Research involving human participants can include the collection of biospecimens, such as blood or tissue, that can be analyzed for diagnostic purposes or evaluation of clinical treatments.
Highlights
Research involving human participants can include the collection of biospecimens, such as blood or tissue, that can be analyzed for diagnostic purposes or evaluation of clinical treatments. Regulatory requirements at the institutional, state, and federal level provide protections for both the health and privacy of research participants. In particular, current law lays out requirements for informed consent, removal of identifiable information for anonymized study, and confidentiality of health records. In addition to these standards, HB 995 would require laboratories to obtain consent from individuals before releasing any biological specimen for anonymous scientific study. It would also allow individuals to direct the laboratory to return or destroy the sample upon completion of testing. This bill would apply retroactively. Failing to adhere to this rule would be a class A felony.
Health and Privacy Protections for Human Biospecimen Donors Research institutions in the United States use biological samples and data from human subjects to study health conditions, assess medical treatments, and develop new therapeutics and diagnostics for a wide variety of illnesses, such as cancer or Alzheimer’s disease. Institutions that collect these samples (e.g., blood, tissue, or cerebrospinal fluid) are bound by many, sometimes overlapping, regulatory frameworks intended to protect the well-being and privacy of participants. The support for human subject protections grew in part out of high-profile revelations of past abuses, such as the Tuskegee Syphilis Study. In this set of trials, Black men with syphilis agreed to be examined and treated, but were misled about the purpose of the study and had effective treatments withheld from them. Concerns about consent, anonymity, and fair use also have received attention in light of the story of Henrietta Lacks, a woman whose tissue was collected as part of a medical procedure, but then distributed without her permission. The cells from that tissue eventually became widely used and highly lucrative in research laboratories, but the Lacks family was neither consulted about their use nor compensated.1 In response to situations like these, the U.S. passed the National Research Act of 1974, which established regulations under the Department of Health and Human Services (HHS) to govern biomedical research. This code developed into what is known as the “Common Rule”, which was most recently updated in 2018 and has 20 federal agency signatories, including HHS (which houses the CDC and FDA), the National Science Foundation, the Department of Justice, and the Central Intelligence Agency.(45 CFR Part 46)
For participating agencies and any research institution supported by them (e.g., the National Science Foundation or National Institutes of Health, two common funding sources for academic research), the Common Rule provides baseline guidance regarding informed consent: participants in studies that involve the collection of biospecimens (e.g., blood, tissue) must be presented with an explanation of the purposes of the research that will be conducted using their specimens, a description of any foreseeable risks or benefits of the research or treatments they may receive, and a description of the confidentiality standards for any records that could identify the subject. The Common Rule does not provide explicit permission for research biospecimens to be shared with law enforcement agencies, though cases exist where law enforcement agencies have obtained access to biospecimens for the purpose of aiding a criminal investigation.2
When samples are collected and associated with identifiable information (e.g., a sample is given a barcode and associated with an electronic record of the participant’s name, address, etc.), participants must also be informed that their biospecimens may be anonymized (dis-associated from the electronic record with identifiers) for use in future, unspecified research or distributed to another party for additional research without additional consent. Upon providing this information, researchers are required to obtain written documentation confirming that the participant has granted consent.
The Common Rule also lays out standards for Institutional Review Boards (IRBs), which are independent committees tasked with oversight of research involving human subjects. The Common Rule mandates that any institution receiving government support, including universities and private research laboratories, register and convene an IRB composed of qualified experts without conflicts of interest to review and approve research involving human participants. It also describes the standards to which the IRB must adhere, including protocols for obtaining informed consent.
As currently constructed, the Common Rule applies only to biospecimens that are linked to identifiers, such as database entries, that contain information about the donor. In certain instances, biospecimens may be “de-identified” or “anonymized” so that an investigator handling the sample will not be able to determine the identity of the donor. In these cases, Common Rule protocols, such as the requirement for informed consent and IRB oversight, do not apply. De-identified samples are commonly used to provide data for large-scale studies rather than to provide an individual with a diagnosis or treatment options. This process protects the privacy of biospecimen donors while still allowing researchers to analyze a sufficient amount of data to make biomedical discoveries that would not be possible at the individual level (e.g., determining genetic risk factors for cancer). In cases where re-identification of a biospecimen is possible (e.g., a sample contains DNA that will be sequenced and can be cross-referenced to a registry), Common Rule protections once again apply.
Several federal and state laws exist to protect the privacy of medical information not directly related to existing biospecimens. The federal Health Insurance Portability and Accountability Act (HIPAA) establishes privacy rules for personal health data, imposing penalties for any entity that shares such data without authorization by the individual who is the subject of the information.(45 CFR Parts 160, 162, and 164) HIPAA does however allow health information to be shared with public health authorities without authorization from an individual for narrow purposes such as preventing the spread of disease. Additionally, the Genetic Information Nondiscrimination Act (GINA) prohibits the use of genetic information in health insurance and employment decisions.(29 CFR Part 1630)
Missouri statutes also protect health-related data.3 In particular, testing results are considered confidential medical records and may not be released without informed consent, but de- identified statistical data or samples are not considered confidential (Mo. Rev. Stat. 191.317). The Missouri Department of Health and Senior Services authorizes local public health agencies to use health information for limited purposes, such as tracking and preventing the spread of disease, but prohibits unauthorized disclosure of identifiable information (19 CSR 20-20.075). To date, no other state has laws in place that implement informed consent requirements for sharing of de- identified biospecimens.4
