By Henry T. Greely

Researchers, research institutions, health care organizations, and others are busily creating vast repositories of tissue samples and health information about hundreds of thousands, or millions, of people. Some of these repositories are mainly samples, some are mainly data (silicon-based), and some are both. I will refer to them all broadly as "biobanks."

These biobanks are being created for good reasons. Researchers are desperate to get more-more samples, more analyses, more health records, more data, from more people, with more diseases, in more different settings. And they are right to be eager. Massive quantities of data may allow us to tease out the causes of various diseases and give us leads toward prevention, treatment, or cures. More immediately, research use of detailed electronic health records may allow us to make today's medicine safer, cheaper, and more effective. (Research from an HMO's electronic health records, for example, helped reveal the heart risks of Vioxx.)

But these biobanks also hold risks. The people whose tissue, DNA, or health records are stored in biobanks could be harmed. And cases of such harm could prompt a backlash, ultimately slowing medical progress. In their desperate quest for data and samples, researchers, aided and abetted by narrow interpretations of the laws, regulations, and ethical precepts governing human subjects research, are riding roughshod over the reasonable expectations-and the appropriate rights-of the people whose data and materials they are using.

Those expectations relate to consent to research, control over what research is done, privacy protections, and sharing of significant results with those whose samples and health information make the whole enterprise possible.

Most people think they need to give their consent before they can be research subjects. This is not unreasonable. A U.S. military court ordered several Nazi researchers executed for violating the first tenet of what came to be known as the Nuremberg Code-no research without the research participant's consent. That broad rule was never entirely true, but it is being stretched increasing thin, in troubling ways. For one thing, the U.S. government has decided that if the research samples or data cannot easily be connected to an identified person by the particular researcher doing the work-even though someone knows whose data is involved and many people could be identified by people who really wanted to do so-it isn't "really" human subjects research. Parents in Texas and Minnesota discovered, to their surprise, that this included blood spots from their newborn babies, taken for medical screening, with no consent, but then used for research.

Of course, many people actually do consent for research, often on a particular topic that is of interest to them. Members of a family with a strong history of Alzheimer disease or breast cancer will often volunteer for research on that disease. They may later discover, to their shock, that their data is being used for research on topics they did not consent to, did not know about, and do not like. In the case of the Havasupai, a Native American people in Arizona, this included research they found deeply offensive. This secondary research often proceeds not just without the participants' consent but without any oversight by IRB's; if the data and samples are viewed as unidentified, it isn't human subjects research-even if it looks at the DNA and health records of real, live humans.

A recent study looked at people who had volunteered for a study of the genetics of Alzheimer disease, who were then asked to let their data and material be used for broader research. Eighty-eight percent of them agreed to this broader use-although that's a pretty good number, the twelve percent who refused are not trivial. On the other hand, a survey of those who agreed to further research uses showed that ninety percent of them believed it was important that they had been asked.1

Some people may not care, as long as their privacy is protected. But is it? In some situations, research data can be legally obtained by the police, attorneys, or anyone else with a court order. In other cases, even protected data can be illegally, or accidentally, obtained for non-research purposes-through hacking, through lost or stolen computers, or even when people with legitimate access to data use it for inappropriate reasons. (Ask celebrities how strongly protected their health information is when they go to a hospital.) At one extreme, researchers make data anonymous, stripping all the identifiers from it and therefore, they argue, fully protecting privacy. But even this "anonymization" is a fiction. Give me date of birth, sex, height, weight, and place of birth of an anonymous person and I'll bet that, with a little work, I can usually give you his or her name. Give me all the information in a detailed electronic health record and it should often be easy.

This is not an entirely hypothetical boast. A few years ago, the then-governor of Massachusetts, William Weld, ordered all health records for state employees and Medicaid recipients to be made available to researchers. Don't worry, he said, no records will be identifiable. A couple of days later, a computer scientist named Latanya Sweeney visited the governor's office and handed his receptionist copies of the governor's medical records. She had identified them using only publicly available motor vehicle and voter registration databases.

Finally, biobanks will often contain important information about research participants that those people themselves don't know. Consider, for example, a brain scan that shows a tumor or a genetic analysis that reveals a very high health risk. Most people assume that researchers will tell them, or their doctors, about this important information. Most research projects, however, expressly promise not to return any information, no matter how medically significant. This is a scandal just waiting to happen, the first time the widow of a dead former research participant realizes that the researchers had information that could have saved her husband's life- if he had been told about it.

Now, in fact, many people-perhaps most people-are happy to participate in medical research. But they have reasonable expectations about taking part in research. They want to have their permission asked. They want to know what their samples and information will be used for. They want to know just how private their information will be. And they want to know that researchers, whose work- whose careers-the research participants make possible, will care enough about those participants to warn them of health risks they uncover.

The underlying problem in all these cases is the mismatch between what the research participants think is happening with their samples and data and what is actually happening. Whatever else happens, a systematic violation of the expectations of people whose tissue, blood, DNA, and personal health information is being used in research is just wrong. And, more practically, if-no, when-they find out that their expectations are being ignored, they will be upset. At least, they should be. And their unhappiness- in some cases, outrage-could hold back important research.

I have made these arguments before, over many years-in more detail in academic journals,2,3 more broadly in a book chapter,4 and with equal fervor in an editorial in an ethics journal.5 The responses were, to be kind, underwhelming. I think it is time to move beyond careful analyses and impassioned editorials. It is time to challenge, in legal and political forums, the ways biobanks are created and run. It is time to get this right, to protect the rights and interests of research participants and to protect the future of important biomedical research. Who's with me?

Henry T. Greely, JD, is Director of the Center for Law and the Biosciences at Stanford University.



1. Susan Brown Trinidad et al., Genomic Research and wide data sharing: Views of prospective participants, GENET.MED.12:486-495 (2010)
2. Henry T. Greely, The Uneasy Ethical and Legal Underpinnings of Large-Scale Genomic Biobanks, ANNUAL REVIEW OF GENOMICS AND HUMAN GENETICS, 8:343-364 (2007)
3. Henry T. Greely, Human Genomics Research: New Challenges for Research Ethics, Perspectives in Biology and Medicine 44(2):221-229 (2001)
4. Henry T. Greely, From Nuremberg to the Human Genome: The Rights of Human Research Participants in MEDICINE AFTER THE HOLOCAUST: FROM THE MASTER RACE TO THE HUMAN GENOME AND BEYOND 185-200 (ed. Sheldon Rubenfeld, Palgrave, New York 2010)
5. Henry T. Greely, To the Barricades! AMERICAN JOURNAL

Search: GeneWatch
The Council for Responsible Genetics’ Genetic Privacy Manual: Understanding the Threats- Understanding Your Rights will be a comprehensive, electronic source of information for the consumer on these issues.
View Project
Cloning and Human Genetic Manipulation
View Project