The individual right of access to one’s own data is a crucial privacy protection long recognized in U.S. federal privacy laws. Mobile health devices and research software used in citizen science often fall outside the HIPAA Privacy Rule, leaving participants without HIPAA’s right of access to one’s own data. Absent state laws requiring access, the law of contract, as reflected in end-user agreements and terms of service, governs individuals’ ability to find out how much data is being stored and how it might be shared with third parties. Efforts to address this problem by establishing norms of individual access to data from mobile health research unfortunately can run afoul of the FDA’s investigational device exemption requirements.
Get full access to this article
View all access options for this article.
References
1.
M.A.Rothsteinet al., “Citizen Science on Your Smartphone: An ELSI Research Agenda,”Journal of Law, Medicine & Ethics43, no. 4 (2015): 897-903, at 901.
2.
B.Patrick-Lake and J.C.Goldsack, “Mind the Gap: The Ethics Void Created by the Rise of Citizen Science in Health and Biomedical Research,”American Journal of Bioethics19, no. 8 (2017): 1-2.
3.
45 C.F.R. pt. 46, subpt. A.
4.
21 C.F.R. pts. 50, 54, 56, 809, 812.
5.
Pub. L. No. 104-191, 110 Stat. 1936 (1996) (codified as amended in scattered sections of 18, 26, 29, and 42 U.S.C. (2012)).
6.
45 C.F.R. pts. 160, 164 (2018).
7.
B.J.Evans and S.M.Wolf, “A Faustian Bargain that Undermines Research Participants’ Privacy Rights and Return of Results,”Florida Law Review71, no. 5 (2019): 1281-1345, at 1296–1307.
8.
S.M.Wolf, “Return of Results in Participant-Driven Research: Learning from Transformative Research Methods,”Journal of Law, Medicine & Ethics48, no. 1, Supp. (2020): 159-166.
9.
Pub. L. No. 90-321, 84 Stat. 1128 (codified as amended at 15 U.S.C. § 1681 (2012)) (authorizing collection and storage of individuals’ financial and credit data without their consent but granting individuals a right of access to their data).
10.
Pub. L. No. 93–579, 88 Stat. 1896 (codified as amended at 5 U.S.C. §§ 552(a), (d) (2012)) (providing an individual right of access to data held in governmental databases).
11.
45 C.F.R. § 164.524 (2018).
12.
B.J.Evans, “The Genetic Information Nondiscrimination Act at Age 10: GINA’s Controversial Assertion that Data Transparency Protects Privacy and Civil Rights,”William & Mary Law Review60, no. 6 (2019): 2017-2109, at 2055-2066 (reviewing the stated legislative and regulatory purposes).
Regulation 2016/679, of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data and Repealing Directive 95/46/EC, art. 15, 2016 O.J. (L 119): 1, 43.
16.
See, e.g., California Consumer Privacy Act, 2018 Cal. Legis. Serv. 3 (West) (“[I]t is the intent of the Legislature to further Californians’ right to privacy by giving consumers an effective way to control their personal information, by ensuring the following rights[, including] … [t]he right of Californians to access their personal information.”); id., at 3–4 (amending Part 4 of Division 3 of the Civil Code to add § 1798.100(d), which provides individuals with a right of access to their data).
17.
M.A.Rothsteinet al., “Unregulated Health Research Using Mobile Devices: Ethical Considerations and Policy Recommendations,”Journal of Law, Medicine & Ethics48, no. 1, Suppl. (2020): 196-226.
18.
45 C.F.R. § 164.524(a).
19.
45 C.F.R. § 164.501 (“Designated record set means: (1) A group of records maintained by or for a covered entity that is: (i) The medical records and billing records about individuals maintained by or for a covered health care provider; (ii) The enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or (iii) Used, in whole or in part, by or for the covered entity to make decisions about individuals.”); see also id. § 160.103 (treating genetic information as health information for purposes of the Privacy Rule); id. § 164.501 (“[T]he term record means any item, collection, or grouping of information that includes protected health information and is maintained, collected, used, or disseminated by or for a covered entity.”).
20.
Id. § 164.501.
21.
B.J.Evanset al., “Regulatory Changes Raise Troubling Questions for Genomic Testing,”Genetics in Medicine16, no. 11 (2014): 799-803, at 800.
45 C.F.R. § 164.524(a)(2), (3) (listing unreviewable and reviewable grounds for denial of access).
26.
See id. § 164.524(a)(2)(iii).
27.
Id.
28.
Id.
29.
A.Wiggins and J.Wilbanks, “The Rise of Citizen Science in Health and Biomedical Research,”American Journal of Bio-ethics19, no. 8 (2019): 3-14.
30.
J.Bobe, M.N.Meyer, and G.Church, “Privacy and Agency Are Critical to a Flourishing Biomedical Research Enterprise: Misconceptions about the Role of CLIA,”Florida Law Review Forum (2019), available at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3499923> (last visited January 22, 2020).
31.
S.R.Arnstein, “A Ladder of Citizen Participation,”Journal of the American Planning Association35, no. 4 (1969): 216-224.
S.R.Peppet, “Regulating the Internet of Things: First Steps toward Managing Discrimination, Privacy, Security, and Consent,”Texas Law Review93, no. 1 (2014): 85-179, at 145.
36.
M.A.Hall, “Property, Privacy, and the Pursuit of Interconnected Electronic Medical Records,”Iowa Law Review95 (2010): 631-663, at 646.
37.
M.A.Rodwin, “Patient Data: Property, Privacy & the Public Interest,”American Journal of Law & Medicine36 (2010): 586-618, at 588.
38.
Peppet, supra note 35, at 93.
39.
Id.
40.
Peppet, supra note 35, at 145.
41.
Id., at 129, 143.
42.
Id., at 143-44.
43.
Id., at 129.
44.
Id., at 161-162; D.Baruaet al., “Viewing and Controlling Personal Sensor Data: What Do Users Want?” in Persuasive 2013: Proceedings of the 8th International Conference on Persuasive Technology (ShlomoBerkovsky and JillFreyneeds., 2013): at 15-26.
Food and Drug Administration, Software as a Medical Device (SAMD): Clinical Evaluation,”December8, 2017, at 11, available at <https://www.fda.gov/media/100714/download> (last visited January 22, 2020).
53.
21 C.F.R. § 801.4.
54.
21 U.S.C. § 321(h).
55.
Rothstein et al., supra note 17.
56.
21 U.S.C. § 321(h).
57.
Medical Devices; Procedures for Investigational Device Exemptions, 45 Fed. Reg. at 3735. See also Rothstein et al, supra note 17.
58.
21 C.F.R. pt. 812.
59.
See Rothstein et al., supra note 17.
60.
Food and Drug Administration, Framework for Regulatory Oversight of Laboratory Developed Tests; Draft Guidance for Industry, Food and Drug Administration Staff, and Clinical Laboratories; Availability, 79 Fed. Reg. 59,776 (October 3, 2014); Food and Drug Administration, Notification and Medical Device Reporting for Laboratory Developed Tests; Draft Guidance for Industry, Food and Drug Administration Staff, and Clinical Laboratories; Availability, 79 Fed. Reg. 59,779 (October 3, 2014).
CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports; Final Rule, 79 Fed. Reg. 7290, 7293 (February 6, 2014) (codified at 42 C.F.R. pt. 493 and 45 C.F.R. pt. 164).
64.
S.F.Terry, “The Tension between Policy and Practice in Returning Research Results and Incidental Findings in Genomic Biobank Research,”Minnesota Journal of Law, Science and Technology13, no. 2 (2012): 691-736, at 708-709.
