Background

Privacy and security are fundamental aspects of the ethical conduct of research involving human participants. Adopted by the World Medical Association (WMA) in 1964, the Declaration of Helsinki established a duty of physicians who are involved in medical research to protect “privacy … and confidentiality of personal information of research subjects.”⁴ Consistent with the mandate of the WMA, the Declaration of Helsink is addressed primarily to physician-researchers,⁵ but it also “encourages others who are involved in medical research involving human subjects to adopt these principles.”⁶

First prepared by the Council for International Organizations of Medical Sciences (CIOMS) in collaboration with the World Health Organization in 1982, the International Ethical Guidelines for Health-Related Research Involving Humans (Guidelines) address the use of “data obtained from the online environment and digital tools.”⁷ In particular, the current (2016) Guidelines provide:

The Guidelines also state that researchers should, through an “opt-out procedure,” inform persons whose data may be used in the context of research in the online environment of the purpose and context of the intended data uses, the privacy and security measures used to protect such data, and the limitations of the measures used and the privacy risks that may remain despite the implementation of safeguards.⁹ If a person objects to the use of his or her data for research purposes, the Guidelines would forbid the researcher from using that data.¹⁰

The Common Rule

In addition to the ethical principles set forth in the Declaration of Helsinki and the Guidelines, the Federal Policy for the Protection of Human Subjects (the Common Rule) requires institutional review boards that review and approve research funded by a signa-tory agency to determine, when appropriate, that “adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data” exist.¹¹ Because many independent scientists, citizen scientists, and patient researchers do not receive federal funding and do not work for an institution that receives federal funding, the Common Rule’s confidentiality and privacy provisions are inapplicable to their research.^{Reference Rothstein, Wilbanks and Brothers12}

The HIPAA Rules

The HIPAA Privacy, Security, and Breach Notification Rules, promulgated by HHS pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH),¹³ provide standards that may be used as a reference point for considering the future regulation of mobile application-mediated health research. As background, the HIPAA Rules were designed to protect the privacy and security of individually identifiable health information created, obtained, or maintained in certain health care and health insurance contexts and to assist patients and insureds in protecting themselves in the event of a privacy or security breach.¹⁴ Although HIPAA authorizes the federal government to impose civil and criminal penalties for violations of the HIPAA Rules,¹⁵ the HIPAA Rules are limited in application to: (1) health plans, health care clearinghouses, and those health care providers that transmit health information in electronic form in connection with standard transactions, including health insurance claims (covered entities);¹⁶ and (2) persons or entities that access or use protected health information (PHI) to provide certain services to, or to perform certain functions on behalf of, covered entities (business associates).¹⁷

As currently written, the HIPAA Rules do not regulate a number of individuals and institutions that collect, use, or disclose PHI, including many independent scientists, citizen scientists, and patient researchers as well as some mobile app developers and data storage companies that support them.^{Reference Terry, Gunter, Rothstein, Cohen, Mello, Cohen and Mello18} The HIPAA Rules may, however, be used as a reference point for considering the future regulation of non-HIPAA covered entities that conduct research. For example, the HIPAA Privacy Rule requires covered entities to adhere to certain use and disclosure requirements,¹⁹ individual rights requirements,²⁰ and administrative requirements²¹ during the conduct of research. In particular, covered researchers must obtain prior written authorization from each research participant before using or disclosing the participant’s PHI unless the use or disclosure falls into one of four research-related exceptions to the authorization requirement.²²

Although much has been made of the concern that some individuals do not read or understand authorizations and other types of mandated forms and disclosures,^{Reference Ben-Shahar and Schneider23} this concern does not obviate the ethical obligation of a researcher, regardless of whether the researcher is affiliated or independent, to request permission to use an individual’s data for research and to respect the individual’s decision.^{Reference Rothstein24} For these reasons, future regulations governing independent, mobile application-based research should be guided by a principle that is analogous to the HIPAA Privacy Rule’s authorization requirement. That is, independent scientists should obtain some form of prior written permission from prospective research participants to use and disclose their data for current and future research purposes.²⁵

The HIPAA Privacy Rule requires research authorizations to contain a number of core elements and required statements.²⁶ Most of these elements and statements are relevant to the context of independent, mobile app-based research and could be included in electronic authorization forms signed by prospective research participants. These elements and statements would include, but not be limited to: (1) the name or other specific identification of each mobile application-mediated researcher who will be collecting, using, or disclosing the research participant’s data; (2) the name or specific identification of each person who will be receiving the participant’s data from the researcher, including any backend data collectors, data processors, and other researchers; (3) a specific and meaningful description of data relating to the participant that will be collected by the mobile application; (4) a specific description of the current research project for which the participant’s data will be collected, used, or disclosed; (5) if the researcher expects to use or disclose the individual’s data for future research projects, information sufficient to put the individual on notice of that expectation;²⁷ (6) a specific expiration date or a relevant expiration event after which the individual’s data will no longer be collected, used, or disclosed; (7) a description of the right of the individual to revoke the authorization together with the exceptions to the right to revoke, including situations in which the individual’s data has already been collected, used, or disclosed for research; and (8) the electronic signature of the individual.²⁸ Conventional researchers who use mobile applications to conduct federally-regulated health research have already considered how best to deliver HIPAA-mandated disclosures to remote research participants.^{Reference Moore29} These online processes could be adapted by independent researchers as well.

The HIPAA Security Rule also may be used as a reference point for considering options for the future regulation of independent, mobile application-based research. The HIPAA Security Rule requires covered researchers to adhere to certain administrative,³⁰ physical,³¹ and technical³² safeguards designed to ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI) and to protect against reasonably anticipated threats or hazards to the security and integrity of ePHI.³³ Administrative requirements include designating a security official who is responsible for the development and implementation of the covered entity’s security policies and procedures³⁴ and implementing policies and procedures that prevent, detect, contain, and correct security violations; ensuring that workforce members have appropriate access to ePHI; preventing workforce members who should not have access to ePHI from obtaining such access; creating a security awareness and training program for all workforce members; and addressing and responding to security incidents, emergencies, environmental problems, and other occurrences such as fire, vandalism, system failure, and natural disaster that affect systems containing ePHI and the security of ePHI, among other requirements.³⁵

The HIPAA Security Rule’s physical safeguard provisions require covered entities to implement policies and procedures that limit physical access to electronic information systems and the facilities in which they are located; address the safeguarding, functioning, and physical attributes of workstations through which ePH is accessed; and govern the receipt and removal of hardware and electronic media that contain ePHI.³⁶ Finally, the HIPAA Security Rule’s technical safeguards require covered entities to implement policies and procedures that allow access to ePHI only to those persons or software programs that have been granted access rights; hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI; policies and procedures to protect ePHI from improper alteration or destruction; procedures to verify that a person or entity seeking access to ePH is the one claimed; and technical security measures to guard against unauthorized access to ePHI that is being transmitted over an electronic communications network.³⁷ In addition to its Privacy and Security Rules, HHS also has promulgated a Breach Notification Rule.³⁸ Following the discovery of a breach³⁹ of unsecured protected health information (uPHI),⁴⁰ covered entities are required to notify each individual whose uPHI has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.⁴¹ The purpose of this notification is to give individuals the opportunity to protect themselves from economic, dignitary, and psychological harms that may follow from the data breach.

In light of the ethical and legal principles discussed above, Congress and appropriate federal agencies should consider requiring reasonable privacy, security, and breach notification measures during the conduct of mobile application-mediated health research. Reasonable privacy measures might include, for example: (1) requiring unregulated researchers to anonymously report their study results; (2) providing that if research data includes participant names or other individual identifiers, these should not be reported or otherwise disclosed; (3) prohibiting marketing and other commercial secondary uses of mobile application-mediated research data without the prior, explicit consent of each research participant; (4) prohibiting “click-through” or other non-explicit, non-meaningful forms of consent; (5) requiring that unregulated researchers implement reasonable administrative, physical, and technical safeguards designed to protect the security of participant data, such as requiring unregulated researchers to safeguard their physical equipment from unauthorized access, tampering, or theft, and encrypting their research data or otherwise make such data unintelligible to unauthorized users; and (6) requiring unregulated researchers to promptly notify their research participants in the event of a discovery of a data breach.