“Patients are often willing to share their health data if it helps people with conditions similar to theirs.” — Jennifer Cubino, COO, BC Platforms

At present, it can be a challenge for biopharma companies to gain access to health data due to diverse regulatory climates around the world. In a recent interview, Cubino discussed regulatory differences between the U.S., the European Union (EU) and other countries amid ongoing efforts to encourage patients who want to share their data, including Cubino’s experiences with BC Platforms.

BC Platforms is a bioinformatics company offering real-world data and technology platforms for use in clinical genomics, personalized medicine and drug development. Among the starkest regulatory differences, stated Cubino, are those between the U.S. and EU. Although both seek to protect patient data, EU rules are generally stricter.

Jennifer Cubino (Source: BC Platforms)

In the U.S., access to patient data is governed by the Health Insurance Portability and Accountability Act, or HIPAA. Enacted in 1996, the allows protected patient health information to be shared only for purposes of treatment, payment or operations. For researchers to gain access to the same data, patients must give explicit consent.

There is an exception: HIPAA allows researchers to use what is known as de-identified data without patient consent. To that end the law lists 18 protected identifiers that must be removed before a data set is considered de-identified. 

The chief EU privacy legislation, known as General Data Protection Regulation (GDPR), uses the term ‘anonymization’. It involves a broader and more extensive de-identification of patient data than in the U.S.. In either case, if researchers take the time to explain their need for data and the benefits it might bring, patients often give their consent, Cubino said.

“Patients ultimately want to know whether their data will be used for the common good.”

If a patient is going through cancer treatment, for example, and researchers ask to study their data to help other cancer patients, they are more likely to consent, Cubino said.

“They know what other patients are going through, and want to find more meaning in what they themselves are experiencing.”

Cubino cited a personal example from one of her children, who has a long-term chronic illness that is now well-controlled. Researchers had asked for personal health data to help carry out research into the condition. 

“I talked it over with my child, who also understands my work at BC Platforms,” Cubino said. “That of course has provided a nice foundation for understanding the purpose of data-based research. As a result, my child’s response was, ‘Yeah, I want to do this. It’s been hard having this condition, and I really want researchers to understand more about what kids like me are going through.’”

Patients remain aware of the risks all the same, she added.

“For example, I’ve read in the press about the anger people can feel over a lack of transparency around how their data has been used, particularly when it involves commercial activities. Patients might feel there is inadequate oversight for the users of their data.”

One solution to improve transparency is emerging from a BC Platforms partner in the Asia Pacific region. The partner is working on an app that would allow patients who share their data to gain access to the research using that data, Cubino said.

“It is a dynamic solution that promotes a real-time, transparent dialogue with patients.”

Greater transparency and engagement offer legal and regulatory benefits to researchers. But they also could help to deepen public trust in and appreciation for the research community, Cubino said.

“Patients will be able to say ‘look at what these researchers were able to learn!’”

Regulations also are likely to evolve, particularly as concerns grow over the legal usage of data. The EU and some of its member countries have responded by tightening access, Cubino said. 

But some countries are trying to balance the needs of both research and patient privacy. Legislation from South Africa, for example, currently sits between GDPR and HIPAA, and appears to applying what has been learned from other countries, Cubino said.

For now, BC Platforms uses EU GDPR as a global standard, adjusting as needed to local or institutional requirements, Cubino said. BC Platforms also uses an EU-based cloud provider that is not subject to the U.S. Cloud Act, a law that allows U.S. authorities access to any data, without court subpoena, kept by U.S.-based cloud providers. 

“This provides our partners with an additional layer of data protection,” Cubino said. 

The company also assists in complying with local requirements involved in sharing and protecting patient data, including genomic information, multiomics data, longitudinal clinical data, patient outcomes and imaging. In short, it offers a robust approach to gathering a rich set of data – while also building trust with patients. 

“Because of our expertise in genomics, we can help our partners develop a path that allows them to grow in a way that’s nuanced for them, with patient privacy and data protection always at the forefront of our thinking,” she said.

Photo: imtmphoto, Getty Images