One thing’s certain – the vast and growing supply of data contained in electronic medical records systems will play a significant role in improving the speed and efficiency of research into new treatments in the years to come.  The challenge will be striking an appropriate balance between the unquestionable promise of this data to enable research – research that will enhance available treatments and save lives – with the rights of individual patients in the privacy of their health information.  Attempts to strike that balance are at the heart of current legislative, regulatory and policy initiatives that will shape the manner and extent to which this valuable resource will be used in the future.

Included in the 21^st Century Cures legislation that passed the House on Friday, July 10, 2015 are changes to HIPAA intended to expand access to patient health records for research purposes.  Specifically, subject to certain requirements, the changes permit use and disclosure of PHI by covered entities for research purposes and remove the prohibition on remote access by a researcher to PHI. In addition, the long-anticipated proposed revisions to the Common Rule, pending with OMB, are expected to significantly alter the consent and IRB review requirements for many research activities, particularly for EMR-based research. For instance, the Advance Notice of Proposed Rulemaking sought comments on proposals to increase data privacy and security requirements for research data, while at the same time reducing informed consent requirements and IRB oversight of research using existing data or biospecimens.

The latest piece of the puzzle came in the form Proposed Privacy and Trust Principles for the Precision Medicine Initiative released by the White House on Thursday, July 8, 2015.  The Precision Medicine Initiative, first introduced in President Obama’s State of the Union Address and supported by $215 million in funding to NIH, NCI, FDA and ONC, aims to establish a voluntary national research cohort made up of at least one million individuals who agree to contribute data from a range of sources, which may include access to medical records, analysis of biospecimens, environmental and lifestyle data, patient-generated information, and personal device and sensor data.  This data will be aggregated and made available to qualified researchers, including those from academic, non-profit and for-profit entities.

The proposed privacy and trust principles provide broad guidance regarding the operation of the research cohort, including its “governance; transparency; reciprocity; respect for participant preferences; data sharing, access, and use; data quality and integrity; and security.” Established by an ‘interagency working group’ convened by the White House, the principles are intended to build privacy into the cohort and ensure confidentiality of patient health information.

Certain of the proposed principles will impact the accessibility and utility of the data to interested researchers, including those in the pharmaceutical and medical device industries, and the details of the further development and implementation of these broad principles will be of critical importance to those who hope to use the cohort data in their future research. For example, the requirement that all data users must publish or post their summary research findings publically as a condition for use of data within the cohort may present challenges for many users. The nature of the findings that would be subject to that public disclosure requirement, and precisely how and when those findings must be disclosed, will impact whether industry, in particular, will be willing and able to leverage this valuable resource while maintaining necessary protections for proprietary information. Additionally, as the data are intended for use not only for hypothesis-driven research, but for hypothesis-generating and feasibility assessments as well, the nature of the findings that must be disclosed will need to be carefully considered to avoid imposing an undue burden by requiring publication of data with limited scientific value, and to avoid the potential disclosure of commercially sensitive information on the early research strategy or direction being contemplated by a researcher; this may limit the extent to which researchers are willing to utilize the data to its full potential.

Similarly, the manner in which certain principles are operationalized will determine how burdensome the use of cohort data will become. Specifically, the proposed principles contemplate a multi-layer consent model for participants in the cohort.  The working group determined that the duration and potential breadth of the research activities contemplated would render a single contact consent at the time of participant enrollment insufficient.  Instead, an ongoing, dynamic consent process has been proposed. As those involved in research know, the development, IRB review and approval, and administration of the informed consent process is burdensome, and the ability to forgo this consent for certain types of non-interventional records research would have a significant impact on reducing the cost and time required to conduct research using cohort data.  The extent to which the implementation of the consent process includes emerging practices for obtaining informed consent through remote, electronic means will impact the magnitude of this potential burden.

The White House is seeking public feedback on these privacy and trust principles online through August 7, 2015. Companies intending to use and participate in the cohort should carefully review these principles and provide feedback at www.whitehouse.gov/precision-medicine.

 This post was written with assistance from Thejasree Kayam, a 2015 Summer Associate at Epstein Becker Green.