The Taiwan Biobank (TWB) is a biomedical research database of biopsy data from 200 000 participants. Access to this database has been granted to research communities taking part in the development of precision medicines; however, this has raised issues surrounding TWB’s access to electronic medical records (EMRs). The Personal Data Protection Act of Taiwan restricts access to EMRs for purposes not covered by patients’ original consent. This commentary explores possible legal solutions to help ensure that the access TWB has to EMR abides with legal obligations, and with governance frameworks associated with ethical, legal, and social implications. We suggest utilizing “hash function” algorithms to create nonretrospective, anonymized data for the purpose of cross-transmission and/or linkage with EMR. Keywords: EMR; biobank; precision medicine; linkage Taiwan has one of the most complete health-related Introduction databases in the world, with records covering up to 99% of the Since the completion of the Human Genome Project in 2003 , population of 23.5 million people . To keep pace with the the biomedical industry has sought to demystify the causal links Big Data revolution, a Biomedical Industry Innovation Program between a person’s genes, the surrounding environment, and (BIIP) was launched to promote a national translational medi- disease. Now, the adventure that began in the genomic era has cal research platform that would facilitate development in the entered the era of “Big Data.” Links are now being made between biomedical industry and improve Taiwanese public health . the biobanks that store genetic data and health databases that When planning this initiative, consideration was required for store electronic medical records (EMR) to boost biomedical re- the strict patient protections afforded under the Personal Data search and to bring us closer to precision medicine. The Preci- Protection Act (PDPA), and the difficulty of accessing EMRs stored sion Medicine Initiative Cohort Program (PMI-CP) in the United in the National Health Insurance Database (NHID), both of which States, the 100 000 Genomes Project in the United Kingdom, and could limit the effectiveness of the BIIP. Recently, the Ministry the China Kadoorie Biobank in China are some ambitious na- of Health and Welfare (MOHW) of Taiwan revised its practical tional projects that exemplify this trend [2, 3]. guideline for the research-oriented use of the NHID. A major Received: 26 September 2017; Revised: 29 October 2017; Accepted: 7 November 2017 The Author(s) 2017. Published by Oxford University Press. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted reuse, distribution, and reproduction in any medium, provided the original work is properly cited. Downloaded from https://academic.oup.com/gigascience/article-abstract/7/1/1/4628126 by Ed 'DeepDyve' Gillespie user on 16 March 2018 2 Lin et al. Figure 1: Flowchart of the BIIP. There are 6 featured policy aspects of the BIIP: talent recruitment, amendments of the law, increased access to electronic medical records and the Taiwan Biobank, development of intellectual property rights, providing financial support, and market and product development. By implement ing these 6 policies, the BIIP aims to establish a biomedical corridor that extends from north to south, with 3 major biomedical centers that will be hubs for the development of Taiwan’s biomedical industry. Under such a framework, a translational medical platform based on the integration of EMR and the Biobank will be the backbone for streamlining biomedical research. IP: intellectual property. reason for this was to enable convergence between the TW accessible National Health Insurance Research Database Biobank (TWB) and the NHID (see Fig. 1). (NHIRD) without prior informed consent. After some deliberation, the Administrative Supreme Court of Taiwan sided with the NHIB, holding that although the pro- The challenge: the impact of the PDPA posed use of the data was without prior personal informed con- sent, it was justifiable under exemption clauses in the PDPA (see Under the PDPA, any use of personal data, unless otherwise pro- Table 1), and permissible because it was related to the NHIB’s vided under the PDPA, shall be subject to autonomous, informed statutory mandate. The court reasoned that even though the consent by the person with entitlement to those data. However, data were not anonymized, the measures taken by NHIB were the health-related data in the NHID are collected for research sufficient to minimize the risk of undue exposure. The court also purposes based on the National Health Insurance Law; that is, emphasized that a personal entitlement to privacy protection is without prior informed consent. Therefore, harmonization be- not an absolute legal interest by nature and, when necessary, tween these 2 laws is critical in implementing the BIIP. may be waived in cases of comparatively bigger public interest. In 2013, a human rights group sued the National Health In- Despite the court’s ruling, uncertainty remains. While hu- surance Bureau (NHIB) of the MOHW . It was alleged that the man rights groups continue to question the legitimacy of aca- PDPA was violated by granting access to NHID data for academic demic access to NHID data, it also remains to be clarified use—even though the data are encrypted and only accessible whether a for-profit organization, such as a pharmaceutical within a restricted area by authorized personnel. It was also al- company, might be granted similar access. Without resolving leged that the NHIB illegally transferred NHID data to a publicly Downloaded from https://academic.oup.com/gigascience/article-abstract/7/1/1/4628126 by Ed 'DeepDyve' Gillespie user on 16 March 2018 Cross Database Convergence of Taiwan Biobank 3 Table 1: Article 6 of the PDPA Personal information of medical records, medical treatment, genetic information, sexual life, health examination, and criminal records should not be collected, processed, or used. However, the following situations are not subject to the limits set in the preceding sentence: 1. when in accordance with law; 2. when it is necessary for a government agency to perform its legal duties or for a nongovernment agency to fulfill its legal obligation, and proper security measures are adopted prior or subsequent to such collection, processing, or use; 3. when the Party has made public such information by himself, or when the information concerned has been publicized legally; 4. where it is necessary to perform statistical or other academic research, a government agency or an academic research institution collects, processes, or uses personal information for the purpose of medical treatment, public health, or crime prevention; the information may not lead to the identification of a specific person after its processing by the provider, or from the disclosure by the collector; 5. where it is necessary to assist a government agency in performing its legal duties or a nongovernment agency in fulfilling its legal obligations, and proper security measures are adopted prior or subsequent to such collection, processing, or use; 6. where the Party has consented in writing, unless such consent exceeds the necessary scope of the specific purpose; the collection, processing or use merely with the consent of the Party is prohibited by other statutes; or such consent is against the Party’s will. Personal information like medical records, medical treatment, genetic information, sexual life, health examination, and criminal records, etc., is sensitive in nature. Article 6 of PDPA provides that such information, in general, shall not be collected, processed, or used. Article 6 of PDPA enlists 6 exceptions to this restriction. these PDPA issues, it is challenging for TW Biobank to develop a 5. it is necessary to assist a government agency in performing legally admissible cross-database convergence scheme to assist its legal duties or a nongovernment agency in fulfilling its the MOHW in complementing the goals of the BIIP. legal obligations, and proper security measures are adopted prior or subsequent to such collection, processing, or use; 6. the Party has consented in writing, unless such consent ex- The opportunity: the preliminary broad consent ceeds the necessary scope of the specific purpose; the collec- arrangement of the TW Biobank makes cross-database tion, processing, or use merely with the consent of the Party convergence possible is prohibited by other statutes; or such consent is against the Party’s will. TW Biobank is a national biobank created under the supervision of the MOHW. It aims to collect data from 200 000 healthy partic- Certainly, informed consent by itself is not a substitute for ipants and 100 000 individuals with 12 specific diseases to form full compliance with ethical, legal, and social implications. This the largest population-based biobank in Taiwan . The funda- is especially true when the informed consent obtained by TWB mental goal of the TW Biobank is to facilitate cross-database is a broad consent; i.e., the consent has been obtained “for un- linkage; therefore, each participant who has contributed data specified future research.” Besides, to facilitate the use of the gave informed consent during the recruitment process, includ- Biobank, tissues and data collected may not remain unlinked. ing for any future cross-database linkage, and for personal Thus, subject to Taiwan’s 2010 Human Biobank Management Act data collected in the NHID. Theoretically, the informed con- (HBMA), participants have been asked to grant TWB the privi- sent obtained by TW Biobank satisfies the exemption clause lege to maintain the “irretrievability” of related data under the stipulated under Article 6, Paragraph 1, Subparagraph 6 of the governance of the ethical code of “re-contact” and the contin- PDPA (see below). The consent obtained during the recruitment uous supervision of the Ethical Governance Committee (EGC). phase of the development of TW Biobank is likely to already Furthermore, TWB may not release its collection without the meet the criteria of the “prior personal consent with autonomy” approval of the EGC. To date, under this enhanced governance exemption. framework, more than 80 000 participants have been recruited, Personal information, such as details of medical treatment, and no queries have been raised about the legitimacy of TWB’s genetics, sexual activity, health examinations, and criminal practices. records, is sensitive in nature. Article 6 of the PDPA states that However, it has been argued that until the PDPA is revised, such information, in general, shall not be collected, processed, its exemption clause should not be applicable to the broad con- or used, except when: sent practiced by TWB. While we believe that this would counter participants’ altruism and autonomy, concerns over the social 1. in accordance with the law; legitimacy behind the argument cannot be ignored. Therefore, 2. it is necessary for a government agency to perform its legal we suggest that TWB adopts an additional “hash function” to duties, or for a nongovernment agency to fulfill its legal obli- protect participants’ privacy. gations, and proper security measures are adopted prior or Biobanks such as the Vanderbilt DNA databank have subsequent to such collection, processing, or use; adopted hash functions that have proved useful in linking DNA 3. the Party has made public such information by himself, data with health data in an anonymous fashion. Replacing the or when the information concerned has been publicized participant’s ID with a hash value returned by a hash function legally; further ensures that the participant’s identity cannot be regen- 4. it is necessary to perform statistical or other academic re- erated from the same hash output (Fig. 2). search, and a government agency or an academic research With sound broad consent from the participant for possible institution collects, processes, or uses personal information database linkage, continuing supervision by the EGC, and an ad- for the purpose of medical treatment, public health, or crime ditional hash function to bridge the gap between the HBMA and prevention; the information may not lead to the identifica- PDPA, it is possible for links between the TWB and NHID to sur- tion of a specific person after its processing by the provider, vive the strict scrutiny of patient and human rights groups con- or from the disclosure by the collector; cerning PDPA compliance. Downloaded from https://academic.oup.com/gigascience/article-abstract/7/1/1/4628126 by Ed 'DeepDyve' Gillespie user on 16 March 2018 4 Lin et al. Figure 2: Flowchart describing the hash function framework. One of the key features of hash function algorithms is that they transform identifiable personal da ta into a unique 128-character code. The Taiwan Biobank will develop and enter into a protocol with the NHID and adopt a hash function framework. When it is necessary to access EMRs in the NHID, all identifiable data processed will be replaced by hash values returned by a hash function, so access to EMRs will proceed in an a nonymous manner. Conclusion References In the Big Data era, it is not possible to achieve precision 1. International Human Genome Sequencing Consortium. Fin- medicine without converging databases of genetic, environ- ishing the euchromatic sequence of the human genome. Clin mental, and EMR information. However, the rigid protection of Pharmacol Ther 2004;431:362–9. patient privacy is an obstacle for biobanks’ access to health 2. Wu T-Y, Majeed A, Kuo KN. An overview of the healthcare sys- databases. We believe a consent-based approach will help tem in Taiwan. London J Prim Care 2010;3(2):115–9. to ease concerns over violations of the PDPA and make the 3. Wei W-Q, Denny JC. Extracting research-quality phenotypes NHID accessible for research purposes. Further, with more from electronic health records to support precision medicine. and more national biobanks such as PMI-CP and the UK’s Genome Med 2015;7(1):41. 100 000 Genomes Project being established, there is an in- 4. Manolio TA, Abramowicz M, Al-Mulla F et al. Global imple- creasing need for unified regional or international standards mentation of genomic medicine: we are not alone. Sci Trans- to ensure the interoperability of EMR. When implementing lat Med 2015;7(290):290ps13. BIIP, the MOHW could use the TWB as an exemplar to stan- 5. Center of Biomedical Industrial Innovation Program. Tai- dardize the procedure for accessing EMR in Taiwan and pave wan biomedical industry-where innovation happens. 2017. the way for Taiwan to be more active in global biobank http://www.biopharm.org.tw/bio/2017/images/incentives/ networks. Taiwan%20Biomedical%20Industry%20brochure%20(BIIP% 20&%20BPIPO).pdf. Accessed 28 October 2017. 6. Chang C-H. Controversy over information privacy arising from the Taiwan National Health Insurance Database exam- Abbreviations ining the Taiwan Taipei High Administrative Court Judgment BIIP: Biomedical Industry Innovation Program; EGC: Ethical Gov- No. 102-Su-36 (TSAI v. NHIA). Pace Int L Rev 2016;28:29. ernance Committee; EMR: electronic medical records; HBMA: 7. Chalmers D, Nicol D, Kaye J et al. Has the biobank bubble Human Biobank Management Act; MOHW: Ministry of Health burst? Withstanding the challenges for sustainable biobank- and Welfare; NHIB: National Health Insurance Bureau; NHID: Na- ing in the digital era. BMC Med Ethics 2016;17(1):39. tional Health Insurance Database; NHIRD: National Health In- 8. Roden DM, Pulley JM, Basford MA et al. Development of a surance Research Database; PDPA: Personal Data Protection Act; large-scale de-identified DNA biobank to enable personalized TWB: Taiwan Biobank. medicine. Clin Pharmacol Ther 2008;84(3):362–9. Downloaded from https://academic.oup.com/gigascience/article-abstract/7/1/1/4628126 by Ed 'DeepDyve' Gillespie user on 16 March 2018
GigaScience – Oxford University Press
Published: Jan 1, 2018
It’s your single place to instantly
discover and read the research
that matters to you.
Enjoy affordable access to
over 18 million articles from more than
15,000 peer-reviewed journals.
All for just $49/month
Query the DeepDyve database, plus search all of PubMed and Google Scholar seamlessly
Save any article or search result from DeepDyve, PubMed, and Google Scholar... all in one place.
Get unlimited, online access to over 18 million full-text articles from more than 15,000 scientific journals.
Read from thousands of the leading scholarly journals from SpringerNature, Elsevier, Wiley-Blackwell, Oxford University Press and more.
All the latest content is available, no embargo periods.
“Hi guys, I cannot tell you how much I love this resource. Incredible. I really believe you've hit the nail on the head with this site in regards to solving the research-purchase issue.”Daniel C.
“Whoa! It’s like Spotify but for academic articles.”@Phil_Robichaud
“I must say, @deepdyve is a fabulous solution to the independent researcher's problem of #access to #information.”@deepthiw
“My last article couldn't be possible without the platform @deepdyve that makes journal papers cheaper.”@JoseServera