Case Study 2: Protecting Health Information Privacy
Dr. Sharon Smart is a senior genetics researcher for Genomatic, Inc., an emerging pharmaceutical company that researches and develops pharmacogenomic products. Dr. Smart was the lead researcher in a recent large-scale clinical study designed to test the efficacy of Alive, a new pharmaceutical.
Alive is designed to successfully treat a terminal form of ovarian cancer that has common genetic links in a sizable portion of the general public. The study amassed considerable, longitudinal health data on thousands of research subjects. Genomatic’s shares recently soared on the NASDAQ stock exchange in expectation of potential approval of Alive through the Food and Drug Administration (FDA). Genomatic had sought final FDA approval after
completing its clinical drug trials.
Seeking FDA Approval
As part of the approval process, the FDA requested copies of relevant medical records of individuals involved in the clinical drug trials for Alive. In its correspondence, the FDA said that it needed the data for review and examination pursuant to the approval process for Alive. In her laboratory in Rockville, Maryland, Dr. Smart assembled the personally identifiable data, including research subjects’ informed consent forms.
Each of the research subjects had previously executed a general waiver for the release of his or her medical records to “federal authorities, including the FDA, for the purposes of conveying study results.” In the same letter, the FDA also asked for additional medical data about whether the research subjects involved in the Alive clinical trials had participated in other clinical trials at Genomatic. The FDA suggested that it wanted this data to confirm that Genomatic had not improperly recruited its research subjects for multiple trials, or provided incentives for their long-term participation in the company’s clinical trials programs. Another pharmaceutical company had recently engaged in a practice of soliciting clinical trial research subjects from community homeless shelters. These individuals became “career” research subjects, participating in dozens of trials and reaping sizeable financial incentives.
Dr. Smart contacted an FDA official about the second request for information. She inquired as to whether the approval process for Alive was contingent upon forwarding the research subjects’ additional medical data. The official suggested that “while the approval process is independent of the request for the additional data, companies that fail to comply with all FDA information requests may see their products’ approval
delayed.”
Responding to Public Health Authorities
That same afternoon, Dr. Smart received a telephone call from Dr. Needy at the state cancer registry. Operated as part of the state department of health, the cancer registry tracks a variety of cancer cases pursuant to state statutory authorization. Dr. Needy had recently learned about Genomatic’s drug trials for ovarian cancer. He asked Dr. Smart to provide the names of all of Genomatic’s clinical research subjects who had been diagnosed with ovarian cancer. Dr. Smart suggested that the names of these individuals would have already been provided by the subjects’ treating physicians or private laboratories that had tested tissue samples for cancer cells. Dr. Needy agreed, but responded that his office had recently uncovered a new type of ovarian cancer that did not typify existing forms of the disease. Specifically, he wanted Dr. Smart to provide the requested information so that the state cancer registry might confirm this potential new form of ovarian cancer tied to the genetic link.
Before Dr. Smart could respond to the state cancer registry’s request for her research subjects’ data, she opened an e-mail from her colleague at Genomatic, Dr. Duit, who worked in the company’s headquarters in Seattle. Dr. Duit was the chief information officer for Genomatic. He had recently received a request from the dean of the medical school at a major university that sought access to some of the company’s clinical trials databases. Researchers at the medical school thought that some of Genomatic’s information might further research on a joint pharmaceutical project between the university and Genomatic.
Dr. Smart called Dr. Duit to question whether she could share the data without the specific informed consent of the subjects. Dr. Duit assured her, “I’ve spoken with our legal counsel, and he told me that there is no state law against sharing this data (at least in Washington state). We need this data, Sharon. Our CEO recently pledged monetary support to the university to broaden our information-sharing network. The university has some data we can use, and we have some data they can use.” Dr. Smart further questioned the use of the data, to which Dr. Duit responded, “Sharon, this is a mutually beneficial practice. Genomatic and the university may both benefit, but the public will benefit as well through improvements in medical science. There’s a strong need to collaborate to bring these medical advancements to the public. I’m assensitive to the privacy issues as you are, but no one debates the value of using this data. Now, send me the data tomorrow.”
Toward A Resolution of these Information Requests
Dr. Smart is uncertain what to do regarding each of these requests for data. Each entity requesting the data seems to have a legitimate claim to the identifiable information. Yet, to share the data with each of these entities may compromise the research subjects’ interests in maintaining the privacy of their health information. Dr. Smart seeks your help in answering the following questions:
Should Dr. Smart provide the identifiable health data about her clinical research subjects to the FDA as part of the drug approval process for Alive?
Must Dr. Smart provide additional identifiable health data to the FDA for its review of Genomatic’s recruitment of clinical research subjects?
Must Genomatic meet the state cancer registry’s request for data on those research subjects
enrolled in the Alive trials?
Should Dr. Smart forward the requested data to the chief information officer at Genomatic if she knows the officer will share the data with outside researchers at the university medical school?
