Health Data Rush
Hard questions in the rush to regulate precision medicine
Data & Society’s Fairness in Precision Medicine project releases an expansive new report on Monday, February 26. As a prelude, this post by lead researcher Kadija Ferryman reviews current regulatory dilemmas surrounding precision medicine and big data health technologies.
Health data is growing, and growing fast — from the rapid digitization of health records in the US, to masses of data being generated by activity trackers and medical sensors. If big data is the “new oil,” then health data is one of its most robust reservoirs.
“Precision medicine” is one major catalyst in this health data rush. This growing field aims to use multiple data sources to tailor medical care to individuals. The US government has launched the All of Us Research Program, which intends to enroll one million participants and collect not only their biological specimens and responses to survey data, but also a vast trove of digital health data, from genetic sequences to electronic health records. While this is the largest and most comprehensive health data project planned to date, others are in the works, such as Project Baseline (from Verily, the healthcare arm of Alphabet Inc., Google’s parent company) and New York University’s HUMAN project. These efforts plan to make the data widely available to academic researchers, for-profit companies, and the participants themselves, in order to accelerate discovery of the factors that make us sick and keep us well. Precision medicine has the potential to transform healthcare and medical research, but we need to think carefully about how the data that will be collected from big data health research participants might, or might not, be regulated.
A recent article by Julia Powles, a law and tech scholar, and Hal Hodson, a tech journalist, describes how Google’s DeepMind transferred over a million patient records from one of the trusts in the UK’s National Health Service without these patients’ consent. Although this did not happen in the context of a large-scale precision medicine research study, the DeepMind case presents a startling example of how the flow of health data can go unregulated, especially when cloaked in the promises of technology for improving health.
As precision medicine rushes on in the US, how can we understand where there might be tensions between fast-paced technological advancement and regulation and oversight? What regulatory problems might emerge? Are our policies and institutions ready to meet these challenges?
Thinking critically about the possibilities and problems in health data regulation, and other tensions in the emerging field of precision medicine, is the focus of the Fairness in Precision Medicine project at Data & Society.
The US is already grappling with health data regulation. The FDA recently closed its request for comments about the use of new technologies in clinical research. The agency had recognized that emerging technologies have the potential to shape medical care and clinical research in profound ways, and this call for input signaled that they needed guidance in regulating in this domain.
In 2013, the FDA barred the private direct-to-consumer genetics company 23andMe from providing genetic disease risk reports to its customers. Since the agency usually regulates medical equipment and drugs, the FDA reasoned that genetic information products could be conceptualized as “medical devices.” Though the company disagreed with this depiction, they eventually modified their services in order to meet the FDA’s demands, but, just recently, the agency reversed its decision, and will allow the company to provide genetic risk services. The agency has also faced some criticism for withholding approval for Scout, a device that collects vital signs and was put on the market via a record-breaking crowdfunding campaign. The regulation of medical devices falls under the purview of the FDA, but the main concern has been the safety of these devices. “Safety” in this sense meant physical safety, but newer devices pose problems of privacy as well. The FDA now has to consider how safe and secure medical devices are. Health data is forcing the agency to expand its regulatory purview.
Though the FDA regulations in question focus on consumer products, it is likely that regulation of health data will impact research such as the All of Us Research Program, which plans to use data from fitness trackers, as well as provide participants with access to their genetic and other health data. All of Us has enrolled its first participants, and this unprecedented collection of health data will provide new possibilities — and prompt new questions about regulation.
All of Us has released reports broadly describing principles that will guide data security and participant privacy, and they clearly view health data as a resource, as well as an unwieldy field of possibility that demands national-level intervention. Vexing questions about regulation remain unanswered.
In the US, as in the UK, there are regulations that govern the proper use, protection, and dissemination of health data. However, as the DeepMind case reveals, these institutions were bypassed in favor of speedy technological development.
DeepMind stated that their work with the data made them similar to direct care providers, so that explicit consent was not needed from patients to release their health data. In the US, we have HIPAA and the Common Rule, but these regulatory regimes can get complicated when health data in precision medicine research studies appear in clinical records, but health data from wireless medical devices can be streamed directly into research apps. How might rules about patient privacy and consent be shifted to meet the desire for technological development with health data in both the consumer and research sectors?
There is also no clear set of guidelines or regulations relating to information — such as internet search data, social media postings, or store rewards programs data — which effectively becomes health data when combined with health information in precision medicine research. These kinds of data and others increasingly make up our daily digital footprints but are not considered health data, and thus are not protected by HIPAA or the Common Rule for medical research. How will the use of these data be governed?
Recent proposals to roll back GINA (Genetic Information Nondiscrimination Act of 2008) protections also warrant concern for precision medicine research. The Trump administration has recently proposed that employer-sponsored wellness programs could receive employees’ genetic information. Without adequate protections, genetic sequencing offered to precision medicine research participants could make it possible for employers to gain access to information that can be used to discriminate against employees. Though there are data security principles in place for big data precision medicine research projects, what steps will be taken to ensure that the data will be kept secure in ways that are socially meaningful?
There is tremendous enthusiasm for gathering and analyzing large volumes and varieties of health data, and we collectively have a duty to understand and balance the complexities — among patients, doctors, healthcare providers and organizations, technologies, regulators, ventures and businesses — in order to regulate with care and deliberation and with a view to better outcomes for all of us. Taking time to ask difficult questions is a vital first step.
Kadija Ferryman is a Postdoctoral Scholar at Data & Society. Her research examines the challenges and opportunities of using big data technologies in medical research and healthcare. She earned a BA in Anthropology from Yale and a PhD in Anthropology from the New School for Social Research, where she studied the ethical impacts of genomics research. Her next release will be a report co-authored with Mikaela Pitcain for Data & Society’s Fairness in Precision Medicine project — available on Monday, February 26 at www.datasociety.net.
