120 (reporting the most frequent concerns were security and confidentiality of health information (73%) and genetic information (61%)). Further, the enactment of HIPAA demonstrates the heightened concerns surrounding the need to protect health information, including data collected for research purposes

See, generally, Currie P. M. , “Balancing Privacy Protections with Efficient Research: Institutional Review Boards and the Use of Certificates of Confidentiality,” IRB Ethics & Human Research 27, no. 5 (2005): 7–12.

See ANPRM, supra note 1, at 44526.

See infra discussion of History and Purpose of Certificates of Confidentiality.

See ANPRM, supra note 1, at 44525.

Office for Protection from Research Risks, Department of Health and Human Services, “Issues to Consider in the Research Use of Stored Data or Tissues,” November 7, 1997, available at <http://www.hhs.gov/ohrp/policy/reposit.html> (last visited April 17, 2013)

National Institutes of Health, Department of Health and Human Services, “Policy for Sharing of Data Obtained in NIH Supported or Conducted Genome-Wide Association Studies (GWAS),” August 28, 2007, available at <http://grants.nih.gov/grants/guide/notice-files/NOT-OD-07-088.html#protection> (last visited April 17, 2013) [hereinafter GWAS].

See ANPRM, supra note 1, at 44519.

National Institutes of Health, “Certificates of Confidentiality: Background Information,” July 21, 2003, available at <http://grants.nih.gov/grants/policy/coc/background.htm> (last visited April 17, 2013).

45 C.F.R. § 46.102(d) (2012).

45 C.F.R. § 46.101 (2012).

45 C.F.R. § 46.101(f) (2012). According to the regulations, Intervention includes both physical procedures by which data are gathered (for example, venipuncture) and manipulations of the subject or the subject's environment that are performed for research purposes. Interaction includes communication or interpersonal contact between investigator and subject. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects. 45 C.F.R. § 46.101(f).

45 C.F.R. § 46.101 (2012) (requiring IRB approval for all studies involving human subjects). The regulations further set forth the elements to be reviewed by the IRB in 45 C.F.R. § 46.111:.

(a) In order to approve research covered by this policy the IRB shall determine that all of the following requirements are satisfied: (1) Risks to subjects are minimized: (i) By using procedures which are consistent with sound research design and which do not unnecessarily expose subjects to risk, and (ii) whenever appropriate, by using procedures already being performed on the subjects for diagnostic or treatment purposes. (2) Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result. In evaluating risks and benefits, the IRB should consider only those risks and benefits that may result from the research (as distinguished from risks and benefits of therapies subjects would receive even if not participating in the research). The IRB should not consider possible long-range effects of applying knowledge gained in the research (for example, the possible effects of the research on public policy) as among those research risks that fall within the purview of its responsibility. (3) Selection of subjects is equitable. In making this assessment the IRB should take into account the purposes of the research and the setting in which the research will be conducted and should be particularly cognizant of the special problems of research involving vulnerable populations, such as children, prisoners, pregnant women, mentally disabled persons, or economically or educationally disadvantaged persons. (4) Informed consent will be sought from each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by § 46.116. (5) Informed consent will be appropriately documented, in accordance with, and to the extent required by § 46.117. (6) When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects. (7) When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. (b) When some or all of the subjects are likely to be vulnerable to coercion or undue influence, such as children, prisoners, pregnant women, mentally disabled persons, or economically or educationally disadvantaged persons, additional safeguards have been included in the study to protect the rights and welfare of these subjects.

45 C.F.R. § 46.111 (2012) (requiring informed consent from research participants).

45 C.F.R. § 46.116 (2012). Although not typically applicable to biospecimen research, the Common Rule also requires “[f]or research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained.” Id., at 46.116(a)(6).

Office for Human Research Protections (OHRP), Department of Health and Human Services, Guidance on Research Involving Coded Private Information or Biological Specimens, available at <http://www.hhs.gov/ohrp/policy/cdebiol.html> (last visited April 17, 2013). OHRP further explains that “[o]btaining identifiable private information or identifiable specimens includes, but is not limited to: (1) using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that have been provided to investigators from any source; and (2) using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that were already in the possession of the investigator.”.

See OHRP, supra note 21.

The OHRP Guidance considers information or specimens “coded” when “(1) identifying information (such as name or social security number) that would enable the investigator to readily ascertain the identity of the individual to whom the private information or specimens pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and (2) a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.” See OHRP, supra, note 51.

See OHRP, supra, note 51.

45 C.F.R. § 46.101(b)(4) (2012).

45 C.F.R. § 46.101(b)(4).

45 C.F.R. § 46.116(d)(1)–(4) (2012).

42 U.S.C. § 241(d) (2012). The authorizing statute does not use the phrase “Certificate of Confidentiality.” The term may come from the regulations, which refer to a “Confidentiality Certificate.” 42 C.F.R. § 2a. In any event, the protections afforded by 42 U.S.C. § 241(d) are commonly referred to as a “Certificate of Confidentiality” by NIH and other issuers, IRBs, and the researchers who use them.

See Federal Drug Abuse and Dependence Prevention, Treatment, and Rehabilitation Act of 1970, Part I: Hearings on S. 3562, S. 3246, and S. 2785 Before the Special Subcomm. On Alcohol and Narcotics of the S. Comm. On Labor and Public Welfare, 91st Cong. (1970).

Id., at 169.

42 U.S.C. § 241(d) (2012).

National Institutes of Health, NIH Announces Statement on Certificates of Confidentiality, NOT-OD-02-037, March 15, 2002, available at <http://grants.nih.gov/grants/guide/notice-files/NOT-OD-02-037.html> (last visited April 17, 2013).

National Institutes of Health, “Certificates of Confidentiality: Background Information,” July 21, 2003, available at <http://grants.nih.gov/grants/policy/coc/background.htm> (last visited April 17, 2013).

National Institutes of Health, “Slide Presentation on Certificates of Confidentiality,” May 3, 2002, available at <http://grants.nih.gov/grants/policy/coc/slides_020503/index.htm> (last visited April 17, 2013).

See NIH Slide Presentation, supra note 34.

32 N.Y.2d 379 (1973). Because such cases involve discovery disputes that rarely give rise to final orders, there are only a few reported cases involving Certificates. In addition to Newman, they are: People v. Still, 369 N.Y.S.2d 759 (App. Div. 1975) (holding that methadone clinic had to produce clinic documents when the individual to whom the information pertained requested their disclosure to defend against criminal charges) and North Carolina v. Bradley, 634 S.E.2d 258 (N.C. Ct. App. 2006) (holding that defendant was not entitled to research records as immaterial to the case, although the records were produced under a protective order for purposes of the appeal).

For a further discussion of cases involving Certificates, see Wolf L. E. , “Certificates of Confidentiality: Protecting Human Subjects Research Data in Law and Practice,” Minnesota Journal of Law, Science & Technology 14, no. 1 (2013): 11–87.

32 N.Y.2d at 382–383.

32 N.Y.2d at 387–390.

32 N.Y.2d at 387.

Beskow L. M. Dame L. Costello E. J. , “Certificates of Confidentiality and Compelled Disclosure of Data,” Science 322, no. 5904 (2008): 1054–1055.

Federal agencies other than NIH issue Certificates. These include the Centers for Disease Control and Prevention, the Health Resources and Services Administration, the Indian Health Service, and the Substance Abuse and Mental Health Services Administration, which issues Certificates only for research they fund. The Food and Drug Administration, like the NIH, issues Certificates regardless of federal funding. National Institutes of Health, “Frequently Asked Questions: Certificates of Confidentiality,” June 20, 2011, available at <http://grants.nih.gov/grants/policy/coc/faqs.htm#133> (last visited April 17, 2013). However, we focus on the NIH because most researchers look to the NIH and the NIH has taken a leading role of educating researchers about Certificates through its “kiosk” website.

See NIH, “Slide Presentation,” supra note 34.

Id.

National Institutes of Health, “Detailed Application Instructions for Certificate of Confidentiality: Extramural Research Projects,” at para. 5(a), March 15, 2002, available at <http://grants.nih.gov/grants/policy/coc/appl_extramural.htm> (last visited April 17, 2013).

Id., at para. 7.

Id.

Id.

Id., at para. 8.

Id.

Id., at para. 9.

Id.

Id., at para. 10.

Id., at para. 11.

Id.

Id.

Eiseman E. , “Case Studies of Human Tissue Repositories: ‘Best Practices’ for a Biospecimen Resource for the Genomic and Proteomic Era,” RAND, 2003, at iii.

Office for Protection from Research Risks (OPRR), Department of Health and Human Services, “Issues to Consider in the Research Use of Stored Data or Tissues,” 1997, available at <http://www.hhs.gov/ohrp/policy/reposit.html> (last visited April 17, 2013).

Id.

Id.

See NIH, supra note 41, at FAQ C3.

National Cancer Institute (NCI), Department of Health and Human Services, Office of Biorepositories and Biospecimen Research, National Cancer Institute Best Practices for Biospecimen Resources, 2011, at 42, available at <http://biospecimens.cancer.gov/bestpractices/2011-NCIBestPractices.pdf> (last visited April 18, 2013).

See Eiseman et al., supra note 56.

See, generally, International Society for Biological and Environmental Repositories, 2008 Best Practice for Repositories: Collection, Storage, Retrieval, and Distribution of Biological Materials for Research, published in Cell Preservation Technology 6, no. 1 (2008): 3–58 available at <http://www.isber.org/bp/bestpractices2008.pdf> (last visited April 18, 2013).

Beskow L. M. , “Institutional Review Boards' Use and Understanding of Certificates of Confidentiality,” Public Library of Science One 7, no. 9 (2012): e44050, at 5.

See Wolf , supra note 36.

Wolf L. E. , “Certificates of Confidentiality: Legal Counsels' Experiences with and Perspectives on Legal Demands for Research Data,” Journal of Empirical Research on Human Research Ethics 7, no. 4 (2012): 1–9.

See, generally, ANPRM, supra note 1.

See APRM, supra note 1, at 44515.

The ANPRM defines “pre-existing data” as “data that were previously collected for purposes other than the currently proposed research study.” See ANPRM, supra note 1, at 44519.

See ANPRM, supra note 1, at 44519 citing Menikoff J. Richards E. P. , What the Doctor Didn't Say: The Hidden Truth about Medical Research (New York, NY: Oxford University Press, 2006): At 113–123.

See ANPRM, supra note 1, at 44519 (emphasis added).

Id.

Id.

Id.

Id.

Id., at 44519–44520.

Id., at 44519, at 44522.

Id., at 44523.

Id., at 44524.

Id., at 44524.

Id., at 44524. For more information concerning the reidentifiability of DNA, see Lowrance W. W. Collins F. S. , “Identifiability in Genomics Research,” Science 317, no. 5838 (2007): 600–602.

See ANPRM, supra note 1, at 44526.

Id., at 44526. See 45 C.F.R. pt. 160 and Subpart A and C of pt. 164 for further detail about the HIPAA Security Rule.

See ANPRM, supra note 1, at 44526.

Id., at 44526.

Id., at 44524. Further, some individuals may object to at least some uses of their biological materials without consent. These objections can be seen in the several lawsuits that have been brought by patients objecting to use of their biological materials for research purposes. See Moore v. Regents of the Univ. of Cal., 793 P.2d 479 (Cal. 1990);

Greenberg v. Miami Children's Hosp. Research Inst., Inc., 264 F. Supp. 2d 1064 (S.D. Fla. 2003);

Wash. Univ. v. Catalona, 490 F.3d 667 (8th Cir. 2007);

Havasupai Tribe v. Ariz. Bd. of Regents, 204 P.3d 1063 (Ariz. Ct. App. 2008).

For further discussion and analysis of these cases, see Wolf , supra note 3, at 103.

The ANPRM's proposal in this regard has been criticized, representing the larger debate on biobanking. Some have argued that such a broad consent for research (especially in the clinical context) is not informed consent; rather, they argue, consent must be to specific research projects to be effective. Others have argued that the proposal goes too far by requiring consent to all research, even when specimens are deidentified. See Nietfeld , supra note 7 for a discussion of these debates. For purposes of this paper, we set those arguments aside and focus on the ANPRM's proposals as they relate to Certificates.

See Goddard , supra note 9, at 120.

See GWAS, supra note 12

see National Cancer Institute, supra note 61.

See NCI, supra note 61.

Id.

See GWAS, supra note 12, at 6. Law enforcement officers frequently used DNA data as evidence in their investigative work. Stored in the Federal Combined DNA Index System (CODIS), samples may be connected with samples from state databases as well. Additionally, the federal government now allows for the collection of DNA evidence from suspects upon arrest and, as of September 2011, 25 states have followed suit. See, e.g., 42 U.S.C. § 14135a(a)(1)(A) (2011) (“The Attorney General may, as prescribed by the Attorney General in regulation, collect DNA samples from individuals who are arrested, facing charges, or convicted or from non-United States persons who are detained under the authority of the United States.”);

Kan. Stat. Ann. § 21–2511(e)(2) (2010) (“[A]ny adult arrested or charged or juvenile placed in custody for or charged with the commission or attempted commission of any felony … shall be required to submit such specimen or sample at the same time such person is fingerprinted pursuant to the booking procedure.”)

N.C. Gen. Stat. § 15A-266.3A(b) (2011) (“The arresting law enforcement officer shall obtain, or cause to be obtained, a DNA sample from an arrested person at the time of arrest, or when fingerprinted. However, if the person is arrested without a warrant, then the DNA sample shall not be taken until a probable cause determination has been made pursuant to G.S. 15A-511(c)(1)”).

See GWAS, supra note 12, at 6. Further, some have noted that law enforcement officers will seek to subpoena the tissues and genetic information of family members of a criminal suspect in order to find a match and support probable cause

Brown T. Lowenberg K. , “Biobanks, Privacy, and the Subpoena Power,” Stanford Journal of Law, Science & Policy 1 (2010): 89–101, at 89, available at <http://www.sjlsp.org/?q=node/57> (last visited April 18, 2013).

See GWAS, supra note 12, at 6.

P.L. 110–233, 122 Stat. 881 (2008).

McGuire A. L. Majumder M. A. , “Two Cheers for GINA?” Genome Medicine 1, no. 1 (2009): 6.1–6.3.

Id., at 6.2.

See GWAS, supra note 12, at 6. “Further, the NIH takes the position that technologies available within the public domain today, and technological advances expected over the next few years, make the identification of specific individuals from raw genotype-phenotype data feasible and increasingly straightforward.”.

McGuire A. L. Gibbs R. A. , “No Longer De-Identified,” Science 312, no. 5772 (2006): 370–371, at 370.

Homer N. , “Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays,” Public Library of Science Genetics 4, no. 8 (2008): e1000167, at 7, available at <http://www.plosgenetics.org/article/info%3Adoi%2F10.1371%2Fjournal.pgen.1000167> (last visited April 18, 2013.

See McGuire Gibbs , supra note 99, at 370.

See Wolf , supra note 66

Wolf , supra note 36.

Recent lawsuits over research use of newborn blood spots without consent resulted in the destruction of millions of specimens in Texas, which illustrates how dependent research is on public trust. Olson S. Berger A. C. , Rapporteurs, “Roundtable on Translating Genomic-Based Research for Health Board on Health Sciences Policy,” in Institute of Medicine, Challenges and Opportunities in Using Residual Newborn Screening Samples for Translational Research (Washington, D.C.: The National Academies Press, 2010): At 2, 20–24, and 26–29.

See ANPRM, supra note 1, at 44525.

See Beskow , supra note 64

Wolf , supra note 66.

See Wolf , supra note 66

Wolf , supra note 36.

According to the interviews we conducted, Certificates may be effective as a deterrent and, when data are produced, they are deidentified, sometimes with other protections, such as promises not to try to reidentify. Id.

See ANPRM, supra note 1, at 44519.

See Brown , supra note 85, at 87

Eisemen , supra note 56, at 134 (“Ideally, the consent process should occur separately from surgical consent.”).

See supra Section Advanced Notice of Proposed Rule Making: Changes to Consent of Biospecimen Collection.

See Catania J. Wolf L. Wertlieb S. Henne J. Lo B. , “Research Participants' Perceptions of the Certificate of Confidentiality's Assurances and Limitations,” Journal of Empirical Research on Human Research Ethics 2, no. 4 (2007): 53–59.

Wolf L. E. Zandecki J. , “Sleeping Better at Night: Investigators' Experiences with Certificates of Confidentiality,” IRB: Ethics & Human Research 28, no. 6 (2006): 1–7.

Wolf L. E. Zandecki J. Lo B. , “The Certificates of Confidentiality Application: A View from the NIH Institutes,” IRB: Ethics & Human Research 26, no. 1 (2004): 14–18, at 14 (describing a situation in which failure to have an IRB-approved consent form resulted in rejection of a Certificate of Confidentiality grant).

See supra Section Use of Certificates of Confidentiality for Biospecimen Research;

ANPRM, supra note 1, at 44524.

See also Ohm P. , “Broken Promises of Privacy: Responding to the Surprising Failure of Anonymization,” University of California Los Angeles Law Review 57 (2010): 1701–1777, at 1704 (arguing that emerging technologies have rendered research data “either useful or perfectly anonymous, but never both”).

45 C.F.R. § 164.512(a) (2012)

NIH, supra note 41, FAQ G.1.

See Beskow , supra note 64

Wolf , supra note 66.

See Wolf , supra note 112.

See ANPRM, supra note 1, at 44524.

Id., at 44522.

See Catania , supra note 110.

Paasche-Orlow M. K. , “Readability Standards for Informed Consent Forms as Compared with Actual Readability,” New England Journal of Medicine 348, no. 8 (2003): 721–726, available at <http://www.nejm.org/doi/full/10.1056/NEJMsa021212#t=article> (last visited April 18, 2013). Using the Flesch-Kincaid readability scale, the investigators found that IRB's generally fail to meet the IRB's own standards for readability.

See Paasche-Orlow , supra note 120.

We used the Flesch-Kincaid Readability scale incorporated into Microsoft Word™ to calculate the readability of the Certificate language. This is the same scale used by Paasch-Orlow , supra note 120.

See Paasche-Orlow , supra, note 120

citing National Work Group on Literacy and Health, “Communicating with Patients Who Have Limited Literacy Skills,” Journal of Family Practice 46, no. 2 (1998): 168–176.

Later literacy assessments have reported similar levels. National Center for Education Statistics, A First Look at the Literacy of America's Adults in the 21st Century (2005), available at <http://nces.ed.gov/pubsearch/pubsinfo.asp?pubid=2006470> (last visited April 18, 2013).

See NIH, supra note 41, FAQ C.3.

See Beskow , supra note 64.

Id.

42 U.S.C. §299c-3 (protecting data collected or supported by the Agency for Healthcare Research and Quality) and 42 U.S.C.A. § 242m (protecting data collected by or supported by the Centers for Disease Control and Protection).