The revised Common Rule requires researchers to present participants with information that is “most likely to assist … in understanding the reasons why one might or might not want to participate in the research,” and that is what “a reasonable person would want to have …” (Title 45 of the Code of Federal Regulations, part 46, effective July 2018) [14]. The Ethics Checklist thus requires researchers to address the question: “Have we determined what a reasonable person would want to know, and explained in our IRB proposal the evidence on which we reached that determination?” There are presently no empirical data or standard protocols for determining what information a reasonable person would want to have before agreeing to participate in deep phenotyping research. Privacy scholars and ethicists are increasingly concerned that the rights of “notice, access, and consent regarding the collection, use, and disclosure of personal data” are no longer adequate because “many privacy harms are the result of an aggregation of pieces of data over a period of time by different entities” [15]. Thus, researchers must consider a broad range of possible information to communicate.

We offer here several of these many possibilities. One decision is whether to provide research participants a list of clear, concrete examples of the inferences that can likely be made from participants’ data. For example, the informed consent material could explicitly say, “You should know that, although we will not reveal this information outside the research team, we may be able to identify when you are going to the bathroom or having sex.” Another decision, especially for researchers who are collecting data on participants’ GPS data and social media content, is whether to provide basic background education to make participants more informed on the data collection and data sharing practices already being utilized by the mobile technology and apps they already use regularly. Third, ethics research has identified a need to make informed consent processes more meaningful and valid by improving communication [16,17]. Research teams may consider innovative strategies such as video-based multimedia as part of the consent procedure [18-20]. They may also consider staged informed consent [21,22], dynamic consent to facilitate 2-way communication between researchers and participants [23], or a systemic oversight approach for big data research that provides flexibility for addressing uncertainty in how data will be used [24].

In addition, researchers in psychiatry must address a further question that has long been challenging for the field, “how to ensure meaningful and valid informed consent with participants who have a mental illness?” [25,26]. The question of decisional capacity in psychiatric research has been well researched, with multiple instruments now available [27], but the field will need to revisit the effectiveness of these instruments in the new context of deep biobehavioral research.

It is well established that biomedical research generally [28] and psychiatric research specifically struggle to enroll racially and ethnically diverse participants [29]. In the United States, for example, there is a reluctance of African Americans to participate in research given a long history of racism and exploitation [30,31].

The Ethics Checklist proposes that researchers answer the following question: Starting at the early conceptualization and research design stages, have we sought input from a diverse community of stakeholders to identify and address potential equity concerns and opportunities to advance justice with our proposed research? The question emphasizes that equity concerns extend beyond simply developing proportional samples, and that from the start, “[r]esearch relationships must become balanced, reciprocal, and community informed, without centering researcher and institutional priorities” [32]. Community advisory boards, which can be comprised of community and family stakeholders, can be a useful vehicle for facilitating such engagement [33]. Operationalizing “diverse community of stakeholders” will depend on the nature and scope of the research, institutional context, and affected communities. The stakeholder group will necessarily be comprised differently; for instance, whether the focus is on a single disease versus basic research, or the research involves multiple international sites versus a single community partner.

In defining the stakeholders, the checklist encourages researchers to go beyond their own research team to seek guidance and build trust, even at the conceptual and research design stage. We agree with Wilkins [34], who suggests that enhancing trust “must build on the principles of community engagement including balancing power dynamics, equitable distribution of resources, effective bidirectional communication, shared decision-making, and valuing of different resources and assets (such as the lived experience and knowledge of group norms and perspectives).” Researchers might, for instance, consult with their institution’s leadership on diversity and inclusion to see if the institution already has mechanisms in place for community engagement. Additional options include reviewing the best practices in community-based participatory research and community-engaged research [35] and consulting expertise in other disciplines, including law [36] and the humanities [37].

In an analysis of smartphone digital phenotyping, Onnela and Rauch [38] write that “[p]atient and participant privacy is always of utmost importance in clinical and research settings.” The literature on ethics of deep phenotyping has similarly identified privacy as foundational [39,40]. Deep phenotyping research requires that data flow across multiple platforms and vendors; thus, to safeguard data privacy, researchers must be aware of where the data go, what happens to the data at each stop, and where security vulnerabilities may exist [10]. The Ethics Checklist thus includes the question, “Have we consulted with information security experts about exactly where the data will flow, from start to finish?” Such consultation could potentially lead to modifications in data collection and data analysis techniques to improve privacy safeguards. For instance, security experts may be aware of the vulnerabilities of particular apps or new technical advances recently developed.

The regulation of mobile health apps is currently undergoing transformation [41,42], as is the regulation of artificial intelligence and machine learning data analysis [43]. At the same time, state privacy laws are emerging [44], as are international law innovations such as the European Union’s General Data Protection Regulation [45]. These legal developments have implications for the deep phenotyping research we describe in this article [7].

For instance, the data collection may require interfacing with multiple third-party vendors, and it is the responsibility of the research team to examine the terms of service, end user license agreements, privacy statements, and Health Insurance Portability and Accountability Act (HIPAA) notices for each of these vendors and associated software applications (Checklist question 10). This may not be an easy task, as research on mobile health apps suggests that many vendors do not have a privacy policy publicly available [46]. It will also be challenging to determine how applicable laws will treat the data being collected (Checklist question 11). Different laws define categories differently. For example, what is considered “sensitive” data under the California Consumer Privacy Act and California Privacy Rights Act might be different from what is considered “special category” data under the European Union’s General Data Protection Regulation or considered “personal health information” under HIPAA [47]. In setting up the research design, the research team may need to enlist institutional or external expertise to help understand and comply with these statutes.

In addition, when data collection follows the individual across state or international boundaries, and when data flow across those boundaries, the research will be exposed to multiple legal jurisdictions, including emerging state laws governing privacy and research [48]. For example, if data is collected continuously while a research participant living in Boston visits a relative in Chicago, then goes to a meeting in Baltimore, both the Illinois Biometric Privacy Act and the Maryland Confidentiality of Medical Records Act may apply. This may place different requirements on the research team. Similarly, if data gathered from a research participant in Detroit are transferred to a vendor operating in nearby Windsor, Canada’s data privacy laws may now be relevant in a way they would not be for traditional research with subjects and data firmly rooted in the United States. Given this potential for movement of research subjects, researchers should answer the question, “Have we ensured compliance with state, federal and international laws governing our research, HIPAA privacy requirements, state data privacy laws, and applicable international privacy laws?” Reviewing HIPAA compliance is foundational, and the details of such review are beyond the scope of our commentary; however, we emphasize here that, given the geographic mobility of the subjects, HIPAA is not the only applicable privacy regime. Thus, addressing legal and regulatory concerns may likely require consultation with legal experts in the researcher’s institution. This review of privacy law can be integrated with the Ethics Checklist question 10 concerning vendors’ policies and question 11 concerning the designation of sensitive information.

The return of individual research results has garnered significant attention in the ethics literature [49-51]. In the context of deep phenotyping research, the return of results is challenging because there are potentially so much data to return and because some of that data fluctuate over time and could be returned hourly, daily, weekly, monthly, and so on. In a virtual workshop we hosted in May 2020, a group of 25 stakeholders from science, medicine, law, and ethics gathered to explore the issues of return of results in deep phenotyping research. The discussion in that workshop made clear that, at present, there is considerable uncertainty over what constitutes “actionable” information in this space as well as divergent practices among research teams in which information participants can access. The Ethics Checklist includes 4 different questions on return of results, including, “Have we considered whether our study will generate any ‘actionable’ results, based on established guidelines, and how have we defined actionability?” The concept of actionability is debated across multiple fields [50,52], and in the context of deep phenotyping it is not clear where the bounds of actionability are.

For instance, if a research team is measuring step count data and a participant’s step count drops below average in a given week, alerting that participant of the data is actionable in the sense that the participant—informed by these data—may choose to walk substantially more steps next week. But what about more complex results, such as a machine learning algorithm that predicts that the participant has a 72% higher likelihood of experiencing a manic episode in the following year? When has the scientific knowledge base accumulated sufficiently to make such a prediction “actionable”? An even more fundamental question is implicated: for any measurement or prediction, what is the confidence in the measurement, sensitivity, or specificity of the interpretation or prediction, and how should that be shared? The effects of researcher mobile health interventions on participants within research studies are only now being studied [53], and the field is still formulating practices for clinical interventions based on phenotyping data [54].

The potential ethical responsibility and legal duty for reanalysis of data is also of concern. For instance, in genomics research, many genetic variations are classified as “variant of uncertain significance (VUS),” but as knowledge increases, those variations may be reclassified [55]. An ethical and legal question is whether researchers should (or must) revisit previously collected data to determine whether reclassification is warranted, and if so, when and how should they contact those participants from the earlier study [56]. This issue will likely emerge in deep geno/phenotyping research, and it should be proactively anticipated with a policy put into place.

The duty to warn and the duty to report are well known to psychiatric researchers, but the advanced data collection and data analysis methods of deep phenotyping introduce unique concerns [57]. At present, the field has only begun to develop protocols and thresholds for when the data should trigger a legal or ethical duty to report the potential for participants’ self-harm or harm to others, and further work is needed to address the possibility of false positives, false negatives, and reliable signal detection. For instance, among the 4 questions included in the Ethics Checklist under this heading, we require that researchers address the question, “Have we updated our lab’s suicidality standard operating procedure (SOP) to be consistent with the novel data acquisition and analysis techniques we are using in our study?” Traditionally, suicidality SOPs have relied almost exclusively on the clinical judgment of the psychiatrist or psychologist reviewing individual records and conducting interviews with the participant. The goal of deep phenotyping research, however, is to reduce reliance on this single stream of data, and instead to incorporate many additional real-world data points. The suicidality SOP may need to be modified in recognition of this new paradigm of psychiatric assessment. For instance, if GPS data show that the participant has spent 3 hours at a local bar, then is located on a bridge at 2 AM in the morning, and has sent 20 text messages in the past 5 minutes, is there a way for the research team to have such behavior flagged in real time and should there be a real time intervention in the protocol? The Ethics Checklist requires that researchers consider such situations.