Biobanking, Consent, and Certificates of Confidentiality: Does the ANPRM Muddy the Water?

The U.S. Department of Health and Human Services (HHS) has proposed substantial changes to the current regulatory system governing human subjects research in its Advanced Notice of Proposed Rulemaking (ANPRM), entitled “Human Subjects Research Protections: Enhancing Protections for Research Subjects and Reducing Burden, Delay, and Ambiguity for Investigators.”1 Some of the most significant proposed changes concern the use of biospecimens in research. Because research involving biological materials begins with an initial interaction with an individual, such research falls squarely within the human subjects research regulatory framework known as the “Common Rule,” which applies to research conducted or funded by the HHS and the other signatory agencies and departments.2 However, as described in detail below, much biospecimen research may fall within exemptions and exceptions under the Common Rule and, thus, may be conducted without consent. The ANPRM proposes requiring written consent for research use of biospecimens, even if the biospecimens were initially collected for a purpose other than research or have been stripped of identifiers.3 This ANPRM proposal responds to criticisms that the Common Rule does not take into account advances in science that result in projects involving genetics, genomics, or other use of biospecimens, all of which present risks not contemplated at the time the Common Rule was last amended.4 The ANPRM argues that, because of the inherent identifiability of biospecimens from which DNA can be extracted, consent should be required for such research.5 This proposed change would allow participants to choose whether their biological materials are used in research and some limited control over specific research uses.6 Breach of confidentiality is widely recognized as the primary risk of biospecimen research;7 for example, research linking individuals or groups to stigmatizing conditions can give rise to psychosocial or even economic harm.8 Moreover, study participants are mainly concerned about confidentiality in this context.9 The ANPRM addresses the informational risks that accompany biospecimen research primarily through standardized data security measures.10 Another strategy for addressing informational risks is a Certificate of Confidentiality (Certificate), which protects against compelled disclosure of participant names and other identifying characteristics.11 While, as the ANPRM notes, there are limits to a Certificate’s protections and it is no substitute for appropriate data security measures, the National Institutes of Health (NIH), among others, has recommended that research projects involving genetics, genomics, or development of biospecimen repositories consider obtaining a Certificate of Confidentiality (Certificate) to provide additional protections to participants.12 Ironically, while the ANPRM seeks to enhance protections to participants in biospecimen research, its consent proposals may make it more difficult to obtain a Certificate and, thus, the additional confidentiality protections recommended for participants in such research. The ANPRM contemplates a brief consent form that would collect all biospecimens relating to interactions with an institution. Thus, the materials may be obtained outside of the research setting, e.g., if biospecimens are collected for clinical purposes, and collected on an institution-wide basis, rather than for a specific research project or even a specific repository.13 However, Certificates are only available for research projects and require specific disclosures to research participants.14 Thus, the ANPRM may prevent researchers from using one of the tools that addresses one of the main concerns – breach of confidentiality – that participants have about participation in biospecimen research. In this article, we explore the implications of these potentially conflicting requirements and make recommendations for revising the regulations to achieve the dual goals of adequate informed consent and confidentiality protections. In doing so, we will draw on previous empirical and analytical work on biospecimen research and our recent empirical work on understanding and usage of Certificates.