Policies of the National Institutes of Health (NIH) increasingly have required federal grantees to share data broadly. 1 The latest and most comprehensive policy was published in the Federal Register on October 30, 2020, with an effective date of January 25, 2023. 2 The Final NIH Policy for Data Management and Sharing was designed to promote the management and sharing of scientific data generated from NIH-funded or conducted research, subject to certain limitations or exceptions. “Data sharing enables researchers to rigorously test the validity of research findings, strengthen analyses through combined datasets, reuse hard-to-generate data, and explore new frontiers of discovery.” 3
Researchers planning to generate scientific data 4 will be required to submit a data management 5 and data sharing 6 plan 7 to the funding NIH institute, center, or office as part of the budget justification section of their grant application. The plan should explain how data will be managed and what data will be shared. The actual plan submitted to the NIH is limited to two pages.
Although there is no requirement that all data be shared by all researchers in all circumstances, data sharing is urged. “NIH expects that in drafting Plans, researchers will maximize the appropriate sharing of scientific data, acknowledging certain factors (i.e., legal, ethical, or technical) that may affect the extent to which scientific data are preserved and shared.” 8 NIH also “strongly encourages” the use of established data repositories to the extent possible for preserving and sharing scientific data, and data should be available for as long as the researchers anticipate it will be useful to the research community, institutions, or the public.
For many researchers and their potential research participants, changes in data management and sharing promoted by the new NIH policy will alter traditional arrangements of the parties regarding possible secondary research using data acquired by or derived from the study. These new expectations regarding access to data are likely to affect disclosures in informed consent documents. “NIH strongly encourages researchers to plan for how data management and sharing will be addressed in the informed consent process, including communicating with prospective participants how their scientific data will be used and shared.” 9 This article considers some of the fundamental assumptions and applications of informed consent implicated by this new policy.
Controls on Data Sharing
The NIH Data Sharing Policy leaves many questions unanswered, including whether the data will be open access or accessible only by credentialed researchers. In its Supplemental Information accompanying the Data Sharing Policy, NIH strongly suggested that data need not be open access. Thus, in describing the characteristics of repositories for storing human data, NIH emphasized the importance of fidelity to consent and documented procedures to communicate and enforce data use agreements. 10 Furthermore, another important characteristic of a data repository is that it “[m]akes use of an established and transparent process for reviewing data access requests.” 11 The Secretary’s Advisory Committee on Human Research Protections (SACHRP) recommended that “NIH consider requiring data requesters to agree to terms and conditions under which the requester must protect data privacy, refrain from attempting to identify individual participants, and not share the data with individuals outside of those who are listed in the data access request.” 12 A requirement of data use agreements, however, is not in the NIH Data Sharing Policy.
NIH is expected to issue additional guidance documents, which will clarify the important relationship with consent provisions of the Common Rule, including the new broad consent provision.Reference See, Wolf and Barnes 13 Other controls on the secondary use of scientific data, such as tiered consent,Reference Ram 14 registered access,Reference Dyke 15 and dynamic consent,Reference Prictor, Teare and Kaye 16 also emphasize the importance of informed consent to discern and respect the choices of participants for sharing their data. In many respects, informed consent is the first step in data management and sharing.
Some Specific Concerns
Although there is a robust literature questioning the effectiveness of informed consent,Reference Dickert 17 it remains the ethical touchstone for research with human participants.Reference Kass, Murray and Mehlman 18 Thus, any changes in the elements or applications of informed consent will have widespread ramifications. Four of the most challenging — and sometimes overlooked — implications are deidentified data, Big Data, unregulated research, and consent bias.
Although there is a robust literature questioning the effectiveness of informed consent, it remains the ethical touchstone for research with human participants. Thus, any changes in the elements or applications of informed consent will have widespread ramifications. Four of the most challenging — and sometimes overlooked — implications are deidentified data, Big Data, unregulated research, and consent bias.
Deidentified Data
Identifiability plays an important part in the regulation of research under the Common Rule, no doubt reflecting the view that there is little risk to data sources if their data are not identifiable. Based on this principle, if researchers deidentify primary research data or clinical data, then secondary research can proceed without regulation under the Common Rule 19 or the HIPAA Privacy Rule. 20
During the protracted rulemaking for the Common Rule revisions that took effect in 2018, several fundamental provisions of the Common Rule were reassessed, including the limited applicability of federal research regulations to: (1) research funded by a Common Rule signatory department or agency or research intended to support an application to the FDA for approval of a drug or medical device; 21 and (2) individually identifiable data or specimens. Ultimately, both controversial yet fundamental principles limiting the applicability of the federal research regulations were retained.
The new NIH Data Sharing Policy does not extend regulatory coverage to deidentified data, but it raises the issue of whether researchers should nonetheless consider providing some level of protection to deidentified data for use in secondary research. “Researchers should consider whether access to scientific data derived from humans, even if de-identified and lacking explicit limitations on subsequent use, should be controlled.” 22
There are several concerns in the use of deidentified data, especially because such research can be conducted without any notice to or consent from the data source.Reference Rothstein 23 First, a frequently mentioned concern, but perhaps not the most important one, is that deidentified data could be reidentified, especially individual DNA analyses.Reference Malin and Sweeney 24 Nevertheless, it is not clear how many people would have the technical ability and motivation to engage in such conduct.Reference El Emam 25 Second, deidentification does not eliminate the risk of group harms. A well-known example involves the Havasupai Tribe in Arizona, where all tribe members and not just research participants suffered from unauthorized research on schizophrenia, inbreeding, and ancestral migration.Reference Drabiak-Syed 26 Third, deidentification does not protect against research that individuals view as objectionable, such as research on psychiatric conditions, gene therapy, or fetal development.Reference Hull 27 Fourth, many individuals are concerned if their data or specimens, regardless of identifiability, are used for a commercial purpose without prior disclosure.Reference Andrews 28 Fifth, deidentified research conducted without consent can lead to a loss of trust in health research and health care generally,Reference Burger 29 and loss of trust is a particular concern in minority communities.Reference Bussey-Jones 30
The wide range of risks associated with research using deidentified data raise the issue of whether the NIH exhortation in the Policy for Data Management and Sharing that researchers “should consider” limitations on access to deidentified data will result in voluntary disclosure controls imposed by researchers.
Big Data
Big Data may be defined as “a large collection of disparate data sets that, taken together, can be analyzed to find unusual trends.”Reference Halamka 31 An assumption of Big Data analytics is that it is not known what individual or combination of data will be valuable, so the default rule is to collect all possibly relevant data.
Perhaps the best example of Big Data health research is the NIH All of Us Research Program, which is enrolling at least one million individuals in the United States. 32 In addition to whole genome sequencing, All of Us participants are asked to share data from (1) health surveys (sociodemographic, lifestyle, and substance use); (2) physical measurements (blood pressure, heart rate, weight, height, and body-mass index); (3) biospecimens (blood and urine); (4) electronic health records (including medications, laboratory results, vital signs, and billing codes); (5) digital health (from Fitbit and other wearables); and (6) geospatial and environmental data (including weather, air pollution, and sensor readings). 33
Even such a comprehensive list does not include all the data of possible relevance to health research. Thus, Big Data health research (and possible future clinical applications) also could include one or more of the following sources: (1) vital statistics of family members; (2) military service records; (3) employment records; (3) financial and consumer information; (4) educational records; (5) travel information and geo-location data; (6) social media postings; and (7) government records.Reference Rothstein 34
Secondary researchers might combine identifiable research information shared by repositories with other accessible data, resulting in a highly detailed compilation of data about the individual. Thereafter, algorithms developed by researchers could analyze the data to discover unexpected associations. To prevent such unauthorized compilation and aggregation, informed consent in the age of Big Data and data sharing should expressly disclose the possibility of further data compilations and analyses.
Unregulated Research
An emerging and contentious issue involves the types of researchers who should be permitted to access health data for secondary research. On the one hand, some researchers and institutions might assert that only responsible, credentialed researchers subject to federal research regulations ought to have access to individually identifiable health records. On the other hand, some researchers and patient advocates might assert that health data derived from publicly funded research ought to be widely available to maximize the likelihood of scientific discovery. In considering these positions it is important to distinguish regulated from unregulated research.
Unregulated research may be defined as research not subject to the Common RuleReference Rothstein 35 or FDA research regulations. 36 Although a few states have their own research laws,Reference Tovino 37 almost all of them have limited applicability and utility, and therefore regulation of health research is overwhelmingly a federal government responsibility. The category of unregulated researchers is diverse and includes research by commercial entities (e.g., employers conducting health research with their employees), independent or self-funded researchers, citizen scientists, patient-directed researchers, do-it-yourself (DIY) researchers, and self-experimenters. 38 Unregulated research is believed to be growing because many individuals and disease-specific organizations regard traditional research as slow, expensive, unresponsive, and dominated by biotech and pharmaceutical companies; social media, crowdsourcing and online communities facilitate new collaborations; and direct-to-consumer genetic testing, open-source data, and widely available smartphone applications for capturing biometric and other health information can generate a vast trove of data for analysis. 39 Unregulated researchers could gain access to research repositories in one of the following ways: (1) if NIH regulations require open access to data from NIH-funded research; (2) if additional research repositories are established on open access principles; or (3) if more lenient access rules are developed by primary researchers or their institutions. Assuming that access to individual health data is not restricted to researchers subject to federal research regulations, this information should be disclosed to potential research participants in the informed consent process. For example, a typical disclosure statement might read: “Your data will be available to other investigators, including those who are not subject to the federal research regulations.” If unregulated researchers will have access to their data, potential participants might prefer limitations on the types of research conducted (e.g., through tiered consent), but it might be difficult to enforce any restrictions against unregulated researchers. 40
Consent Bias
If researchers add disclosures about deidentified information, Big Data, and, possibly, even unregulated research, the length and complexity of the informed consent process will increase. It is foreseeable that some researchers will assert that the additional disclosures will cause potential research participants to suffer from information overload and comprehension will decrease, the percentage of potential participants who decline to participate will increase, and studies will be less accurate due to consent bias.
Consent bias is a type of selection bias that occurs when those who consent to participate in research differ in important ways from those who decline to participate.Reference Rothstein and Shoben 41 The concept of consent bias, however, is widely misunderstood. Consent bias only occurs when those who consent for research and those who decline differ along a dimension measured by or affecting a particular research study. Consent bias is not the same as unrepresentativeness of the participants or their data. There are many legal, ethical, and policy reasons, including NIH funding requirements, why research participants should be representative of the population. But consent bias would arise only if the opinions or health characteristics of those who declined to participate in research differed from those who agreed to participate in ways measured by the research. Even then, researchers could use a variety of standard statistical methods, such as inverse probability weighting, to reduce the effects of any residual selection bias. 42 Therefore, any additional provisions in a consent document to satisfy new data sharing disclosure requirements are highly unlikely to bias well-designed, administered, and analyzed studies.
The Evolving Role of Informed Consent
Informed consent for research was developed in the mid-twentieth century to protect the autonomy and dignity interests of research participants whose consent was lacking or obtained through coercion or deceit. Such practices exposed many vulnerable individuals to risks that were mostly physical. At the time, research was typically small-scale, location-specific, and under the direction of physician-investigators. Most of the studies were interventional, including clinical trials of new treatment methods and new drugs. The relative simplicity of research allowed potential research participants to understand, in at least general terms, the research plan and the potential risks and benefits. Thus, they were able to decide whether to give or refuse permission to participate.
Today’s biomedical research is often quite different, and its scale can involve many thousands of participants at numerous sites. In addition to interventional research, research is increasingly informational, with researchers aided by modern computational methods analyzing millions of data points related to participants’ health status as well as sociodemographic, environmental, and behavioral measures. The risks to individual participants today are often dignitary in nature, involving the personal, relational, and economic consequences of researchers generating and disclosing sensitive information.
The new characteristics of research have led some experts on research ethics to regard informed consent as anachronistic for twenty-first century, informational research.Reference Rothstein 43 Measures that previously were sufficient to protect the interests of research participants are now ineffectual. For example, removing individuals’ names from medical records or coding them is insufficient to protect privacy when the research involves genomic data and is subject to sophisticated computer attacks. 44 Research participants also may be asked to consent to unspecified future research, either by primary enrollment in a research repository or through secondary research. Critics assert that one-time consent, even when modified by participant-designated limitations or external oversight, is problematic for data-based research.
Although informed consent can certainly be improved, it is much too important to discard even for informational research. Informed consent should not be considered too narrowly, or its success judged on how much information is retained by research participants. Focusing only on getting consent from potential participants, fails to capture the essential symbolic and interpersonal dimension of informed consent. Especially now that it is increasingly difficult or impossible to provide potential participants with detailed information about possible future research uses of their data, the process of asking for consent takes on greater significance.Reference Eyal 45 This may be especially important for research with participants who are members of racial or ethnic minorities with a history of mistreatment in research or persistent health inequity.
Asking for consent by an investigator demonstrates respect for the autonomy and dignity of the potential research participant, serves to build trust, and is a symbolic expression of the moral equivalence of the researcher and research participant in an otherwise asymmetrical relationship. In the context of modern data management and sharing, informed consent should do more than add some new disclosures by also emphasizing the asking for consent by researchers. Regardless of the specifics recalled by participants, informed consent will be viewed as a success if participants are assured of the trustworthiness of the researchers and the researchers commit to protecting the participants’ privacy and other important interests.
Conclusion
The NIH Policy for Data Management and Sharing is intended to be flexible so that researchers can design policies depending on the type of research, data generated, legal and ethical limitations, concerns and preferences of research participants, and interests of other researchers and the public. The flexible sharing admonition of the NIH will require thoughtful consideration by researchers, institutional review boards, research administrators, and data repositories in balancing these multiple interests to develop responsible data management and sharing practices and policies. NIH should supplement its Data Sharing Policy with guidance documents, use case descriptions, best practices, and sample documents to serve as guardrails for the increasingly broad range of researchers. Informed consent documents and processes will be important in explaining the data sharing plans, limitations, and procedures to potential participants.
Informed consent disclosures about deidentified data and Big Data will have increased significance. Although the NIH Policy does not apply to unregulated research, public and private stakeholders should consider a range of measures to facilitate ethical conduct of research and data utilization. 46 Concerns about possible consent bias attributable to data sharing disclosures should not be a major concern. Finally, explaining informed consent procedures and documents should not be viewed as ministerial tasks assigned to lower-ranking members of the research team, but as important steps in the essential relationship and trust building of the research enterprise.
This article is an expanded and annotated version of the author’s remarks at a conference of the National Academies of Sciences, Engineering, and Medicine on April 29, 2021.
Note
The author has no conflicts of interest to disclose.
Acknowledgment
The author is indebted to Kyle Brothers and Geoffrey Lomax for their valuable suggestions.
