Biobanking, consent, and certificates of confidentiality: Does the ANPRM muddy the water?

Journal of Law, Medicine and Ethics

Volumn 41, Issue 2, 2013, Pages 440-453

  Williams, Brett A ^a   Wolf, Leslie E ^a  

^a GEORGIA STATE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; CONFIDENTIALITY; HEALTH CARE FACILITY; HUMAN; HUMAN EXPERIMENT; INFORMED CONSENT; LEGAL ASPECT; STANDARD; UNITED STATES;

BIOLOGICAL SPECIMEN BANKS; CONFIDENTIALITY; HUMAN EXPERIMENTATION; HUMANS; INFORMED CONSENT; UNITED STATES;

EID: 84879697927     PISSN: 10731105     EISSN: 1748720X     Source Type: Journal    
DOI: 10.1111/jlme.12054     Document Type: Article

References (47)

1. "Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators, " 76 Fed. Reg. 44512 (July 26, 2011) [hereinafter ANPRM] (to be codified at 45 C.F.R. pts. 46, 160, and 164 and 21 C.F.R. pts. 50 and 56).
2. The Common Rule is codified at 45 C.F.R. pt. 46, subpart A. Promulgated by HHS, the Rule applies to research conducted by the Department of Agriculture, Department of Energy, National Aeronautics and Space Administration, Department of Commerce, Consumer Product Safety Commission, International Development Cooperation Agency, Agency for International Development, Department of Housing and Urban Development, Department of Justice, Department of Defense, Department of Education, Department of Veterans Affairs, Environmental Protection Agency, National Science Foundation, Department of Transportation, and the Central Intelligence Agency. While the Food and Drug Administration has concurred with the Federal Policy, it has not adopted the policy in its entirety and maintains changes from the policy in its IRB and informed consent regulations. See "Protection of Human Subjects; Informed Consent; Standards for Institutional Review Boards for Clinical Investigations, " 56 Fed. Reg. 28025 (June 18, 1991) (to be codified at 21 C.F.R. pts. 50 and 56).
3. See A. L. McGuire, "Identifiability of DNA Data: The Need for Consistent Federal Policy, "American Journal of Bioethics 8, no. 10 (2008): 75-76; L. E. Wolf, "Advancing Research on Stored Biological Materials, Reconciling Law, Ethics, and Practice, "Minnesota Journal of Law, Science & Technology 11, no. 1 (2010): 99-156.
4. See, e.g., J. J. Nietfeld, J. Sugarman, and J.-E. Litton, "The Bio-Pin: A Concept to Improve Biobanking, "Nature Reviews Cancer 11, no. 4 (2011): 303-308.
5. Potential research participants have identified that their greatest concern, and thereby their main reason for nonparticipation in biospecimen research, relates to the confidentiality of their health-related and genetic information. K. A. B. Goddard et al., "Biobank Recruitment: Motivations for Nonparticipation, "Biopreservation & Biobanking 7, no. 2 (2009): 119-121, at 120 (reporting the most frequent concerns were security and confidentiality of health information (73%) and genetic information (61%)). Further, the enactment of HIPAA demonstrates the heightened concerns surrounding the need to protect health information, including data collected for research purposes. See, generally, P. M. Currie, "Balancing Privacy Protections with Efficient Research: Institutional Review Boards and the Use of Certificates of Confidentiality, "IRB Ethics & Human Research 27, no. 5 (2005): 7-12.
6. See infra discussion of History and Purpose of Certificates of Confidentiality.
7. National Institutes of Health, "Certificates of Confidentiality: Background Information, " July 21, 2003, available at (last visited April 17, 2013).
8. 45 C.F.R. § 46.102(d) (2012).
9. 45 C.F.R. § 46.101 (2012).
10. 45 C.F.R. § 46.101(f) (2012). According to the regulations, Intervention includes both physical procedures by which data are gathered (for example, venipuncture) and manipulations of the subject or the subject's environment that are performed for research purposes. Interaction includes communication or interpersonal contact between investigator and subject. Private information includes information about behavior that occurs in a context in which an individual can reasonably expect that no observation or recording is taking place, and information which has been provided for specific purposes by an individual and which the individual can reasonably expect will not be made public (for example, a medical record). Private information must be individually identifiable (i.e., the identity of the subject is or may readily be ascertained by the investigator or associated with the information) in order for obtaining the information to constitute research involving human subjects. 45 C.F.R. § 46.101(f).
11. 45 C.F.R. § 46.101 (2012) (requiring IRB approval for all studies involving human subjects). The regulations further set forth the elements to be reviewed by the IRB in 45 C.F.R. § 46.111: (a) In order to approve research covered by this policy the IRB shall determine that all of the following requirements are satisfied: (1) Risks to subjects are minimized: (i) By using procedures which are consistent with sound research design and which do not unnecessarily expose subjects to risk, and (ii) whenever appropriate, by using procedures already being performed on the subjects for diagnostic or treatment purposes. (2) Risks to subjects are reasonable in relation to anticipated benefits, if any, to subjects, and the importance of the knowledge that may reasonably be expected to result. In evaluating risks and benefits, the IRB should consider only those risks and benefits that may result from the research (as distinguished from risks and benefits of therapies subjects would receive even if not participating in the research). The IRB should not consider possible long-range effects of applying knowledge gained in the research (for example, the possible effects of the research on public policy) as among those research risks that fall within the purview of its responsibility. (3) Selection of subjects is equitable. In making this assessment the IRB should take into account the purposes of the research and the setting in which the research will be conducted and should be particularly cognizant of the special problems of research involving vulnerable populations, such as children, prisoners, pregnant women, mentally disabled persons, or economically or educationally disadvantaged persons. (4) Informed consent will be sought from each prospective subject or the subject's legally authorized representative, in accordance with, and to the extent required by § 46.116. (5) Informed consent will be appropriately documented, in accordance with, and to the extent required by § 46.117. (6) When appropriate, the research plan makes adequate provision for monitoring the data collected to ensure the safety of subjects. (7) When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data. (b) When some or all of the subjects are likely to be vulnerable to coercion or undue influence, such as children, prisoners, pregnant women, mentally disabled persons, or economically or educationally disadvantaged persons, additional safeguards have been included in the study to protect the rights and welfare of these subjects.
12. 45 C.F.R. § 46.111 (2012) (requiring informed consent from research participants).
13. 45 C.F.R. § 46.116 (2012). Although not typically applicable to biospecimen research, the Common Rule also requires "[f]or research involving more than minimal risk, an explanation as to whether any compensation and an explanation as to whether any medical treatments are available if injury occurs and, if so, what they consist of, or where further information may be obtained."Id., at 46.116(a)(6).
14. Office for Human Research Protections (OHRP), Department of Health and Human Services, Guidance on Research Involving Coded Private Information or Biological Specimens, available at (last visited April 17, 2013). OHRP further explains that "[o]btaining identifiable private information or identifiable specimens includes, but is not limited to: (1) using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that have been provided to investigators from any source; and (2) using, studying, or analyzing for research purposes identifiable private information or identifiable specimens that were already in the possession of the investigator.?
15. 45 C.F.R. § 46.101(b)(4) (2012).
16. 45 C.F.R. § 46.101(b)(4).
17. 45 C.F.R. § 46.116(d)(1)-(4) (2012).
18. 42 U.S.C. § 241(d) (2012). The authorizing statute does not use the phrase "Certificate of Confidentiality." The term may come from the regulations, which refer to a "Confidentiality Certificate." 42 C.F.R. § 2a. In any event, the protections afforded by 42 U.S.C. § 241(d) are commonly referred to as a "Certificate of Confidentiality" by NIH and other issuers, IRBs, and the researchers who use them.
19. See Federal Drug Abuse and Dependence Prevention, Treatment, and Rehabilitation Act of 1970, Part I: Hearings on S. 3562, S. 3246, and S. 2785 Before the Special Subcomm. On Alcohol and Narcotics of the S. Comm. On Labor and Public Welfare, 91st Cong. (1970).
20. 42 U.S.C. § 241(d) (2012).
21. National Institutes of Health, NIH Announces Statement on Certificates of Confidentiality, NOT-OD-02-037, March 15, 2002, available at (last visited April 17, 2013).
22. National Institutes of Health, "Certificates of Confidentiality: Background Information, " July 21, 2003, available at (last visited April 17, 2013).
23. National Institutes of Health, "Slide Presentation on Certificates of Confidentiality, " May 3, 2002, available at (last visited April 17, 2013).
24. 32 N.Y.2d 379 (1973). Because such cases involve discovery disputes that rarely give rise to final orders, there are only a few reported cases involving Certificates. In addition to Newman, they are: People v. Still, 369 N.Y.S.2d 759 (App. Div. 1975) (holding that methadone clinic had to produce clinic documents when the individual to whom the information pertained requested their disclosure to defend against criminal charges) and North Carolina v. Bradley, 634 S.E.2d 258 (N.C. Ct. App. 2006) (holding that defendant was not entitled to research records as immaterial to the case, although the records were produced under a protective order for purposes of the appeal). For a further discussion of cases involving Certificates, see L. E. Wolf et al., "Certificates of Confidentiality: Protecting Human Subjects Research Data in Law and Practice, "Minnesota Journal of Law, Science & Technology 14, no. 1 (2013): 11-87.
25. 32 N.Y.2d at 382-383.
26. 32 N.Y.2d at 387-390.
27. 32 N.Y.2d at 387.
28. L. M. Beskow, L. Dame, and E. J. Costello, "Certificates of Confidentiality and Compelled Disclosure of Data, " Science 322, no. 5904 (2008): 1054-1055.
29. Federal agencies other than NIH issue Certificates. These include the Centers for Disease Control and Prevention, the Health Resources and Services Administration, the Indian Health Service, and the Substance Abuse and Mental Health Services Administration, which issues Certificates only for research they fund. The Food and Drug Administration, like the NIH, issues Certificates regardless of federal funding. National Institutes of Health, "Frequently Asked Questions: Certificates of Confidentiality, " June 20, 2011, available at (last visited April 17, 2013). However, we focus on the NIH because most researchers look to the NIH and the NIH has taken a leading role of educating researchers about Certificates through its "kiosk" website.
30. National Institutes of Health, "Detailed Application Instructions for Certificate of Confidentiality: Extramural Research Projects, " at para. 5(a), March 15, 2002, available at (last visited April 17, 2013).
31. E. Eiseman et al., "Case Studies of Human Tissue Repositories: 'Best Practices' for a Biospecimen Resource for the Genomic and Proteomic Era, " RAND, 2003, at iii.
32. Office for Protection from Research Risks (OPRR), Department of Health and Human Services, "Issues to Consider in the Research Use of Stored Data or Tissues, " 1997, available at (last visited April 17, 2013).
33. National Cancer Institute (NCI), Department of Health and Human Services, Office of Biorepositories and Biospecimen Research, National Cancer Institute Best Practices for Biospecimen Resources, 2011, at 42, available at (last visited April 18, 2013).
34. See, generally, International Society for Biological and Environmental Repositories, 2008 Best Practice for Repositories: Collection, Storage, Retrieval, and Distribution of Biological Materials for Research, published in Cell Preservation Technology 6, no. 1 (2008): 3-58 available at (last visited April 18, 2013).
35. L. M. Beskow et al., "Institutional Review Boards' Use and Understanding of Certificates of Confidentiality, " Public Library of Science One 7, no. 9 (2012): e44050, at 5.
36. L. E. Wolf et al., "Certificates of Confidentiality: Legal Counsels' Experiences with and Perspectives on Legal Demands for Research Data, " Journal of Empirical Research on Human Research Ethics 7, no. 4 (2012): 1-9.
37. P.L. 110-233, 122 Stat. 881 (2008).
38. A. L. McGuire and M. A. Majumder, "Two Cheers for GINA?" Genome Medicine 1, no. 1 (2009): 6.1-6.3.
39. A. L. McGuire and R. A. Gibbs, "No Longer De-Identified, " Science 312, no. 5772 (2006): 370-371, at 370.
40. N. Homer et al., "Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays, " Public Library of Science Genetics 4, no. 8 (2008): e1000167, at 7, available at (last visited April 18, 2013.
41. Recent lawsuits over research use of newborn blood spots without consent resulted in the destruction of millions of specimens in Texas, which illustrates how dependent research is on public trust. S. Olson and A. C. Berger, Rapporteurs, "Roundtable on Translating Genomic-Based Research for Health Board on Health Sciences Policy, " in Institute of Medicine, Challenges and Opportunities in Using Residual Newborn Screening Samples for Translational Research (Washington, D.C.: The National Academies Press, 2010): at 2, 20-24, and 26-29.
42. See J. Catania, L. Wolf, S. Wertlieb, J. Henne, and B. Lo, "Research Participants' Perceptions of the Certificate of Confidentiality's Assurances and Limitations, "Journal of Empirical Research on Human Research Ethics 2, no. 4 (2007): 53-59.
43. L. E. Wolf and J. Zandecki, "Sleeping Better at Night: Investigators' Experiences with Certificates of Confidentiality, " IRB: Ethics & Human Research 28, no. 6 (2006): 1-7.
44. L. E. Wolf, J. Zandecki, and B. Lo, "The Certificates of Confidentiality Application: A View from the NIH Institutes, " IRB: Ethics & Human Research 26, no. 1 (2004): 14-18, at 14 (describing a situation in which failure to have an IRB-approved consent form resulted in rejection of a Certificate of Confidentiality grant).
45. M. K. Paasche-Orlow et al., "Readability Standards for Informed Consent Forms as Compared with Actual Readability, " New England Journal of Medicine 348, no. 8 (2003): 721-726, available at (last visited April 18, 2013). Using the Flesch-Kincaid readability scale, the investigators found that IRB's generally fail to meet the IRB's own standards for readability.
46. See Paasche-Orlow et al., supra, note 120, citing National Work Group on Literacy and Health, "Communicating with Patients Who Have Limited Literacy Skills, "Journal of Family Practice 46, no. 2 (1998): 168-176. Later literacy assessments have reported similar levels. National Center for Education Statistics, A First Look at the Literacy of America's Adults in the 21st Century (2005), available at (last visited April 18, 2013).
47. 42 U.S.C. §299c-3 (protecting data collected or supported by the Agency for Healthcare Research and Quality) and 42 U.S.C.A. § 242m (protecting data collected by or supported by the Centers for Disease Control and Protection).