Description
We distinguish here between the context of providing health care, which is a highly regulated and complex area, and the specific use case where an individual's information is being sought for use in health care research. The particular case here involves a person whose disease has experimental treatments available. We will assume for this case that the person is both an adult and capable of making decisions for themselves and giving consent. This use case may be extended into the future to account for pediatric research or research involving persons deemed incapable (mental health for example). We also note that there may be a predecessor or stereotypical case - Human Research Consent - that encompasses any research project that has humans as subjects. This could include but is not restricted to areas like human-computer interface research, social sciences research or marketing research.
Narrative
Alice has been diagnosed with cancer and is being treated by her doctor, Dan. Dan is an oncologist with an active research agenda and is aware of a Phase III trial of a new drug for the type of cancer that Alice has. The trial is a randomized unblinded two-armed study that compares the standard of care (the treatment that Alice is currently receiving) vs standard of care plus the new drug.Two-armed means that the patients in the trial will be divided into two groups randomly (hence randomized). It is an unblinded study, which means that patients will know which arm they are on. While Dan is not an investigator on the study, he feels that Alice should be presented with the option of participating in the study. This use case starts after Alice has made the choice, in discussion with Dan, to participate in the study. We note that this narrative elides over whether or not Dan's use of Alice's health information to determine if she might be a candidate for research raises its own set of consent and use issues. Dan will provide Alice with treatment, including the experimental drug if she ends up on the experimental arm, but will not use the data in her health record for the study. If Alice consents, the study team will be provided with regular data extracts from her health record for the purposes of their research. To enable this data extract Bob from the study team will seek consent from Alice to participate in the study, using their standard consent form. Alice will be assigned a study number (typically a random number of some kind.) The study team will regularly extract health data from her record in accordance with the consent until a defined study end-point is reached or Alice withdraws from the study. Each tranche of data collected by the study team will be de-identified (used) and tagged with Alice's study number. The de-identified data will be sent to the drug manufacturer who is the sponsor of the trial. The drug company will use the de-identified data to evaluate the study results and produce any necessary regulatory or research results.
For the purposes of this discussion group, the consent that Alice agrees to is a 'contract' which can be recorded on a blockchain. It may be the case that each data extraction and/or each transfer of data to the drug sponsor may be recorded as well. Until the data is de-identified, the study team will record access to and uses of the data on the blockchain. These transactions on the blockchain will enable Alice to verify that her data is only being used for the purposes set out in the consent/contract and only by authorized people.
Question for the discussion group: Should the de-identified data, after transfer to the drug company, be included in the use case?
Related
Alice gives consent, assents or approves the collection, use and disclosure information about her for the purpose of clinical research. See these resources for some ideas:
Alice Authorizes Clinical Research from HEART (talks about an aggregator subsequently sharing with clinical researchers)
Alice Selectively Shares Health-Related Data with Physicians and Others from HEART (talks about deidentified data)
The GA4GH folks have a committee that created a model data sharing consent form in CommonAccord. There's capacity for it to be signed. (This is perhaps where we want to concentrate our efforts.)
Jim shares this link as a resource for helping with the first use case.
Champion / Stakeholder
John Wunderlich
Actors
<<Provide a list of the actors, including what type of entity they are and what their role in the use case.>>
<<Should we consider including bad actors who do not do what they are "supposed to"?>>
Actor | Technical Role | Role in the use case |
Alice | A person who sends a message. | The patient who is the subject of health research and whose consent is required to enable the research. |
Bob | A person who receives a message. | The person or entity that seeks consent from Alice |
| Study Sponsor | The organization that receives de-identified data including Alice's data. | |
| Study Team | The individuals who collect Alice's information at the health organization where she receives care. Bob is a member of the study team. | |
| Dan | None | The attending physician who informs Alice about the health research but is not part of it. For this use case, we separate the attending physician and the investigating physician so that there is a clear demarcation between access to health information for treatment and access to health information for research. We recognize that this is a bit of a contrivance but do so nonetheless to clarify the roles and data flows. |
Mal | A person who intercepts a message. | Generic bad actor |
Prerequisites / Assumptions
<<Provide a description of all assumptions or prerequisites that need to be in place for the use case to be applicable or possible.>>
Use Case Diagram
<<Provide the list of steps.>>
1 | Alice sends Bob a Message. |
2 | Bob thinks about it. |
3 | Bob sends Alise a Response. |
<<Do we want to use sequence diagrams? There's a nice online tool here.>>
End State
Describe the end state or states at the end of the Use Case. If the use case proceeds as it is supposed to, what is the successful (and hopefully testable) end state. If the use case does not proceed, how does it fail?
Success
Failure