Part of the "2016 Annual Conference: Big Data, Health Law, and Bioethics" held at Harvard Law School on May 6, 2016. This conference aimed to: (1) identify the various ways in which law and ethics intersect with the use of big data in health care and health research, particularly in the United States; (2) understand the way U.S. law (and potentially other legal systems) currently promotes or stands as an obstacle to these potential uses; (3) determine what might be learned from the legal and ethical treatment of uses of big data in other sectors and countries; and (4) examine potential solutions (industry best practices, common law, legislative, executive, domestic and international) for better use of big data in health care and health research in the U.S. The Petrie-Flom Center for Health Law Policy, Biotechnology, and Bioethics at Harvard Law School 2016 annual conference was organized in collaboration with the Berkman Center for Internet & Society at Harvard University and the Health Ethics and Policy Lab, University of Zurich. Learn more at http://petrieflom.law.harvard.edu/events/details/2016-annual-conference.

1. 1
Big Data and Individual Autonomy in a
Crowd
Barbara J. Evans, Ph.D., J.D., LL.M.
Director, Center for Biotechnology & Law
University of Houston Law Center
713-­743-­2993 • bjevans@central.uh.edu
Big Data, Health Law, and Bioethics
May 6, 2016

2. Source:
http://www.earthmagazine.org/sites/earthmagazine.org/
files/1324689388/i-­‐269-­‐7d9-­‐9-­‐2.jpg
1. Protecting
one’s
planet
from
external
impacts*
2. Marshaling
their
data
to
learn
about
themselves
Grand challenges all advanced civilizations meet
in the course of living long enough to
become an advanced civilization
* Rusty Schweickart, B612 Foundation

3. The Norm of Common Purpose*
The moral framework for 21st-­century science
may differ significantly from traditional
conceptions of clinical and research ethics
A “norm of common purpose… a principle
presiding over matters that affect the interests
of everyone”
“Securing these common interests is a shared
social purpose that we cannot as individuals
achieve”
* Faden, Kass, et al., Hastings Ctr. Rep. Supp (Jan-­Feb 2013)

4. The Most Valuable Data Resources for
21st Century Informational Research
• Deeply descriptive: integrates data from many
different data sources to provide a detailed
characterization of each included individual
• Large-­scale: reflects many different individuals
• Inclusive: include everybody or almost everybody
to capture rare events, minimize selection bias,
support hypothesis-­free testing where we do not
know ex ante which people, events, or traits hold
the answer.

5. Consumers →
↓ Data Holders
M
A
R
Y
P
A
U
L
A
M
Y
J
A
C
K
J
O
H
N
M
A
Y
A
D
A
N
S
U
E
Insurer 1 • • • •
Insurer 2 • • • • •
Clinic 1 • • • •
Clinic 2 • • • • • •
Hospital 1 • • •
Hospital 2 • • • • •
Clinical Lab 1 • • • • •
Clinical Lab 2 • • • •
Research Lab • • • •
DTC Lab • • • •
At home sensor • • • •
Fitness Tracker • • • •

6. What
Are
Information
Commons?
Data
Ownership
Data
Commons
Public
Domain
Data commons are not the data resources
themselves
They are institutional arrangements (like
laws or agreements) to facilitate collective
action to create and sustain the data
resources

7. 7
Major US Federal Regulations
affecting privacy and data access
• Common Rule consent requirements for use of
data and tissues
– 45 CFR Part 46, Subpt. A
– OHRP Guidance (August 2004 as updated)
– NPRM (Sept. 8, 2015)
• HIPAA individual authorization requirements for
use of protected health information
• FDA human-­subject protections and medical
device regulations affecting biospecimen use
PLUS: NEVER OVERLOOK STATE LAW!!

8. consents
to
data
use
no
consent
to
data
use
willing
to
share
data
Quadrant
1:
consent
alignment
Data
holder
and
individual
data
subject
both
consent
to
the
data
use,
possibly
in
response
to
policy
incentives
Quadrant
2:
data-­‐
holder-­‐driven
access
Data
holder
invokes
regulatory
exceptions
to
individual
consent
(e.g.,
de-­‐identification,
public
health
uses,
consent
waivers)
not
willing
to
share
data
Quadrant
3:
consumer-­‐
driven
access
Individuals
invoke
access-­‐forcing
mechanisms
(e.g.,
HIPAA’s
individual
access
right)
and
contribute
their
data
Quadrant
4:
legislated
access
Access
under
laws
that
require
mandatory
data
access
for
specific
public
health
or
regulatory
purposes
Individual
Data
holder
Shared Control of Stored Data