*The All of Us Research Program was created as part of the Precision Medicine Initiative (PMI). To learn more about how the All of Us Research Program is rooted in precision medicine, see our Program Overview.
The Precision Medicine Initiative (PMI) launched in January 2015 to accelerate “biomedical discoveries and provide clinicians with new tools, knowledge, and therapies to select which treatments will work best for which patients.” Precision medicine is enabling a new era of clinical care through research, technology, and policies that empower patients, researchers, and providers to work together toward development of individualized care. Advancing the science of medicine also calls for a change in the culture of medical practice and medical research to engage individuals as active collaborators—not just as patients or research subjects.
As part of its commitment to ensure that privacy is built into the foundation of the Precision Medicine Initiative, the White House convened an interagency working group in March 2015 with the goal of developing the following Privacy and Trust Principles. The principles provide broad guidance for future PMI activities regarding: governance; transparency; participant empowerment; respect for participant preferences; data sharing, access, and use; and data quality and integrity. The principles articulate a set of core values and responsible strategies for sustaining public trust and maximizing the benefits of precision medicine.
The Privacy and Trust Principles were developed by an interagency working group that was co-led by the White House Office of Science and Technology Policy, the Department of Health and Human Services Office for Civil Rights, and the National Institutes of Health. The Principles were developed after and were informed by a series of expert roundtables, review of the bioethics literature, an analysis of privacy policies and frameworks used by existing biobanks and large research cohorts, and comment from the public.
In addition to the Privacy and Trust Principles, PMI is taking steps to build security practices into the development of the initiative to ensure the confidentiality and integrity of all PMI data. The Security Policy Framework will draw on industry’s best practices in identifying strong administrative, technical, and physical safeguards to ensure the confidentiality and integrity of all PMI cohort specimens and data, and will be reevaluated regularly to keep pace with an ever-advancing technological environment.
-
Governance should include substantive participant representation at all levels of program oversight, design, implementation, and evaluation.
-
Governance should create and maintain active collaborations among participants, researchers, health care providers, the Federal Government, and other stakeholders.
-
Governance should ensure regular assessment of policies and practices in order to maintain currency with scientific, technological, and ethics-related developments.
-
In addition to complying with all applicable laws and regulations governing privacy, security, and research with humans, those who use or manage PMI data should be required to adhere to the rules developed by the established governance system in furtherance of the principles outlined here.
-
Governance mechanisms should ensure accountability; responsible data management; protection against any intentional or unintentional unauthorized access, use, disclosure, or re-identification of PMI data; and proper identification, management, and mitigation of breaches.
-
Communications with participants should be overseen centrally in order to ensure consistent and responsible engagement.
-
Special considerations related to engaging and communicating with certain populations (e.g., children or decisionally-impaired individuals) should be addressed.
-
Risks and potential benefits of research for individuals, families, and communities should be considered.
-
The potential for research to lead to stigmatization or other social harms should be identified and evaluated through meaningful and ongoing engagement with the relevant stakeholders.
-
Researchers and other data users should be informed of and subject to consequences for failure to adhere to all rules developed in furtherance of these principles.
-
A dynamic information-sharing process should be developed to ensure all PMI participants remain adequately informed through all stages of participation.
-
Information should be communicated to participants clearly and conspicuously concerning: how, when, and what information and specimens will be collected and stored; generally how their data will be used, accessed, and shared; types of studies for which the individual’s data may be used; the goals, potential benefits, and risks of participation, including risks of inappropriate use or compromise of the information about participants; the privacy and security measures that are in place to protect participant data, including notification plans in the event of a breach; and the participant’s ability to withdraw from the cohort at any time, with the understanding that consent for research use of data included in aggregate data sets or used in past studies and studies already begun cannot be withdrawn.
-
Information should be made publicly available concerning PMI data protections and use, and compliance with governance rules.
-
Participants should be notified promptly following discovery of a breach of their personal information. Notification should include, to the extent possible, a description of the types of information involved in the breach; steps individuals should take to protect themselves from potential harm, if any; and steps being taken to investigate the breach, mitigate losses, and protect against further breaches.
-
All users of PMI data should be expected to publish or publicly post a summary of their research findings, regardless of the outcomes, as a condition of data use. To enrich the public data resource, mechanisms for data users to integrate their research findings back into PMI should be developed.
-
PMI should enable participants’ access to the medical information they contribute to PMI in consumer-friendly and innovative ways.
-
Educational resources should be made available to participants to assist them in understanding their health information and to empower them to make informed choices about their health and wellness.
-
Innovative, responsible, and consumer-friendly ways of sharing research data with participants should be developed. This could include sharing aggregate research data, research findings, information about ongoing research studies, as well as data collected about participants.
-
Data access, use, and sharing should be permitted for authorized purposes only. Certain activities should be expressly prohibited, including sale or use of the data for targeted advertising.
-
Multiple tiers of data access—from open to controlled—based on data type, data use, and user qualifications should be employed to ensure that a broad range of interested communities can utilize data while ensuring that privacy is safeguarded and public trust is maintained.
-
PMI should use privacy-preserving methods to maintain a link to participant identities in order to return appropriate information and to link participant data obtained from different sources.
-
Unauthorized re-identification and re-contact of PMI participants will be expressly prohibited. Data analyses should be conducted with coded data to the extent feasible.
-
Measures for protecting PMI data from disclosure in civil, criminal, administrative, legislative, or other proceedings should be explored.
-
Data quality and integrity should be maintained at all stages—collection, maintenance, use, and dissemination. Standards of accuracy, relevance, and completeness should be appropriately up-to-date.
-
Participants should be able to easily report any inaccuracies in information maintained by PMI and request that such inaccuracies be addressed in PMI records.
-
PMI should be broadly inclusive, recruiting and engaging individuals from communities with varied preferences and risk tolerances about data collection and sharing.
-
PMI should promote participant autonomy and trust through a dynamic and ongoing consent and information sharing process. This process should enable participants to engage actively in an informed and voluntary manner, and to re-evaluate their own preferences as data sharing, use requirements, and technology evolve.
-
Participants should be able to withdraw their consent for future research use and data sharing at any time and for any reason, with the understanding that consent for research use of data included in aggregate data sets or used in past studies and studies already begun cannot be withdrawn.
-
Participants should be provided choices about the types and frequency of communications they receive, and about the circumstances under which they would like to be re-contacted for certain purposes, such as to collect additional information or specimens for supplementary research activities.
