Jump to ContentJump to Main Navigation
Human Subjects Research RegulationPerspectives on the Future$

I. Glenn Cohen and Holly Fernandez Lynch

Print publication date: 2014

Print ISBN-13: 9780262027465

Published to MIT Press Scholarship Online: January 2015

DOI: 10.7551/mitpress/9780262027465.001.0001

Show Summary Details
Page of

PRINTED FROM MIT PRESS SCHOLARSHIP ONLINE (www.mitpress.universitypressscholarship.com). (c) Copyright The MIT Press, 2018. All Rights Reserved. Under the terms of the licence agreement, an individual user may print out a PDF of a single chapter of a monograph in MITSO for personal use (for details see http://www.mitpress.universitypressscholarship.com/page/privacy-policy). Subscriber: null; date: 17 August 2018

In Search of Sound Policy on Nonconsensual Uses of Identifiable Health Data

In Search of Sound Policy on Nonconsensual Uses of Identifiable Health Data

(p.265) 17 In Search of Sound Policy on Nonconsensual Uses of Identifiable Health Data
Human Subjects Research Regulation

Barbara J. Evans

The MIT Press

Abstract and Keywords

This chapter discusses informational (observational) studies that use pre-existing data or biospecimens. It summarizes existing regulatory pathways for gaining research or public health access to data and specimens under the Common Rule and HIPAA Privacy Rule and explores their defects. Non-consensual (unconsented) access to identifiable data and specimens is occasionally necessary to support socially beneficial public health and research studies where consent is impracticable or would introduce unacceptable biases into the study finding. The existing Common Rule waiver provisions, which allow IRBs to approve nonconsensual access, fail to meet the needs of modern informational research while also failing to provide adequate protection to people whose data and specimens are used. The recent ANPRM neglected this problem, and this chapter identifies needed substantive reforms and examines the appropriate processes and procedures for modernizing the Common Rule’s waiver provisions.

Keywords:   Waiver provisions, Consent waiver, Data, Biospecimens, Informational research, Observational studies, Waiver reform

Health data and biospecimens are crucial resources for twenty-first century biomedical discovery and health care system improvement (Institute of Medicine 2007, 128–30; Hakimian and Korn 2004, 2500; Institute of Medicine 2010, 1). Health care providers and payers hold large datasets that are potentially valuable as a scientific resource. An estimated 300 million biospecimens were stored in the United States as of 1999, and this inventory was thought to be growing at about 20 million per year (Eiseman and Haga 1999, xvii–xviii). Testing these stored specimens could yield a wealth of additional health-related data including genetic information.

Studies of previously collected data or biospecimens are sometimes called information-based research to distinguish them from studies that involve human subjects directly and personally (Institute of Medicine 2009, 7). The Common Rule protects people who participate directly in clinical and behavioral studies but also applies to some categories of purely informational research (National Commission 1978, 56175). The Common Rule's definition of human subject, 45 CFR 46.102(f), includes living individuals about whom an investigator obtains identifiable private information. Even if a person has no direct contact with biomedical researchers, the person may become a human subject if identifiable information flows to an investigator via a health record or biospecimen.

OHRP published guidances in 2004 and 2008 in an attempt to clarify how the Common Rule's informed consent requirements apply to informational research (DHHS 2008). Despite these efforts, the “current requirements for informed consent for future research with pre-existing data and biospecimens are confusing and consume substantial amounts of researchers' and IRBs' time and resources” (DHHS 2011, 44523). The ANPRM explored possible changes to the Common Rule's informed consent framework for informational research, but it was a preliminary, (p.266) optional step in rulemaking, which is the process federal agencies employ to create or amend their regulations. The ANPRM offered no actual regulatory text for public comment and instead discussed broad directions for reform and sought public input on 74 questions.

The agency received well over a thousand comments, some of them detailed, and more than two years later still had not progressed to the next step of publishing proposed regulations for public comment. Delays are not uncommon in the context of a major rulemaking because initial approaches may lose momentum or need to be adjusted in response to public comments. Whatever the fate of this particular ANPRM, the Common Rule's framework of access to data and biospecimens is a likely target for reforms in coming years.

This chapter explores an important and neglected element of any successful modernization program: reform of the waiver provisions, 45 CFR §46.116(d), of the existing Common Rule. It then turns to a second question: What is the appropriate process for debating and deciding the policies to be embodied in the future Common Rule?

17.1 Nonconsensual Access to Data and Biospecimens for Use in Research

Surveys show that the public has misgivings about any nonconsensual (unconsented) use of patients' private health information, and these concerns are especially intense when identifiable information is involved (Institute of Medicine 2009, 66, 82). The Common Rule requires informed consent as its basic rule but offers a number of pathways for nonconsensual access to data and specimens. These pathways allow researchers to obtain de-identified, coded, and even identifiable data and biospecimens without informed consent.

17.1.1 Research Access under the Existing Common Rule

One access pathway is the exemption, 45 CFR 46.101(b)(4). This ex-emption allows nonconsensual research use of data and biospecimens that have been de-identified in the sense of having overt identifiers (e.g., names) removed. As Weil et al. discuss in chapter 14 of this volume, OHRP's 2008 guidance offered another important pathway that allows nonconsensual research access to data and biospecimens that have been coded (DHHS 2008). Coding is a process that masks identifying information but stops short of achieving a permanent, irrevocable de-identification (National Bioethics Advisory Commission 1999, 1; FDA 2008, 4–5;

(p.267) Evans 2009, 318). Overt identifiers that associate a piece of data or a biospecimen with a particular individual are replaced by a code number, but re-identification is theoretically possible using a code key. The use of coded data and biospecimens in research offers various advantages, such as making it possible to update research findings to reflect subsequent clinical observations about the patients whose data and tissues are being studied. Another advantage is that coding preserves the potential to contact those patients in the event researchers discover incidental findings that would have clinical significance in their future medical care (Evans 2009, 317–19). The 2008 guidance allows researchers to use coded data and biospecimens without consent, provided that the researchers receive no access to the code key.

Consent waivers are another major access pathway in informational research. The Common Rule's waiver provisions 45 CFR (46.116(d)) allow IRBs to approve nonconsensual access to data and specimens. As Williams and Wolf explain in chapter 13 of this volume, an IRB must determine that the disclosure of information satisfies several criteria before approving a waiver. Notably, however, these criteria do not explicitly require de-identification or coding (45 CFR 46.116(d)). It would be possible for researchers to obtain identifiable information without consent pursuant to an IRB-approved waiver. In practice, many IRBs would hesitate to conclude that a disclosure of identifiable information meets the criterion that requires minimal risk, but the waiver provisions technically would allow them to do so (Evans 2009, 331).

17.1.2 The ANPRM Approach to Research Access

The ANPRM dedicated significant thought to research that uses deidentified data and biospecimens but scarcely touched on research that uses coded or identifiable health information. In the months leading up to the ANPRM, there had been a lively public debate about the potential to re-identify data and biospecimens shared in de-identified form (Ohm 2010, 1706; Rothstein 2010, 5) although, as Clayton and Rivera note in their chapters, the threat to privacy was at times overstated. The ANPRM proposed to address this problem by adding more stringent consent requirements for studies that use de-identified data and specimens under the exemption (45 CFR 46.101(b)(4) (DHHS 2011, 44518–21, 44527)).

In contrast, the ANPRM merely posed questions about the proper use of consent waivers but proposed no specific reforms (DHHS 2011, 44523–25). This was a serious omission because nonconsensual access to (p.268) identifiable data and specimens is a pivotal issue in modern biomedicine. De-identified data and specimens have limited scientific utility, and many important scientific, public health, and health care system improvement studies require at least some access to identifiable health information (Evans 2011a, 90–92). As the US Food and Drug Administration noted in a recent report to Congress, “we have come to understand that there may be infrequent occurrences when de-identified datasets may be insufficient to meet the needs of medical product surveillance” (FDA 2011, 11). Epidemiologists also have pointed out that in research “using computer-stored prescription data linked with hospital data … it is necessary to have information on identifiers in order to link the data that permits the research to be done” (Weiss 2011, 4–5).

Two areas of difficulty are studies that require longitudinally linked health records and studies that correlate genetic and other diagnostic test results with clinical information. Longitudinal records allow patients' treatments and outcomes to be monitored on an ongoing basis across multiple encounters with the health care system. Linking genetic information from people's biospecimens with clinical data can reveal associations between specific genes and related medical conditions. The US health care system is notoriously fragmented and each individual's health information is widely scattered and stored in many different locations (Hall 2010, 640). Bringing data and biospecimens together to create useful linkages requires at least some access to identifiers to verify whether information received from various locations describes the same person. If data-holders de-identify their data and biospecimens before releasing them to researchers, these resources cannot then be linked back together to form longitudinal health records or specimens annotated with clinical information (Evans 2011a, 93–94).

To add another complication, selection bias (consent bias) is a problem in some research contexts (Institute of Medicine 2009, 209–14). As explained in the chapter by Weil et al., this bias exists when the subset of people who are willing to consent to research are unreflective of the general population scientists are seeking to study. Requiring informed con-sent may introduce biases that undermine the validity of certain types of scientific study. This problem explains the need for regulatory pathways that allow nonconsensual access to data and biospecimens in situations where the bias would be large enough to make a difference. The waiver provisions of the existing Common Rule purport to address this problem in the following way: they specify that waivers should be approved only when “the research could not practicably be carried out without (p.269) the waiver” (45 CFR 46.116(d)). Unfortunately, OHRP has done little to clarify what this criterion implies in day-to-day practice.

The ANPRM offered no concrete proposal for improving the Common Rule's waiver criteria and, indeed, talk of amending the regulation seems premature when OHRP has made little effort over the years to clarify the regulation it already has. For example, OHRP could issue guidance instructing IRBs that they would be on safe ground concluding that “the research could not practicably be carried out” without a waiver if the re-search requires more than 500 health records (or 5,000, or 50,000—the point is to specify a concrete number at which OHRP is prepared to presume that obtaining consent is impracticable; see SACHRP 2008; Evans 2011b, 28). Through guidance, OHRP also could require researchers to make a showing of why it would bias their results to condition access to data on consent: for example, is the study examining a very rare event that might be missed if researchers study a partial data set that includes only consenting individuals (SACHRP 2008; Evans 2011b, 28)? As IRBs struggle with the present lack of clarity, the waiver provisions are criticized both for providing too much and too little data access.

17.2 The Inherent Defect in the Common Rule's Waiver Provisions

Historical factors help explain the modern discontent with the Common Rule's waiver provisions. Before the Common Rule existed, nonconsensual access to data and biospecimens was common in various public health contexts such as reporting of communicable diseases (Amoroso and Middaugh, 2003, 50; Gostin 2008, 4). It apparently also was quite common for researchers to use data and biospecimens without informed consent. In 1974 Congress created a National Commission for the Study of Ethical Problems in Medicine and Biomedicine (National Commission) to help develop the Common Rule, Pub. L. No. 93–348, 88 Stat. 342, 201–202. The National Commission discovered that many investigators surveyed in the 1970s believed consent was unnecessary when a “study was based exclusively upon existing records” (National Commission 1978, 56188).

The Common Rule bears the imprint of customary data-access practices that existed before the regulation came into force (Evans 2011a, 120). Its consent exceptions are historically contingent—in other words, they were shaped by historical accidents and are not necessarily grounded in clear principles that explain why certain uses of data, but not others, warrant nonconsensual access to data and biospecimens. The National

(p.270) Commission attempted to enunciate such principles in its 1978 report on human subject protections (National Commission 1978, 56181). Unfortunately, as explained below, its recommendations were never properly implemented.

The National Commission incorporated findings of a separate Privacy Protection Study Commission that examined the use of data and bio-specimens in research (National Commission 1978, 56181). This privacy study concluded that “medical records can legitimately be used for bio-medical or epidemiological research without the individual's explicit authorization,” but only if “the importance of the research or statistical purpose for which any use of disclosure is to be made is such as to warrant the risk to the individual from additional exposure of the record or in-formation contained therein.” (National Commission 1978, 56181). The National Commission called for an IRB to assure that such conditions are met before approving nonconsensual research uses of existing documents, records, or tissue specimens (National Commission 1978, 56181). The National Commission felt that consent is not needed “if the subjects are not identified or identifiable” (National Commission, 56181). Even in studies “where the subjects are identified, informed consent may be deemed unnecessary” as long as certain criteria are met (National Com-mission 1978, 56181). One of the recommended criteria was that an IRB should determine that “the importance of the research justifies such invasion of the subjects' privacy” (National Commission 1978, 56179).

The National Commission thus would allow nonconsensual use of identifiable data and biospecimens only when the use could be justified under utilitarian balancing principles. Later commentators have agreed that unconsented uses of data, if they can be justified at all, are justified only when they offer important public benefits (Casarett et al. 2005, 597; Jacobson 2002, 1497–99). The National Bioethics Advisory Commission recognized the need for nonconsensual data use in some circumstances, but only if an IRB determines that “the benefits from the knowledge to be gained from the research study outweigh any dignitary harm associated with not seeking informed consent” (National Bioethics Advisory Com-mission 2001, 103–104).

Given this wide agreement that nonconsensual access should be al-lowed only for studies that serve important public purposes, it is surprising that the Common Rule's waiver criteria do not require IRBs to weigh this factor before approving access to data and biospecimens. This omission reflects another accident of history. The waiver provisions (45 CFR 46.116(d)) first appeared in the Common Rule in 1981 (DHHS (p.271) 1981, 8390). The regulatory record indicates that these provisions were designed for purposes that had nothing to do with health data and bio-specimens. Instead, DHHS indicated that waivers were needed in connection with controlled experiments that study how beneficiaries of federal benefit programs, such as Medicare and Medicaid, modify their consumption of health care services in response to various program incentives (DHHS 1981, 8383; Evans 2011a, 122). The waiver provisions thus were never intended for use in approving nonconsensual access to data and biospecimens, and this fact explains why they lack the utilitarian balancing criterion that the National Commission and later bioethicists have recommended.

In the years after 1981 the waiver provisions were pressed into service for approving nonconsensual access to data and biospecimens. Unfortunately, their criteria were never updated to reflect this new application. The Common Rule's waiver criteria are inherently defective as applied to disclosures of identifiable data and biospecimens because they omit a key criterion that the National Commission and later bioethicists felt is crucial to ensure that such disclosures are ethically justified. As a result people whose data and biospecimens are used without consent have no legal assurance that their sacrifice will serve a socially beneficial purpose. Surveys reveal that members of the public are troubled by nonconsensual access to their data and that they care deeply how their data are used (Institute of Medicine 2009, 81–84). The Common Rule's waiver provisions are unworthy of public trust insofar as they allow nonconsensual access without insisting on a publicly beneficial use.

17.3 Directions for Waiver Reform

This defect cannot be repaired merely by inserting a new waiver criterion that requires IRBs to perform utilitarian balancing before approving a consent waiver. Utilitarian balancing is a fine principle, but it is devilishly hard to implement. When DHHS proposed the HIPAA Privacy Rule's waiver provisions a decade ago, the agency attempted to include such a criterion. The draft of the Privacy Rule's waiver provisions would have required IRBs to determine that “the research is of sufficient importance so as to outweigh the intrusion of the privacy of the individual whose information is subject to the disclosure” (DHHS 2000, 82698). This requirement received “a large number” of negative comments that cast grave doubts upon IRBs' competence to administer a utilitarian balancing test (ibid. at 82698). DHHS ultimately removed the nettlesome (p.272) balancing requirement from the Privacy Rule's waiver provisions (DHHS 2002, 53270). The current HIPAA waiver provisions, like the Common Rule's waiver provisions, do not require IRBs to determine that the proposed research offers benefits commensurate with the burdens it places on nonconsenting individuals (45 CFR 164.512(i), 46.116(d)).

This defect will be difficult but not impossible to address. The US legal system regularly confronts difficult trade-offs between individual and public interests in the context of takings doctrine, which specifies when people's property can be taken without their consent for public uses such as highway construction, industrial development, and land reform. There, too, utilitarian balancing tests have proved difficult to administer and controversial (Evans 2011a, 79–82, 125). Courts and commentators have proposed a number of alternative approaches that may offer ideas for better managing nonconsensual data access. For example, a centralized, national oversight body may be the appropriate institution to decide which types of research offer sufficient public benefit to warrant nonconsensual access to data and biospecimens (Evans 2011a, 126). As local review bodies, IRBs may lack the global perspective required to make this determination. A list of presumptively beneficial data uses could be prepared and OHRP could issue guidance creating a safe harbor for IRBs that grant waivers in connection with the listed types of studies. A related concern is that IRBs, at least as they are constituted under the existing Common Rule, lack basic attributes of independence, legitimacy, and accountability that are necessary when making decisions that burden individual rights. When decisions require delicate trade-offs affecting individual rights, the public expects a level of transparency and independence that IRBs simply do not possess (Evans 2009, 331–32). OHRP could use guidance to create a safe harbor for waiver decisions that voluntarily follow a set of public-regarding procedural norms (Evans 2011b, 28).

Another approach would be to reject utilitarian balancing in favor of natural rights approaches employed in some nineteenth-century takings cases (Claeys 2003, 1577–89). These approaches have considerable resonance with modern, autonomy-based bioethical analysis and emphasize factors such as whether waivers that allow research access to large regionally or nationally scaled data networks offer mutually advantageous exchanges in which each data subject gives something to, but gets potential benefits from, the larger community of other data subjects (Evans 2011a, 127–29). The question is not whether research places any burden on the individual, but whether it places disproportionate (unfair) burdens (p.273) on particular subgroups of individuals. The goal of research oversight would be to ensure strong baseline privacy and data security protections for all data subjects and to discourage data uses that force “some people alone to bear public burdens which, in all fairness and justice, should be borne by the public as a whole.” Armstrong v. United States, 364 US 40, 49 (1960) (J. Harlan dissenting).

Another valuable insight from takings theory is that it is sometimes easier to enunciate criteria in the negative than in the positive (Evans 2011a, 127). Identifying data uses that do not serve a beneficial public purpose may be easier than describing all the data uses that do. It may be possible for bioethicists to describe attributes of research that does not warrant nonconsensual access to data and biospecimens, even if it will never be possible to specify all the various types of research that may be worthy of consent waivers. For example, ClinicalTrials.gov provides a medium where sponsors of clinical trials are encouraged to disclose information about their planned clinical research projects. There is no similar registry for health informational research that uses data and bio-specimens. Perhaps there should be. If such a registry existed, a sponsor's refusal to register an informational research project might be seen as presumptive grounds for waiver denial. If sponsors are unwilling to disclose information about their planned uses of data or biospecimens, this sends a strong signal that the research is aimed at producing private gains rather than public benefits. Research that serves private purposes still would be allowed, but it would be ineligible for consent waivers and would require informed consent. It may be possible for bioethicists to develop a list of “red flags” to guide IRBs on when not to approve con-sent waivers. Such measures could boost the perceived legitimacy of the Common Rule's waiver provisions.

17.4 Need for an Appropriate, Inclusive Process for Establishing Policy

Modernizing the Common Rule's consent framework presents two distinct challenges. The first challenge is to identify sound substantive policy—when should the use of data and biospecimens require informed consent and what additional protections (e.g., data security requirements) should apply to informational research? The second challenge is to ensure an inclusive and legitimate process for debating and deciding policy on these matters. This second challenge is particularly important when stakeholders hold divergent views, as is true in the debate about informed consent and access to data and biospecimens.

(p.274) The ANPRM presumed that OHRP can amend the Common Rule's informed consent requirements by means of informal rulemaking, the familiar process in which federal agencies publish proposed changes to their regulations, receive written comments from the public, and then develop final, amended regulations that will have the force of law (5 USC 553). Federal agencies often employ informal rulemaking when amending their existing regulations, but it is not an appropriate process if Congress has imposed different requirements in the statute that authorizes an agency to make and amend its regulations. OHRP's legal authority to establish and amend the Common Rule's informed consent requirements comes from an aging statute (42 USC 300v-1), which Congress enacted as part of the National Research Act of 1978 (1978 Act), Pub. L. No. 95–622, 92 Stat. 3412, Title III (1978).

The essence of the challenge DHHS faces today is that it is trying to adapt its regulations for the modern research context using authorities granted by an outdated statute. The 1978 Act imposed special procedures for rulemakings that establish the substantive bioethical requirements of the Common Rule, such as its informed consent provisions. The 1978 Act replaced the earlier National Commission with a new President's Com-mission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research (President's Commission), Pub. L. No. 95–622, 92 Stat. 3412, 301; 42 USC 300v, 300v-1.

Congress delegated the task of developing recommendations concerning the Common Rule's informed consent policies to the President's Commission, rather than to the Secretary of DHHS. When Congress enacted the 1978 Act, Congress already had received and been favor-ably impressed by the recommendations that the National Commission published in 1978 (National Commission 1978; US Senate 1978, 17). Congress urged the President's Commission to avoid duplicative effort (42 USC 300v-1(a)(2)(3)). The President's Commission endorsed the National Commission's 1978 report, including the recommendations about nonconsensual access to data and biospecimens discussed earlier in this chapter (National Commission 1978, 56181).

Congress placed special constraints on DHHS's authority to establish the Common Rule's informed consent requirements (42 USC 300v-1(b)). This statute requires the Secretary of DHHS either to implement the com-mission's recommendations or else publish in the Federal Register a for-mal determination that the recommendations are not appropriate before rejecting them and implementing a different policy. Thus Congress's delegation of rulemaking authority to the Secretary of DHHS was subject to (p.275) a requirement that the Secretary must relate substantive bioethical provisions of the Common Rule, such as its informed consent policies, to recommendations of the President's Commission. This statute is still in effect today.

The 1978 Act envisioned that the President's Commission would play an ongoing role in developing human subject protection policies. It was to report to the President, Congress, and federal agencies every two years and include a review of the adequacy of the existing regulations and recommend further legislation or rulemaking if needed (42 USC 300v-1(c)). Thus Congress envisioned that the President's Commission would deter-mine when the Common Rule was out of date and recommend appropri-ate action to address the problem. The Secretary of DHHS's authority is framed in the statute as a power to make rules in response to such recommendations. Unfortunately, the President's Commission no longer exists, and subsequent bioethics advisory bodies have not had the legal status to fill its shoes (Evans 2013, 405–406). The statute does not spell out an alternative pathway for updating the substantive ethical requirements of the Common Rule in its absence.

Congress may have envisioned periodically re-authorizing a President's Commission to guide future policy development. Unfortunately, this plan fell apart late in the 1980s. Congress enacted legislation in 1985 to create a Biomedical Ethics Board that was to “study and report to Congress on a continuing basis on the ethical issues arising from … biomedical and behavioral research, including the protection of human subjects of such research,” Pub. L. No. 99–158, 99 Stat. 820, 11 (1985). The Board “be-came politically deadlocked due to abortion politics, its appropriations were frozen, and finally its term expired in 1990” (Poland 1998, 12). As bioethical issues became politically divisive, Congress stopped authoriz-ing bioethics commissions to aid in keeping the Common Rule up to date. This left DHHS with a defective statutory framework that lacks a functioning process for amending key provisions of the regulations, such as the Common Rule's consent provisions.

Without the President's Commission, it is genuinely debatable whether the Secretary of DHHS has legal authority to amend the Common Rule's informed consent provisions (Evans 2013, 403–409). Under the current statute the Secretary's rulemaking authority is triggered by recommendations from a commission that no longer exists. Into this gap the ANPRM presumed that DHHS has authority to update the Common Rule on its own, if there is no President's Commission to recommend that the agency do so. The statute does not clearly grant DHHS this authority (Evans (p.276) 2013, 403–409). Before the Common Rule's waiver provisions can be fixed, Congress may need to act to clarify DHHS's rulemaking authority.

17.5 Conclusion

There is wide agreement that the Common Rule needs to be modernized for the environment of modern informational research. How to do so is the unanswered question. The search for sound policies on access to data and biospecimens is not just a normative bioethical inquiry. It also requires development of an open, inclusive, and legally sound process for debating and resolving the bioethical questions.


This research was supported by the Greenwall Foundation and the University of Houston Law Foundation.


Bibliography references:

Amoroso, Paul J., and John P. Middaugh. 2003. Research vs. public health practice: When does a study require IRB review? Preventive Medicine 36: 250–53.

Casarett, David, Jason Karlawish, Elizabeth Andrews, and Arthur Caplan. 2005. Bioethical issues in pharmacoepidemiologic research. In Brian L. Strom, ed., Pharmacoepidemiology, 4th ed. Hoboken, NJ: Wiley, 587–98.

Claeys, Eric R. 2003. Takings, regulations, and natural property rights. Cornell Law Review 88: 1549–1671.

Department of Health and Human Services (DHHS). 1981. Final regulations amending basic HHS policy for the protection of human research subjects. Federal Register 46 (8): 366.

Department of Health and Human Services (DHHS). 2000. Standards for privacy of individually identifiable health information. Federal Register 65 (82): 462.

Department of Health and Human Services (DHHS). 2002. Standards for privacy of individually identifiable health information. Federal Register 67 (53): 182.

Department of Health and Human Services (DHHS). 2008. Guidance on Research Involving Coded Private Information or Biological Specimens. http://www.hhs.gov/ohrp/policy/cdebiol.html.

Department of Health and Human Services (DHHS). 2011. Advance Notice of Proposed Rulemaking. Human subjects research protections: Enhancing protections for research subjects and reducing burden, delay, and ambiguity for investigators. Federal Register 76 (143): 44512.

Eiseman, Elisa, and Susanne B. Haga. 1999. Handbook of Human Tissue Resources: A National Resource of Human Tissue Samples. Santa Monica, CA: RAND Science and Technology Policy Institute. (p.277)

Evans, Barbara J. 2009. Ethical and privacy issues in pharmacogenomic research. In Howard L. McLeod, C. Lindsay DeVane, Susanne B. Haga, Julie A. Johnson, Daren L. Knoell, Jill M. Kolesar, Joseph D. McInerney, P. David Rogers, and Joseph R. Walker, eds., Pharmacogenomics: Applications to Patient Care, 2nd ed. Lenexa, KS: American College of Clinical Pharmacy, 313–38.

Evans, Barbara J. 2011a. Much ado about data ownership. Harvard Journal of Law and Technology 25 (1):69–130.

Evans, Barbara J. 2011b. Comments in docket HHS-OPHS-2011-0005; Human subjects research protections: Enhancing protections for research subjects and reducing burden, delay, and ambiguity for investigators. (October 25): 1–36.

Evans, Barbara J. 2013. Why the Common Rule is hard to amend. Symposium: Imagining the Next Quarter Century of Healthcare Law. Indiana Health Law Review 10 (2): 363–410.

Food and Drug Administration (FDA). 2008. Guidance for Industry. E15 definitions for genomic biomarkers, pharmacogenomics, pharmacogenetics, genomic data and sample coding categories (ICH, April). http://www.fda.gov/downloads/RegulatoryInformation/Guidances/ucm129296.pdf.

Food and Drug Administration (FDA). 2011. Report to Congress: The Sentinel Initiative—A National Strategy for Monitoring Medical Product Safety (August 19). http://www.fda.gov/downloads/Safety/FDAsSentinelInitiative/UCM274548.pdf.

Gostin, Lawrence O. 2008. Public Health Law, 2nd ed. Berkeley: University of California Press.

Hakimian, Rina, and David Korn. 2004. Ownership and use of tissue specimens for research. Journal of the American Medical Association 292 (20): 2500–2505.

Hall, Mark. 2010. Property, privacy, and the pursuit of interconnected electronic medical records. Iowa Law Review 95: 631–63.

Institute of Medicine, Roundtable on Evidence-Based Medicine. 2007. The Learning Healthcare System: Workshop Summary. Washington, DC: National Academies Press.

Institute of Medicine, Committee on Health Research and the Privacy of Health Information. 2009. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health through Research. Washington, DC: National Academies Press.

Institute of Medicine, Roundtable on Evidence-Based Medicine. 2010. Clinical Data as the Basic Staple of Health Learning: Creating and Protecting a Public Good: Workshop Summary. Washington, DC: National Academies Press.

Jacobson, Peter D. 2002. Medical records and HIPAA: Is it too late to protect privacy? Minnesota Law Review 86: 1497–1514.

National Bioethics Advisory Commission. 1999. Research Involving Human Biological Materials: Ethical Issues and Policy Guidance, vol. 1. Washington, DC: GPO.

National Bioethics Advisory Commission. 2001. Ethical and Policy Issues in Research Involving Human Participants, vol. 1. Washington, DC: GPO. (p.278)

National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. 1978. Protection of human subjects: Institutional review boards. National Research Act of 1978 (1978 Act), Pub. L. No. 95–622, 92 Stat. 3412, Title III (1978). Federal Register 43 (231): 56–174.

Ohm, Paul. 2010. Broken promises of privacy: Responding to the surprising failure of anonymization. UCLA Law Review 57: 1701–77.

Poland, Susan Cartier. 1998. Bioethics commissions: Town meetings with a “blue, blue ribbon.” Kennedy Institute of Ethics Journal 8 (1): 91–109.

Rothstein, Mark A. 2010. Is deidentification sufficient to protect health privacy in research? American Journal of Bioethics 10 (9): 3–11.

Secretary's Advisory Committee on Human Research Protections (SACHRP). 2008. SACHRP Letter to HHS Secretary (January 31). http://www.dhhs.gov/ohrp/sachrp/sachrpletter013108.html.

US Senate. 1978. S. Rep. No. 95–852. President's Commission for the Protection of Human Subjects of Biomedical and Behavioral Research Act of 1978.

Weiss, Stanley H. 2011. Letter dated October 26 from Chair, Joint Policy Committee of the Societies of Epidemiology, to Jerry Menikoff, Director, Office for Human Subject Protections, 4–5. http://www.regulations.gov(referencing document ID: HHS-OPHS-2011–0005–1066).