Data Registry Gives Patients Control
Patients Designate What Information Can Be Used for Research
Health advocacy group Genetic Alliance recently unveiled a registry that enables patients to control at a granular level how health information is shared with medical researchers, says Greg Biggers, a leader at the group.
The new Reg4All "is the world's first participant controlled health and disease registry," says Biggers in an interview with HealthcareInfoSecurity (transcript below). "It's a place where anyone can come and add their piece to the health puzzle. ... Anything that I store there as a participant, I have complete control over." Stored information can include data from electronic health records as well as genomic data, he says.
In the interview, Biggers explains:
- How a third-party service manages the identity of patients, and the role encryption plays in Reg4All;
- How patients can choose to share their data with others, such as support groups or "big data" medical research repositories;
- How researchers get authorized to use Reg4All data and how the scientists can use Reg4All to contact potential study participants.
Biggers serves on the council of the Genetic Alliance and is its entrepreneur-in-residence. The health advocacy group has a member network of more than 1,000 disease-specific advocacy organizations, as well as thousands of universities, private companies, government agencies and public policy organizations. Biggers is also CEO at Genomera, a technology company that focused on facilitating medical research and collaboration.
MARIANNE KOLBASUK MCGEE: Tell us briefly about Genetic Alliance and your role.
GREG BIGGERS: Genetic Alliance is known as a health advocacy organization, but we're a little unique in the advocacy world. Genetic Alliance is actually a network of over 10,000 organizations around the world that are related to health, health research, health advocacy and helping consumers claim their own center of control over their health. Among those 10,000 organizations are over 1,200 disease- or condition-specific organizations. ... My role at Genetic Alliance: I've served on our board - we actually call it a council, but it is much like a board of an organization - for a few years. I have recently come in-house for a time as entrepreneur-in-residence helping Genetic Alliance meet this next inflection point in what the world needs out of us and what we can bring the world in terms of going beyond traditional advocacy or actions. Now [we are] actually launching some innovative products and services into the world like this Reg4All that we'll be talking about today.
MCGEE: Tell us about the Reg4All project and how this initiative can enable patients to control the privacy of their data while they share that information with researchers.
BIGGERS: Reg4All is the world's first participant-controlled health and disease registry. It's a place where anyone can come and add their piece to the health puzzle for themselves and for the world. In the health profession there is this thing called a registry, which has existed for many years. There are many registries scattered around the world. This new initiative, Reg4All, is unique in two different ways compared to all the other registries around the world. The first one is that it's participant-controlled as I mentioned. So, anything that I store there as a participant, I have complete control over. The second thing that is unique about Reg4All compared to most other registries in the world is that it is cross-disease, spans all of health.
Many of the registries around the world are specific to a particular condition or group. What we are realizing ... is that these boundaries we've put between conditions often are artificial. So it's time to stop artificially segregating things like vitiligo, which is a rare condition about skin pigment, from mild hypothyroidism or from the effects of a car accident I was in. All these things are integral to my whole health and so ought to be able to be treated in an integral way in addition to being sliced and diced more specifically the way traditional registries work.
Sharing Genomic Data
MCGEE: What sort of information do patients share about themselves via Reg4All? For instance is there a way for them to eventually share complex data like genomics data? Are there third-party sources that contribute the patient's data, including healthcare providers or others?
BIGGERS: Where Reg4All is going is a very comprehensive source for data about people. ... So it starts with a low-intensity but a very engaging experience that is kind of like a gamified survey. I, as a user for Reg4All, just begin answering some simple questions about myself and my health, and it is things like: How do I sleep? How informed do I feel about my health? ... If I continue to go through this survey - and I can stop at any time I'd like - it includes a handful of what the National Institute of Health call their common data elements. The NIH and a few other organizations have agreed on...[a] baseline set of health information we ought to be collecting about anyone regardless of what their conditional disease is. So it includes those things. And then it asks me about what kinds of conditions I've been diagnosed with, and based on the items I tell [the survey] about my health, and what things I might be struggling with or I have been diagnosed with, then the system will in a personalized manner guide the next kind of data it collects from me based on those [answers]. So if I say I suffer from liver disease, it will then start to bring in much more liver-specific kinds of questions and prompt me for data about that, for example. So that's [the] kind of very engaging set of experiences we set up for the users. Then we add to that even more disease- or condition-specific questions [developed by] ...experts in the 13,000 known diseases in the world [and are] working with the foundations that support patients with those diseases, as well as their scientific advisory boards.
[So this] is a massive undertaking ... what we're launching right now. We will add to that the ability to automatically import critical data records from electronic medical record systems. In the United States, the [HITECH Act] regulations driving [adoption of] electronic medical records mean that by the end of 2013, anyone whose data is stored in an electronic system in their clinic or their hospital will have the right and the ability to have that data either downloaded for their own use or forwarded to another system like Reg4All. And then we're also collaborating with some groups to help us bring in other kinds of complex data sets, such as genomics. ... The idea here is ... whether it's simple survey answers or very specific disease-related questions, or if it's my clinical records or my genome or whatever it is, we're providing a place for the individual ... whom that data is [about] to control everything about that data.
MCGEE: Can you tell us a little about the security technologies that are involved in allowing patients to control what data is shared? For instance, will there be data segmentation? Will there be electronic authorization in terms of giving permission to opt-in or to opt-out to certain studies?
BIGGERS: At the time that I create my account with Reg4All it actually creates links for me in two different systems. One is the place where my health data is being stored. The second system is a place that handles a few things about my identity and what permissions I'm setting for what other people might do or not do with my data. We've kept those systems completely separate from one another and it's actually [a] third party that runs the identity and authorization service. So the only link between the two is, in technical terms, an encrypted foreign key that when the identity service authorization service says I have authorized this [event] to happen, it then sends over the key to decrypt my health data for use of whatever I've [provided consent] for. ... At a very, very granular level I have control over everything about my data. I even choose what data I'm storing. We think the much bigger power of the system and the exciting kind of moral center of Reg4All is that, I as a participant choose everything that can happen with the data I am storing.
So for example I can choose whether or not I want to be discoverable by researchers based on some of the data about my health. And this doesn't mean they get to know my identity. But we will be [providing] an interface to researchers where if they are looking for cohorts for some research study, they can search based on criteria of the people they need in a research study. Then I can also control whether I am open to be contacted for things like studies or cohort development, and if I have said yes to that, then the researcher who is developing this cohort has the option to reach out to me via Reg4All. I'm still not yet identified to that researcher. Reg4All handles the communication. I get a communication saying, "There is a researcher over here who would like to talk to you about a study they are doing." And it's not until I say "yes" that the actual direct contact has been facilitated between the researcher and myself. I can also [designate] certain groups or certain doctors I'm always willing to share my data with. So, for example, if I'm in a liver cancer support group and I already know I want to share this set of data with that group, I can share this portion of my data with that group. Don't ask me every time they want to see it, just do it.
MCGEE: Will patient data that gets stored on the Reg4All site get stored in databases, and how are researchers who access that information authenticated?
BIGGERS: As each participant desires, yes there will be opportunities for participants in Reg4All, to share their data with "big data" kinds of databases. ... As Reg4All validates certain research projects ... then I as a participant of Reg4All am given the option, "Would you like to share your data with this project at Sage Bionetworks?" for example, or with this worldwide repository of breast cancer variance that we are trying to make open-source. But again, it is so important to us here that each participant gets to choose whether they want to do that. So coming into Reg4All as a user, no assumptions are made about what I might want to share or keep private. And I can say I want to make everything public - and I know [some] people do that. But more often people are saying, "Yes I am willing to share this and this with these three groups, [but] ask me for all the rest.
You also asked about how we validate what researchers are able to use the system ... and data in the system. We are starting by using the same criteria that the U.S. government regulatory bodies use for validating good and ethical research. So we're starting by saying we will use the same criteria that [is] required to have a study listed in the ClinicalTrials.gov website. And it is important to note, we're not doing this because we are U.S.-centric, but a lot of thought has gone into the governance of that [ClinicalTrials.gov] system, which happens be run by the U.S. government, and that is a good starting place for us.
Over the next year or two, we'll look for ways we need to grow beyond just those criteria, but it's a good starting point. And so [a participating research user could be a] respected researcher at a commercial or academic institution [who has] received approval from their IRB, their Institutional Review Board, which is the ethics and safety oversight kind of committee that approves or disapproves particular research proposals. So any researcher or study that has met the criteria to be listed in ClinicalTrials.gov we will also welcome into our system.
MCGEE: Would the principle policies and technologies used have potential to be applied elsewhere in healthcare to protect patient data? For instance, would health information exchange organizations be able to use the principles behind this to manage their sensitive patient data?
BIGGERS: Well what we know is that this approach is absolutely needed and useful for Reg4All and for speeding translational research. We are excited about how the moral center of what we're doing here might affect the rest of health and healthcare, but I think it is important to note that we think of this as, not a way for Reg4All or for Genetic Alliance to manage information, but this is a way for individuals to manage their information. So the focus of control is radically different. It's not an institution managing it. It's saying, "Let's let each individual express their desires for how their data is used or protected." ... So we think of this actually more about choice of expression than privacy per say, although the condition of privacy is controlled by what you share and don't share.
But to answer your question a bit more directly, we would love to see these notions be included in clinical medical records management. ... But we have our hands full doing it just in our project, so we don't have any plans to go make that happen soon, but we're always open to collaborating with advanced thinkers ... in the electronic medical record field.