Importance of Participant-Centricity and Trust for a Sustainable Medical Information Commons

Abstract

Drawing on a landscape analysis of existing data-sharing initiatives, in-depth interviews with expert stakeholders, and public deliberations with community advisory panels across the U.S., we describe features of the evolving medical information commons (MIC). We identify participant-centricity and trustworthiness as the most important features of an MIC and discuss the implications for those seeking to create a sustainable, useful, and widely available collection of linked resources for research and other purposes.

Comprehending complex health diseases and conditions calls for the ability of big data analytics to analyze vast amounts of data on diverse health-related variables. Such data are typically sourced from multiple projects and data repositories, forming a data resource commons. The importance of data commons have not gone unnoticed.¹ A 2011 National Academies committee report called for the development of an Information Commons and Knowledge Network to advance research and improve health.² Over the past decade, we have seen the evolution of medical information commons (MIC) in the U.S. and elsewhere, which we define as networked environments in which diverse sources of data on large populations become broadly available for research use and clinical applications, and which include the collection of many different common pool resources.³ As Elinor Ostrom observed over a career of studying various kinds of common pool resources, the stability and effectiveness of any commons requires forming a community, establishing rules, and monitoring compliance with those rules.⁴ Some groups, such as the Global Alliance for Genomics and Health (GA4GH) have worked to establish rules to govern how the resources in an MIC are brought together. Informed by that work, and drawing on the research that we conducted over the past three years, which included a landscape analysis, expert stakeholder interviews, and community advisory panels in three cities across the U.S., we believe that the two most important features of an MIC, around which those rules must be established, are: (1) an MIC must be oriented around the people whose data it contains and whom an MIC is ultimately intended to benefit; and (2) the system must be trustworthy. Here we discuss these features and how to best address them in order to build a sustainable resource, or rather, a sustainable, useful and widely available collection of linked resources.

What Does it Mean to be Participant-Centric?

A central determinant of the long-term effectiveness of an MIC will be its ability to meet the needs of the people it is supposed to serve. Most of the decisions that affect flow of information and materials are now made under models designed by and for academic research institutions, private health care delivery organizations, commercial laboratories and other institutions organized around generation and use of data. But do the interests of those who design the systems and hold the data align with the rights and interests of the participants — the people the data describe — who are also, ultimately, its intended beneficiaries? Throughout our work we heard a strong desire from both expert stakeholders and community members for an MIC to be participant-centric. In our interviews with expert stakeholders, for example, the overwhelming majority confirmed that it is important to give participants a significant role and that limited conceptions of the participant role in research are no longer tenable in the context of an MIC.⁵ The overwhelming majority of individuals on our community advisory panels reached the same conclusion.⁶ But what does it mean for an MIC to be participant-centric and how can it be accomplished?

Scholars describe participant-centric initiatives as “tools, programs, and projects that empower participants to engage in the research process” by giving participants the option to have control over data and to engage in a reciprocal partnership with researchers.⁷ Fundamentally, being participant-centric means showing respect for participants as persons with a voluntary, continuous role in decision-making, versus human subjects who are only engaged during the consent process, or sets of data points without interest or concern for how the data are used or analyzed. It is important to recognize that the principle of participant-centrism is not the result of armchair (or academic seminar) analysis or pie-in-the-sky thinking. In fact, existing citizen science genomics efforts such as the Personal Genome Project exemplify norm-disruptive approaches to engaging participants and data-sharing.⁸ In addition, Elinor Ostrom and her colleagues' extensive empirical work establishes that a successful commons must involve key stakeholders in the governance of the shared resource.⁹ For an MIC, participant-centricity begins with governance, ensuring that all key stakeholders — including the participants who are the data contributors and ultimate beneficiaries — have a seat at the table.

A participant-centric MIC also recognizes and mitigates the risks that participants, individually and collectively, face, such as re-identification, as well as discrimination and stigmatization based on the collection, aggregation, and use of genomic and other health-related data.¹⁰ Risks of discrimination and stigmatization are of special concern to individuals and groups who have already experienced significant social disadvantage and are especially vulnerable to harm from impersonal, non-transparent algorithmic decision-making drawing on big data.¹¹ Concern may also be heightened for particular areas of genomic and other health-related information, such as information about potential genomic contributors to drug or substance abuse, propensity for criminal behavior, and intelligence or impulsivity, as well as particular kinds of research uses, such as studies that stratify by social or ancestry groups.¹² In the U.S., some risks could be reduced if the Genetic Information Nondiscrimination Act (GINA) were strengthened and expanded beyond health insurance and employment to include other forms of genetic discrimination in eligibility for life insurance or access resources.¹³ Given these gaps and weaknesses in current health data privacy laws, obligations to respect the autonomy of participants and potential participants and to invest in initiative or project-level privacy protection measures are especially strong. For example, if MICs establish credible sanctions for unauthorized re-identification of data and violations of agreements about permissible data uses, that could help discourage careless or malicious acts that might result in harm to participants while offering those affected a means of redress.

Another aspect of being participant-centric is ensuring that participants' voices are heard and included in meaningful ways in the governance of their collective data so that they can ensure that there is alignment between uses and their values, needs, and interests. A “researcher reputation system” where participants can post ratings on researchers and a report card on researchers' dissemination of results to participants and open-access journals, along with other metrics, has been suggested to cultivate this type of engagement.¹⁴ Other strategies to ensure that participants have a voice at the table should also be explored.

Ethically and pragmatically, then, for its long-term sustainability as a rich data resource, it is in the interest of an MIC to be participant-centric. Being participant-centric can build public support and improve recruitment and retention, inclusive of historically underrepresented groups.¹⁵ It can also help ensure that priorities, practices and outcomes align with public and participants' expectations and values, in order to increase and sustain trust, as discussed in more detail below. At the same time, the degree to which participants are involved in existing data resources falls on a continuum. At the far end are fully participant-driven initiatives. For example, through organizations such as PXE International (https://www.pxe.org) and the Chordoma Foundation (https://www.chordomafoundation.org), affected individuals and families have systematically created online disease communities with a common purpose, generated resources needed to advance research and clinical care, and set the terms for provision of these resources to researchers and private firms while themselves conducting citizen science.¹⁶ The Life Raft Group (https://liferaftgroup.org) has similarly created data and other research resources for gastro-intestinal stromal tumors.¹⁷ Under the tagline, “Your data drives discovery” the Multiple Myeloma Research Foundation (https://themmrf.org) has adopted novel business practices derived from industry to establish a database, collected over 4,000 samples in a repository, refined diagnostic technologies, raised funds for research, sponsored sequencing projects, and cultivated industry partners.¹⁸ This initiative has been transformational by increasing life expectancy, in part through the ten drugs that have made it to market and the many more drugs that are still being tested. The Cystic Fibrosis Foundation (https://www.cff.org) funded early work, provided data access to patients, and made resources available that led to the suite of drugs now available to treat most forms of the disease.¹⁹ However, that model has faltered at the point of access to treatment due to pricing of the end-products, with salient controversies over coverage and reimbursement in the U.K., Australia, Ireland, France, Canada, and the U.S. To date, most of the strongest participant-driven projects focus on cancer or rare, often inherited, diseases.²⁰

Many valuable lines of research do not map to a constituency that can be organized around a single disease, however. For example, people with genomic variants usually associated with disease pathology, but who are actually healthy, may harbor clues about the underlying biology that cannot be discovered by only studying those with disease. Understanding factors that result in avoiding disease or determining age of onset will depend on data and materials from unaffected individuals, who are followed longitudinally. Large-scale studies can also reveal an individual's risk of various health outcomes, which when linked to therapeutic interventions should guide individualized wellness and prevention programs. This necessity is one of the compelling rationales for large-scale national genomic projects, such as All of Us (https://allofus.nih.gov) and the UK Biobank (https://www.ukbiobank.ac.uk). Some research study designs (for example, for most common disorders) would benefit from ready access to data about many people with few use restrictions, and simply cannot be organized around particular known diseases. Since all the uses cannot be foreseen in advance, the governance structure for such broadly used resources must rely on process and must credibly represent the rights and interests of the entire community. Attention also needs to be paid to privacy and security. There is some optimism that the technical solutions to allowing greater access to data while reducing privacy risks may emerge soon. Specifically, blockchain, homomorphic encryption and other modern multi-party encryption schemes may soon assist in enforcing process and policy; these ideas need to be pursued and, if workable, implemented.²¹

In sum, participant-centricity has a robust ethical and pragmatic policy justification and is critical for commons sustainability. Yet, despite prevailing rhetoric about the importance of being participant-centric, a landscape analysis of data-sharing efforts revealed that there is considerable work to be done.

In sum, participant-centricity has a robust ethical and pragmatic policy justification and is critical for commons sustainability.²² Yet, despite prevailing rhetoric about the importance of being participant-centric, a landscape analysis of data-sharing efforts revealed that there is considerable work to be done. The current system varies greatly in its involvement of participants and respect for their rights and interests. Many data structures have been built to address the needs of researchers, clinicians, private firms, or institutions, or were built in an era when individual control and reducing vulnerability to mass privacy breaches were not priorities; this is not necessarily incompatible with participant-centric design, but the rights and interests of participants are often subordinate or marginal, rather than incorporated as a central design principle. At the very least, the role of participants in many of these efforts is not being made visible.

The participant-centric model requires ongoing, meaningful efforts to engage the participants and potential participants; it is not reducible to one-off engagement events. Systematic efforts to gather input from participants can inform policy and practice, as well as guide specific projects. But they are not enough. Our research revealed three important design principles for ensuring participant-centricity in an MIC: (1) an MIC design should ideally involve opt-in consent by individual participants, (2) meaningful, ongoing representation of participants in governance is essential, and (3) there needs to be dynamic interaction with participants over time.

The clear message from community members who participated in one of the three Community Advisory Panels (CAPs) and were asked to weigh in on policies for an MIC is that opt-in consent should be required for inclusion in an MIC.²³ This is consistent with other studies that have found that participants prefer opt-in consent, except in unusual cases of public health or other collective good, for which opt-out may be appropriate.²⁴ We need not revisit here the general arguments for and against carrying out some research in the absence of consent or with opt-out options. We acknowledge that weighing all relevant considerations, opt-out or no consent may be appropriate in contexts such as public health surveillance, use of de-identified information from a single source, like an electronic health record or newborn blood spot collection, or for research where an inclusive dataset is genuinely necessary in order to produce unbiased results, subject to careful oversight and accountability mechanisms.²⁵ We further acknowledge that the very flexibility we have highlighted as a desirable feature of a commons may lead to stakeholders (participants included) setting rules for particular data commons that do not involve opt-in consent. This may be especially likely in countries and health system contexts where norms of solidarity and equality loom large and where there is less concern about potential insurance discrimination.²⁶ Nevertheless, during our research we found that MICs can trigger concerns that militate against opt-out or presumed consent.²⁷ Members of our advisory panels pointed to opt-out regimes in other contexts and described them as exploitative, noting they can erode trust and may come across as “sneaky.” Many of them favored dynamic, granular consent as an alternative. However, some did express reservations about this approach, concerned about participation of the digitally unsophisticated, potential burdens on the research enterprise, and unwelcome intrusion from incessant consent requests. Thus, they seemed to settle on a more balanced approach that involves both opting-in to participation and maintaining some individual control over data uses, coupled with knowing how their data are being used and governance structures that ensure fair and meaningful representation.

Perhaps one of the most important things we have learned from our work about participant-centricity is that if the rhetoric of reciprocal relationship (or participant empowerment, partnership, or engagement) is not matched by performance, distrust will result. One or a few instances of misuse of data or exploitation of participants have the potential to create skepticism or outright hostility toward the entire enterprise of building an MIC.

There is also general support for the idea that participants should have a seat at the table when decisions are being made, and participant representatives should be selected through a process that is attuned to diversity.²⁸ When given a choice among several options, a clear majority of community members across sites favored participant representatives having voting rights on governing boards. In addition, community members emphasized the importance of incorporating diversity of participants in governance. The expert stakeholders we interviewed who are involved in various aspects of data-sharing initiatives from diverse employment sectors (i.e. laboratory, academia, non-government organization, government, technology, and healthcare company) also emphasized the important role of participants in governance.²⁹ A few talked about this at some length, reporting dissatisfaction with the way that community representation on institutional review boards has worked out in practice and cautioning against tokenism. Some stressed the importance of giving participants a voice in choosing their representatives, for example via some kind of election process.³⁰ Expert stakeholders also understood and grappled with the importance of diversity. While a complete response to the diversity challenge was elusive, there was agreement about finding ways to involve a broad range of public representatives as well as advocacy communities and using a process for selection that results in geographical, socioeconomic, ethnic, health status, and other kinds of diversity. It was acknowledged that participants' rights and interests can only be fully represented if their diversity is recognized and represented.³¹

Finally, stakeholders from our research felt that it is important to interact with participants over time (but respect the wishes of those who would prefer not to be re-contacted). The individuals who participated on our community advisory panels were eager for a dynamic, reciprocal relationship, rather than a single transaction.³⁰ The professional stake-holders we interviewed — some of whom were themselves also participants in an MIC — mentioned that a few firms or platforms create an appealing participant experience. For example, professionals mentioned the Platform for Engaging Everyone Responsibly (PEER), which uses Private Access to allow individuals to tailor data sharing to their preferences and contribute data by completing self-paced survey instruments; the approach 23andMe has developed for reaching out to participants without being overly intrusive; and LunaDNA's proposed community-owned sharing model, which gives individuals who contribute their data for research a share in the profits generated from data access fees paid by researchers.³³ Community members and expert stake-holders also discussed the pros and cons of several strategies for giving information back to participants in an ongoing relationship with an MIC, including accessing raw data, returning individual and general results, showing community benefit, and offering opportunities to engage in citizen science. All are worth considering.

Perhaps one of the most important things we have learned from our work about participant-centricity is that if the rhetoric of reciprocal relationship (or participant empowerment, partnership, or engagement) is not matched by performance, distrust will result. One or a few instances of misuse of data or exploitation of participants have the potential to create skepticism or outright hostility toward the entire enterprise of building an MIC. For an MIC to be successful, it must be trustworthy.

How Can we Build Systems that are Trustworthy?

Several scholars have drawn attention to the importance of building trust among research participants for genetic studies.³⁴ Trust in the context of big data initiatives has been defined as “the willingness of a trustor to accept the potential risks involved in the sharing and further use of their personal data resulting from both optimism about the trustees' goodwill and interest in the public good.”³⁵ Several of the expert stakeholders we interviewed and participants on our community advisory panels described how difficult it is to re-build trust once it has been eroded. Building and maintaining trust was viewed by many as one of the most difficult and most important non-technical challenges of building an MIC.

Taking seriously the commitment to make an MIC participant-centric can go a long way in building and maintaining trust. In particular, building trust was seen as an iterative process that goes well beyond informed consent. Engaging with participants and including them in every aspect of an MIC, including its governance, shows respect for the values and priorities of participants and emphasizes the good intentions of other stakeholders involved in building and maintaining an MIC. In addition, in order for participants to have warranted trust in an MIC, an MIC must prove to be trustworthy.³⁶ Both expert stakeholders and members of our community advisory panels described four critical attributes of a trustworthy MIC: transparency, access to data within the MIC, security, and accountability.

Transparent and truthful communication was viewed by members of our community advisory panels as an intrinsic moral obligation, something that is owed to participants in exchange for their agreeing to share information with an MIC.³⁷ Similarly, the GA4GH identified transparency, conceptualized as clear and accessible information on data-sharing practices, as one of the principal aspects of responsible data sharing.³⁸ Individuals we spoke with also recognized that the more transparent an MIC is, the more successful it will be in recruiting participants and obtaining access to their sensitive health and related information. Some felt that simply communicating truthful information to participants would be enough; others expressed the need for more engaged communication that builds relationships and forms collaborations. Participants were interested in transparent communication about how data are being used (or not) and why, how the commons is governed, what security mechanisms are in place, when data breaches occur, and how data breaches are being dealt with. Cultural change is needed in the research and clinical care communities so that transparent communication is woven into the fabric of all the data commons and other initiatives that make up an MIC. Technical solutions are also needed to facilitate more user-friendly and accessible modes of communication.

Giving participants access to their own data, and making sure that those data meet quality standards, are also considered essential elements of a trustworthy MIC. In the U.S., individuals have a right under the Health Insurance Portability and Accountability Act (HIPAA) to request a copy of their health data from covered entities. This right of access applies to all data about the individual held by a covered entity in one or more “designated record sets,” and broadly includes medical records and “other records that are used, in whole or in part by or for the covered entity to make decisions about individuals.”³⁹ Even when not legally compelled, however, giving participants access to their own data can empower them and engender trust.⁴⁰ Yet, several of the expert stakeholders we spoke with stated that people rarely request their data. If this is true, it is important to study why (e.g., do participants not know they can access their data and how to do it, or are they being obstructed in some way?).⁴¹ Regardless of whether there is a legal right of access, MICs should assume an obligation to ensure that individuals have access to their individual-level data, if desired. If this principle is built into the design from the beginning, it will ensure the system retains this feature, which is essential to long-term trust. Trying to retrofit it into a system that has not accommodated individual access will be much more expensive and difficult.

Participants on our community advisory panels also emphasized the importance of having access to data that are accurate and reliable. Our expert stakeholders agreed, noting that much of the data currently in data commons are of such low quality that the data cannot be trusted.⁴² Funders, data generators, and other stakeholders should thus ensure that quality standards are in place and must, at a minimum, be transparent about the quality of their data.⁴³ This requirement is important for research integrity and trustworthiness of the system; if participants can access their information in an MIC but that information is inaccurate or unreliable, then an MIC may be perceived as untrust-worthy and efforts to build trust by providing access could be undermined.

Finally, in order for an MIC to be trustworthy it must have security measures in place to ensure that data are used only by approved users for authorized purposes. Data security is largely a technical challenge, one critical for building a trustworthy MIC. Recent privacy breaches, such as the ones at Equifax and Facebook, have increased concern about the security of personal, financial, and health information.⁴⁴ De-identification may be one way to protect privacy in the event of a data breach, although re-identification may be difficult to prevent. Some uses of data can be free and open, such as when “data altruists”⁴⁵ have deliberately made their data freely available, such as through Open Humans (https://www.openhumans.org), or when the private elements are not needed for analysis. However, most data in an MIC are much more valuable when they can be linked to individuals, and if there is sufficient data about an individual within an MIC, including genomic data, then there is a potential for re-identification.⁴⁶ For this reason, mechanisms beyond de-identification are needed to secure personal data, including having a robust informatics system that tracks approved uses and users of the information and prevents unauthorized access and misuse, including unauthorized downstream re-disclosure and re-use. In the event of a breach, participants should immediately be informed and told what will be done to protect them and to prevent a similar incident from happening in the future. The rules for governing data security as an important element of the commons are a work in progress.

A more robust system of accountability, with sanctions for misuse, is needed. Some participants from our community advisory panels worry about what legal recourse they have if their data are misused or stolen. The systems of accountability that are in place were uniformly thought to be inadequate because they are not comprehensive and there is insufficient enforcement and sanctions. For example, as mentioned above, although GINA protects against genetic discrimination in employment and health insurance in the U.S., it does not protect against discrimination in life, disability, and long-term care insurance.⁴³ Likewise, although there are sanctions imposed under HIPAA for the misuse of protected health information in the U.S., individuals have no real recourse when they become a victim of a privacy breach. There is no appeals process for IRB determinations, and there are limited enforcement mechanisms to ensure that institutions that share data do so according to the use limitations (the most severe sanctions typically consist of loss of data access privileges or funding, versus civil or criminal penalties). A more comprehensive system of accountability rules that has clear enforcement mechanisms in place, which could include audits, a private right of action for participants, or stronger sanctions for violations, would help build trust in the system.⁴⁸

Conclusion

This paper considers the potential for a sustainable MIC that facilitates open and responsible data sharing to emerge from the “ground up,” through loose coordination and adherence to a set of high-level design principles rather than through imposition of a uniform structure. As Elinor Ostrom described, those high-level design principles must be agreed to by all stakeholders and should appeal to both ethics and pragmatism. Our research suggests that stakeholders broadly agree that an MIC should be both participant-centric and trustworthy. In addition, in order for the data resources that emerge to be sufficiently powerful to support the type of research needed to understand genotype-phenotype correlations, revolutionize clinical care, and reinvigo-rate public health, including addressing health disparities, custodians must be more concerned with how to share these resources openly yet responsibly than with maximizing profit or professional notoriety from the data. We also need to make sure that with so many different actors and rules in play, there are clear ways to create a networked environment that allows data to be easily aggregated and used. Otherwise, we risk the problem of an anti-commons: limited, cumbersome access and limited use.⁴⁹

Despite these concerns, building an MIC is not a pipe dream. The gap between its achievement and its potential will depend critically on design decisions about participant-centricity and trustworthiness for both the constituent elements and for the system as a whole. Those design decisions lie in the hands of individual participants and their advocates, research institutions, governments, private firms and nonprofit organizations. We will all reap the benefits of the system we design.