Sharing Data Under the 21St Century Cures Act
Total Page:16
File Type:pdf, Size:1020Kb
© American College of Medical Genetics and Genomics REVIEW Sharing data under the 21st Century Cures Act Mary A. Majumder, JD, PhD1, Christi J. Guerrini, JD, MPH1, Juli M. Bollinger, MS1, Robert Cook-Deegan, MD2 and Amy L. McGuire, JD, PhD1 On 13 December 2016, President Obama signed the 21st Century “identifiable, sensitive” information and strengthens the associated Cures Act (“the Act”) into law. Many of its provisions support protections. At the same time, the Act exacerbates or neglects the creation of an “Information Commons,” an ecosystem of several challenges, for example, increasing complexity by adding a separate but interconnected initiatives that facilitate open and new definition of “identifiable” and failing to address the financial responsible sharing of genomic and other data for research and sustainability of data sharing and the scope of commercialization. clinical purposes. For example, the Act supports the National In sum, the Act is a positive step, yet there is still much work to be Institutes of Health in mandating data sharing, provides funding done before the goals of broad data sharing and utilization can be and guidance for the large national cohort program now known achieved. as All of Us, expresses congressional support for a global pediatric study network, and strengthens patient access to health Genet Med advance online publication 25 May 2017 information. The Act also addresses potential barriers to data sharing. For example, it makes the issuance of certificates of Key Words: 21st Century Cures Act; certificates of confidentiality automatic for federally funded research involving confidentiality; data sharing; HIPAA; privacy INTRODUCTION (see Table 1). The Act is a positive step toward the creation of On 13 December 2016, President Obama signed the 21st an Information Commons, yet there is still much work to be Century Cures Act (“the Act”) into law.1 As the title of the Act done before the goals of broad data sharing and utilization suggests, its overarching goal is to accelerate development of can be achieved. treatments through investment and changes to the policy environment surrounding discovery, drug and device CREATING AN INFORMATION COMMONS development, and health-care delivery. The omnibus 996- Four features of the Act are particularly notable for their page law works to achieve these goals through numerous, potential to enhance the Information Commons: (i) support- diverse provisions. ing the National Institutes of Health (NIH) in mandating data Many of those provisions are directed at promoting data sharing, (ii) promoting the assembly of a representative sharing and, in our view, support the creation of an national cohort in the United States (the All of Us research “Information Commons,” which the National Research program), (iii) encouraging global data sharing through a Council recognized as critical to improving the health of pediatric clinical study network, and (iv) strengthening individuals and communities.2 The Information Commons patient access to information. can be understood as a robust ecosystem of separate but interconnected initiatives that facilitate open and responsible Pushing for open and responsible data sharing sharing of genomic and other data for use in research and First, Section 2014 of the Act authorizes the NIH Director to clinical practice. The American College of Medical Genetics require award recipients to share data in a manner consistent and Genomics recently affirmed the value of sharing data for with applicable federal laws and regulations. The NIH has both these uses.3 already adopted policies mandating data sharing, for example, We analyze the Act through the lens of its impact on data through its Genomic Data Sharing Policy.4 Thus, the Act is an sharing and the creation of an Information Commons. While endorsement of existing NIH policies and a statutory basis for our assessments of the Act’s data-sharing provisions are expanding their scope. It is also a basis for stepped-up generally positive, the legislation exacerbates some existing enforcement of these policies. However, it does not address concerns and leaves several challenges unresolved, raising difficult questions about funding. In an environment in which important questions related to, among other things, commer- investigators are frequently asked to slash budgets, data- cialization and the identifiability of research participants sharing mandates that impose additional costs (e.g., for 1Center for Medical Ethics and Health Policy, Baylor College of Medicine, Houston, Texas, USA; 2School for the Future of Innovation in Society, Arizona State University, and FasterCures, a Center of the Milken Institute, Washington, DC, USA. Correspondence: Mary A. Majumder ([email protected]) The last two authors contributed equally to this work. Submitted 8 January 2017; accepted 3 April 2017; advance online publication 25 May 2017. doi:10.1038/gim.2017.59 GENETICS in MEDICINE | Volume 19 | Number 12 | December 2017 1289 REVIEW MAJUMDER et al | 21st Century Cures Act Table 1 21st Century Cures Act provisions relevant to data sharing Topic What the Act does Potential impact on data sharing Complications Large-scale NIH Authorizes up to a total of $4.8 billion Supports rapid advance of cohort study Funding remains contingent on annual research initiatives for these initiatives (§ 1001) and formation and growth of brain- and appropriations by Congress cancer-focused data commons PMI cohort study (All Imposes high-level requirements related Possible source of innovative policies Requirements may not be effectively of Us) to privacy and security protection, and practices in these areas and model operationalized ensuring diversity, securing trust for other initiatives (via access policies), and transparency (§ 2011) Research subject Expands reach and strengthens Reduces risks to research participants Potential to reinforce siloing of research privacy protections under certificates of related to disclosure of information and clinical care; increased complexity due confidentiality (§ 2012); authorizes FOIA collected or compiled in the course of to adoption of identifiability definition exemption for biomedical information; research that differs from other regulatory low threshold for determination that definitions information is identifiable, triggering protections (§ 2013) NIH promotion of Authorizes NIH Director to require award Endorsement of existing NIH policies Balancing commitment to data sharing data sharing recipients to share data in a manner mandating data sharing and basis with protection of trade secrets and consistent with applicable laws and for expansion and for stepped-up commercial information; does not address regulations (§ 2014) enforcement financial sustainability issue HIPAA clarifications Directs Secretary to issue clarifying Reduces burden on researchers Defers consideration of important and revisions guidance on remote access for reviews conducting preparatory reviews and questions related to health data–based preparatory to research and likely to advance broad consent research and markets in health data authorizations for future research paradigm, which should facilitate (e.g., whether to permit sale of PHI to use/disclosure of PHI; sends data sharing researchers without patient authorization) controversies to working group (§ 2063) Global pediatric Supports NIH participation in formation Confirms Congressional receptivity to Leaders need to be aware of and address clinical study and operation of global pediatric clinical global data-sharing trend, which has potential public resistance to global network study network (§ 2072) many benefits sharing Patient access to Builds on existing patient access right Should increase patient use of Need investment in infrastructure if direct electronic health under HIPAA, promoting awareness and access right to contribute directly to contributions are to grow in line with information attention to barriers (§§ 4006–4008) commons proponents’ hopes; may exacerbate diversity problem FOIA, Freedom of Information Act; HIPAA, Health Insurance Portability and Accountability Act; NIH, National Institutes of Health; PHI, protected health information; PMI, Precision Medicine Initiative. preparation and transmission of data, and participant room for a free market to develop around commercially recontact in cases where it is unclear that consent extends protected data. to broad data sharing) may not be financially sustainable. The Act does speak to the tension between data sharing and Launching a diverse, trustworthy, transparent national trade secrecy, although perhaps not with the degree of nuance cohort program that those who study these issues might wish to see. This Section 1001 of the Act authorizes up to $4.8 million in tension has become more salient in recent years as a result of funding over 10 years for three NIH research initiatives that two trends: the growing importance of large data sets and aim to build large data sets of health information: the related interpretive algorithms to research and innovation, Precision Medicine Initiative, including its All of Us program; and patent law developments that have increased incentives to Brain Research through Advancing Innovative Neurotechnol- protect that information as trade secrets.5–9 The Act seems to ogies; and the Beau Biden Cancer Moonshot. The All of Us affirm that proprietary interests trump data-sharing interests program in particular aims to enroll at least 1 million US through its recognition