1. mHealth in Regulated Academic Research Organizations

A recent study looked at NIH’s support for mHealth research at three time points over a 10-year timespan (2005, 2010 and 2015) and found 12-fold increase in the number of mHealth projects.³⁵ Organizations hosting these mHealth studies have been slow to respond as public facing guidelines directed to researchers are, for the most part, non-extant.³⁶ Because organizations supported by NIH to conduct health research are required to comply with federal regulations for human subjects protections (45 C.F.R. 46), these entities must utilize a process of review to ensure that research is conducted consistent with the regulations and accepted ethical principles. While behavioral mHealth research is becoming more common, there is a knowledge gap among those designing the research as well the institutional review boards (IRBs) charged with evaluating the probability and magnitude of harms to participants against possible benefits.³⁷

An example of this gap was reported in a 2015 study evaluating IRB determination letters in mHealth research that involved wearable sensors. Specifically, eight protocols were obtained that used a combination of sensors to: (1) record the participant’s first-person point of view using an outwardly facing wearable camera, (2) location via and a waist worn GPS device and, (3) movement using an accelerometer. For each protocol, the IRB determination letters were coded for patterns and themes with results revealing that risk identification and management strategies were inconsistent across the several IRBs involved.^{Reference Nebeker, Linares-Orozco and Crist38} One inconsistency was whether the IRB expanded its charge beyond human subjects to include protections of bystanders. Bystanders are people who are not research participants, yet may become part of the research record if their image or other personal information is captured by a device used by the research participant. Also noteworthy in this review was a consistent lack of concern about how GPS data would be managed. The granularity and volume of location data generated from wearing a GPS sensor can reveal sensitive and personal information about the participant. Lacking standards for storage of these data, both researchers and IRBs should be aware of the sensitivity of location data and think carefully about how to securely store these data. This is especially true when not covered by privacy protection regulations like HIPAA, for example.

Needless to say, mHealth research conducted within a regulated environment may have advantages because the infrastructure exists; however, the need for both the researchers and IRB members to become knowledgeable about the technologies being used as well as the types of data produced is critical. The example above is based on a 2013 NIH study and the use of “research” grade technologies as opposed to clinically tested and/or commercial products. As such, the researchers had full control over data collection and storage — no third party or platform was involved. Following launch of these observational studies, commercial wellness products were deployed in the marketplace (e.g., Fitbit initially and now, Apple Watch) and are now used in behavioral research. With these commercial products, the researcher lacks direct access to and control of the “research” data which, introduces new potential risks for research participant protections around data management and privacy protections. In addition, the federal regulations for human subjects protections conflict with the standard language found in the Terms of Service (ToS) agreements specific to exculpatory language (45 C.F.R. 46.116); making use of the product nearly impossible without introducing potential compliance issues for research organizations operating under the Common Rule.³⁹

When it comes to mHealth strategies, it is critical that we not assume those involved in the design or use of health technologies are well versed in the risk assessment process. The new technologies used in mHealth research are powerful and sophisticated and, in many cases the risks assessment is difficult to calculate.

2. Unregulated Citizen Science

Unregulated health research carried out by citizen scientists continues to rapidly expand. While there are various terms to describe this category of researcher such as lead innovators,^{Reference von Hippel40} quantified self,^{Reference Lupton41} bio-citizens,⁴² do it yourself,⁴³ and participant-led researchers⁴⁴ — one thing they all have in common is taking health matters into their own hands. Another commonly used term is N-of-1, which can be attributed to the labels introduced above, as well as systematic cross-over studies that are carried out by the individual or, in partnership with their physician/clinician. Those taking part in citizen science, broadly speaking, are highly motivated people who are either looking for solutions to pressing health problems or are genuinely curious about their health and factors that influence wellness.^{Reference Ajana45} Regardless of whether they are conducting self-tracking, self-experimentation or building solutions, they are doing this work without regulatory or ethical frameworks to guide practice. Well-documented harms from this type of research, for example with brain stimulation, highlight risk especially as such “do-it-yourself” efforts can be rapidly spread via social media leading to exponential risk.^{Reference Wexler and Reiner46} Initiatives to explore the related ethical dimensions and concurrent development of guidelines and/or regulatory infrastructure are emerging, but nascent. One pressing question, and the objective of the over-arching study,^{Reference Rothstein47} is whether we can build from existing structures and norms to offer guidance on responsible mHealth research practices to this group.

Because these researchers may not be affiliated with an organization that receives federal funding and, subsequently, not subject to the Common Rule or FDA regulation there is no requirement to involve an IRB prior to launching a study. Another point of consideration when evaluating whether or how to regulate people conducting self-study are the definitions used to define a human subject. The current regulation states that a human subject is a “living individual about whom an investigator (whether professional or student) conducting research…”⁴⁸ A person involved with self-tracking or self-experimentation is both the researcher and the participant, as such, the regulatory language must adapt if expanded to include those conducting this form of citizen science.

An example of a citizen science activity in the behavioral health sector can be found with a group of patients who have formed a Participant Led Research (PLR) initiative in southern California called Project Apollo. These individuals have a common frustration with the healthcare system and have experienced difficulty getting an accurate diagnosis. Few in the group have received formal research training or been exposed to what might influence its ethical conduct, yet regardless, they are embarking on a journey of becoming better informed patients. They have come together to support one another in the process of learning how to self-track and, potentially, self-experiment with an overarching goal of building their health literacy, research literacy and agency. To this end, they are learning how to review the scientific literature, form a research question and test a hypothesis. Given these are behavioral health studies, the questions focus on lifestyle and environment with hypothesis testing on topics of sleep, nutrition, pain and stress (e.g., stopping screen-time two hours prior to bedtime will improve my sleep). The majority of Apollo participants are using a commercial product called an Oura ring to monitor their sleep duration and quality along with heart rate variability, respiratory rate, body temperature and resting heart rate.

Another example is the Gut Instinct project, a PLR involving a citizen scientist recruiting other citizens to participate in research.⁴⁹ The Gut Instinct platform, developed by a doctoral student at UC San Diego, facilitates the ability for non-professional researchers to design and deploy studies. Whereas the Project Apollo PLR is a within subject, N-of-1 design, Gut Instinct studies are design by an individual who then recruits others to participate. In one case, a study was designed and implemented to answer a question about whether using less social media increased optimism; another looked at weather drinking beer in the evening helped people go to sleep.⁵⁰ The research team behind Gut Instinct has a goal of helping people to learn about themselves and solve their own problems.^{Reference Pandey51}

Since regulated researchers are, at times, involved with Apollo and Gut Instinct, they have obtained IRB approval for some of the research associated with these citizen science projects. However, in these examples, the citizen scientists are learning how to conduct a systematic investigation but, not necessarily with a goal of contributing to generalizable knowledge. They envision teaching others how to learn about their health through PLR in the form of self-tracking and self-experimentation. Using the formal definition of “research,” which is “a systematic investigation designed to contribute to generalizable knowledge” and “human subject,” defined earlier, it is unlikely activities carried out by these PLR activities would qualify as something to be regulated based on current definitions.⁵² That being the case, should there be guidelines or guardrails that support those who are embarking on PLR or otherwise conducting research that is not federally regulated? Should the research definitions be expanded, or would most agree that self-study is human nature and any regulation marathonight compromise agency? And, are trained researchers who provide support to PLR studies acting responsibly?

Bystanders

Technology-enabled studies to observe participant behaviors via wearable sensors or research on social network platforms can inadvertently capture information about people who are not research participants and who have not provided consent.⁶⁸ These data, while potentially sensitive, may not be covered by data security or privacy protection regulations. New rules and regulations to guide ethical research and protect bystanders is needed moving forward.

Return of Information

The idea of returning study information to a research participant is relatively novel but not uncommon in behavioral science research. Returning lifestyle data (e.g., sleep, steps) may be useful in conveying feedback and can be used as a motivational tool in Just in Time Adaptive Interventions to promote behavior change.^{Reference Nahum-Shani, Hekler and Spruijt-Metz69} The mechanics of returning information back to study participants can be labor intensive and, as such, feasibility in terms of staff time and additional costs is a potential barrier.^{Reference Khodyakov70} There are also ethical challenges that are important to consider, including whether the information to be returned to participants is actionable or not (e.g., early onset Alzheimer disease).^{Reference Nebeker, Leow and Moore71}

Researcher Controlled or Commercial Products

As noted, commercial products (e.g., fitness tracking devices and mood management apps, social network platforms) are increasingly being used to support behavioral research studies. When using products that do not claim to be a clinical treatment, vetting processes (e.g., FDA) to ensure products are safe and effective are not required. As such, researchers take on an additional responsibility of needing to know and understand potential risks passed onto participants. Researchers and IRBs may need to review vendor terms of service and privacy statements to identify what participant personal data is collected, used and shared. Knowing this information may influence what digital tools are used in behavioral health research — especially if the type of information collected by the commercial vendor conflicts with federal regulations for human research protections. Because terms of service are written to reduce liability to the vendor, a disclaimer that speaks to whether the “user” is able to file a claim if injured is usually inserted. Language that limits a research participant’s ability to seek damages that arise from their participation in research conflicts with the Common Rule — specifically 45 C.F.R. 46.117.⁷² Moreover, once a product is selected, it will be important to convey how the commercial entity may use the individual’s information outside of the research study for which they are being invited to participate. Guidance to help researchers decide what product may be a good fit for their research was recently published and includes five domains to consider: (1) “Participant Privacy,” (2) “Risks and Benefits,” (3) “Access and Usability,” (4) “Data Management” and, (5) Ethical Principles, which are presented as intersecting relationships.^{Reference Nebeker, Ellis and Torous73}