003 MCGEVERAN FATEHI MCGARRAUGH_PROOF -SK.DOCX (DO NOT DELETE) 7/5/2012 1:08 PM Deidentification and Reidentification in Returning Individual Findings from Biobank and Secondary Research: Regulatory Challenges and Models for Management William McGeveran, Leili Fatehi, & Pari McGarraugh* I. Introduction ........................................................................... 486 II. Current Regulatory Requirements for Biobank Research Under the Common Rule and HIPAA ........... 488 A. Regulatory Requirements Under the Common Rule .......................................................................... 490 B. Regulatory Requirements Under HIPAA ................. 497 III. Regulatory Requirements Under the Proposed Amendments to the Common Rule ................................ 504 A. Harmonization Between the Common Rule and HIPAA ...................................................................... 505 B. Shift from “Exempt” Categories of Research to “Excused” Categories of Research ........................... 506 C. Informed Consent and IRB Registration .................. 509 D. Summary: The Potential Impact of the ANPRM ...... 511 IV. The Mutual and Concurrent Challenges of Returning Individual Findings from Biobank and Secondary © 2012 William McGeveran, Leili Fatehi, & Pari McGarraugh * William McGeveran, J.D., Associate Professor, University of Minnesota Law School; Leili Fatehi, J.D., Visiting Scholar, Hubert H. Humphrey School of Public Affairs, University of Minnesota and Adjunct Associate Professor of Law, University of Minnesota Law School; Pari McGarraugh, J.D./M.P.H. Candidate 2013, University of Minnesota Law School and School of Public Health. Preparation of this article was supported by the National Institutes of Health (NIH), National Human Genome Research Institute (NHGRI) grant #2-R01-HG003178 on “Managing Incidental Findings and Research Results in Genomic Biobanks & Archives” (Wolf, PI; Kahn, Lawrenz, Van Ness, Co-Is). The contents of this article are solely the responsibility of the author(s) and do not necessarily represent the views of NIH or NHGRI. 485 003 MCGEVERAN FATEHI MCGARRAUGH_PROOF -SK.DOCX (DO NOT DELETE) 7/5/2012 1:08 PM 486 MINN. J. L. SCI. & TECH. [Vol. 13.2 Research Under Current and Proposed Regulations .... 513 A. The Emerging Disparity in Thinking About Return of Results ..................................................... 514 B. Practical Challenges .................................................. 519 V. Management Models for Reidentification and Returning Individual Findings ........................................................ 524 A. Actors in the Biobank System Must Plan for Reidentification and Return of Results................... 525 B. The Common Rule and HIPAA Privacy Rule Should Address Reidentification for Return of Results ...................................................................... 529 C. Three Management Models for Return of Results Within Biobank Structures ..................................... 531 1. The Collection Site ............................................... 531 2. The Biobank ......................................................... 533 3. A Trusted Intermediary ....................................... 535 Conclusion ................................................................................. 539 I. INTRODUCTION The consensus paper that anchors this Symposium breaks new ground contemplating the practicalities of returning incidental findings (IFs) and other individual research results (IRRs) to the contributors of specimens or DNA data stored in biobanks and used for genetic and genomic research.1 Actors within the biobank system who conscientiously seek to address these issues will confront dizzying regulatory complexities at every turn. While acknowledged in the consensus paper, these complexities were too broad for detailed consideration in that paper. This Article fills in the compliance challenges connected to one key step in the return of IFs and IRRs: the reidentification of specimens or data. The large majority of genetic and genomic research in the United States is subject to either the Department of Health and Human Services (DHHS) Common Rule2 that governs human 1. Susan M. Wolf et al., Managing Research Results and Incidental Findings in Genomic Research Involving Biobanks & Archived Datasets, 14 GENETICS MED. 361 (2012). 2. Multiple federal agencies have adopted the Common Rule. Each agency separately codifies the rule in the Code of Federal Regulations. The agency most relevant to this discussion is the Department of Health and Human Services, which has codified the Common Rule at Subpart A of 45 003 MCGEVERAN FATEHI MCGARRAUGH_PROOF -SK.DOCX (DO NOT DELETE) 7/5/2012 1:08 PM 2012] DEIDENTIFICATION AND REIDENTIFICATION 487 subjects research, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule,3 or both. Both of these regimes create huge incentives for biobanks to provide and for researchers to use specimens or data that have been deidentified according to specific definitions spelled out in the regulations or in guidance materials supplementing the regulations. The reasons for promoting deidentification are sound. By encouraging the stripping of identifying information from specimens or data used by researchers, these regulations and guidance materials aim to reduce threats to the personal privacy of contributors. But these rules do not accommodate emerging views, exemplified by the consensus paper, about the desirability of returning IFs and IRRs to contributors in at least some circumstances.4 Indeed, a recent Advanced Notice of Proposed Rulemaking to amend the Common Rule,5 while simplifying some aspects of the regulations, would further entrench deidentification as a fundamental attribute of most genetic and genomic research using specimens and data stored in biobanks. This reliance on deidentification creates obstacles for any attempt to return IFs or IRRs. Following this Introduction, this Article proceeds in Part II to summarize the tangle of regulatory requirements implicated by the reidentification of specimens or data in order to return IFs and IRRs. Part III examines the recently issued Advance Notice of Proposed Rulemaking that contemplates changing the Common Rule in ways that would further complicate return of IFs and IRRs within biobank research systems. Part IV then describes the regulatory challenges that specimen or data collection sites, biobanks, and researchers face as a result of these current and proposed rules. Finally, Part V offers some models for biobank systems to address those challenges. C.F.R § 46. 45 C.F.R. §§ 46.101–46.124 (2011). For more discussion of the Common Rule, see infra Part II.A. 3. 45 C.F.R. §§ 160.101–160.552, 162.100–162.1802, 164.102–164.534 (2011). For more discussion of HIPAA and the HIPAA Privacy Rule, see infra Part II.B. 4. Wolf et al., supra note 1, at 369. 5. Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators, 76 Fed. Reg. 44,512, 44,513–14 (July 26, 2011) (to be codified at 45 C.F.R. pts 46, 160, 164, and 21 C.F.R. pts 50, 56). For more discussion of these proposed amendments, see infra Part III. 003 MCGEVERAN FATEHI MCGARRAUGH_PROOF -SK.DOCX (DO NOT DELETE) 7/5/2012 1:08 PM 488 MINN. J. L. SCI. & TECH. [Vol. 13.2 II. CURRENT REGULATORY REQUIREMENTS FOR BIOBANK RESEARCH UNDER THE COMMON RULE AND HIPAA A biobank research system encompasses three roles: (1) initial collection sites feeding specimens or data into the system, (2) biobanks aggregating those specimens or data for downstream research use, and (3) secondary researchers obtaining and using specimens or data from biobanks.6 In the simplest model, a collection site serves merely as the conduit between individuals who contribute specimens or related data and a biobank that, in turn, provides those specimens or data to secondary researchers who actually conduct the research and analysis. In reality, however, the design is often far more complex and differs significantly from one biobank system to the next. Research activities may take place anywhere within the system. Potential collection sites include both primary researchers conducting individual research studies and clinical sources such as hospitals that may or may not conduct research. Furthermore, biobanks may collect their own specimens or data, partly or entirely eliminating the distinct role of the collection site in that biobank system. Some biobanks, such as the Framingham Heart Study7 and Coriell Personalized Medicine Collaborative,8 conduct their own research in addition to aggregating and distributing specimens and data, while others, such as the Rhode Island BioBank,9 serve only the latter function. Thus, a biobank may be a primary researcher if it is a collection site and it conducts research; a secondary researcher if it conducts research on pre- existing specimens or data obtained from primary collection sites; or not a researcher at all if it only aggregates and distributes pre-existing specimens and data. Depending on the type of researching entity, the particular 6. Wolf et al., supra note 1, at 362, fig. 1. 7. About the Framingham Heart Study, FRAMINGHAM HEART STUDY, http://www.framinghamheartstudy.org/about/index.html (last updated Apr. 5, 2012). 8. About the Study, CORIELL PERSONALIZED MED. COLLABORATIVE, http://cpmc.coriell.org/Sections/About/?SId=9 (last visited Apr. 16, 2012). 9. Brown Univ., Core Facilities, Research Facilities