Introduction
Biomedical research involving human participants is undergoing a revolution. In domains as disparate as genomics and environmental health, patients, families, and other members of the public are increasingly taking the lead. They may partner with traditional academic researchers or may fly solo. Organizations such as Genetic Alliance have become pioneers, forging new participant-driven (and family-driven) models of research, biobank assembly, and research governance.Reference Eriksson, Kaye, Terry, Terry, Vayena, Tasioulas, McGowan, Buyx, Lamas, Engelbrecht, Grant, Wiggins and Wilbanks1
The importance of these new research models is widely recognized. In the multi-year effort to revise the federal Common Rule regulating research with human participants, the emergence of these new models was cited as one of the catalysts for revision.2 The federal “All of Us” precision medicine research program expressly aims to facilitate participant-driven research, and incorporates a commitment to return individual-specific results and data in part for this purpose.3 A burgeoning literature documents the growing importance of these new forms of research, which I will group under the rubric “participant-driven research” (PDR). The literature uses a range of terms, including “citizen science.”4 In an era marked by sharp conflict over who is a “citizen” and how non-citizens are treated, this paper avoids the assumption that participants are (or should be) “citizens.”
When these new forms of PDR are conducted in partnership with traditional researchers at an academic institution, they are likely to fall under the Common Rule.5 Such institutions often render to the federal government a Federalwide Assurance (FWA), committing to oversee all research conducted by the institution under federal rules for research with human participants, regardless of whether a particular research project is funded by the federal government.6 PDR may also be conducted with partners aiming to develop a drug or device requiring federal approval for marketing and thus be covered by regulations on human subjects research promulgated by the federal Food & Drug Administration (FDA).7 PDR may further be conducted with funding from (or under the aegis of) a federal science agency, and thus be subject to federal rules on research with human participants.8 However, organizations and individuals may conduct PDR without such conventional collaborations. In that case, PDR may fall outside the Common Rule and FDA human subjects regulations. The organizers of such research may voluntarily elect to follow federal regulations and may seek review by an independent Institutional Review Board (IRB), but these steps are not ordinarily required. A small number of states impose their own compliance requirements that may reach PDR in their jurisdiction, but most do not.Reference Rothstein9
PDR often relies on the Internet to connect geographically separated individuals and mobile technology such as smartphones or activity trackers to collect and share information. Thus, a number of scholars have asked what rules or norms should govern PDR, especially when it falls outside the Common Rule and FDA regulations and may be facilitated by the Internet and mobile technology. Proposals have varied.Reference Vayena and Fiske10 Vayena and Tasioulas limit the requirement for formal ethics review to those projects posing more than minimal risk. Their caution in imposing this requirement is based on respect for the innovative character of PDR. They strive to “prevent ethics review becoming a strait-jacket on [PDR]-inspired innovation, stifling individual liberty, and serving as a disincentive to non-experts who might otherwise make valuable contributions to medical knowledge.” The danger is that ethics analyses will take traditional research as the gold standard and treat PDR as a rogue offshoot that requires taming. Thus, recommendations to impose federal oversight on the mHealth technologies commonly used in PDR including federal governance features modeled (strictly or loosely) on IRBs11 seem at odds with the fundamental thrust of PDR — to free research from traditional constraints and hierarchies. Even when those recommendations are aimed at mHealth technologies and Internet-enabled research, they threaten to significantly alter or close down much PDR.
It may be tempting to divorce the modality of mHealth-enabled research from the context in which it is used — here, PDR. That is highly problematic, as it treats the data-gathering and communicative machinery of research as the focus of legal and ethical analysis, stripped of context.
Such recommendations fail to recognize that PDR is actually leading research innovation in a number of ways, and that traditional research needs to learn from PDR rather than insisting on the reverse. One domain in which PDR is ahead is return of a participant’s results (RoR) — used here to include return of incidental or secondary findings — and providing participants with access to their own raw data. Many PDR projects are pioneering RoR and data access, with much to teach conventional research. Indeed, RoR and data access are central to many PDR projects.Reference Terry12 They inform participants of their individual findings, empower participants to make knowledgeable decisions about sharing their results and data, allow them to find others with related findings in order to collaborate in research, permit them to track emerging knowledge related to their findings, and catalyze them to seek clinical consultation as needed. RoR and data access in PDR move research designs away from the traditional paternalism in which only the researchers could view findings and data to a more horizontal model in which participants can themselves see those findings and make decisions about whether and how to share the information.
This pioneering contribution by PDR is under-recognized. When an analysis of PDR fails to pay attention to the path-breaking character of PDR in creating important models for RoR and data access and fails to recognize how central this feature is in much PDR,13 that analysis significantly under-credits PDR. It thus perpetuates a vision of PDR as less valuable than traditional research, with little to teach. And when commentary finds even less warrant for RoR in PDR than in traditional research,Reference Rothstein14 it misunderstands the architecture of much PDR, which often depends on robust involvement of participants, transparency about findings, and giving participant control over their own findings and data.
It may be tempting to divorce the modality of mHealth-enabled research from the context in which it is used — here, PDR. That is highly problematic, as it treats the data-gathering and communicative machinery of research as the focus of legal and ethical analysis, stripped of context. Context, however, makes all the difference. Consider an analogy: if research regulation and oversight were proposed for genetic testing regardless of how such testing was used in research, this would treat alike genetic testing in research to determine how best to provide care to patients with colorectal cancer, and genetic testing in research to decide what claims of familial relationship immigration authorities should allow at the U.S. southern border. Many other examples could illustrate the pitfalls of grounding research regulation on the technology used. The technology may certainly be relevant to evaluation of the research, but only in context. In assessing research, context matters.Reference Beskow and Burke15
Grounds for RoR and Data Access in PDR
A robust literature already details the ethical and legal grounds for RoR and access to data in traditional research. My focus here is on the grounds that obtain in PDR. While PDR is heterogeneous, four grounds for RoR and access to data generally obtain. The analysis below considers RoR and data access separately. Though they are often conflated, as both accomplish forms of information transfer and transparency, they actually have different histories and underpinning, as well as different processes.Reference Evans and Wolf16
1. Ethical Bases for RoR
First, the ethical grounds that have been articulated for RoR in traditional research generally apply to RoR in PDR as well. Commentators have articulated a range of ethical justifications for RoR, including participant vulnerability and partial entrustment of information to those performing the research leading to reciprocal duties,Reference Richardson17 the importance of researcher respect for participant autonomy and interests,Reference Illes18 the problem that withholding data makes participants “passive purveyors of biomaterials and data” not partners,Reference Kohane19 and in some cases the existence of a researcher duty to warn, especially when warning might prevent imminent harm.Reference Shah20 Most of these rationales do not require a particular type of researcher. A participant-(or family-) driven research organization would be subject to these same arguments. While a physician or other clinician conducting research might be subject to additional arguments for RoR (such as those based on the researcher being a type of professional with special access to participant informationReference Miller21), the organization conducting PDR is already subject to adequate grounds for RoR.
It is important to recognize what is being argued here. Some commentators have misunderstood the literature on RoR (including return of incidental or secondary findings) as relying on a claim that RoR is mandatory.Reference Rothstein and Morreim22 For the most part, the RoR literature does not make this claim. Instead, RoR is customarily subdivided into cases in which researchers should consider return, may consider return in their discretion, and should not consider return.Reference Wolf, Fabsitz, Wolf, Jarvik and Wolf23 “Should” is not “must.” Moreover, the RoR literature is virtually uniform in arguing that RoR should generally be an offer to convey findings, not an insistence.24 If the participant chooses to refuse the offer, they have the right to do so.
2. Legal Grounds for RoR
To date, the ethical grounds for RoR have received far more attention than the legal grounds. Yet many (though not all) of the legal grounds for RoR could apply in PDR, not just in traditional research. For example, an assertion that the researchers owed a duty of reasonable care that in a specific case warrants RoR, could ground a claim for research negligence if RoR was not undertaken. This would likely be a negligence claim, not a malpractice claim; malpractice claims generally apply only to clinicians rendering clinical care, rather than non-clinicians conducting research.Reference Marchant and McGuire25 In the research context, claims of negligence figure larger, the claim being that the researcher (whether a professional or not) failed to exercise ordinary care or failed to act as a prudent researcher. As yet, there are few cases litigating failure to return research results (though there are reported cases suing for failure to appropriately communicate results in clinical care, rather than researchReference Clayton, Pike, Wolf, Wolf and Wolf26).
There are some legal grounds for RoR that would not apply in PDR that lies beyond the Common Rule and FDA regulations on research with human participants, namely the provisions of these regulations themselves that support RoR. Legal commentators have argued that the provisions of these regulations requiring informed consent and detailing the need to specify potential risks and benefits support the necessity of addressing whether RoR will be offered and the implications of offering it or failing to do so as part of the protocol.Reference Wolf27 Indeed, the revised Common Rule includes provisions requiring researchers to clarify whether RoR will be offered.28 In addition, the Common Rule and FDA regulations call for communicating findings that may affect a participant’s willingness to continue in the research.29 That provision, too, may support a duty to offer a finding that may have such an effect.
3. Ethical Grounds for Access to Data
In the context of PDR, commentators have offered strong justification for participant access to their own data. In the context of Internet-enabled research and citizen science, Vayena and colleagues have emphasized the importance of participant access to their own data and using participatory data governance models that can create a “data democracy.”Reference Vayena, Blassime, Vayena and Tasioulas30 Evans has illuminated the virtues of self-governing data communities, lauding them as an advance over traditional models of research that robbed participants of data access and control. “The existing regulations… do not excite people about becoming partners in the grand scientific challenges of the twenty-first century… showering individuals with unwanted, paternalistic protections—such as barriers to the return of research results—while denying them a voice in what will be done with their data.”Reference Evans31 Lunshof and colleagues argue that, “providing access to their raw data is essential to taking individuals seriously as partners in research not merely as sources of samples and data.”Reference Lunshof, Evans and Thorogood32
PDR projects and advocates have themselves done the best job of articulating the importance of facilitating participant access and control. Thorogood and colleagues explain:
There are many good reasons for researchers to provide access to individual-level uninterpreted data. Empirical studies show that many people believe that their genomic data belongs to them…. Providing access may also build trust and incentivize participation. Moreover, patients are often experts in their condition and may be more motivated to determine the relevance of their health data than researchers focused on discovery. Access will enable curious citizen scientists to explore the myriad meanings of their DNA. Research may even thrive when individuals themselves share data with patient-led registries, research projects, or public repositories like openSNP or Open Humans.33
Participants’ access to their own raw data is a hallmark of PDR. This type of data transparency and open access is central to PDR’s respect for participants as the drivers of this type of research.
4. Legal Grounds for Access to Data
The law conferring a right of data access may be relevant as well to PDR.Reference Evans34 The best-known law conferring a right of data access in the United States is the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.35 HIPAA’s application depends on the involvement of a HIPAA-covered entity. PDR research, even when conducted outside of a health care institution or academic center that is a covered entity, may utilize a laboratory that is HIPAA-covered.
HIPAA, however, is only one example of a law conferring a right of data access. Many additional federal and state statutes do so as well. Indeed, there is nearly a 50-year history in American law of recognizing data access rights in multiple contexts.Reference Evans, Wolf, Evans, Wolf and Evans36 This stands to reason. Individuals have a strong interest in seeing what data are being held on them. Those data may pose privacy risks, reputational risks, and risks of being subject to discrimination and stigma. Unless people can see information collected on them, they have no way of assessing those risks and deciding whether to authorize further use and sharing of those data. Indeed, data may sometimes be incorrect and require revision.37
Whether specific federal or state law would apply to a particular PDR protocol, biobank, or data repository would depend on the facts. The general point, however, is that rights of data access suffuse federal and state law. Analysis of their application to a particular PDR project will often be warranted.
Strengths and Potential Concerns over RoR and Data Access in PDR
Commentators have cautioned that RoR in the mHealth research that is a frequent hallmark of PDR “raises a variety of issues including the quality and validity of the findings provided, the scientific rigor, validity of data and quality, app users’ expectations and understanding of the limitation of these findings and their privacy interests.”38 Yet these same core issues — research data quality and whether participants understand the limits of the research findings and difference between research and clinical results — are debated as well in the context of traditional research. In fact, RoR and data access in PDR echo a broader trend toward designing research to allow participant access to their own information and the capacity to self-manage it, including in return of results.Reference Yu and Kohane39
A recent report from a committee of the National Academies on RoR in research involving biospeci-mens focused mainly on traditional research and recommended limiting both RoR and data access based on data quality.40 That committee held up clinical data as the gold standard, and evidenced great reluctance to endorse access to research findings and data that did not meet clinical standards, creating multiple roadblocks and requirements. Evans and I have argued that the committee erred in its understanding of the ethics and the law, on both RoR and data access.41 Much research generates information and data that are exploratory and do not meet clinical standards. The committee itself cited studies — such as those involving environmental exposures — that could not yet generate clinical-grade data, but were firmly based in a community of participants and committed to sharing results while scientific understanding progressed.42 The committee further recognized that research projects have already developed impressive methods for communicating research findings together with the caveat that the information’s clinical and health implications are still being investigated and no clinical action should be taken based on the research findings without clinical confirmation. As indicated above, the case for participant access to raw data regardless of data quality is also clear.43
At the same time, responsible handling and communication of research data and findings are ethically required in all research with human participants. This requirement flows not just from law (including the Common Rule and FDA regulations on research with human participants), but from multiple other sources as well, including participant expectations, organizational commitments and reputational concerns, and journal publication requirements. The requirement applies to both traditional research and PDR. Indeed, examples the National Academies committee cites of community-based and participant-driven research with deep roots in the participant community and strong communicative practices suggest that traditional research may have much to learn from PDR.44 Particular PDR protocols (like particular protocols in traditional research) can certainly raise issues. But to approach PDR research projects as intrinsically more problematic than traditional research — including protocols from well-established PDR entities responsibly conducting sophisticated research and carefully offering RoR and data access — is a mistake.
PDR studies are fully capable of eliciting careful and informed consent. They can clearly state the quality of the data they generate — whether clinical-quality data (e.g., from a CLIA-certified laboratory), or research-quality data whose meaning is still being investigated. They can caution participants to refrain from making clinical decisions based on data that are not clinical grade. When PDR projects make interpreted results available to their participants, they can again communicate warnings about the nature of those interpretations. If the analytic and clinical validity of the interpretations is not established, they can communicate this warning. Indeed, PDR studies with strong participant governance have the advantage that they are likely to be motivated to assess participant understanding and perspectives in order to refine their communicative strategies, and likely to know how to perform this assessment effectively. They can also establish recommended referral pathways to clinical assessment and care for those participants whose data and/or interpreted results suggest a need for clinical follow-up and evaluation. PDR studies can take advantage of their participant engagement to rigorously assess their communicative practices, participant understanding and actions, and the practical usability of routes to clinical care.
Particular PDR protocols (like particular protocols in traditional research) can certainly raise issues. But to approach PDR research projects as intrinsically more problematic than traditional research — including protocols from well-established PDR entities responsibly conducting sophisticated research and carefully offering RoR and data access — is a mistake.
What PDR Can Teach Traditional Research
Participant-driven research has much to teach traditional research on multiple fronts. Certainly, the level of participant engagement in much PDR would be the envy of many traditional research projects struggling to recruit and retain participants. The self-governing quality of PDR communities and organizations, their accountability to participants, and their transparency about research results, individuals’ data, and aggregate findings create a fundamentally different landscape than typically found in traditional research. Studying how PDR communities and organizations form, how they conduct research, and how they ensure accountability and transparency would offer an enlarged set of possibilities to traditional research.
To some extent, community-based participatory research (CBPR) occupies the middle ground between traditional and participant-driven research. CBPR can take multiple forms, with some commentators describing a spectrum involving greater or lesser community control.Reference Blumenthal45 PDR goes a step further by assuming that participants are driving the research, sometimes with no involvement with traditional researchers, and often enabled by Internet communications and mobile technologies such as smartphones.
When Vayena et al. laud the virtues of PDR “data democracies” and Evans shows the powerful possibilities open to self-governing data communities, they invite traditional researchers to learn from practitioners of PDR. Instead of treating PDR as the unruly off-spring of “real” research, they respect the potential of PDR to create new and powerful models for research. They treat PDR protocols as sites for learning.
Conclusion: Learning from PDR
Return of results and data access are commonly core elements of participant-driven research. They are central features, not bugs. The methods that PDR projects use and protections they incorporate deserve special study by traditional research entities.
Whether traditional research mechanisms will learn from PDR remains an open question. The rhetoric of respect for new, more participant-driven research models is now commonplace. From the preface to the revised Common Rule to the “All of Us” program’s commitment to returning participants’ data, the rhetoric is everywhere. As always, however, there is a big difference between talking the talk and actually embracing PDR and what it offers. The actual content of the revised Common Rule offers little to PDR and learns little from it. And whether “All of Us” will actually facilitate PDR remains an open question.
PDR is still evolving, though a number of models have emerged. As Rothstein et al. acknowledge, most collection of data using mobile devices and the Internet — a central method in PDR — involves very limited risk. Yet they urge all states to promulgate law governing this and all research. They recommend that federal bodies (namely, the National Institutes of Health (NIH) with the Office for Human Research Protections (OHRP) at the U.S. Department of Health & Human Services (DHHS)) educate those involved in mHealth research and urge those federal bodies to create research review organizations.46
None of this constitutes learning from the methods core to PDR. This instead treats those methods and PDR as a problem to be tamed by those in charge of traditional research and regulation. There is signifi-cant danger that state governments in regulating all research would stifle PDR, and that NIH and OHRP in creating research review organizations for PDR would re-impose the rules that organizations and communities conducting PDR have found detrimental to sustained engagement and progress in scientific understanding.
Threats to clamp down on the methods used in PDR will come as no surprise to those involved. Perhaps the last recommendation offered by Rothstein et al. offers some hope. Those authors recommend that, “Organizations of researchers conducting studies in unregulated environments, such as community organizations, member associations, and patient research networks, should adopt guidance and/or standards for their members….”47 There may be safety in numbers and articulation of collective norms. Ultimately, the future of PDR rests on the willingness of PDR organizations and communities to persist — to share their protocols and practices, to show how they handle RoR and data access, to publish their findings, and offer transparency on risks and benefits. On the other side of the divide, the future of traditional research may rest on the willingness to learn from PDR experiences, embrace change, and recognize progress.
Acknowledgments
Preparation of this article was funded in part by National Human Genome Research Institute (NHGRI), National Cancer Institute (NCI), and Office of the Director grant #R01CA207538 (Rothstein, Wilbanks, PIs) on “Addressing Ethical, Legal, and Social Issues (ELSI) in Unregulated Health Research Using Mobile Devices” and by NHGRI and NCI grant #1R01HG008605 (Wolf, Clayton, Lawrenz, PIs), on “LawSeq: Building a Sound Legal Foundation for Translating Genomics into Clinical Application.” The views expressed in this article are those of the author and not necessarily those of the funders.
