Research ethics in a pandemic: considerations for the use of research infrastructure and resources for public health activities

Abstract The number and size of existing research studies with massive databases and biosample repositories that could be leveraged for public health response against SARS-CoV-2 (or other infectious disease pathogens) are unparalleled in history. What risks are posed by coopting research infrastructure—not just data and samples but also participant recruitment and contact networks, communications, and coordination functions—for public health activities? The case of the Seattle Flu Study highlights the general challenges associated with utilizing research infrastructure for public health response, including the legal and ethical considerations for research data use, the return of the results of public health activities relying upon research resources to unwitting research participants, and the possible impacts of public health reporting mandates on future research participation. While research, including public health research, is essential during a pandemic, careful consideration should be given to distinguishing and balancing the ethical mandates of public health activities against the existing ethical responsibilities of biomedical researchers.


I. INTRODUCTION
Although public health research is undoubtedly essential during a pandemic, 1 the line between research and public health activities is tricky in the best of times and can blur quickly in a public health emergency. 2 Elements common to both endeavors range from study design, to the collection and use of personally identifiable and protected health information, and to analysis techniques. Many point to the a priori purpose of a given initiative as a way to distinguish between research and public health activities. 3 Yet, even while public health practice focuses on assurance, assessment, and policy development, these activities might contribute to generalizable knowledge-the hallmark of research. For example, in 2010 following the Deepwater Horizon oil spill in the Gulf of Mexico, the U.S. Centers for Disease Control and Prevention (CDC) tapped into the National Poison Data System (NPDS) for the purpose of monitoring health impacts of people in the region (ie, surveillance as a public health activity). Nevertheless, the CDC's utilization of the NPDS post-environmental disaster also demonstrated the database's utility for advancing scientific understanding of how oil spill exposures affect human health (ie a resources for potential public health research with the primary purpose of contributing generalizable knowledge). 4 Additionally complicating the divide between research and public health activities 5 is the now widespread practice of banking of data and samples for secondary research use. During a public health emergency, research repositories are attractive, ready-made data resources and communication channels with large, and, ideally, diverse cohorts through which public health activities could be pursued expeditiously. Given that emergency responses 'tend to be nonresearch,' 6 what risks are posed by repurposing research infrastructure for public health activities?
The COVID-19 pandemic has already provided case examples highlighting key questions about the public health activities that seek to leverage existing research infrastructure. For  research participants and collected nasal swabs with the goal of improving detection, monitoring, and control of influenza outbreaks in greater Seattle, Washington. On March 10, 2020, the New York Times 8 reported on SFS's ongoing efforts to assess retrospectively the prevalence of the 2019 novel coronavirus, SARS-CoV-2, 9 using nasal swab samples collected for research purposes during the 2019-20 influenza season. In early February 2020, SFS began petitioning the state, CDC, and U.S. Food and Drug Administration (FDA) officials for permission to use the SFS's existing sample bank to track COVID-19 spread. SFS participants had consented to the testing of their swabs for influenza and 'other respiratory pathogens (germs)' and to receiving these research results back from the study team, as well as for the secondary use of their data for research purposes. Through the consent process, SFS had alerted participants that Washington state law requires reporting of infectious diseases, including influenza, 10 but did not discuss the use of SFS's research infrastructure, including data or samples, for other public health activities. 11 After about 2 weeks of rebuff, and within the context of undeniable national spread of the virus and inadequate testing for it, the SFS team decided to test the samples without the explicit approval of public health authorities or regulators. The SFS team promptly identified a SARS-CoV-2 positive result and alerted local public health officials. The sample was rerun in the Washington state laboratory, where the positive result was confirmed, and the research participant was subsequently notified by public health officials. 12 Despite this apparent successful use of existing research infrastructure for public health activities, 13 CDC and FDA regulators ordered SFS to stop retrospective testing of their existing samples immediately but indicated that, with additional consent language clarifying the use of research study materials for public health activities, SFS could prospectively test participants for SARS-CoV-2. In the first few days of March, the University of Washington's ethical review board determined that, given the public health emergency, SFS had an ethical obligation to test all samples for SARS-CoV-2, citing that SFS already had consent from participants to test for another communicable diseases and return those results and, therefore, was already engaged in both research and public health activities. On March 9, 2020, state regulators again shut down retrospective testing by SFS. 14 SFS eventually completed its retrospective testing of samples, identifying 25 positive results across 2353 participants, including the first documented case of community transmission of SARS-CoV-2 in the USA. 15 The back and forth between federal and state authorities, the research team, and the overseeing ethics board, which eventually culminated in the Seattle Flu Study turning its resources toward a joint public health initiative announced March 23, 2020, 16 illustrates the complexity of the boundary between federally regulated research and public health activities 17 and highlights key concerns about the repurposing of research infrastructure and its use for public health activities. Firstly, what are the points researchers must consider as they contemplate either mining already collected research data during a public health emergency, or, as in the case of the SFS, undertaking new analyses on already collected samples in the name of public health response? Secondly, what are the considerations for reporting back to research participants types of information derived from public health activities not explicitly disclosed in the informed consent process? Thirdly, given the uncertainty of risks and benefits posed by public health activities, are there any additional concerns raised by legal mandates to disclose information derived from research sources to public health authorities at different governmental levels? These questions are particularly worthy of contemplation given the number of large research initiatives' data and sample banks that could potentially be called upon by public health authorities during this pandemic-including, notably, the National Institutes of Health's All of Us SM Research Program.

II. USE OF EXISTING RESEARCH REPOSITORIES FOR PUBLIC HEALTH ACTIVITIES
Most federally sponsored human subject research activities are governed by a set of regulations known as the Common Rule. 18 However, while public health research is governed by the Common Rule, public health activities 19 are among those deemed 'not to be research' and therefore entirely outside of Common Rule's reach. 20 This regulatory exception specifically acknowledges that public health activities may 'use information and biospecimens from a variety of sources,' including, presumably, from existing research studies or data repositories. Section 46.104(d)(4)(iii) further clarifies consent is not required for secondary use of research data or biospecimens for public health activities. So regardless of whether the data used for public health activities are data that have been previously generated for research or novel data generated from research samples, public health activities are legally considered 'not research.' Following from this exemption, the use of research data/specimens for public health activities does not require consent from the individuals to whom those data and samples originated. From this perspective, the SFS would not have needed additional consent of participants for SARS-CoV-2 testing had the SFS's SARS-CoV-2 testing been designated a public health activity. Arguments in favor of research data use for public health activities highlight the difference between the profound physical and emotional harms wrought by historical antecedents, such as the notorious U.S. Public Health Service Syphilis Study at Tuskegee, and the potential dignitary harms caused by data or samples previously derived from consented research participants being used for public health activities. And if the primary risk posed to research participants by public health activity use of their data is dignitary harm, researchers should correspondingly consider the privacy rights of participants (outside of those mutually agreed upon in informed consent) before proceeding with these activities.
The most influential health data privacy protections in the U.S. are codified by the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. 21 All covered entities and their 'business associates' must follow the HIPAA privacy requirements, which generally covers people/entities providing healthcare, health insurance, or related services. Under HIPAA, outside of their use for care delivery, anyone wanting access to a person's records must obtain their explicit consent with a few very specific exceptions. One of the exceptions that allows for no-signature release of protected personal health information is the request of a 'public health authority.' 22 Within the regulations 'public health authority' is broadly conceptualized as a federal, state, or other territorial division's agency or authority (or their designee), whose mandate includes public health matters.
Notably, the U.S. National Institutes of Health (NIH), the largest funder of biomedical research in the world, 23 is authorized by law to assist as a 'public health authority' based on U.S. Department of Health and Human Services (HHS) interpretation dating back to at least December 2002. 24 As a public health authority, one might argue that the entirety of the NIH's research resources-whether NIH-funded researchers or participants are aware or not-might be accessible for use in public health emergencies unless other restrictions would preclude such use. Notably, the SFS, funded through the private Brotman Baty Institute for Precision Medicine, 25  under NIH's public health authority designation and was not designated as a public health activity by state authorities as it initially pursued SARS-CoV-2 testing. Of further interest with regard to privacy protections, during a pandemic, Certificates of Confidentiality-which are shields protecting identifiable sensitive research information from disclosure-are potentially penetrable, as disclosures are permitted if required by laws regarding the reporting of communicable diseases, necessary for the individuals' medical care, or done with the individuals' consent. 26 Although the human subjects research regulations are relatively clear-cut with respect to public health activities, the ethical considerations for the use of existing research infrastructure for public health activities might not be. Past examples of unethical practice of public health research drove the development of the current regulatory structures intended to protect human research subjects. 27 Almost two decades ago, Dr Nancy Kass set forth an ethical framework for public health practitioners to assess the implications of public health activities, distinguishing biomedical ethics (which relies heavily upon individual autonomy) and public health ethics (which emphasizes justice, among other principles). 28 Later Lee, Heilig, and White (2012) provided a compelling justification for the conduct of public health surveillance in the absence of explicit consent from individual patient-participants, 29 recognizing an ethical obligation to put any public health data collected to use and, similarly, the need to justify nonuse of data that has been collected ['to use the data we collect for public health benefit; not using the data for improving health must be justified' (at 42)].
As Felice Batlan highlights in her analysis of national security claims from the lens of public health emergency, 30 the power to define a 'public health emergency' and the ethical concerns raised by these powers are far from straightforward. These complexities are only compounded if individual researchers themselves-rather than designated public health authorities (such as the NIH as a whole) who/which are, at least, politically accountable-take it upon themselves to engage in public health activities, as did the researchers of the SFS who quietly defied state and federal guidance to continue their testing program. 31 When research resources have been funded by public tax dollars (such as NIH grants), even decisions regarding the well-intentioned donation of supplies and equipment (redirecting such items from research labs that were wound down as nonessential during the pandemic to support emergency medical 26  Compromising individual rights and interests for public benefit has a fraught and contentious history. Yet even the constitutionally protected right to privacy has long been recognized as not absolute but one that is (i) conditioned upon exercise of that individual right to privacy not interfering with another's enjoyment of the same right and (ii) subject to reasonable, proportional, and necessary constraints imposed by state and local authorities fulfilling their roles to ensure public health and safety and by federal authorities supplementing such public health responses when they are inadequate. 34 Moreover, there is a compelling argument that, although not yet widely recognized, there exists a constitutional right to public health. 35 This argument builds upon an acknowledgment that health has individual and collective aspects, as individuals alone 'cannot achieve environmental protection, hygiene and sanitation, clean air and surface water, uncontaminated food and drinking water, safe roads and products, or control infectious disease.' 36 In any case, considering vertical conflicts between local, state, and federal authorities and issues regarding preemption is essential to reconciling researcher obligations that seem to be inconsistent or in conflict within Public Health Law and Ethics: A Reader 2 (2nd ed. 2010)) (emphasis added). The interaction of and relationship between the right of privacy and right of public health are both interesting and important considerations; however, given such a discussion requires advanced legal analysis and involves complex legal theory, it has been left for discussion elsewhere.
the specific context of a public health emergency. Research repositories that cross jurisdictional boundaries could be particularly complicated in this regard when trying to ensure a uniform research experience as well as equitable distribution of risks and benefits. 37

III. REPORTING UNEXPECTED RESULTS
Another dilemma highlighted by the SFS case is the considerations of reporting back to research participants' information that is not explicitly described in the informed consent process. Further complicating matters in the SFS's case was the fact that their SARS-CoV-2 test had not, at the time of their original proposal, undergone traditional regulatory review and approval. The majority of the SFS's laboratories, like many research laboratories, are exempt from the Clinical Laboratory Improvement Amendments of 1988 (CLIA) 38 and therefore generally are not authorized to return individual research results by the FDA. The FDA is the oldest consumer protection arm of the federal government and works to ensure that food, drugs, devices, biologics, and others are trustworthy. Nevertheless, since its inception, the FDA has been criticized for 'slowing the progress' of medical innovation 39 and for its perceived political bent. 40 An Emergency Use Authorization (EUA) under Section 564 of the Federal Food, Drug, and Cosmetic Act (FD&C Act) allows for the special use of unapproved medical products during some types of emergencies. 41 These are sometimes called 'medical countermeasures' (and include, for example, in vitro diagnostic tests, personal protective equipment, antivirals, vaccines, and biological therapeutics) that can be used 'to diagnose, treat, or prevent serious or life-threatening diseases or conditions' when there are 'no adequate, approved, and available alternatives.' 42 For example, in the case of SARS-CoV-2, HHS Secretary Alex Azar issued a determination on February 4, 2020, that COVID-19 'is a public health emergency and that circumstances exist justifying the authorization of emergency use of in vitro diagnostics for detection and/or diagnosis of the novel coronavirus.' 43 On February 29, 2020, the FDA issued guidance to 'accelerate the availability novel coronavirus (COVID-19) diagnostic tests developed by laboratories and commercial manufacturers during the public health emergency.' 44 This guidance stressed the importance of test validation, limits of detection, accuracy, and inclusivity; recommended the inclusion of a transparency statement that the test has been validated but FDA's independent review of this validation is pending on all results; and required laboratories to report positive results immediately to federal, state, and local public health authorities. 45 The return of research results has been a Catch-22 for this reason. If researchers share information that turns out to be inaccurate or misleading, they might be held liable for the erroneous disclosure. Alternatively, if researchers withhold information that could be considered clinically relevant, they might be liable for failing to disclose this information. Expert panels 46 have recommended that research results be returned with clear disclaimers regarding their potential limited reliability and validity, but participants might not fully appreciate these limitations. Liability concerns (at least those related to disclosing the information), however, seem reduced in the context of actions taken in immediate response to COVID-19, given the liability immunity declaration issued by the HHS. 47 While this immunity declaration unequivocally includes testing for SARS-CoV-2 within its scope of covered countermeasures, researchers do not categorically fall within the scope of covered persons. For immunity protection to be applicable, researchers would need to be recognized as 'qualified persons.' 48 It is possible, but not a given, that NIH-funded researchers could be within this category.
Additionally, when considering the return of unexpected research results derived from public health activities, what, if any, considerations should be given to participants right not to know, for example, in the case of SARS-CoV-2 antibody testing? While 'right not to know' considerations within the specific context of an oft-fatal infectious disease might seem a stretch, reporting such results might seem contrary to the 'no surprises' principle in biomedical research, (which essentially means that researchers should avoid data practices that fail to align with participants' understanding and expectations). 49 When asked, the many of participants from a variety of different types of research want and expect to receive results back from their research participation. 50 Given these expectations, is it necessary to obtain consent to return research results? In the past decade, 'right not to know' has been supported primarily in terms of incidental findings on genetic assay. 51 For many genetic conditions, there are no treatments. However, in the case of results generated as the result of a public health emergency, an individual's right not to know might be supplanted by the public good of informing them. If research resources are later used for public health activities, a question not definitively answered and likely requiring a case-by-case determination is whether reporting of those results should be treated pursuant to research norms (which historically have required consent) or public health norms (which prioritize information access to control the spread of disease over individual preferences).
Although the return of results might seem like a minor consideration, as 'back to work' certificates are being contemplated by many governments, the implications of whether and which SARS-CoV-2 results are to be returned should not be summarily dismissed by researchers or policy makers. 52 Such concerns underscore the need for a system of ethical board oversight or other structured consultation, to aid researchers in assessing the risks and benefits of using research resources for public health activities.

IV. PUBLIC HEALTH REPORTING
Finally, are there any additional reporting concerns raised by legal mandates to disclose to public health authorities at different governmental levels if consent has not been obtained specifically? Public health reporting varies from aggregate, potentially anonymous data (eg, disease prevalence) to fully identifiable data (eg, contact tracing). Because public health response toolkits include police powers and the ability to infringe upon individual civil liberties, there are understandable concerns regarding the numerous potential uses for research data that might be generated or seized during a public health emergency. For example, because of the immigration law implications (such as the Inadmissibility on Public Charge Grounds final rule), undocumented immigrants might be unwilling to risk seeking health care during the COVID-19 pandemic regardless of public statements from U.S. Citizenship and Immigration Services (within the Department of Homeland Security) that seeking services to test, treat, or prevent COVID-19 would 'not negatively affect' any individual in the Public Charge analysis. 53 The inclusivity of a research data set being contemplated for use as part of a response during a public health emergency might require careful consideration regarding whether doing so advances or impedes an equitable distribution of the benefits and risks not only of the public health surveillance itself but also (i) the actions taken and policies developed and implemented based on those results made possible with that research resource and (ii) the subsequent willingness to participate in research. 54 One example to highlight this dilemma is contact tracing. Public health authorities in other nations have adopted contact tracing to identify networks of exposed people. 55 Given that human subject research studies now commonly include connected devices which collect data that could be valuable in contact tracing, this is of particular concern. Researchers themselves struggle with appreciating the scope and implications of privacy concerns raised by the scope of big data research, 56 leaving ethics review boards and the participants they serve at a loss. 57 In the public health emergency context, these powerful data might only further obscure variables in the delicate calculus of individual risk and public benefit, underscoring the benefit of establishing formal consultation and review processes for public health activities that would use research data.

V. CONCLUSION
Both the volume and granularity of data collected in research repositories are orders of magnitude greater than it has ever been. However, utilizing these data-as well as the research infrastructure that supports them-in the name of public health response is not without risk. The differing legal and ethical obligations for research and public health activities are worthy of researchers' careful consideration even in the face of a public health emergency imposing powerful urgency constraints on decision-making.
To be clear, these tensions should not inhibit research from proceeding during a pandemic nor the transfer of research resources to public health activities per se. Rather, it is incumbent upon the research community, including biomedical legal and ethical scholars and practitioners, to reflect upon the many tensions experienced during the COVID-19 pandemic between public health initiatives (the infrastructure and support for which has been proven woefully inadequate in the U.S.) and biomedical research (the leveraging of which might be particularly useful in times of public health emergencies, regardless of the state of public health infrastructure) and consider the creation of a formal consultative process, so that, in the future, research infrastructure might be called upon both responsibly and swiftly to augment public health initiatives. Further, as ever larger and more diverse datasets are amassed, the lines between research and public health activities-not to mention clinical care-will continue to blur. The current pandemic highlights the need for each of these communities-researchers, public health authorities, and clinicians-to reconsider the legal and ethical bounds of their mandates and critically examine areas of overlap. Active engagement with policy makers is needed. Finally, it would be particularly prudent for the research community, equipped with its robust resources and good intentions, to think critically about how to avoid the research enterprise being simply an enabler for the continued neglect of public health in the U.S.