Although the GDS Policy is specific to NIH-supported research, the RFI highlights broader policy issues concerning genomic and genetic information, particularly as innovations in clinical, research-oriented, and consumer-facing applications proliferate. Among those issues are: whether and to what extent genomic or genetic information can be de-identified; the appropriate level of consent for collecting, using, and disclosing genomic or genetic information, including for future unspecified research; and broadly, balancing the promise of scientific advances with individual privacy interests.
NIH seeks comment on how the GDS Policy should approach a number of issues, most notably: (1) de-identification and the use of potentially identifiable data, (2) data linkage, and (3) the types of research subject to the GDS Policy.
De-identification and use of potentially identifiable data
Citing a growing interest in more flexibility in the methods for de-identifying information than is permitted under the current policy, NIH seeks comment on the policy’s de-identification standard and circumstances under which sharing of potentially identifiable data (e.g., general location or date of treatment information) should be permitted. Currently, absent an exception, the policy allows only the sharing of genomic data that has been de-identified in accordance with the HIPAA Safe Harbor, provided that other conditions (e.g., IRB approval of consent procedures) have been met.
NIH would like input on the risks and benefits of expanding de-identification options, including by allowing use of the HIPAA Expert Determination Method. This could facilitate the use and sharing of data with scientific utility that is not eligible for the HIPAA de-identification Safe Harbor.
NIH also requests comments on the circumstances under which sharing of data with indirect identifiers, potentially with additional protections, should be allowed. The requirement to allow sharing only of Safe Harbor de-identified data has presented challenges for studying emerging issues. For example, date ranges shorter than a year may have scientific value when studying disease progression (e.g., with COVID-19) and higher resolution location data (e.g., full ZIP codes or mobile location data) may be valuable for studying social determinants of health or environmental risk.
Data linkage
The RFI also highlights an increasing capability to link research subject data from diverse datasets, such as combining EHR data with genomic information, and the resulting research opportunities and privacy-related challenges from doing so. NIH raises questions concerning appropriate consent practices for such data-linkage. In particular, NIH asks whether data linkage should be addressed when obtaining consent for sharing and future use of data, and how to make such consent meaningful, especially when it is difficult to know in advance which data sources may add scientific value when combined. The consent expectations for linking data collected in a clinical setting also are unclear today, as the current GDS Policy appears primarily concerned with genomic data collected in a research setting, where consent and waiver practices are routine. In contrast, clinical data may not have been collected with consent for research, and it may be impractical or infeasible to retroactively seek such consent, making linking difficult in a manner consistent with the current approach to consent and de-identification.
Types of research subject to the policy
Spurred by the development of novel types of sensitive data with high scientific utility (e.g., proteomic or metabolomic data), NIH is evaluating whether the overall scope of the GDS Policy should be expanded to cover information beyond genomic data. The agency also is considering whether the policy should be expanded to cover smaller scale studies (involving fewer than 100 participants) and NIH-funded research that generates large-scale genomic data but where NIH’s funding does not directly support the sequencing itself.
In addition, NIH indicated that it will seek opportunities to bring the GDS Policy in better alignment with the new NIH Data Management and Sharing (DMS) Policy, effective January 2023, which sets additional expectations for managing and sharing scientific data, including data subject to the GDS Policy.
Organizations that participate in NIH-funded research involving genomic data, and those who are engaged in research or other uses or disclosures of genomic or genetic data outside the scope of the GDS Policy should monitor, and consider participating in, the comment process. The outcome is likely to provide an important baseline for policy makers involved in the legislative and regulatory initiatives governing the use and disclosure of genomic and genetic information. Comments are due to NIH by February 20, 2022.
