HarvardMedicalSchool
CENTER FOR BIOMEDICAL INFORMATICS
Countway Medical Library
10 Shattuck St.
Boston, Massachusetts 02115
Isaac S. Kohane
phone: (617) 432-2145
fax: (617) 432-6039
isaac_kohane@harvard.edu
June 19, 2007
Honorable Members of the Committee:
I first wish to express my appreciation for the opportunity to present some perspectives on what is truly one of the central questions in health care delivery and biomedical research. That is, how does the increasing role that genetic and genome-scale personal data play in defining not only which sets of regulations best protect the patient while enabling maximum benefit to our citizenry from biomedical research, but which institutions are the best placed to be guarantors for the safety of the patient’s data and to ensure timely and efficient communication and interpretation of these data for biomedical research and for care of the individual patient. I will first direct my remarks to concerns about the existing weakness of the current system because these concerns inform me of what might be possible alternatives for the stewardship of healthcare data. I will then discuss some solutions that are particularly relevant to the practice of clinical research as it may be the application that is most affected by the convergence of genomic data and current privacy regulations.
As a clinician and as a biomedical researcher, it is clear to me, as it is to several of my colleagues that we have entered a period of momentous change but also of failings very much akin to what led to the report written by Abraham Flexner on behalf of the Carnegie Foundation and published in 1910. This report made the multitudinous failings of the healthcare education system of that time and its implications for the practice of medicine so abundantly clear that, in very short order, about half of the medical schools in the country closed. Among the problems noted at the time was that what was then the cutting edge in biomedical science, namely the growing awareness of the central role of infectious organisms in multiple diseases and the scientific basis for preventing and treating these diseases, was largely absent from most of the medical system in the United States. There are significant parallels today. It is with some concern that we should read a set of papers that I have referenced at the end of this testimony, which reveal that although a surprisingly large number, upwards of 30% of primary care practitioners, order genetic tests for screening patients for risk of future cancer, the principal reasons for these physicians ordering these tests are not their educational level nor necessarily their index of suspicion of a risk of cancer based on the family history. Rather, it is because the patients, often armed with web pages describing a potential risk to them based on the family history are arriving at the doctor’s offices and asking for the tests and these physicians are complying and indeed ordering these tests. Moreover, several studies have shown that for the same genetic tests clinicians are uncomfortable or even at a total loss as to how to interpret the results for the patients for which they were ordered. These tests do not have minor impacts. Some of them may lead to very dramatic preventative measures such as bi-lateral surgical removal of breast or ovaries. Incorrect interpretation of these same tests may incorrectly reassure the patients regarding their future risks with potential severe consequences. Additional studies demonstrate that marketing campaigns by genetic testing companies can increase the use of these genetic tests again without increased competence on the part of the clinicians in interpreting the results. In this context then, we have a full abdication of the traditional responsibility that a clinician takes for the timely and proper ordering of tests to maximize the benefit to the patient and minimizing unnecessary anxiety and procedures. The healthcare system is also abdicating its responsibility in providing the best possible interpretation of these tests in a way commensurate with the professionalism of our healthcare system. In face of these systematic failures highlighted by, but not unique to genomics, the opportunities for disintermediation of the conventionally formulated parts of the healthcare system are high indeed. Already there are several private sector initiatives to provide full testing, interpretation and counseling to individuals. These organizations may take the form of information service companies, home laboratory testing companies, medical publishers, or disease oriented for-profit or patient advocacy non-profit organizations. For some of the aforementioned examples, this will be the first time that that kind of organization is responsible for the safekeeping and privacy of highly personal and potentially clinically informative health care data. Several of these organizations will not be the end users of the data, nor will they be the generators of the data. A prismatic example of this sort are companies or organizations that create personally controlled health records. These are personalized databases that represent the accretion of healthcare information across the patient’s lifetime including their genomic data. Some of these companies are going to distinguish themselves from others by providing added value interpretations of these genetic tests particularly in the instances where the healthcare system has been singularly silent. What levels of regulatory enforcement should govern such companies? I am not a lawyer and it is certainly not clear to me whether or not they fall under HIPAA regulations. But more fundamentally, how are we going to ensure that they meet the reasonable expectations of patients for privacy and not exploitative use of their data if they agree to join one of these services? What if the interpretations provided by such companies outside the healthcare system and direct to consumer, provide erroneous information upon which unfortunate decisions are made subsequently? What liability infrastructure pertains? Is it the same as for the practice of medicine? In the end it is a matter of society’s expectations and whether we expect the same level of protection from these new entities as from the formally constituted healthcare system. As we wait for the societal expectations to complete their trajectory to implementation as practice and regulation, there are nonetheless some reasonable practices that we should consider. First, with regard to personal health records, almost every month we hear of the potential disclosure, accidental for the most part, of millions of personally identified records from a variety of stewards of our data ranging from commercial to governmental agencies. For this most personal data, particularly genetic data which is mostly constant for our whole lives and furthermore which is also disclosing of the health state of our relatives, we should and can be a lot more careful. At the very least all data should not only be transmitted as encrypted, but it should also be stored encrypted. Consequently, without the encryption keys, these databases will not be disclosing even if they “fall off the back of a truck.” Furthermore, as healthcare data is stored in personal health records lying outside the confines of healthcare institutions where the social contract of the patient-provider relationship provides additional security and confidentiality assurances, all disclosures should require the explicit consent of the patient. In our Internetworked society, such control by the individual or authorized proxy is not only feasible but has been implemented by several groups, including ours for the Indivo personally controlled health record at Children’s Hospital, Boston. An important rate-limiting step, however, to the widespread adoption of this model of personal control is the streamlined implementation of a web-enabled system of delegated “trust.” With such a web of trust, the patient can readily determine the degree to which a party to which they are disclosing their data is in fact known and trustworthy. There are a multitude of distributed solutions and centralized solutions to this implementation but in either instance, the Department of Health and Human Services can serve a catalytic role by vetting one or more of these and educating health-data hosting organizations, vendors and the public in the use of such systems. At the same time, continued support for the implementation of institutional, provider-oriented electronic health records will provide the substrate with which all the personally controlled health records will accrete a life-long record of each patient’s health.
To the same degree that there is concern about whether HIPAA is sufficiently expansive to cover the many uses to which genomic data types might be employed, there is also concern that where HIPAA is already in place it may be potentially acting against the best interests of patients. Here however, information technology and the precise nature of genomic data allows us to create novel solutions that overcome these deficiencies in our system without necessarily requiring overhaul of our regulatory infrastructure. Precisely because of worries that have been articulated by diverse groups, including the biomedical research establishment, there has been increasing fastidiousness with which information flow in human biomedical research is approached. Specifically, in the large genomic population studies of which we read now almost every week in the popular press. In each of these studies, great pains are taken to ensure that there is mutual ignorance between patient or study subject and researcher. That is, that the researchers ensure that they do not know the identity of any of the patients corresponding to any of the measurements in any given study. Conversely, the patients agree that they will not know the results of tests that were performed on them during the study, specifically of the genetic measurements made upon them in such a study and especially if the findings are beyond the scope of the original study. As a result, if there were any finding that might pertain to the patient’s health or an opportunity for eliminating the risk of a disease or more effectively treating an existing a disease of that particular patient, that opportunity to help the patient is lost. In a recent article in the magazine Science, we described a mechanism, that can be implemented today, whereby we could maintain the anonymity of an individual and yet use information technology and healthcare data to allow patients to fully benefit individually and not just as an altruistic member of a class of individuals from their participation in that study. This solution depends on providing all study subjects with an electronic health record under their personal control that contains a copy of all their healthcare data. The biomedical research institution in parallel constructs an anonymized research database, as they would today. Then, findings of sufficient importance pertaining to a patient or set of patients are in essence anonymously “broadcast” over the Internet. If individual study subjects chose to “tune in” to these broadcasts, and specifically tune in for specific categories of broadcasts such as autism, heart disease or cancer, then if there is a match of their personal health record including their genomic data to that broadcast then they can be apprised while maintaining their anonymity from the perspective of the healthcare researcher. The individual therefore can benefit directly from their participation in a study. This benefit will not only likely cause increased satisfaction of the general public with the value of biomedical research but may increase very significantly the participation in clinical trials, a participation which is absolutely necessary if we are to develop the large population studies required to dissect out the genomic component of the basis of the disease burden of the citizens of this country.
In closing, we are at a potentially transforming moment in healthcare research and delivery where our country can take the lead in using genomic information and information technology to increase our ability to deliver individualized care of greater quality and with greater efficiency. To do so will ultimately require the kind of fundamental rethinking of our biomedical establishment that followed the report of Abraham Flexner almost one century ago.
Thank you.
Isaac S. Kohane, MD, PhD
Henderson Associate Professor of Health Sciences and Technology
Children's Hospital and Harvard Medical School
Director, Countway Library of Medicine
Director, i2b2 National Center for Biomedical Computing
Co-Director, HMS Center for Biomedical Informatics
References
Wideroff L, Freedman AN, Olson L, Klabunde CN, Davis W, Srinath KP, et al. Physician use of genetic testing for cancer susceptibility: results of a national survey. Cancer Epidemiol Biomarkers Prev. 2003 Apr;12(4):295-303.
Freedman AN, Wideroff L, Olson L, Davis W, Klabunde C, Srinath KP, et al. US physicians' attitudes toward genetic testing for cancer susceptibility. American journal of medical genetics. 2003 Jul 1;120(1):63-71.
Mouchawar J, Laurion S, Ritzwoller DP, Ellis J, Kulchak-Rahm A, Hensley-Alford S. Assessing controversial direct-to-consumer advertising for hereditary breast cancer testing: reactions from women and their physicians in a managed care organization. Am J Manag Care. 2005 Oct;11(10):601-8.
The Indivo Personal Health Record: http://www.indivohealth.org/
Kohane IS, Mandl KD, Taylor PL, Holm IA, Nigrin DJ, Kunkel LM. Medicine. Reestablishing the researcher-patient compact. Science. 2007 May 11;316(5826):836-7.