As hospitals walk the tightrope of patient data-sharing, one system offers a new balance

Such efforts would take partnerships between industry and academic institutions -- which are already essential to medical innovation -- to a new level.

Before COVID-19 struck, major health systems had started selling the "mining rights" to troves of their health data and stored materials -- including details about patients' DNA found in samples of their blood or tissue. Current law allows this, as long as names and identifying details are stripped from patients' or research participants' individual records and samples before turning them over.

Now that the pandemic has squeezed hospitals' finances further, and increased the need for research on a grand scale, more medical centers may seek income from such "big data" agreements with industry partners. That's especially true for those whose patients also volunteer for in-house research studies.

But a new framework published in the New England Journal of Medicine could help them do so more responsibly, going beyond the minimum legal requirements and respecting patients by giving them more say in how their individual data may be used.

It was written by a team from Michigan Medicine, the University of Michigan's academic medical center -- one of the first to adopt such a framework. The authors lay out an approach already applied to thousands of U-M patients and research study volunteers, and dozens of projects.

"We believe our approach provides an ethical way to advance medical discovery and innovation while also respecting the trust patients and research participants put in the University of Michigan," says first author Kayte Spector-Bagdady, J.D., M.Bioethics, chief of the research ethics service of the Center for Bioethics & Social Sciences in Medicine and faculty at Michigan Medicine.

She wrote the piece with fellow members of a special U-M committee that oversees the university's process, including Sachin Kheterpal, M.D., M.B.A., associate dean for research information technology and a co-leader of U-M Precision Health, Ray Hutchinson, M.D., active emeritus professor of pediatrics and former associate dean for regulatory affairs, and Erin Kaleba, M.P.H., director of the office that oversees clinical research data.

Special consent

The crux of the system, launched in 2018, is an easy-to-understand informed consent document that research participants can choose to sign, in addition to the forms that they sign to take part in a U-M-run research project. The additional consent focuses on sharing their information, and any samples taken from them, outside the university.

They must first discuss the special outside-sharing consent form with research staff, who assess each participant's understanding of what giving the additional consent means.

The critical passage in the form reads: "You give permission to share your samples and information with researchers around the world including those working for companies. Researchers and their organizations may potentially benefit from the sale of the data or discoveries. You will not have rights to these discoveries or any proceeds from them."

More than half of research volunteers asked for such consent have given it. Once they do so, it opens up the possibility (with additional legal and ethical steps) for companies, foundations, medical specialty societies and nongovernmental agencies to access their samples and data to move innovation forward.

If their samples are being sought for a project with a specific company, they will be told about the project and company, though their consent applies to all approved industry use. They are told they can revoke their consent in future, stopping their data from being shared further.

But, if they don't consent, the samples of tissue and blood taken during their care and research participation, and the contents of their health record, will be marked as off-limits for sharing with industry. U-M teams may still use it for academic research, under a broader consent document and ethics board approvals.

A dedicated gatekeeper

The authors are all part of the other crucial part of U-M's approach: a committee that must review, approve and track any projects that involve patient data or specimen sharing with companies.

The article in NEJM lays out the decision process followed by the Michigan Medicine Human Data & Biospecimen Release Committee. It must review all proposals involving transfer of data or human materials to non-academic entities, mostly through partnerships between a U-M researcher and an outside company.

There are a few exceptions. Aggregated summaries of data, which do not disclose individual participant information, do not need to be reviewed. Data and specimens collected under industry-sponsored clinical trials that already include shared of information with the company that sponsored the study, do not need committee review either.

The committee, which meets every other week, has on average of three new proposals to review each time. Only a few have been rejected outright -- mainly because the project proposed to use samples acquired before the new consent process, and there was no easy way to reach back to the people those samples had come from to ask for their consent.

The U-M framework does allow for the committee to grant exceptions, in rare cases, to the usual process.

For instance, if researchers and an outside partner are studying an "orphan" disease that affects few people, the committee weighs the importance of finding new treatment and prevention options against the individual participant's right to consent to industry use.

Past research has found that people who enroll in research are willing to accept some level of risk to themselves to help others with the same condition.

Though industry data-sharing doesn't carry risk of physical harm like a clinical trial might, it does carry a small risk that health data could be "re-identified" if matched with other types of available data sources, for instance in a databank of DNA from people who have taken ancestry DNA tests.

The committee even requires this level of consent when academic organizations are partnering with a commercial platform, such as an industry-supported disease registry.

Even in the face of COVID-19, and the pressing need to seek answers to a global pandemic, the framework is crucial, says Marschall Runge, M.D., Ph.D., U-M executive vice president for medical affairs and dean of the U-M Medical School.

"The temptation has never been greater to take shortcuts around health data protections to vie for huge federal grants or to develop and monetize intellectual property," says Runge. "That is why we have adopted our approach, and we hope it will serve as an example for others."

Disclosure: Kheterpal is a principal investigator or co-investigator on grants from the National Institutes of Health, Blue Cross Blue Shield of Michigan, the American Heart Association, Apple Inc, Merck & Co. Inc, and Becton Dickinson & Company.