Ethical Issues in Big Data
Health Research
Currents in Contemporary
Bioethics
Mark A. Rothstein
About This Column
Mark A. Rothstein serves as the
section editor for Currents in Contem-
porary Bioethics. Professor Rothstein
is the Herbert F. Boehl Chair of Law
and Medicine and the Director of the
Institute for Bioethics, Health Policy
and Law at the University of Louisville
School of Medicine in Kentucky.
(mark.rothstein@louisville.edu)
abortion and art • summer 2015 425
Let me say at the outset that I am not
an expert on Big Data. I am not even
an expert on Little Data. I am, like
many of you, someone who teaches
and writes about research ethics,
including privacy, autonomy, and
informed consent. I am someone who
is concerned whenever I hear that a
new research method is so exciting
and so promising that we ought to
set aside the ethical principles and
rules that have shaped the world of
research ethics since the Nuremberg
Code in 1947. I am reminded of the
statement of J. Robert Oppenheimer,
theoretical physicist and father of the
atom bomb: “When you see some-
thing that is technically sweet, you
go ahead and do it and you argue
about what to do about it only after
you have had your technical success.”1
I hope we do not fall into the trap of
believing that any new information
technology is worth using in health
research regardless of the ethical
issues in performing the research or
the larger implications.
In this article, I will cover the fol-
lowing issues: (1) whether traditional
research regulations should apply to
Big Data health research; (2) the rela-
tionship between privacy and auton-
omy in Big Data health research; and
(3) the role of informed consent in
Big Data health research.
Research Regulation
Big Data lacks a generally accepted
definition, but “it is typically described
as a large collection of disparate data
sets that, taken together, can be ana-
lyzed to find unusual trends.”2 There
has been much written about Big
Data’s promises and possibilities3 as
well as its limitations and unrealistic
expectations.4 I will simply assume
that, for purposes of my talk, Big
Data is a promising technology with
the potential to identify previously
unsuspected or unproven associa-
tions between disparate data points.
Also, although Big Data approaches
may be used in a variety of settings,
I will be focusing on health research.
As an initial matter, we need to
consider whether there is anything
unique about research using Big
Data. Perhaps we could call this “Big
Data exceptionalism.”5 One distinc-
tive aspect of Big Data is that health
information may be gleaned from
unusual sources — beyond the usual
clinical records, research data, and
reports about drugs and medical
devices. To find associations between
everyday activities and health, Big
Data researchers have used, among
other things, consumer purchasing
records6 and social media. If Big Data
researchers use publically available
sources, then there is no research eth-
ics problem, but accessing and using
private sources of data is another
issue.
Big Data usage of social media
has rightfully received widespread
attention for two reasons. First,
some of the Big Data applications
have attempted to predict impor-
tant health trends, including the
HealthMap Ebola tracker,7 Google
Flu Trends,8 and Twitter Influenza
Surveillance.9 Second, some research
using social media has been criti-
cized for a lack of informed consent,
including the Facebook Emotional
Contagion study10 and the OkCupid
research on compatibility that used
deliberately erroneous matches.11
Of immediate concern is that the
use of personal information linked to
health or, even worse, the intentional
manipulation of behavior, is not sub-
ject to traditional, federal research
oversight.12 The reason is that these
studies are not federally funded, not
undertaken by an entity that has
signed a federal-wide assurance, and
not performed in contemplation of
an FDA submission. The Common
Rule would apply to a graduate stu-
dent interviewing 10 undergraduates
about their attitudes toward drink-
ing on campus. But the Facebook
JL ME CO LUMN
Emotional Contagion Study, a behav-
ioral experiment involving 689,003
people and 3 million postings, was
not considered subject to the Com-
mon Rule.13 It is apparent that terms
of service agreements, click-through
consents, and voluntary oversight are
inadequate. Thus, Big Data raises the
long-debated question of whether
more comprehensive regulation of
research is desirable.
Of course, there is an alterna-
tive to expanding the applicabil-
I hope we do not fall into the trap of believing
that any new information technology is worth
using in health research regardless of the ethical
issues in performing the research or the larger
implications.
ity of the Common Rule. It could
be asserted that non-interventional
research ought to be deregulated
— even research currently subject
to the Common Rule. That was the
main recommendation of an Insti-
tute of Medicine (IOM) publication
in 2009, with the misleading title of
Beyond the Privacy Rule: Enhancing
Privacy, Improving Health through
Research.14 Apparently, the authors
of the report believed that privacy
would be enhanced by abolishing
informed consent for all information-
based research, including research
using individually identifiable health
information.15
The IOM report justified its rec-
ommendation by invoking a broad
utilitarian argument: “If society
seeks to derive the benefits of medi-
cal research in the form of improved
health and health care, information
should be shared for the greater good,
and governing regulations should
support the use of such information,
with appropriate oversight.”16 The
ethical basis of research ethics, how-
ever, is not consequentialism, but
deontology. According to the Presi-
dential Commission on Bioethical
Issues: “As persons, research subjects
possess an inviolability that rules out
treating them as mere means to the
426 journal of law, medicine & ethics
ends of others, including others who
may be suffering from a disease or in
need of medical care.”17 It is an inter-
esting question whether using indi-
viduals’ health data and biological
specimens without their knowledge
or consent is using them as “means to
the ends of others.”
Under our current regulatory sys-
tem, research either satisfies the
shared values of respect for persons,
beneficence, and justice — or it fails
to satisfy them. Weighing benefits
and risks on a macro level would put
IRBs in an impossible position and
would, undoubtedly, result in insti-
tutional pressure to approve research
without consent. Of course, IRBs do
weigh risks and benefits; research
will not be approved unless there is
a reasonable relationship between
risks and benefits. In addition, indi-
viduals perform their own weigh-
ing of risks and benefits in deciding
whether to participate. But, saying
that the potential collective bene-
fits of research ought to be weighed
against individual harms to deter-
mine whether research can proceed
without any consent would weaken
the current standard for waiver of
consent and apply it to all non-inter-
ventional studies.18
I want to make two other points
related to whether traditional
research rules ought to apply to Big
Data. First, the argument has been
made that codes of research ethics,
from Nuremberg to Helsinki to the
Common Rule, were only designed to
address the risk of physical injuries
to human subjects. Thus, the argu-
ment goes, intangible infringements
on autonomy, privacy, dignity, and
similar interests are insignificant and
may be balanced against the societal
interest in scientific discovery. Jay
Katz, perhaps the greatest author-
ity on research ethics, said “I want to
emphasize . . . the centrality of dignity,
not physical injuries, in any appraisal
of the ethics of research.”19 The regu-
lation of research is intended to pro-
tect against both physical and digni-
tary harms.
Finally, several scholars have
argued that individuals have an
ethical obligation to participate
in research for the betterment of
humankind. 20 This is certainly a
defensible ethical stance. It is also
defensible to be skeptical of a uni-
versal moral obligation to participate
in research, because, in the words
of Stuart Rennie, it would benefit
mostly “researchers, research insti-
tutions, public and private research
funding agencies, and pharmaceuti-
cal companies.”21 For today, even if
there is a moral obligation to partici-
pate in research, I would argue that
individuals ought to have the ulti-
mate right to decide whether to par-
ticipate in research.
Privacy and Autonomy
Privacy has many definitions, but I
regard it as a condition of limited
access to an individual or informa-
tion about an individual.22 One of
the most promising aspects of health
information technology in both the
clinical and research settings is the
ability to provide greater privacy
protection. For example, in research,
electronic health records (EHRs)
can be scanned to find information
or associations without any need
to identify the individuals whose
records contained the data.
I am sure you are aware of the
complexity of the deidentification
provisions of the HIPAA Privacy
Rule.23 You also probably know of the
substantial scholarship dealing with
the risk of reidentification,24 includ-
ing the risks associated with research
using DNA. I do not want to spend
time on this issue, except to say that
reasonable protections for the pri-
vacy, confidentiality, and security of
health information in research are
necessary but not sufficient to protect
the interests of research subjects.
The loss of privacy can lead to both
tangible and intangible harms, and

these are not trivial matters. Yet, in
discussions about information-based
research, I think there is often too
great a focus on privacy as the sole
criterion of ethical research. From
the perspective of research subjects,
what is often characterized as a con-
cern about privacy is really a concern
about autonomy. Tom Beauchamp
and James Childress describe auton-
omy as follows:
Respect for autonomy obligates
professionals in health care
and research involving human
subjects to disclose information,
to probe for and ensure under-
standing and voluntariness,
and to foster adequate decision
making. As some contempo-
rary Kantians have argued, the
demand that we treat others
as ends requires that we assist
them in achieving their ends
and foster their capacities as
agents, not merely that we avoid
treating them solely as means to
our ends.25
Autonomy is the main interest of
research subjects in their biologi-
cal specimens and health records —
both identifiable and unidentifiable.
Regardless of what an informed con-
sent document states about the use
of surgical waste, what state property
law provides for abandoned biologi-
cal specimens, what language is con-
tained in the HIPAA Privacy Rule
or a health care provider’s Notice
of Privacy Practices, or even what
is written in a consent for research,
many individuals strongly believe
that their biological specimens and
health records “belong to them.” This
is not to say that they want possession
or exclusive use of them, but merely
that they believe they ought to be
consulted and asked for permission
before their specimens and data are
collected, analyzed, stored, and used
for research.
There have been numerous sur-
veys of patients and their caregivers
on this issue and they all say the same
thing. If individuals are asked for
their permission to perform research
using their biological specimens and
health information, they will over-
abortion and art • summer 2015 427
whelmingly agree.26 On the other
hand, if their specimens and infor-
mation are used without their knowl-
edge and consent, they will consider
it a serious breach of trust.27
Feelings of suspicion or even
betrayal are especially prominent
among individuals who belong
to minority groups that, histori-
cally, have been treated unfairly in
both clinical and research settings.
Unfortunately, the list is a long one.
It includes the Tuskegee Syphilis
Study,28 the Havasupai Tribe case,29
and — not far from where we are
meeting today — the Kennedy
Krieger Institute Lead Abatement
Study30 and the development of the
immortalized cell line of Henrietta
Lacks.31
Informed Consent
In my view, if researchers are going
to respect the autonomy of research
subjects, they must seek and obtain
informed consent. Three aspects of
informed consent are especially rel-
evant to Big Data.
First, the argument has been
made by some bioethics scholars and
researchers that informed consent is
too burdensome, too expensive, too
impractical, too time-consuming,
and most damning — it doesn’t work.
As Barbara Koenig has written, “The
focus on consent in contemporary
biomedical research has become the
modern equivalent of a fetish.”32 A
variety of studies have demonstrated
that research subjects do not read
written descriptions of the research
contained in informed consent docu-
ments; if they read the document,
they often do not understand what
they read; and when asked about it
later, they cannot remember what
they signed.33 Instead of informing
the potential research subject, the
argument goes, informed consent
documents are incomprehensible
legal instruments written for the
benefit of the researchers and their
institutions.
This is not the time to discuss all
of the proposals to streamline and
improve the informed consent pro-
cess. Nevertheless, I believe that too
much is made of the fact that con-
sent rarely satisfies the ideal of an
Mark A. Rothstein
informed, interactive process. In
my view, whether research subjects
understand all of the key elements
of the research protocol misses the
point. The focus should not be exclu-
sively on the giving of consent by
the research subject. It also should
be on the asking for consent by the
researcher.
Asking for consent is a demonstra-
tion of respect for the autonomy and
dignity of the individual, a tangible
exercise in trust building, and an
expression of the moral equivalence
of the researcher and research sub-
ject in an otherwise asymmetrical
relationship. The informed consent
document should be viewed as the
researcher’s personal pledge to honor
and apply in good faith the ethical
conduct of research approved by an
IRB, which represents the shared
morality of the community.34
Another debate in the literature,
especially regarding biobanks and
health record repositories, concerns
whether “opt out” approaches would
be better suited to non-interven-
tional research than traditional “opt
in” methods. The argument for using
“opt out” is that placing the burden
on the individual makes it is easier
for the researcher and results in
higher accrual rates.
I think it is ethically dubious not
to inform individuals that they have a
right to opt out of research. It exploits
the uninformed and is hardly better
than participation by conscription
or deceit. So, if prospective research
subjects should be told something,
the question is what should they be
told? I am troubled by the notion
that individuals can be given vague,
watered-down, incomplete, incom-
prehensible, unenlightening, or oth-
erwise deficient information. The
better approach is to give them robust
information carefully tailored for lay-
persons and designed to provide rel-
evant information that will help them
decide whether they want to be “in”
or “out.” I believe a robust “opt out” is
ethically required and, if so, I would
argue it is virtually indistinguishable
from “opt in” consent. Furthermore,
in practical terms, if the researcher
is using a touch screen enrollment
program, there really is no difference
JL ME COLUMN

between touching an “opt in” or “opt other dimensions, but what might be a the annual conference of Public Responsi-
out” box. slightly unrepresentative sample asso- bility in Medicine and Research, Baltimore,
MD, December 5, 2014.
Finally, I want to address the issue of ciated with obtaining informed con-
“consent bias,” a type of selection bias sent is not necessarily a biased sam-
Acknowledgement
said to exist when informed consent ple. Furthermore, if there is a degree The author is indebted to Kyle Brothers and
for research, especially information- of bias, common statistical methods Nic Terry for helpful comments on an ear-
based research, causes an unrepre- can correct for it. Therefore, using lier draft.
sentative sample, which then leads to informed consent for a study is very
flawed results. According to the IOM, unlikely to result in statistically sig- References
“Selection bias occurs if the individu- nificant, residual, consent bias.37 All 1.  Think Exist website, available at
<http://thinkexist.com/quotes/j._rob-
ert_oppenheimer/> (last visited May 4,
2015).
2. J. D. Halamka, “Early Experiences with
Despite unique aspects, such as its data sources, Big Data at an Academic Medical Cen-
scale, and open access provisions, the ethical issues ter,” Health Affairs 33, no. 7 (2014):
1132-1138, at 1132.
surrounding Big Data are similar to those involving 3. M. J. Khoury and J. P. A. Ioannidis,
“Big Data Meets Public Health,” Sci-
traditional biomedical research. Without question, ence 346, no. 6213 (2014): 1054-1055;
J. Lane et al. eds., Privacy, Big Data
the regulation of research can be improved in many and the Public Good: Frameworks for
ways. The development of new analytical tools, Engagement (New York: Cambridge
University Press, 2014); J. Roski, G. W.
however, such as Big Data, should not serve as a Bo-Linn, and T. A. Andrews, “Creating
Value in Health Care through Big Data:
catalyst for abandoning foundational principles of Opportunities and Policy Implications,”
Health Affairs 33, no. 7 (2014): 1115-
research ethics. I continue to believe that respect 1122; P. M. Schwartz, “Information Pri-
vacy in the Cloud,” University of Penn-
for persons, beneficence, justice, and independent sylvania Law Review 161, no. 6 (2013):
review are absolutely essential to the ethical 1623-1662.
4. S. Hoffman and A. Podgurski, “Big Bad
conduct of research. Data: Law, Public Health, and Biomed-
ical Databases,” Journal of Law, Medi-
cine & Ethics 40, no. 1 (2012): 56-60;
D. Ruths and J. Pfeffer, “Social Media
als who give permission to access their types of research are subject to various for Large Studies of Behavior,” Science
346, no. 6213 (2014): 1063-1064.
medical data differ from the group of forms of bias and the effect of consent 5. See N. P. Terry, “Big Data Proxies and
individuals who are unwilling to give bias, especially compared with other Health Privacy Exceptionalism,” Health
permission for their health informa- challenges to research methodologies, Matrix 24, no. 1 (2014): 65-108 (dis-
tion to be used in research.”35 Thus, has been greatly overestimated. cussing ways in which health privacy
may be protected in an age of big data).
the IOM cautions that selection bias
6. See, e.g., V. Mayer-Schonberger and K.
can lead to inaccurate and less gener- Conclusion Cukier, Big Data (New York: Mariner
alizable research results.36 Despite unique aspects, such as its Books, 2014): at 57-58 (describing how
There is a great deal of confusion data sources, scale, and open access Target used predictive analytics to cor-
surrounding consent bias. Perhaps provisions, the ethical issues sur- relate the purchase of unscented lotion
with pregnancy).
a simple example will help. Suppose rounding Big Data are similar to those 7. HealthMap Ebola Tracker, “2014 Ebola
I were doing a study on IRBs, and involving traditional biomedical Outbreaks,” available at <http://health-
I wanted to know whether experts research. Without question, the regu- map.org/ebola/#timeline> (last visited
believe that an advanced degree in lation of research can be improved in May 4, 2015).
8. J. Ginsburg et al., “Detecting Influenza
bioethics is essential or valuable for an many ways. The development of new
Epidemics Using Search Engine Query
IRB chair. If I only surveyed individu- analytical tools, however, such as Big Data,” Nature 457, no. 7232 (2009):
als of one gender, the sample would Data, should not serve as a catalyst 1012-1014. But see D. Butler, “When
be unrepresentative, but it would only for abandoning foundational prin- Google Got Flu Wrong,” Nature 494,
be biased if there is a relationship ciples of research ethics. I continue no. 7436 (2013): 155-156 (criticizing
methodology of original study).
between the gender of the respondents to believe that respect for persons, 9. D. A. Broniatowski, M. J. Paul, and
and their responses. In this example, I beneficence, justice, and indepen- M. Dredze, Letter, “Twitter: Big Data
doubt the responses about the value dent review are absolutely essential Opportunities,” Science 345, no. 6193
of an advanced degree would differ to the ethical conduct of research. (2014): 148.
10. A . D. I. Kramer, J. E. Guillory, and J.
based on gender. Certainly, there are
T. Hancock, “Experimental Evidence
many persuasive ethical and political Note of Massive Scale Emotional Contagion
reasons to have a sample that is rep- This article is an annotated and slightly through Social Networks,” Proceedings
expanded version of remarks presented at
resentative on the basis of gender and of the National Academy of Sciences,

428 journal of law, medicine & ethics


U.S. A. 111, no. 24 (2014): 8788-8790.
But see I. M. Verma, “Editorial Expres-
sion of Concern and Correction,” Pro-
ceedings of the National Academy of
Sciences 111, no. 29 (2014): 10779 (edi-
tor-in-chief ’s statement of concern that
the collection of data did not include
any informed consent or an opportu-
nity to opt out of the study). See also
S. T. Fiske and R. M. Hauser, “Protect-
ing Human Research Participants in
the Age of Big Data,” Proceedings of the
National Academy of Sciences 111, no. 8
(2014): 13675-13676.
11. C. Rudder, “We Experiment on Human
Beings!” (July 28, 2014), available at
<http://blog.okcupid.com/index/php/
we-experiment-on-human-beings/>
(last visited May 4, 2015).
12. It has been argued that this research
violates state research laws, in par-
ticular, Maryland’s. See S. Dance,
“Facebook, OkCupid Research Raises
New Ethical Questions in Use of ‘Big
Data,’” available at <http://articles.bal-
timoresun.com/2014-09-26/business/
bs-bz-facebook-okcupid-20140925_1_
big-data-users-professors> (last visited
May 4, 2015).
13. For a further discussion, see R.
Klitzman and P. S. Appelbaum, “Face-
book’s Emotion Experiment: Implica-
tions for Research Ethics,” available
at <http://www.thehastingscenter.org/
Bioethicsforum/Post.aspx?id=7002&a
mp;blogid=140&terms=facebook+and+
%23filename+*.html> (last visited May
4, 2015).
14. Institute of Medicine, Beyond the
HIPAA Privacy Rule: Enhancing
Privacy, Improving Health through
Research (Washington, D.C.: The
National Academies Press, 2009).
15. See M. A. Rothstein, “Improve Privacy
in Research by Eliminating Informed
Consent? IOM Report Misses the
Mark,” Journal of Law, Medicine &
Ethics 37, no. 4 (2009): 507-512 (criti-
cizing IOM report).
16. See Institute of Medicine, supra note
14, at 35.
17. Presidential Commission for the Study
of Bioethical Issues, Moral Science:
Protecting Participants in Human Sub-
jects Research (2011): at 70, available
at <www.bioethics.gov/node/558> (last
visited May 4, 2015).
18. The Common Rule currently permits a
waiver of consent where the only record
abortion and art • summer 2015 429
linking the subject and the research
would be an informed consent docu-
ment, the research is minimal risk, and
the main risk is a breach of confiden-
tiality. 45 C.F.R. § 46.117(c). The IOM
Report would make even personally
identifiable research subject to waiver
of consent.
19. J. Katz, Statement of Committee Mem-
ber Jay Katz, Final Report of the Advi-
sory Committee on Human Radiation
Experiments (New York: Oxford Uni-
versity Press, 1996): at 545.
20. J. Harris, “Scientific Research is a Moral
Duty,” Journal of Medical Ethics 31,
no. 4 (2005): 242-248; R. Rhodes, “In
Defense of the Moral Duty to Partici-
pate in Biomedical Research,” American
Journal of Bioethics 8, no. 10 (2008):
37-38; G. O. Schaefer, E. J. Emanuel,
and A. Wertheimer, “The Obligation
to Participate in Biomedical Research,”
Journal of the American Medical Asso-
ciation 302, no. 1 (2009): 67-72.
21. S. Rennie, “Viewing Research Partici-
pation as a Moral Obligation: In Whose
Interest?” Hastings Center Report 41,
no. 2 (2011): 40-47.
22. M. A. Rothstein, “Privacy and Confiden-
tiality,” in Y. Joly and B.M. Knoppers.
eds., Routledge Handbook of Medical
Law and Ethics (New York: Routledge,
2015): at 52.
23. M . A. Rothstein, “Research Privacy
under HIPAA and the Common Rule,”
Journal of Law, Medicine & Ethics 33,
no. 1 (2005): 154-159.
24. R. B. Altman, “Data Re-Identification:
Societal Safeguards,” Science 339, no.
6117 (2013): 1032-1033.
25. T. L. Beauchamp and J. F. Childress,
Principles of Biomedical Ethics, 7th ed.
(New York: Oxford University Press,
2013): at 107.
26. See Rothstein, supra note 15, at 510-511
(discussing studies).
27. M. A. Rothstein, “Is Deidentification
Sufficient to Protect Health Privacy in
Research?” American Journal of Bioeth-
ics 10, no. 9 (2010): 3-11.
28. See J. H. Jones, Bad Blood: The Tuske-
gee Syphilis Experiment (New York:
Free Press, 1993) (presenting a detailed
history of the study).
29. Tilousi v. Arizona State Univ. Bd. of
Regents, 2005 WL 6199562 (D. Ariz.,
March 3, 2005). See K. Drabiak-Syed,
“Lessons from Havasupai Tribe v. Ari-
zona State University Board of Regents:
Mark A. Rothstein
Recognizing Group, Cultural, and Dig-
nitary Harms as Legitimate Risks War-
ranting Integration into Research Prac-
tice,” Journal of Health & Biomedical
Law 6, no. 2 (2010): 175-225.
30. Grimes v. Kennedy Krieger Inst., Inc.,
782 A.2d 807 (Md. 2001). See D. R.
Buchanan et al., “Justice and Fair-
ness in the Kennedy Krieger Institute
Lead Paint Study: The Ethics of Public
Health Research on Less Expensive,
Less Effective Interventions,” Ameri-
can Journal of Public Health 96, no. 5
(2008): 781-787 (reviewing Kennedy
Krieger case).
31. See R. Skloot, The Immortal Life of
Henrietta Lacks (New York: Crown,
2010) (describing the scientific research
undertaken without any consent).
32. B . A. Koenig, “Have We Asked Too
Much of Informed Consent?” Hastings
Center Report 44, no. 4 (2014): 33-34.
33. M. E. Falagas et al., “Informed Con-
sent: How Much and What Do Patients
Understand?” American Journal of
Surgery 198, no. 3 (2009): 420-435; G.
Henderson, “Is Informed Consent Bro-
ken?” American Journal of Medical Sci-
ences 342, no. 4 (2011): 267-272; W. T.
King and J. E. Heubi, “Comprehension
Testing in Informed Consent,” Ameri-
can Journal of Bioethics Empirical Bio-
ethics 5, no. 3 (2014): 39-54.
34. To maximize the benefits of direct
involvement by physician-investiga-
tors while minimizing the possibil-
ity of objective or subjective coercion,
it might be helpful to use a two-stage
informed consent process. At the first
stage, a research coordinator or simi-
lar person would review the research
protocol, and if the individual indicates
a willingness to participate, then the
physician-investigator would follow up
with a personal visit to reiterate the
assurances in the informed consent
document and underscore his or her
personal commitment to the ethical
conduct of the research.
35. See Institute of Medicine, supra note
14, at 209.
36. Id.
37. M . A. Rothstein and A. B. Shoben,
“Does Consent Bias Research?” American
Journal of Bioethics 13, no. 4 (2013): 27-37.