The first issue faced when conducting research with EHRs or on genetic conditions is whether informed consent is needed [23,24]. As set forth in the Common Rule and specified in US regulatory requirements, anyone conducting research with human subjects must have an institutional review board (IRB) review their study before initiation. Under the new federal regulations, referred to as the Final Rule [25], the definition of research remains unchanged as “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge” (see 45CFR46.102(l)). However, the classification of “human subjects” now includes detailed definitions about identifiable private information (ie, “private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information”) and identifiable biospecimens (ie, “a biospecimen for which the identity of the subject is or may readily be ascertained by the investigator or associated with the biospecimen;” see 45CFR46.102(e)).

If informed consent is required, it can be obtained directly from the research participant or the participant’s legally authorized representative. A legally authorized representative is determined by law or court authority. Under the Final Rule, individuals with intellectual disabilities or those with genetic conditions are not specifically referenced. However, research participants who may be “vulnerable to coercion or undue influence” or those with “impaired decision-making ability” are mentioned. Examples of these potential participants may include children, prisoners, or those with intellectual disabilities.

In the informed consent form, researchers need to include whether any identifiable private information will be used as part of the study. It is unclear if a specific genetic condition, intellectual disability would fall under the definition of private identifiable information within the Final Rule. The code simply mentions that definition of will be reviewed regularly and updated as needed. Until then it appears that agencies who implement this policy will need to define what falls under the umbrella of identifiable private information. The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (see 45CFR160-164), which covers EHRs, does define genetic information and considers it protected health information. Like the Final Rule, HIPAA has specific requirements about sharing information, including data from an individual’s EHR. Thus, EHR research on specific genetic conditions would need to be reviewed by an IRB to determine whether informed consent should be obtained from participants.

There are cases, however, when a waiver of informed consent can be granted. The following criteria must be met to request a waiver: (1) the research involves no more than minimal risk to the subjects; (2) the research could not practicably be carried out without the requested waiver or alteration; (3) if the research involves using identifiable private information or identifiable biospecimens, the research could not practicably be carried out without using such information or biospecimens in an identifiable format; (4) the waiver or alteration will not adversely affect the rights and welfare of the subjects; and (5) whenever appropriate, the subjects or legally authorized representatives will be provided with additional pertinent information after participation (see 45CFR46.116(f)). In general, local IRBs need to interpret the regulations and determine if a study qualifies as research on human subjects, and if so, whether a waiver of consent can be granted when conducting EHR research on genetic conditions.

When researchers meet all the requirements of a waiver of informed consent, it is often under the auspices of conducting research for the common good [26]. Examples include research aimed at improving public health or the quality of medical care. However, EHR research without consent may violate the ethical principles of autonomy in the hopes of achieving beneficence and justice [27]. However, many bioethicists have argued in favor of EHR research without consent as long as the aforementioned requirements of a waiver are met, and proper privacy and security restrictions are in place [26,28,29].

If informed consent is not waived, several different models have been proposed for meeting human subject protection requirements and minimizing researcher burden. A tiered, or categorical, consent model that offers research participants options for how and when their data can be used has been espoused as best practice in the field on genetics research [30,31]. A tiered consent model allows participants to choose from many options, such as allowing their data to be used for the current study only, the current study as well as future studies about a specific condition or type of research, or unlimited use of their data [23,32,33]. This type of consent model could also include an option for reconsent, such as when a new subcategory of a genotype or phenotype for a particular condition is discovered that may need an additional level of consent before further research is conducted [34]. Although this approach is in line with the Belmont principle of respect for persons and encourages autonomy among research participants, some have criticized it given that it may be logistically challenging to implement and could potentially diminish the utility and applicability of clinical data, whether information in EHRs or biospecimens, for future research purposes [35,36]. A recent evolution of the tiered consent model is dynamic consent in which researchers and participants have ongoing communication that allows participants to update their consent preferences over time and enables researchers to return results to those interested [37].

A second approach to informed consent is the use of a blanket, or general, consent model [12,23,34]. Blanket consent can be described as an all-or-nothing option for using EHR data or biospecimens in future research. In other words, participants are given the choice to consent to all future research use of their data without being given the details of what that research may entail. The National Institutes of Health now asks funded investigators to include broad data sharing as part of their informed consent forms for genetic research studies [38]. Similar to the tiered consent model, there are advocates and critics of this approach. Proponents cite that it covers all the necessary ethical and legal requirements of informed consent, whereas detractors argue that the lack of specifics on future use means that it is more akin to providing permission than consent that is truly informed [39,40].

The open consent model, used by the Personal Genome Project, takes the blanket consent model a step further by stating up front that participants’ data may be accessed broadly and there are no guarantees of anonymity, privacy, or confidentiality [34]. The goal of this approach is to provide more specifics about the possible ways data may be used and the risks of participating. Advocates of this approach argue that being open and honest about the study design and potential uses of data will promote trust and willingness to participate.

A final model of informed consent that has been proposed involves opting out of research participation. The opt-out model requires a participant to actively withdraw from the research. If they do not withdraw, it is assumed they passively consent to participate. This model was adopted by the Iceland biobank project, a national effort to merge three sources of data—EHR, genealogical, and genetic—into one database for research purposes [23]. The opt-out model, however, was not consistently applied across the data sources and was met with criticism by those who felt it did not offer adequate control for research participants or meet ethical and legal requirements [32]. It seems there is no uniform approach to seeking consent for biobank research [41].

Few studies have focused on informed consent models for accessing only EHR data, without a link to biospecimens. In a commentary on whether it is ethical to access EHR data, even identifiable information, without consent, Miller asserts the answer lies in the balance between risks and benefits [26]. In cases where the public good outweighs the personal risks to an individual, then informed consent can be waived under the auspices of a utilitarian philosophy. However, the objection to this approach is that it violates an individual’s right to privacy.

Ultimately, under the Final Rule and HIPAA Privacy Rule, this decision rests in the hands of IRBs. However, in a study of IRB chairs and administrators that were presented with a hypothetical EHR research protocol, opinions varied widely as to whether informed consent was needed, even when identifying information was not included [42]. IRB chairs and administrators who stated that consent was needed reasoned that there was a risk for reidentification. Even though identifiable information (eg, last name) was not being extracted, other information such as birth date, postal code, and ethnic origin were included. IRB chairs and administrators who said consent was not needed stated that the data were anonymous or that the identifiability of participants was not relevant to determining if consent was required.

Several US-based studies have examined the preferences of patients related to providing informed consent for use of clinical data, including both biospecimens and EHRs. In one large survey study, most patients were willing to participate in a biobank [43]. However, some studies suggest that participants tend to prefer a broad consent model, as long as no personally identifiable information is used [44,45]. In another study, public sharing of deidentified data was favored by the majority of participants when either a tiered or blanket option was given [46]. Sharing of data has not been shown to be related to level of understanding or recall of the informed consent process [47]. However, preferences for models of consent have been shown to vary by some sociodemographic factors, such as race, ethnicity, income, and education [43,45,46].

Consent preferences are also driven by what information is being accessed and how it is being used. Patients favored seeking consent for the use of medical history data and treatment-related information [48]. Reconsent was preferred when researchers were investigating a health condition that was unrelated to the one for which they originally gave consent, if deidentified data were shared with an investigator at a different institution, and when a child for whom a parent had previously given consent had reached adulthood [43,49]. Patients’ decision to consent to research use of their biospecimen is also related to personal characteristics, including whether a participant has an existing genetic condition [49].

Studies in Europe and Canada have found similar preferences. Surveys and focus groups with patients in Ireland and the United Kingdom indicated a preference for some level of control over use of EHR data for research, with many favoring a study-by-study or tiered consent model [50-52]. In an Italian study, over half of those enrolled in a national twin registry were against the use of their EHR data without informed consent [53]. Similarly, in Canada, participants preferred to be asked for consent either verbally or in writing before releasing their EHR data to researchers [54].

One of the most common ethical, legal, and social issues related to using EHRs for research is who has access [27,33,55]. Patients often had the most concern about health insurance and pharmaceutical companies as well as government agencies using their EHR data for research purposes [44,54,56-58]. Pereira et al [59] found that 66.9% (328/490), 44.9% (220/490), and 40.0% (196/490), respectively, did not want insurance companies, pharmaceutical companies, and the government to have access to their health information. Patients worried that research conducted by pharmaceutical companies would be used to promote products, and there was potential for insurance companies to deny coverage for patients [54]. These companies were seen as less “legitimate” to patients because the research they were likely to conduct was not “pure science,” which aimed to generate knowledge for the common good [58]. Patients were also concerned with unauthorized access to their medical information or sharing of EHR data with noncredible researchers [57]. One example cited was government researchers accessing EHR data but then selling it to a pharmaceutical company [56]. Therefore, patients often desired greater oversight of individuals who conducted EHR research within these organizations [44]. Typically, the amount of trust a patient had in the researcher or organization conducting the research was related to the patient’s views on privacy [44,51,54,56].

Some patients reported that they would prefer to limit access to certain information in their medical records to maintain privacy [58,60]. Patients were less likely to share sensitive information such as substance abuse history, mental health information, sexual health information, domestic violence records, reproductive health records, and genetic information and would want to be asked permission before sharing this information with researchers [60]. In particular, patients were concerned with the disclosure of conditions viewed as stigmatizing, such as HIV/AIDS and mental illness, to researchers [56-58]. One study reported that patients viewed reproductive and mental health information as more sensitive than genetic data [58]. To ensure privacy, some patients wanted to limit access to portions of their EHR to their health care provider [61] or not include any sensitive information in their EHR [16,33].

Despite widespread support for research use of EHR data and biospecimens, patients often preferred that their information remain anonymous [49,51]. Hull [62] conducted interviews with patients of academic medical centers to examine attitudes and preferences on the use of anonymous versus identifiable samples for genetic research. On the basis of responses to two hypothetical scenarios, 72.96% (850/1165) preferred to be informed about the use of their anonymous blood samples, whereas 83.35% (971/1165) of patients wanted to be told if it was an identifiable sample. However, only 23.38% (271/1159) of patients responded differently to the two scenarios, with most (196/1159, 16.91%) indicating they wanted to be notified about the use of an identifiable sample and did not need to know if it was done with an anonymous sample.

In biobanking research, similar privacy concerns have been raised about lack of oversight and the potential for biospecimens to be identified [63,64]. Although technology has enabled large-scale genomic studies to be conducted, the sharing of data with outside researchers and linking of biospecimens with EHRs has increased the potential for reidentification of participants [23,63]. Improved data mining technology has also contributed to privacy and identifiability concerns [65]. Despite the fact that some research has shown that reidentification of biospecimens and EHR data is difficult when proper security controls are in place [66,67], concerns about privacy and security are likely to be an ongoing issue.

Patients voiced concerns about the implications of breaches of privacy. Common fears were discrimination, stigmatization, or psychosocial discomfort if medical information was shared with insurance companies or employers [22,23,51,63]. Similarly, employment and life insurance discrimination concerns were raised by community advisory group members regarding the presence of genomic information in the medical record [68]. In addition, concerns were expressed by some that genetic health information may affect their medical care—specifically the discontinuation or withholding of treatment [68]. In genetics research, patients also cited worries about release of information to family members without their consent [22,63]. Moreover, genetic information about risk for having a late-onset disease, such as Huntington’s, could lead to social stigmatization as well as insurance and employment discrimination [22,65,69].

Three studies identified some individual factors related to views on privacy. Older people, described as individuals aged 50 years and older, reported less concern with privacy of genetic information than did younger people in a focus group study [58]. Gender differences were found related to the potential consequences of a security breach. Male patients reported concern about impacts on employment, finances, and insurance, whereas female patients were concerned about risks related to social discomfort and embarrassment [51]. Finally, those who had more experience with using computers were less concerned about security issues [59].

Bioethicists have debated whether to return the results of genetic research to biobank participants. Much of the discussion has focused on the return of individualized versus aggregate results. Most agree that returning aggregate or summary results, through a newsletter or website, is appropriate. This is seen as both a measure of accountability for the researchers conducting the study and a sign of respect for the participants [23]. The provision of individual genetic results from a research study, though, has been a more contentious subject. Ethical arguments in favor of returning results are grounded in the principle of respect for persons and beneficence [23]. Having access to genetic information about oneself may have an impact on one’s health, quality of life, and future decision making. Returning individualized results to participants also prevents researchers from being gatekeepers of important information. However, those against sharing individual results cite that research and clinical care should not be blurred, and an investigator providing genetic results is acting more like a clinician than a researcher. In addition, those opposed state that research and clinical testing are quite different, with the goal of the latter being to provide better care to a patient, whereas the former is concerned with creating generalizable knowledge [23].

Given this debate, several ethics boards and research committees have created recommendations or guidelines for when to share individualized results, including for which genetic conditions [31,70,71]. The eMERGE network has also addressed this issue [72]. Among these guidelines, there is consensus that individual results should only be returned if they are medically actionable, even if they were incidental findings. Researchers are also encouraged to thoughtfully consider the language in the informed consent form that details what types of results will be shared with participants [22]. However, in a recent study that examined informed consent forms, the majority of consent forms did not discuss return of results [73]. The authors acknowledge, though, that many of these forms may have been created years before any guidance was offered on this issue.

When patients have been asked about their preferences for the return of research results, most indicate they want to know. In a survey of patients enrolled in a Health Maintenance Organization (HMO) plan, about two-thirds said they would be willing to participate in research within the HMO if written information about the study was provided to them and almost three-fourths if results were provided [74]. Another study asked participants about their views regarding collection of tissue samples and genetic testing [49]. Return of test results was strongly supported by all participants, with the highest level of support among those who were concerned about having a health condition that may be genetic. In a survey of preferences for return of results using donated tissue samples, just under half (129/271, 47.6%) reported they always wanted to be given individual results, 25.1% (68/271) wanted results only after the researcher had assessed the risks and benefits of sharing the information, and 27.3% (74/271) wanted results if their doctor thought the information would inform decision making related to their care [75]. Respondents who thought genetic information was more sensitive than other types of health information were more likely to want to be told all individual results.

Important ethical, legal, and social issues are raised when vulnerable populations are involved in genetic research [76]. Although similar to the issues already discussed, concerns related to recruitment, informed consent, privacy and security, and disclosure of results are often amplified when conducting research with vulnerable populations [23,77].

A clear example is when children are recruited to be part of genetic studies. One study asked adults whether they would want to be reconsented if their parents enrolled them in a biobank study when they were children. Overall, most respondents (799/1186, 67.37%) said they would be willing to continue participation, but almost half (543/1186, 45.78%) wanted to be reconsented [78]. In a review of procedures used in 6 different birth cohort studies, investigators found that blanket consent was never used. However, the studies varied in their approach to returning research results; although some provided participants and their families with routine clinical information and test results, other studies only informed participants if test results were abnormal for a treatable condition. Finally, all studies recontacted participants when they reached adulthood and allowed them the opportunity to withdraw or reconsent [79]. A recent study, though, examined an alternative consent model. When presented with an opt-out model of enrollment into a study that linked the child’s EHR with biospecimens, most parents were supportive [80]. Parents stated there was little risk given that the data would be deidentified. Although some were concerned about the security of EHR data, none raised reservations about access to genetic information.

Although studies have been conducted using EHRs of vulnerable populations, such as epidemiological research [81-83], very few have examined the ethical, legal, and social issues related to this type of research. Simon and colleagues [84] discussed the risks and benefits of conducting research on individuals with psychiatric conditions using large medical databases. Although privacy risks are of critical concern, the authors argued that these population-based research methods have provided many benefits, including information on prevalence estimates, treatment effectiveness, and impact of health policy. With appropriate safeguards, this research can also lead to reducing stigmatization and discrimination through education and outreach efforts based on research findings.