Genomic Data Sharing: Part II – Playing by the Rules

The discussions surrounding the Precision Medicine Initiative (PMI) have highlighted some of the policy challenges inherent in balancing the sharing of valuable research data with the protection of participants whose data is being shared. How do you ensure that researchers, and even participants themselves, have appropriate access to data while making sure that the data is not inadvertently or deliberately released or misused in a way that might present a risk to participants?

As mentioned in the last blog post: Part I – Enhancing Consent through the NIH Genomic Data Sharing Policy, the NIH is not new to this, of course, and has had success in developing policies that support the sharing of data that also harbors information about the disease status of research participants.  The NIH Genomic Data Sharing (GDS) Policy, which became effective on January 25, 2015, and its predecessor, the Policy for Sharing of Data Obtained in NIH Supported or Conducted Genome-Wide Association Studies (GWAS) have enabled the sharing of potentially sensitive genomic and phenotypic data from NIH-funded studies.  The ethical principles and privacy safeguards incorporated in the GDS Policy enable secondary use of NIH genomic data while respecting participant autonomy and protecting privacy.

These protections have been built into both the submission and access stages of the genomic data sharing process.  When investigators submit data, their institution must assure, through submission of an Institutional Certification, the appropriateness of the data submission as well as the secondary use of the data, based on the consent of the participants.  When qualified investigators seek access to the  data, they must describe how they intend to use the data through a Data Access Request (DAR) in the database of Genotypes and Phenotypes (dbGaP) and promise, through a  Data Use Certification (DUC) Agreement, to adhere to the GDS Policy’s ethical principles, terms of data access, and privacy safeguards.  Before access is granted, each request is reviewed by an NIH Data Access Committee (DAC) for consistency with the appropriate data uses, as outlines by the data submitters, and Policy expectations.

Since 2007, and under the GWAS Policy, approximately 3,700 datasets have been submitted and made available in dbGaP for secondary research, and nearly 21,000 access requests from over 3,300 investigators from 46 countries, have been approved by NIH.  Of the large number of approved requests, we can say that approved users of the data have adhered to the terms of Policy most of the time, and that only 27 violations of the Policy (out of the 21,000 approved requests) have been reported.  The figure below provides a schematic of this, as well as the general categories that these violations fall under.  Policy compliance violations, also known as data management incidents, have occurred in both the submission and access processes as well as in data security.  For example, in one case, an investigator accidentally reversed the labels for two datasets in a data submission, such that a dataset meant only for disease-specific secondary research was made available for general secondary research use and vice versa.  Fortunately, the mistake was discovered before the data were improperly used.  The datasets were then reconfigured with the appropriate use categories and made available again to the research community.  NIH has also made a similar mistake in handling the data once it was received.

In all Policy compliance violation cases, NIH has worked cooperatively with the violator to remedy the situation.  Most importantly, however, and to the best of our knowledge, none of the 27 Policy compliance violations have resulted in harm to the research participants from which the data were generated.  Additional information on Policy compliance violations and specific cases, as well as other statistics on data submission, access, and use, are available on the Facts & Figures section of the GDS Policy website.

In order to advance our understanding of how the myriad of genetic, environmental, and behavioral factors interact to play a role in human health and disease, we must continue to enable the responsible sharing of genomic and associated data broadly within biomedical research community, while at the same time respecting the wishes of study participants.    NIH’s policies for sharing of genomic data have led the way and set a precedent for culture changes in sharing all types of data, including sharing of data though groundbreaking initiatives such as PMI.

For more information on the GDS Policy please visit the GDS website.

Genomic Data Sharing: A Two-Part Series

NIH is committed to both the responsible stewardship of participants’ biospecimens and data.  Meeting our commitments protects the interests of research participants and ensures public trust in the biomedical research enterprise.  For biomedical research in general, policies and practices must strike a careful balance between the benefits of research and any potential risks to the study participants.  This balance will be covered in two separate blog posts about genomic data sharing:  Part I addresses promoting participant trust and permission for research and Part II, next week, will delve into the responsible sharing of genomic data for research.

Part I

Enhancing Consent and Participant Trust through the NIH Genomic Data Sharing Policy

One way to promote trust is to ensure that participants’ biospecimens, tissues and cells, and the information derived from them, are used in research only with their permission (consent).  Efforts to modernize federal regulations (i.e., the Advanced Notice of Proposed Rule Making to update the Common Rule) are focusing on the need to enhance research protections and reduce regulatory burden.  Some of the proposed reforms apply to research using specimens and data and include important changes to informed consent requirements.  NIH supports these reforms because seeking consent is respectful to participants and facilitates sharing of biospecimens and data in order to maximize the public benefits of research.

In fact, NIH is taking steps at a policy level to enhance consent in the context of NIH-funded large-scale genomic research.  In August 2014, NIH issued its Genomic Data Sharing (GDS) Policy, which outlines expectations for obtaining participant consent.   According to the GDS Policy, investigators who intend to generate large-scale genomic and phenotypic data from new collections of biospecimens and/or cell lines may only do so with the consent of the participants who provided those biospecimens and/or cell lines, even if the data generated are de-identified.  Further, NIH strongly encourages investigators who seek consent for research participation to also request consent for future research use and broad sharing of genomic and phenotypic data generated from the biospecimens or cell lines.

Last month, NIH released NIH Guidance on Consent for Future Research Use and Broad Sharing of Human Genomic and Phenotypic Data Subject to the NIH Genomic Data Sharing Policy, to provide guidance on consent expectations and information that can be tailored to individual studies and conveyed to prospective participants during the consenting process.  NIH has also posted a series of Frequently Asked Questions on consent for broad sharing (see Section H).

Why is NIH taking this approach to consent for sharing of human genomic data? First, studies of research participants’ preferences have taught us that participants expect to be asked for permission to use and share their de-identified specimens for research, and it is understandable why people might want to have some say in the use of their biospecimens. To preserve and even bolster public trust in research, it is critically important for the research enterprise to begin to respect the wishes of participants in this way.  Moreover, as has been well-documented, the risk of re-identification of genomic data is no longer a theoretical possibility.  As such, it is no longer tenable for us to hold that anonymization is still achievable or to allow the use of “de-identified” biospecimens without consent on the premise that such use is without some risk to the donor.  The evolution of genomic technology and analytical methods require us to acknowledge the risk of re-identification.

We believe that NIH’s expectation for consent under the GDS Policy is a step in the direction of continuing to earn the trust and respect of research participants.

For more information on the GDS Policy please visit the GDS website.

Stayed tuned for Part II – Genomic Data Sharing – Playing by the Rules to learn more about responsible sharing of data from NIH-funded genomic research.

Let’s Talk About DURC: A Workshop Invitation

It is almost universally acknowledged that life science research is fundamentally important and is the basis for advances in medicine, agriculture, environmental quality and a strong national economy.  However, over the past several years, the U.S. Government has recognized that some information generated by important life science research could be misused by those with the intent of harming public health or other aspects of national security.  This is the dual use dilemma: good science could be put to bad uses.

The NIH Office of Science Policy, in association with its Federal partners, has been actively involved in the discussion of how to best address research with this potential, known as ‘Dual Use Research of Concern, or (DURC).  In recent years, the U.S. Government has issued two policies on the oversight of DURC, both with the goal of preserving the benefits of important life sciences research while minimizing the risk that such research could be misused to cause harm.  The first Policy was issued in March 2012 and required Federal departments and agencies to review their life science research portfolios to determine if any research projects had potential DURC implications.

The second U.S. Policy, United States Government Policy for Institutional Oversight of Life Sciences DURC, was issued in September 2014.  The institutional policy outlines the procedures for the oversight of DURC at the local level and describes the responsibilities of Principal Investigators and research institutions.  The institutional policy must be implemented by institutions subject to its scope by September 24, 2015.

In advance of the implementation date, the White House Office of Science and Technology Policy and the National Institutes of Health are co-hosting a public workshop to discuss and solicit feedback from the community on the implementation of the institutional policy.  The workshop will take place at the NIH on July 22, 2015, and will include a series of panels where institutional representatives will share their experiences, challenges, and innovative practices in identifying research which is subject to the policy, developing risk mitigation plans, and raising awareness and educating about DURC.  The event will also feature an interactive case study that will highlight issues that investigators and institutions need to consider when determining whether research is subject to the policy.  This is a unique opportunity for the research community to provide feedback on the policy, and I hope stakeholders will take advantage of it and will come to share their thoughts.

I hope to see you on the 22nd!  In the meantime, you can contact staff in the NIH Office of Science Policy with questions about DURC by emailing [email protected].

In the OSP Kitchen – Single IRB for Multisite Research Policy

We’re all familiar with the analogy that policy development is akin to sausage making:  you don’t want to see how it’s made.  NIH takes a somewhat different approach in that we not only hope stakeholders will join us in the kitchen as policies are developed; we also seek out your suggestions for improving the recipe.

In Dec 2014, NIH posted the draft “Policy on the Use of Single Institutional Review Board (IRB) for Multisite Research” for public comment.  (You may recall Dr. Sally Rockey’s RockTalk post discussing the draft policy.) As a result, OSP received, reviewed, and analyzed 167 comments submitted by individuals, entities affiliated with academic institutions, patient advocacy groups, IRBs, private healthcare and research organizations, tribal nations, and the general public.  Public Comments on the Single IRB Policy are available on the OSP website.

While the vast majority of comments (~70%) support the use of a single IRB for multi-site research studies, commenters across all demographics also provided very thoughtful recommendations, questions, and concerns. These comments were broad in scope and expressed differing, often conflicting, opinions for NIH to consider.  Going back to the sausage-making analogy, if one commenter suggests that you double the amount of cayenne pepper and another one calls for it to be eliminated, you obviously can’t follow both suggestions but it’s clear that the “cayenne pepper issue” may warrant further discussion.

One such issue made clear by the comments received is the strikingly dissimilar understanding of the roles and responsibilities of the site or institution conducting human subjects’ research and the responsibilities of the reviewing IRB with regard to the protection of human subjects.  It’s important to keep in mind that through this draft Policy, NIH doesn’t suggest that the primary responsibility for the protection of human subjects may be relinquished by the local investigator or institution; rather, the policy attempts to streamline one component of human research protections, the IRB regulatory review.

While the regulations (at 45 CFR part 46.114 and 21 CFR part 46.114, for those policy wonks following along at home) have always allowed for reliance on an external IRB for multi-site research, recent support from the Office of Human Research Protections (OHRP) (2010 letter) and FDA (2006 guidance) have helped to reduce the fear of regulatory liability when relying on a single IRB.

Several groups including the National Cancer Institute Central IRB (CIRB), Clinical & Translational Science Awards (CTSA) program, and NeuroNext have laid a strong foundation and continue to develop an infrastructure that reduces redundancy and inefficiency in IRB review and approval of multisite research with the goal of bringing promising new treatments to patients more quickly. We look to build on this foundation and the lesson learned in order to address issues of trust and communication between sites/institutions and single IRBs that may be external to their organization.

Cognizant of the diversity of public opinion and logistical challenges involved in operationalizing the draft Policy, we are using the public comments to identify issues that may warrant additional guidance during a transition period after the Policy is effective prior to the required date of full compliance.

Thank you to all who shared your thoughts and perspective through the Public Comment process.  Your input is invaluable as NIH moves forward with this important policy – stay tuned as we continue to tweak the recipe…