7 Reading Response

All of Us Research Program—Protocol v1.12 IRB Approval Date: 23 October 2019

Protocol Title All of Us Research Program 1 Principal Investigator(s) Joshua Denny, M.D., M.S. Vanderbilt University Medical Center +1 615 936-5033 Sponsor National Institutes of Health (NIH) Primary Contact John Wilbanks Sage Bionetworks +1 617 838-6333 Protocol Version Core Protocol v.1.12 pre02 Date 16 October 2019 IRB reference AoU IRB Protocol # 2017-05 IRB Approval date v1.5: May 20, 2017 v1.6: Feb 13, 2018 v1.7: Mar 28, 2018 v1.8: Jul 11, 2018 v1.9 Oct 19, 2018 v1.10 Mar 05, 2019 v1.11 Aug 12, 2019 v1.12 Oct 23, 2019

1 Precision Medicine Initiative, PMI, All of Us, the All of Us logo, and “The Future of Health Begins with You” are service marks of the U.S. Department of Health and Human Services.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

2

Program Leadership and Governance Leadership The All of Us Research Program (AoURP) is a large collaborative initiative sponsored by the National Institutes of Health (NIH). The research program functions as a consortium of awardees from multiple institutions. Its governance involves representation from each awardee and participant representatives. The consortium also includes the program director and project scientists/specialists from NIH. Each awardee has responsibilities commensurate with expertise. See Table 0–1: Program Unit Awardees for a list of NIH-funded awardees and contact Principal Investigators (PIs). Dr. Joshua Denny of Vanderbilt University Medical Center serves as the Principal Investigator on behalf of the consortium. Governance The Steering Committee (SC) is the primary governing body of AoURP. The SC recommends strategic directions for the program and oversees planning, coordination, and implementation of the program’s overall operations. Its 50 voting members include PIs from each awardee as designated in the notice of award; representation from NIH, comprising of the deputy director and chief officers of AoURP; representation from community partners and participants (see section 3.1); and additional representation as needed to ensure balanced representation of stakeholders. The governance also includes an Executive Committee (EC) which is a small governing body composed of 17 members, that ensures the program is effectively meeting its objectives and mission. The EC proposes solutions to challenges and provides the Director with strategies, options, and information to aid in programmatic decisions. The Director has discretion to delegate specific decisions to the EC. Membership of the EC is determined by the Director and reflects the awardees within the consortium with balanced interests to ensure effective deliberation. The Steering Committee may approve the formation of additional governance bodies– committees, task forces, boards, etc. – as necessary to fulfill the mission of AoURP. The purpose of these additional governance bodies is to alleviate the bandwidth constraints of the SC and EC by gathering subject-matter experts from within the consortium to oversee discussion and develop policies, recommendations, or guidelines related to their assigned topic. Figure 0–1: Governance Structure

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

3

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

4

Table 0–1: Program Unit Awardees

Biobank Stephen Thibodeau Mayo Clinic Communications Awardees Ronnie Tepp HCM Patrick McGovern Wondros DRC—Data and Research Center

Sekar Kathiresan Broad Institute Joshua Denny Vanderbilt University Medical Center David Glazer Verily

HPOs—Health Care Provider Organizations Primary Sites RMCs—Regional Medical Centers (Contact PIs listed)

David Goldstein New York City Precision Medicine Consortium Lucila Ohno-Machado California Precision Medicine Consortium Christine Johnson Henry Ford Health System Jordan Smoller New England Precision Medicine Consortium Philip Greenland Illinois Precision Medicine Consortium Akinlolu Ojo University of Arizona Steve Reis University of Pittsburgh Bruce Korf University of Alabama at Birmingham Murray Brilliant Marshfield Clinic Research Institute Stephan Zuchner University of Miami Health System FQHCs—Federally Qualified Health Centers

Parinda Khatri Cherokee Health Systems Yashoda Sharma Community Health Center, Inc. Eric Schlueter Eau Claire Cooperative Health Center Carmen Chinea HRHCare Donna Antoine-LaVigne Jackson-Hinds Comprehensive Health Center Fatima Muñoz San Ysidro Health Center VAMCs—Veterans Affairs Medical Centers Christopher J. O’Donnell United States Department of Veterans Affairs PTSC—Participant Technology Systems Center Praduman Jain Vibrent Health TPC—The Participant Center Eric Topol Scripps Translational Science Institute Community Partner Awards Patricia Watkins Lattimore Delta Research and Educational Foundation Edgar Gil Rico National Alliance for Hispanic Health Mitchell Lunn San Francisco General Hospital Foundation

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

5

Gretchen Funk Fifty Forward

Fornessa T. Randal The Asian Health Coalition For more information, see https://allofus.nih.gov/funding/awardees

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

6

Table of Contents

PROGRAM LEADERSHIP AND GOVERNANCE ................................................................................................. 2 1 BACKGROUND AND SCIENTIFIC RATIONALE .................................................................................... 11

1.1 PILOT ACTIVITIES ............................................................................................................................................................. 11 2 OBJECTIVES ................................................................................................................................................ 14

2.1 WHAT IS THE ALL OF US RESEARCH PROGRAM?...................................................................................................... 14 3 STUDY OVERVIEW .................................................................................................................................... 15

3.1 PARTICIPANTS REPRESENTATIVES .............................................................................................................................. 16 3.2 CREATING A RESOURCE FOR RESEARCH ..................................................................................................................... 17 3.3 MAKING THE RESOURCE ACCESSIBLE FOR RESEARCH ............................................................................................ 19 3.4 STUDY TIMELINE/STUDY DURATION .......................................................................................................................... 20

4 SELECTION OF PARTICIPANTS .............................................................................................................. 20 4.1 ELIGIBILITY......................................................................................................................................................................... 20 4.2 INCLUSION AND EXCLUSION CRITERIA ........................................................................................................................ 21 4.3 VULNERABLE POPULATIONS .......................................................................................................................................... 21

5 RECRUITMENT OUTREACH .................................................................................................................... 22 5.1 OUTREACH TO HPO MEMBERS ..................................................................................................................................... 23 5.2 OUTREACH TO DIRECT VOLUNTEERS .......................................................................................................................... 24 5.3 THE SUPPORT CENTER .................................................................................................................................................... 24 5.4 OUTREACH TO COMMUNITIES ....................................................................................................................................... 25 5.5 MOBILE ENGAGEMENT ASSET ....................................................................................................................................... 27 5.6 SUMMARY OF OUTREACH AND ENGAGEMENT APPROACHES ................................................................................ 27 5.7 READABILITY OF OUTREACH AND ENROLLMENT MATERIALS ............................................................................. 28

6 ENROLLMENT ............................................................................................................................................ 29 6.1 ENROLLMENT STRATEGIES ............................................................................................................................................. 29 6.2 LEVELS OF ENROLLMENT................................................................................................................................................ 29 6.3 ACCOUNT CREATION ........................................................................................................................................................ 31 6.4 INFORMATION COLLECTED PRIOR TO INFORMED CONSENT ................................................................................. 31 6.5 INFORMED CONSENT OVERVIEW .................................................................................................................................. 31 6.6 ELECTRONIC CONSENT .................................................................................................................................................... 33 6.7 DATA OVERSIGHT AND CHOICE OF LAW ..................................................................................................................... 37 6.8 MONITORING ENROLLMENT .......................................................................................................................................... 38

7 WHAT IS INVOLVED? PROGRAM PROCEDURES................................................................................ 41 7.1 PARTICIPANT-PROVIDED INFORMATION (PPI) ....................................................................................................... 42 7.2 USE OF PERSONAL HEALTH TECHNOLOGIES ............................................................................................................. 43 7.3 PHYSICAL MEASUREMENTS ............................................................................................................................................ 45 7.4 BIOSPECIMEN COLLECTION ............................................................................................................................................ 46 7.5 BIOSPECIMEN PROCESSING AND STORAGE ................................................................................................................ 48 7.6 ELECTRONIC HEALTH RECORDS (EHRS) ................................................................................................................... 51 7.7 DATA LINKAGE .................................................................................................................................................................. 51 7.8 EARLY AND LONG-TERM PARTICIPANT INVOLVEMENT ......................................................................................... 53

8 RISKS/BENEFITS ASSESSMENT ............................................................................................................. 56 8.1 RISKS .................................................................................................................................................................................... 56 8.2 BENEFITS ............................................................................................................................................................................ 58 8.3 RISK/BENEFIT ANALYSIS ............................................................................................................................................... 60

9 ISSUES TO CONSIDER ............................................................................................................................... 60 9.1 PAYMENT FOR PARTICIPANTS ....................................................................................................................................... 60

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

7

9.2 HANDLING ON-SITE REPORTABLE EVENTS ............................................................................................................... 61 9.3 PARTICIPATION OPTIONS: DEACTIVATE AND WITHDRAWAL PROCEDURES ..................................................... 62 9.4 DESTRUCTION OF SPECIMENS........................................................................................................................................ 64

10 ACCESS TO INDIVIDUAL-LEVEL INFORMATION FOR PARTICIPANTS ......................................... 65 10.1 PRINCIPLES OF INDIVIDUAL-LEVEL INFORMATION AVAILABILITY ..................................................................... 65 10.2 INDIVIDUAL-LEVEL PROGRAM INFORMATION .......................................................................................................... 65 10.3 INFORMATION ACCESS TECHNOLOGIES ...................................................................................................................... 67 10.4 INDIVIDUAL-LEVEL INFORMATION ACCESS PROCESSES......................................................................................... 68 10.5 PHYSICAL MEASUREMENTS—RETURN OF MEDICALLY ACTIONABLE RESULTS.............................................. 70 10.6 PARTICIPANT-PROVIDED INFORMATION AND EHR ................................................................................................ 74 10.7 ACCESS TO BIOSPECIMEN-DERIVED INFORMATION (NON-GENETIC) ................................................................ 74 10.8 ACCESS TO GENOMIC RESULTS ...................................................................................................................................... 74

11 CREATION OF THE ALL OF US RESEARCH PROGRAM RESOURCE................................................. 75 11.1 THE RAW DATA REPOSITORY ....................................................................................................................................... 75 11.2 THE CURATED DATA REPOSITORY ............................................................................................................................... 75 11.3 THE PTSC DATA REPOSITORY ...................................................................................................................................... 76

12 ACCESS TO THE RESOURCE FOR RESEARCH ...................................................................................... 77 12.1 ALL OF US DATA ACCESS GOVERNANCE ...................................................................................................................... 78 12.2 ACCESS AND USE OF DATA ............................................................................................................................................. 79 12.3 ACCESS AND USE OF BIOSPECIMENS ............................................................................................................................ 82 12.4 CONTACTING PARTICIPANTS ......................................................................................................................................... 82

13 CONFIDENTIALITY, PRIVACY, AND SECURITY .................................................................................. 83 13.1 SECURITY POSTURE .......................................................................................................................................................... 84 13.2 FISMA AND ITS SIGNIFICANCE TO THE ALL OF US RESEARCH PROGRAM ......................................................... 84 13.1 OVERVIEW OF PRIVACY AND DATA CONFIDENTIALITY PROTECTIONS .............................................................. 87

14 POST-ENROLLMENT ENGAGEMENT STRATEGY ............................................................................... 91 14.1 CONCEPTUAL FRAMEWORK ........................................................................................................................................... 92 14.2 APPROACH TO ENGAGEMENT ........................................................................................................................................ 93 14.3 RETENTION ......................................................................................................................................................................... 95

15 SITE MONITORING, RECORD KEEPING, AND QUALITY ASSURANCE ........................................... 98 15.1 HPO AND DV ENROLLMENT SITE MONITORING ..................................................................................................... 98 15.2 TRAINING EXPECTATIONS ............................................................................................................................................... 99

16 REFERENCES ............................................................................................................................................ 101 17 LIST OF TERMS AND ACRONYMS ........................................................................................................ 103 18 LIST OF APPENDICES ............................................................................................................................. 107 19 PROTOCOL VERSIONS ............................................................................................................................ 108

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

8

Table of Tables TABLE 0–1: PROGRAM UNIT AWARDEES .......................................................................................................................................... 4 TABLE 0–2: PROTOCOL SYNOPSIS ........................................................................................................................................................ 9 TABLE 4–1: VULNERABLE POPULATIONS EXCLUDED AT LAUNCH....................................................................................... 22 TABLE 7–1: ESTIMATED DURATION OF PARTICIPANT JOURNEY .......................................................................................... 41 TABLE 7–2: SURVEY COMPLETION TIMES ...................................................................................................................................... 43 TABLE 7–3: QUESTIONS TO PARTICIPANTS PRIOR TO SCHEDULING THE BLOOD SAMPLE COLLECTION ............ 47 TABLE 9–1: PARTICIPATION OPTIONS ............................................................................................................................................. 62 TABLE 10–1: MEDICALLY ACTIONABLE FINDINGS AT THE TIME OF BASELINE PHYSICAL MEASUREMENTS .... 70 TABLE 12–1: DATA ACCESS BY TYPE ................................................................................................................................................ 81 TABLE 13–1: THREAT ASSESSMENT ................................................................................................................................................. 88 Table of Figures FIGURE 0–1: GOVERNANCE STRUCTURE ........................................................................................................................................... 2 FIGURE 1–1: PPI DEVELOPMENT PROCEDURE ............................................................................................................................. 12 FIGURE 3–1: PARTICIPANT INTERACTION FLOW ........................................................................................................................ 19 FIGURE 6–1: PARTICIPANT JOURNEY ............................................................................................................................................... 30 FIGURE 7–1: BIOSPECIMEN FLOWCHART ....................................................................................................................................... 49 FIGURE 7–2: DATA WORKFLOW SAMPLE FOR PARTICIPANTS............................................................................................... 54 FIGURE 10–1: ALL OF US RESEARCH PROGRAM INDIVIDUAL-LEVEL INFORMATION: DATA AND RESULTS......... 66 FIGURE 10–2: DATA FLOW FOR PARTICIPANTS AND HPO STAFF ......................................................................................... 68 FIGURE 10–3 EXAMPLE OF PHYSICAL MEASUREMENT CARD—CO-BRANDED ................................................................ 72 FIGURE 10–4 EXAMPLE OF PHYSICAL MEASUREMENT CARD—5 X7 FORMAT ................................................................ 73 FIGURE 11–1: CURATED DATASET .................................................................................................................................................... 77 FIGURE 13–1: ALL OF US RESEARCH PROGRAM CONNECTIONS AND DATA FLOW ........................................................ 84

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

9

Protocol Synopsis Table 0–2: Protocol Synopsis

TITLE All of Us Research Program (All of Us)

SPONSOR National Institutes of Health (NIH)

FUNDING ORGANIZATION

National Institutes of Health (NIH)

NUMBER OF SITES Multiple sites through selected Health Care Provider organizations (HPOs) and Direct Volunteer (DV) partners, and sites representing core functions, such as the Biobank, Data and Research Center (DRC), Participant Technology Systems Center (PTSC), other technology partners , and Community Partners.

RATIONALE Precision medicine is an approach to disease treatment and prevention that seeks to maximize effectiveness by considering individual variability in genes, environment, and lifestyle. Precision medicine seeks to redefine our understanding of disease onset and progression, treatment response, and health outcomes through the more precise measurement of molecular, environmental, physiologic, and behavioral factors that contribute to health and disease. This understanding will lead to more accurate diagnoses, more rational disease prevention strategies, better treatment selection, and the development of novel therapies. By enrolling a diverse group of one million or more participants who provide questionnaire responses—participant-provided information (PPI), electronic health record (EHR) data, biospecimens, physical measurements, and permission for re-contact—for many years, the All of Us Research Program will have the scale and scope to enable research for a wide range of diseases, both common and rare, as well as increasing our understanding of healthy states.

STUDY DESIGN At its core, this is a large longitudinal cohort program with repeated engagement of participants to create a research resource that enables a variety of future observational and interventional studies, some of which will require subsequent IRB approvals.

PRIMARY OBJECTIVE To build a robust research resource composed of PPI, environmental, physiologic, genetic, and health data plus biospecimens from one million or more research participants reflecting the diversity of the United States.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

10

This resource will facilitate the exploration of biological, social, and environmental determinants of health and disease.

NUMBER OF PARTICIPANTS AND ENROLLMENT MODES

One million or more individuals willing and able to answer questionnaires (PPI), provide biospecimens and physical measurements, share their EHR data, and authorize re-contact will be enrolled via two modes, whichever is most convenient for the participant: through HPOs or DV sites, using digital interfaces. We expect that many more than one million individuals may enroll into the cohort and complete some of these components (see Section 4, Selection of Participants).

PARTICIPANT SELECTION CRITERIA

Inclusion Criteria: • Adults 18 and older with decisional capacity to consent • Currently reside in the United States or a territory of the

United States Exclusion Criteria:

• Prisoners at the time of enrollment

DURATION OF PARTICIPATION AND DURATION OF STUDY

Duration of Study: The All of Us Research Program is expected to last at least 10 years, with active enrollment occurring in the first five years. Duration of Participation: Participation is expected to last for the entire duration of the research program, with regular data contribution and follow-up.

PRIMARY ENDPOINT Collection and curation of rich participant health and biospecimen data accessible to the research community, to enable a broad spectrum of research studies.

SECONDARY ENDPOINTS

Build the infrastructure to enroll participants, collect biospecimens, and securely share health-related data for ongoing research.

SAFETY EVALUATIONS

Safeguards are in place to maintain the privacy of the participants, the confidentiality of the biospecimens, and the security of the data collected through the research program (see Section 13, Confidentiality, Privacy, and Security).

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

11

1 Background and Scientific Rationale Our current approach to health care is informed by clinical trials that have sample sizes in the thousands, or tens of thousands, meaning that we typically lack the statistical power to make fine- grained predictions about how a given treatment will affect a given individual. As a result, therapies often fail in practice and most interventions fail to integrate with most patients’ own knowledge and lifestyles. Historically, this approach is characterized by a lack of inclusion and diversity in clinical study; that is, the benefits of precise and personalized interventions may not be accruing equitably across society. Precision medicine is an approach to disease prevention, diagnosis, and treatment that seeks to maximize effectiveness by considering individual variability in genes, environment, and lifestyle. Precision medicine seeks to redefine our understanding of disease onset and progression, treatment response, and health outcomes through the combined analysis of biological, environmental, and behavioral factors that contribute to health and disease. This understanding may lead to more rational disease prevention strategies, more accurate diagnoses, better treatment selection, and the development of novel therapies. The promise of precision medicine can only be achieved with input from a broad population that reflects the true diversity and life experiences of those in the United States. By combining health-related information from one million or more diverse participants, the All of Us Research Program will have the right scale and inclusive scope to enable research for a wide range of diseases, both common and rare. A cohort of this size will have the statistical power to detect associations between genetic and environmental exposures and a wide variety of health outcomes. A deliberately inclusive strategy that prioritizes groups historically underrepresented in biomedical research (UBR) should provide enough power for meaningful subgroup analyses and lead to the most precise medicine for these groups. Outcomes of this research could include novel prevention and screening strategies, earlier and more precise diagnoses, new and more rational use of therapies, and improved understanding of why some people remain healthy despite exposures and risk factors for disease. Coincident with advancing the science of medicine is a changing culture of health care practice and biomedical research that engages individuals as active partners. The All of Us Research Program aims to actively engage participants and their advocates in all aspects of the research program, including governance, oversight, design, conduct, dissemination, and evaluation. Participants will not only provide their biological, health, behavioral, and environmental data, they will also be able to access their information, learn about the research being conducted, and be partners in the discovery process. This ongoing partnership between the research program and participants is described in Section 14, Post-Enrollment Engagement Strategy.

1.1 Pilot Activities In an effort to make the All of Us Research Program participant-centered, understand barriers to participation, and improve participant experience, we piloted aspects of the research program using structured methods with input from diverse groups of potential participants. These pilots were led by Vanderbilt University Medical Center, in partnership with the Broad Institute, the University of Michigan, Vanderbilt University, and Meharry Medical College (details are provided in Appendix M, a brief overview is presented below).

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

12

The pilot was split in two major phases. The first phase focused on creating a registry (the “pilot registry”) of volunteers for testing various features of the research program. The second phase focused on engaging participants from the pilot registry to test and provide feedback on selected aspects of the program, starting with developing and/or refining a set of questionnaires (or modules) to be presented to participants (participant-provided information, or PPI). See Figure 1–1: PPI Development Procedure. The feedback was collected through Community Engagement (CE) Studios and online questionnaires. CE Studios consist of face-to-face facilitated discussions with a panel of community members or people with firsthand knowledge or experience of a particular condition or community, with the goal to obtain project-level input to guide the research (Joosten et al., 2015). Figure 1–1: PPI Development Procedure

More than 5,200 participants joined the pilot registry. To recruit a diverse group of participants, the pilot team supplemented the electronic recruitment with in-person recruitment strategies and outreach to All of Us consortium partners with communities eager to participate. Spanish speakers and participants without a bachelor’s degree were especially taken into consideration and invited to participate.

1.1.1 Pilot Community Engagement Studios Seventy-seven Community Engagement (CE) Studios were convened with broadly diverse and hard-to-reach populations to ensure the feedback did fostered inclusivity. The CE studios focused on the Expression of Interest website, the enrollment process, the informed consent procedure, and return of value to participants. Seventeen of these CE studios were conducted in collaboration with six Federally Qualified Health Centers (FQHCs) located in Middletown, CT; Knoxville, TN; Columbia, SC; Peekskill, NY; Jackson, MS; and San Ysidro, CA. Forty-six percent of CE Studio panelists were racial/ethnic minorities, and 9% were sexual and gender minorities.

PPI Committee

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

13

Input from this engagement has informed the research program in many domains. For instance, the CE Studios participants identified the newness of precision medicine as a concept to individuals across the diverse population sampled, reinforcing that focused effort should be put toward ensuring the comprehensibility of the All of Us Research Program. They also revealed a preference for more flexibility in the enrollment procedure. This led us to include additional options in this process. The CE Studios informed the language and imagery used by the All of Us Research Program, incentives for participation, approaches for the language translation process, privacy and security language in participant materials, and the types of information to be returned to participants.

1.1.2 Pilot Online Participant Provided Information (PPI) Testing Various health surveys (PPI modules) were assessed through cognitive interviews of volunteers from the pilot registry and online qualitative testing. The results led to minor editing of questions to improve clarity, better represent perspectives reported by participants, and accommodate a wider range of literacy levels. This pilot also informed the preferred formatting of the questionnaires for self-administered delivery. Notably, the introduction for each module was adjusted to include lay language and guide participants. Additional directions and concept explanations were also added to complement question- and-response options as needed to improve clarity. Following readability analysis, using the Flesch-Kincaid Grade Level scale (Flesch,1948), module content was re- reviewed to ensure that essential meaning and concepts were fully retained. A few questions regarding sexual orientation and gender identity were added to the “Basics” module to be inclusive of the LGBTQ (lesbian, gay, bisexual, transgender, queer/questioning) community. The 2020 U.S. census combined race and ethnicity question was added to be inclusive of major races and ethnicities (https://www.census.gov/2020census/). Spanish versions for the PPI modules were tested with Spanish-speaking pilot participants through cognitive interviews to ensure the translation of the modules used common terminology for a variety of Spanish speakers. The consortium’s Spanish Translation Team followed the IRB- approved translation process to refine the Spanish versions for each module and include an ethnographic representation of Spanish dialects.

1.1.3 Pilot Informed Consent Process Despite widespread consensus on the importance of informed consent, ensuring research participants are truly informed remains a challenge to researchers worldwide. Given the planned scale and scope of the All of Us Research Program, a truly informing consent process becomes ever more essential and more challenging to design. We have drawn on a number of sources to inform our approach to informed consent, starting with the findings from the CE Studios, dress rehearsals at sites, and receiving participants’ feedback. The CE Studios reaffirmed the need to focus efforts toward ensuring the comprehensibility of the All of Us Research Program’s informed consent. To this end, written consent materials were crafted with simple, plain language at a reading level appropriate for a diverse audience. Empirical research as well as best practice guidance recommend that informed consent materials should be written at the 5th-grade reading level (Beskow LM., 2016; National Quality Forum (NQF), 2005; Agency for Healthcare Research and Quality (AHRQ), 2009). Accordingly, the All of Us written informed consent materials targeted the 5th-grade reading level; a description of the readability analysis process they underwent can be found in Section 5.6, Readability of Outreach and Enrollment Materials.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

14

Additionally, to improve comprehensibility, the informed consent process is hosted electronically on the All of Us Research Program website and app. These platforms allow for the incorporation of multimedia informing approaches, including video, animations with voiceover, icons, and tactile interactive features—approaches specifically requested by participants in the CE Studios and endorsed as best practices by the AHRQ and NQF. In addition to “traditional” informed consent forms, electronic presentation of informed consent (eConsent) presents the opportunity to highlight and reinforce key consent topics, using an accessible, digestible textual presentation (Doerr et al., 2016; Doerr et al., 2017). Hosting the informed consent process electronically has the further benefit of being highly scalable—essential, given the research program’s ambitious enrollment targets—as well as flexible to accommodate state-specific consent requirements and dynamic, modular consent models. Another key finding from the CE Studios was that “individualization” of precision medicine should be reflected throughout the All of Us Research Program; in other words, a participant’s experience should not be generic or pre-programmed, but individually adaptable to their unique needs and preferences. While this concept is consistent with the core informed principle of respect for persons, operationalizing autonomy while preserving informedness within the informed consent process is a relatively novel challenge within large-scale human subjects research projects (Doerr et al., 2017). CE Studio participants strongly stated that sponsorship and enrollment expectations should be transparent and understandable at the outset of the All of Us Research Program. At the same time, limited attention span and the risk of informedness decay over time argues against “front-loading” informed consent processes (Doerr et al., 2016). To meet these competing demands, the informed consent process has been designed to be modular, with consenting interactions tied to the All of Us Research Program’s activities over time. An overarching primary consent module gives a complete overview of sponsorship and all the All of Us Research Program elements. Two additional modules focus on sharing EHR data and on the return of genomic results. By completing these consent modules participants become eligible to participate in diverse program activities, i.e., being invited to contribute biospecimens hinges on consenting to join the program, agreeing to genomic analysis, and sharing EHR data. The informed consent process is described in detail in Section 6, Enrollment. It is our specific intention to monitor enrollment over time to ensure that our approach is consistent with the principles of informed consent as well as those of the research program as a whole.

2 Objectives

2.1 What Is the All of Us Research Program? The mission of the All of Us Research Program is to advance the science of precision medicine and ensure everyone shares in its benefits. To accomplish this, the All of Us Research Program established a set of core values to guide our decisions and actions as the program grows in capacity, reach, and research. We aspire to incorporate these values throughout our journey as our first participants enroll, we collect the first data points, and we plan the first studies:

1. Participation is open to all. 2. Participants reflect the rich diversity of the U.S.A.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

15

3. Participants are partners. 4. Trust will be earned through transparency. 5. Participants have access to their information. 6. Data will be accessed broadly for research purposes. 7. Security and privacy will be of highest importance. 8. The program will be a catalyst for positive change in research.

The overall objective of the All of Us Research Program is to build a robust research resource that can facilitate the exploration of biological, clinical, social, and environmental determinants of health and disease. The research program will collect and curate health-related data and biospecimens from one million or more individuals who reflect the diversity in the United States; these data and biospecimens will be made broadly available for research uses. The All of Us Research Program is an observational study that will provide the information needed to address a wide range of scientific questions. Resource use is anticipated to be very broad, from the use of aggregate data to the use of individual-level data and biospecimens. This broad usage of data will address a wide range of biomedical and scientific opportunities across diverse populations. Some examples of opportunities that we anticipate can be addressed through judicious use of this resource include:

1. Enabling participants to partake in research by bringing research closer to communities across the country through a direct volunteer approach.

2. Empowering participants with information and data that may improve their own health 3. Making data broadly available to traditional and nontraditional researchers (including

nonprofessional or “community” scientists) to develop innovative technologies and methodologies

4. Developing quantitative estimates of risk for a range of diseases by integrating environmental exposures, genetic factors, and gene–environment interactions

5. Discovering biomarkers that identify individuals with an increased risk of developing common diseases

6. Optimizing screening and prevention strategies based on individual genomic, environmental, and behavioral risk factors

7. Developing tools and approaches for new or improved disease classifications and relationships

8. Using personal health technologies to correlate sensor data, behavior, and the environment with health outcomes

9. Identifying the determinants of safety and efficacy for common therapeutics 10. Using biological data to develop new therapeutic strategies 11. Inviting participants to enroll in clinical trials of targeted interventions and therapies

3 Study Overview

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

16

The All of Us Research Program aims to enroll one million or more participants from throughout the United States to provide insight into the substantial interindividual differences in physiology, risk of disease, and response to therapy. Participants will be invited to share their electronic health records, if any, and answer health-related questionnaires. Some participants may also be invited to undergo physical measurements and provide biospecimens from which genomic information and other biomarkers may be derived through analytics. The selection of participants to these modules will be based on the desire for demographic diversity. The information and biospecimens collected will become a useful resource for current and future researchers to investigate why some people develop certain health conditions while others do not.

3.1 Participants Representatives A central principle of the All of Us Research Program vision and promise is to include participants as true partners in all aspects of the program, from research design through governance. Participants will help set the standard for the program to reflect the diverse needs, preferences, and priorities of participants inclusive of the range of age, social, racial, ethnic, cultural, geographical, sexuality, gender, physical abilities, and health statuses of individuals in the United States. AoURP will facilitate meaningful involvement of diverse participant communities in governance and oversight, operations, and communications of the program and enable ongoing input from groups often underrepresented in research. Processes and mechanisms for elevating participant voices will include:

1. Steering Committee – Up to five participant representatives and up to five PIs from community partner awards will be members of the steering committee with oversight on the direction and implementation of the program.

2. Advisory Panel – A working group that provides expert advice on the vision, scientific goals, and operations of the All of Us Research Program. Currently, the advisory panel consists of subject matters experts and researchers. The panel will meet at a minimum of six times annually (three all-day Face-to-Face meetings, three 1-hour WebEx meetings, and ad hoc meetings as needed). The panel will include at the minimum three participant representatives, to represent the perspective of the general public and communities underrepresented in biomedical research. These advisory panel participant representatives will be selected from an “open call” for self-nomination on their Participant Portal account.

3. Executive Committee – Two participant representatives from the steering committee or the advisory panel will be members of the executive committee also.

4. AoURP Participant Panel – We will ask our consortium engagement leads to nominate participant representatives from their respective Participant/Community Advisory Boards to serve on the AoURP Participant Panel. The panel will consist of 24 participants with an emphasis on representing diverse socioeconomic groups, educational backgrounds, needs, and preferences, who will provide feedback and insight about the program to AoURP staff.

5. Governance structure – Representatives serving on the AoURP Participant Panel will have the opportunity to serve on our governing committees, boards, and task forces as appropriate.

To ensure diversity of participant voices, we will create a clear and concise description of participants’ role in each panel and committee and emphasize the importance of diversity to the program. We will include questions in the application or nomination form for individuals to identify

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

17

communities and perspectives they represent, consider perspectives currently represented in the program, and identify gaps in perspectives not currently represented.

Interested prospective participants on the Advisory Panel and the AoURP Participant Panel will submit a personal statement (self-nominees) or the consortium engagement lead will complete a nomination form, in both cases describing the individual’s background and experience. As a part of the selection process, in addition to filling gaps in perspectives not represented, participant representatives are also expected to be interested in and willing to devote the time needed to learn about the vision, opportunities, and challenges of the All of Us Research Program. They must be committed to advancing health and wellness research, particularly for those who have been historically underrepresented in biomedical research (UBR), and they must also have the willingness and ability to work collaboratively with the program’s researchers, physicians, technology experts and staff.

Participant representatives will be invited to serve one 2-year term; however, our goal is to develop a relationship with our participant partners such that they will remain engaged in some capacity throughout the life of our program. This will enable sufficient time for advocates to learn about and help shape the program and also allow opportunities for a diversity of participant advocates to serve and contribute value to the program. In addition to the Advisory Panel, the AoURP Participant Panel, and involvement in governance, participants can provide feedback and input on the program, including using comment or suggestion boxes at partner sites and contacts and/or email addresses at partner sites. There is an open text box on the Participant Portals. Participants are also able to share their experience by completing IRB- approved structured surveys. Cognitive Testing and Usability Testing are also used to further enhance participant involvement and experience.

In addition to having participant representatives help shape the All of Us Research Program in the ways described above, the program invites participants to become partners in the data gathering and research process through various means, including data return and as “community” scientists investigating the data. The combination of a highly engaged participant population and rich biological, health, behavioral, and environmental data will undoubtedly help the program to develop a key resource for biomedical investigation.

3.2 Creating a Resource for Research To build the All of Us Research Program, we seek to enroll one million or more participants. Interested individuals will be able to enroll in one of two ways; whichever is most convenient for them. See illustration in Figure 3–1: Participant Interaction Flow.

1. Through a participating health care provider organization (HPO). This approach is primarily, but not exclusively, for people who are a member of an HPO’s health plan and their affiliates or have received care at any of several participating health centers across the United States. However, any eligible individual who wishes to enroll at an HPO may do so,

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

18

even if they do not have a prior connection with that HPO. Participating HPOs were chosen in the peer review process based on their ability to provide a diverse cross-section of the population as well as for their ability to support and quickly enable the technical and scientific requirements of the study.

2. Virtually, as direct volunteers (DVs), for non-HPO members, or for people who are seeking a more convenient place to enroll.

Both the DV and HPOs paths will rely on program-specific digital tools rendered on a smartphone application and/or a research program website to register participants. Participants will provide some or all the following:

• Participant-provided information (PPI) via questionnaires and surveys (see Section 7.1, Participant-Provided Information (PPI))

• Electronic health records (EHRs). The All of Us Research Program seeks consent to access information from each participant’s EHR. Not all participants will have an EHR, and the process for sharing EHR data to the DRC will differ between members of an HPO or a DV. HPOs will share EHR data with the DRC for their participants following informed consent. Outside of the HPOs, participants will be able to share their EHR data with the DRC via the Sync4Science (S4S) technology that is currently in development (see Section 7.6, Electronic Health Records) or similar technology from other vendors.

• Physical measurements and biospecimens (PM&B). Participants who have agreed to share their EHR data may be invited to provide baseline physical measurements (see Section 7.3, Physical Measurements) and biospecimens (blood, urine, and/or saliva). Biospecimens will be assayed to generate various biological data, which may be incorporated into participants’ study records (see Section 7.4, Biospecimen Collection). In addition, DNA will be isolated from the blood or saliva samples for genetic assays.

• Passive mobile and digital health data (personal health technology data). Additional data may eventually be collected from a subset of participants to be determined, through health, wellness and fitness devices, other sensors, and/or mobile applications (see Section 7.2, Use of Personal Health Technologies).

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

19

Figure 3–1: Participant Interaction Flow

3.3 Making the Resource Accessible for Research The All of Us Research Program aims to provide a useful resource that becomes enriched and improved over time. The research program expects to include detailed longitudinal health and exposure information from participants and retains the flexibility to enhance its scope as funding allows. A core dataset of all data contributed will be developed (see Section 11, Creation of the All of Us Research Program Resource). Ideally, in time, the core dataset will include PPI, physical measurements, digital health technology readings (e.g. Fitbit), genomic and baseline biospecimen assays, and EHR-derived information from most participants. Data elements will be transferred through encrypted channels to the All of Us Research Program’s Data and Research Center (DRC) for storage and for creating a dataset accessible to researchers. The data will be stored in a secure cloud-computing environment that follows rigorous standards to protect individual privacy and data confidentiality (see Section 13, Confidentiality, Privacy, and Security). AoURP will use a variety of approaches to remove explicit personal identifiers such as name, email, phone number, street address, medical record number (MRN) and Social Security number (SSN) from the datasets made available for research purposes, including from free text data sources such as open response fields and EHR notes. The Committee on Access, Privacy, and Security (CAPS) will evaluate these

Participant Portal Hosts

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

20

approaches prior to release and routinely control their quality to minimize the risk of inappropriate re-identification. The researcher-accessible dataset will be queried through a dedicated analysis platform, the All of Us Research Program Research Hub, for research purposes. The DRC will develop tools to enable analysis of the data within this secure cloud-computing environment. Qualified researchers who wish to access the data will agree to not remove data from the Research Hub without approval. The All of Us Research Program will bring researchers to the data rather than asking researchers to download data to their own machines. The Committee on Access, Policy, and Security (CAPS) will serve as the stewards of the data. (see Section 12, Access to the Resource for Research)

3.4 Study Timeline/Study Duration The All of Us Research Program is expected to last at least 10 years, with active enrollment occurring in the first five years. Follow-up is expected to be continuous for the life of the program. For example, data from EHR will be added to a participant’s All of Us dataset at least biannually for those who signed the HIPAA Authorization for Research (Appendix F2). Participants will not receive notification each time EHR data are added. Lastly, the data analysis platform (the All of Us Research Program Research Hub) will be built and available for use by qualified researchers within the second year and available for the life of the program. (Section 12, Access to the Resource for Research)

4 Selection of Participants The full potential of the All of Us Research Program will be realized only by reflecting the full diversity of the United States regarding demographics (age, race and ethnicity, education, socioeconomic status), health status (both healthy participants and those with disease), disabilities, and geography.

4.1 Eligibility All individuals living in the United States or a territory of the United States are eligible to participate, provided they meet the inclusion/exclusion criteria below. The All of Us Research Program recognizes the opportunities and challenges of enrolling a diverse population. Qualifiers of diversity include but are not limited to race, ethnicity, age, sex, gender identity, sexual orientation, disability status, access to care, income, educational attainment, and geographic factors. The research program will actively recruit minority populations who are historically underrepresented in biomedical research (UBR). The emphasis placed on UBR is an effort to enable rigorous research that may inform policy, prevention, and/or treatment approaches and thereby decrease current health disparities. While the aim of the All of Us Research Program is to engage and enroll participants from all life stages, initial enrollment efforts will center around individuals legally able to consent to participate in research on their own. Any considerations to include a broader population will be addressed in future protocol amendments.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

21

Educational content and consent materials will be available in English and Spanish at the national launch; therefore, initial enrollment efforts will focus on participants who read and speak either English or Spanish. The All of Us Research Program explicitly values inclusion; as such, in the future we will release materials translated in other languages reflective of the broader United States population. Additionally, we will ensure participation is open to persons living with physical disabilities. Site- specific accommodations will be made to ensure that persons living with physical disabilities who meet the inclusion criteria are able to enroll.

4.2 Inclusion and Exclusion Criteria

4.2.1 Inclusion Criteria

• Adults 18 and older with the legal authority and decisional capacity to consent • Currently residing in the United States or a territory of the United States

4.2.2 Exclusion Criteria

It is the goal of the All of Us Research Program to be as inclusive as possible. Although all eligible persons should be considered for enrollment, it is crucial that adequate consenting procedures be in place to ensure that the rights, safety, and welfare of all participants enrolled are not compromised. During this initial enrollment period, and until specific enrollment procedures are developed, the following eligible individuals will be excluded:

• Individuals who are incarcerated at the time of enrollment We do not intend to enroll prisoners without appropriate oversight by the IRB; however, we recognize that it is possible, even likely, that some participants may become incarcerated over the course of their participation in the All of Us Research Program. We believe that prisoners should not bear an unfair share of the burden of participating in research or be excluded from its benefits, to the extent that voluntary participation is possible (Huang et al., 2017). Participation in the All of Us Research Program does not affect participants’ rights and is in no way meant to change their social setting or impinge on prison resources or other inmates. Therefore, it is our intention to comply with all relevant federal and state laws, and applicable regulations for the inclusion of prisoners in scientific research. Until further notice from the IRB, the research program material will include a note that people who are incarcerated cannot take part at this time, but that we hope this will change in the future. If we learn that a participant has become incarcerated, we will suspend their participation, using the “deactivate” feature, until such a time as we are equipped to allow for participation by incarcerated populations or until they are no longer incarcerated.

4.3 Vulnerable Populations

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

22

The vulnerable populations that will be excluded in the initial enrollment efforts are summarized in Table 4–1: Vulnerable Populations Excluded at Launch. Separate protocol amendments will be developed that include plans to enroll vulnerable participants, such as children, prisoners, and cognitively impaired individuals. Table 4–1: Vulnerable Populations Excluded at Launch

Excluded at Launch Vulnerable Population X Adults without decisional capacity to consent X Children (<18 years old in most US states) X Prisoners

Due to the minimal risk nature of this protocol, if an individual is interested and able to participate in the All of Us Research Program, meets the eligibility criteria, and is not specifically excluded, they will not be turned away. For example, adult women living in the United States or a territory of the United States who are capable of consent will not be turned away from participation based on their pregnancy status. If known, pregnancy status will be electronically recorded at the time of the PM&B visit.

5 Recruitment Outreach To achieve the broad enrollment and participant diversity objectives of the All of Us Research Program, AoURP will engage potential participants through a range of outreach approaches. Outreach is defined as providing materials and information about the research program in advance of creating a research program account. Prospective participants will learn about the All of Us Research Program via:

1. Targeted advertisement, including: • Print flyers, brochures, and posters • Advertisements (TV, radio, online, mobile) • Billboards and bus advertisements • Direct marketing (email and snail mail)

2. Personal interest groups: • Social media • Community events • Press coverage

3. Directly at HPOs or DV partner sites, including:

• In waiting areas • During the regular course of clinical care at HPOs • Local informational events • Regional informational events organized by research program awardees, HPOs, or DV

partners. • Employee invitations • Re-contact of consented participants in existing research programs • Outpatient clinics

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

23

Inpatient setting For additional detail about asset development and outreach strategy, see Appendix C Potential participants who wish to learn more about the research program will be directed to:

• Trained staff at HPO or authorized DV partner sites • The All of Us Research Program Support Center • The All of Us website (http://joinallofus.org)

Web-based materials (assets) are especially important, given the broad geographic scope and the large numbers of prospective participants needing to be engaged to meet the one million or more enrollment goal. IRB-approved information materials targeted to the general public will be available on the All of Us website, including:

• Branding and animation videos about the research program • Anthem video, with or without English or Spanish subtitles • Community videos • Frequently asked questions • Messages from program leadership (e.g., the master narrative) • Testimonials from participants

IRB-approved assets, such as advertisement messages, images, videos, and other outreach assets, will be available on the All of Us Asset Portal (AllOfUsAssetPortal.org). These assets may be combined and personalized for various populations (rural, multilingual, location, etc) as long as the composite assets still maintain the approved standards endorsed by the IRB. All composite assets must be approved by NIH prior to use.

• IRB-approved assets may be “mixed and matched” to create new assets that are a composite of elements of previously approved assets

• All assets used must clearly indicate, and emphasize, that the activity is research • When combining assets, the overall tone, messages, and ethos of the original

combination of assets cannot be altered

5.1 Outreach to HPO Members HPOs may use both nationally and locally developed outreach approaches to engage their patient population, members of their health plan or of an affiliate, and any interested eligible individuals in their catchment area. HPOs will be able to use approved research program advertising materials as is or co-brand these materials following guidelines (such as images, look, and feel). They may also use locally developed outreach materials that speaks to their local community. Advertisement will include local program contacts. All locally developed outreach materials will be presented to the IRB as part of the Institution-Specific IRB Application (ISIA) process. Interested parties can also follow the link to the research program website or mobile application for more information. As a condition of their NIH award, HPO awardees must affirm:

• They will not add non-HPO members who enroll in AoURP through their sites to the HPO’s general operations marketing list or advertising list

• They will not recruit non-HPO members to join the HPO health system

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

24

5.1.1. Outreach in an inpatient setting

For HPOs who wish to engage participants in an inpatient setting, precautions will be taken to ensure the patients’:

• Safety; • Fitness to consent (physical, emotional, and decisional); and • Comfort (physical and emotional).

Trained AoURP site staff will be required to obtain the approval of the prospective participant’s care team prior to approaching the individual. The member of the care team providing approval must have direct access to the patient in order to assess the capacity to consent. AoURP site staff will work with the clinical care team to ensure that speaking with the potential participant about AoURP does not disrupt the individual’s clinical care. If the care team determines a person does not have the capacity to consent, or that approaching the AoURP site staff would be disruptive, the individual will not be approached.

5.2 Outreach to Direct Volunteers To complement the regional efforts of the HPOs, The Participant Center (TPC) will develop the strategies to engage direct volunteers. TPC team is led by Scripps Translational Science Institute (STSI) and supported by Walgreens, WebMD, the Blue Cross Blue Shield Association (BCBSA), the National Blood Collaborative, and others. TPC outreach efforts will use approved national and/or customized advertising materials and a multi-pronged strategy for outreach to historically underrepresented populations in biomedical research. The TPC approach will be designed to enroll people across the country and, in particular, focus on underrepresented populations (UBR) and those in areas not serviced by HPO awardees, although they may also have a presence in HPO- covered regions to provide additional support for clinic visits. Targeted outreach materials will be developed specifically to reach the DV populations.

5.3 The Support Center A Support Center will provide assistance on demand – via phone, chat, and email – seven days per week between the hours of 7 a.m. and 10 p.m. ET, excluding federal holidays. Instructions for contacting the Support Center will be posted on the research program website and on the Participant Portals. The Support Center phone number and email will also be listed on marketing and promotional materials. Anyone can contact the Support Center; however, assistance will be limited to topics covered within the IRB-approved participant-facing content, FAQs, scripts, and the Knowledge Base (see Appendix L). No clinical guidance or advice will be given. The Support Center will initially assist in both English and Spanish. All inbound requests will be tracked via an electronic ticketing system to ensure proper escalation, closure, auditing, measurement, and process improvement. We will use this tracking system to prioritize and develop new FAQs and Knowledge Base entries to ensure we are meeting the needs of participants. The Support Center will record whether the caller is part of an HPO or a DV, the nature of the

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

25

question or request, and the status of the request to ensure it has been addressed. Callers will have the option to voluntarily provide their name, email address or a preferred phone number, and their state of residence for follow-up. The Support Center staff will triage requests as follows:

• Tier 1—Handled by Support Center staff using the IRB-approved FAQs and/or Knowledge Base

• Tier 2—Directed to affiliated enrollment sites (HPO or DV) for site-specific response—for example, scheduling blood draws and physical measurements

• Tier 3—Directed to the technology provider for technical topics not addressed in the IRB- approved FAQs and/or Knowledge Base (e.g., technical problems with the website or mobile application)

• Tier 4—Directed to The Participant Center for topics that are not yet covered in the IRB- approved FAQs and/or Knowledge Base. Tier 4 tickets may include:

a. “Escalated issues” that were not satisfactorily responded to via the Support Center supervisor

b. Feedback or suggestions (about the research program, marketing, research, technology, etc.)

c. New topics that should be added to either the Support Center Knowledge Base and/or added to the FAQs

For Tier 3 and Tier 4 topics, subject matter experts (SMEs) will be called for consultation as needed. These topics will be added to the Knowledge Base. Where applicable and following IRB review and approval, responses may also be added to the FAQs. Standard quality monitoring will be performed to ensure proper escalation, auditing, measurement, and process improvement. In the future, we will explore whether the Support Center can facilitate the enrollment process for interested individuals lacking digital access or acumen.

5.4 Outreach to Communities

Outreach to communities and grassroots community engagement is foundational to the All of Us Research Program. To that end, we are building a national network of community organizations that will facilitate the four essential and unique components of the creation of active participant community: outreach, engagement, recruitment, and retention. We define outreach as providing materials and information to an audience (unidirectional interaction); engagement as listening, responding, and supporting that audience (bidirectional interaction); recruitment as facilitating enrollment in the program; and retention as ongoing activities with participants after enrollment.

There are three members of this national network that will be central to working with communities: Community Partners, Gateway organizations, and the National Library of Medicine (NLM). Each of these three groups understands their communities and will provide outreach, engagement, recruitment, and retention strategies tailored to their communities.

The All of Us Research Program enhanced its engagement activities with Community Partner awards. The Community Partners serve as trusted intermediaries, fuel the diversity engine (i.e.,

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

26

enhance the reach of the program to traditionally underrepresented communities), and work collaboratively with the consortium to achieve full engagement and retention of individuals and communities that have been traditionally underrepresented in biomedical research. The inaugural Community Partners are raising awareness about the program among seniors and older adults in rural areas, Hispanics and Latinos, African Americans, Asians Americans, Pacific Islanders and Native Hawaiians, and the LGBTQ community to complement other outreach efforts of the program.

Community Partners use a variety of outreach techniques that include digital (social media, emails) as well as mass-media (broadcast media, printed materials) strategies. For engagement, Community Partners will be utilizing in-person strategies to conduct dialogues with their communities (create advisory councils, educational webinars, and health helplines, as well as tabling). For recruitment, Community Partners will assist interested members of their communities in enrollment (launch events geared towards enrollment, provide enrollment materials at existing events). For retention, Community Partners will show that the program is invested in responding to participants’ interests and needs and seeks to work with them for a decade or more (offer regular “check-ins” via phone, ongoing social media campaigns, newsletters).

AoURP is also partnering with Gateway organizations to enhance its community outreach and engagement efforts. Gateway organizations are defined as trusted, grassroots community and provider organizations that, if aligned with the All of Us Research Program, can serve as impactful ambassadors, catalyze interest, and pave the way for other organizations to sign on to support the program. Gateway organizations provide many of the same outreach, engagement, recruitment, and retention strategies as Community Partners but also strengthen the support system of respected community leaders (develop train-the-trainer modules, identify and train community/provider leaders in AoURP specifics, develop AoURP specific Continuing Medical Education/Continuing Nursing Education, encourage leaders to provide articles/content for news outlets, provide print materials at local offices).

As another means of outreach to communities and meeting them where they are, the AoURP has formed a creative and innovative partnership with the National Library of Medicine (NLM) to leverage the library system as a respected health resource, convener, trusted intermediary, and resource. For many people in this country, particularly those with limited internet access, the public library system serves as an invaluable and vital community hub. This partnership will focus on three key areas: (1) positioning public libraries to deliver effective community education and awareness for AoURP; (2) AoURP community engagement through public libraries; and (3) the creation of a learning management system platform (LMS). The first area entails distributing AoURP materials (physical signage, handouts and displays) in libraries, providing online health information training for library staff to meet the needs of community members, and creating a traveling exhibit that combines physical displays with interactive public events modeled after the NLM History of Medicine traveling exhibit program. The second area entails establishing a National Network of Libraries of Medicine (NNLM) Program Partner for each of the 8 NNLM regions across the United States that will coordinate AoURP engagement activities with the NLM, pilot and model unique community engagement activities such as training library patrons to reach out to their communities, creating “office hours” at partner locations, providing AoURP materials in bookmobiles equipped with internet access, partnering with other community organizations, and leveraging existing health programming such as maker spaces (do-it-yourself spaces where people can gather to create, invent, and learn) and digital commons in public libraries. Collectively, the information we gather will help us identify best practices for messaging and conduct outreach that leads to increased public interest

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

27

and engagement in the All of Us Research Program. The third area entails creating an online platform and central repository for educational and training material about All of Us and precision medicine, with resources designed for members of the public, health professionals, librarians, researchers, and All of Us staff.

5.5 Mobile Engagement Asset As additional outreach, the All of Us Research Program has deployed mobile engagement assets (MEAs) to bring awareness about the research program to remote areas and geographic locations whose residents are traditionally underrepresented in biomedical research. By bringing information about the All of Us Research Program directly to these populations, the aim is to break down barriers to equitable representation within the program. This outreach is especially valuable for engaging highly mobile populations like migrant workers and those living in shelters and other temporary housing, racial and ethnic minorities, and the LGBTQ and disability communities. The MEAs offer personal exploratory interactions with the All of Us Research Program; special attention has been given to creating a warm and welcoming, but not coercive, environment where people can learn about the research program. The MEA experience is carefully developed to be considerate of cultural aspects and to leverage existing community network relationships. The MEAs are an agile tool that can be leveraged for other uses when not scheduled for outreach to underrepresented populations. Other uses include support of HPOs and DV partner activity. Community and faith- based groups, consortium members, and other partners can request an MEA through an online event request form found on the All of Us website (http://joinallofus.org). The description of the MEA experiences and its usage are found in Appendix I.

5.6 Summary of Outreach and Engagement Approaches In summary, the following outreach and engagement approaches can be used by all AoURP awardees:

1. Tabling at community events, health fairs and/or clinic waiting rooms. AoURP site staff will set-up an information kiosk or table at community events and health fairs. They may also set up in facility cafeterias, corridors, and/or in clinic waiting rooms and at outpatient/inpatient clinics to engage and inform the public about AoURP.

2. Inviting a diverse group of community members to meet monthly or quarterly as part of a Community Advisory Board (CAB)/Participant Advisory Board (PAB) to discuss and advise on AoURP engagement and retention strategies at the local level.

3. Inviting a diverse group of AoURP participants as advisors/community champions/ambassadors to provide community-specific feedback to the site and help promote AoURP at community events/health fairs within the community; this may include providing testimonials, providing feedback on recruitment strategy and tabling at community events with research staff.

4. Installing comment/suggestion boxes in waiting rooms at enrollment sites to collect AoURP- related feedback.

5. Health and science educational events: science cafes, health fairs, or seminars. A science café is a forum where researchers discuss their current research and how it pertains to AoURP. Health fairs and seminars are opportunities for research staff to engage with

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

28

potential participants about AoURP while also promoting health literacy and educating community members on research.

6. Sharing NIH-approved testimonials from participants and those interested in joining the program to raise awareness and share first-person perspectives of why one has joined or might join the program. These testimonials are short-format videos that can be displayed on social media channels or in waiting rooms.

Taken together, this diverse set of outreach and engagement activities will significantly amplify the program’s messaging through multiple channels and activities across the nation and will build a rich and vast network of influencers and community ambassadors to reach, educate, and motivate UBR populations across the nation to enroll and meaningfully engage in the AoURP for the duration of the program.

5.7 Readability of Outreach and Enrollment Materials Consistent with best practice recommendations of the National Quality Forum (NQF) and the Agency for Healthcare Research and Quality (AHRQ) for engaging participants with a broad spectrum of health literacy, outreach and enrollment materials have been written at the middle- school-grade reading level. This practice ensures that these materials are broadly comprehensible by the greatest number of residents of the United States. Reading level experts reviewed all public research program copy and assessed reading levels using both the Flesch Reading Ease and the Flesch–Kincaid Grade Level scales. Materials were further reviewed for sentences per paragraph; words per sentence; overall word, sentence, and paragraph counts; and use of passive voice. By adjusting the vocabulary used and the length and structure of sentences and paragraphs, reviewers worked to increase reading ease and reduce grade level. Whenever possible, the amount of copy was reduced while retaining appropriate sentence structure (e.g., no single-word sentences). Finally, reviewers converted copy to the active voice to increase its accessibility and ability to engage low-literacy readers. Following analysis, the research program copy was re-reviewed to ensure that essential meanings and concepts were fully retained. The target metrics are:

Flesch Reading Ease: ≥70 Flesch-Kincaid Grade level: ≤7

Passive sentences % of total ≤10% Sentences per paragraph: <3 Further, where possible, the enrollment materials incorporate multimodality presentation methods (aural, visual, and interactive) to aid comprehension of persons with low literacy. For example, animated videos with visual cues and voice modulation will further facilitate comprehension in low- literacy populations. For people who wish to read more in-depth information, some information on a limited number of key topics may be written at a high school or college reading level.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

29

6 Enrollment Enrollment in the All of Us Research Program is voluntary and not time-sensitive.

6.1 Enrollment strategies The following enrollment approaches can be used by all AoURP awardees:

1. Kiosks at locations such waiting rooms, cafeterias or corridors at outpatient/inpatient clinics. 2. Pre-screening and reaching out to potential participants using existing patient/research

registries or EHR systems. Sites must obtain a waiver of consent from the PMI-IRB to access personal information in EHR or registries for screening purpose.

3. Sending personalized Invitation from a healthcare provider to prospective participants using IRB-approved text.

4. Deploying mobile clinical research units with trained site staff to inform hard to reach populations, and to facilitate the enrollment and completion of study procedures as applicable. The mobile clinical research units may be equipped with some or all of the following facilities: private interview rooms, a bathroom, a phlebotomy chair, centrifuge, and refrigerator/freezer.

5. Creating mobile “Pop-Up” to enable AoURP trained site staff to engage and recruit prospective participants at events or physician offices or clinics. In lieu of visiting the AoURP research office, the eligible mobile “pop-up” staff has the ability to enroll participants and/or conduct physical measurement and biospecimen collection from pre- consented participants at events and locations, provided all privacy and confidentiality requirements are met.

6.2 Levels of Enrollment

There are four levels of participation for internal tracking:

• Interested individual: Someone who provides contact information to receive research

program updates. This person may have downloaded the research program app and/or pressed “Join Now” on the website.

• Registered individual: A person who created an account by entering a name and either a mobile phone number or an email address and has chosen a language preference but has not yet completed the informed consent process. A registered participant has a unique AoURP participant identifier (PID).

• Consented individual: A person who meets the eligibility and inclusion criteria and is enrolled in AoURP. A consented individual has completed the primary informed consent process and the HIPAA Authorization/EHR consent (if available and where relevant, based on AoURP capacity to effectively search for and access records). A consented individual hasn’t yet participated in any research program activities such as completion of questionnaires or providing physical measurements and biospecimens.

• Participant: A person who completed “the Basics” PPI module and who is in the eligibility queue for providing physical measurements and biospecimens. o Core Participant: A person who completed the required PPI modules and provided

physical measurements and biospecimens. A core participant can contribute to other

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

30

activities such as providing digital health data using sensor modules and/or wearables, if available.

o Active Participant: A participant who accessed their Participant Portal account and has completed at least one AoURP activity in the past six months.

o Full Participant: Someone who completes all protocol elements available to them over the life of the program.

We will track participant enrollment levels over time and report back to the Steering Committee and NIH on our success against ongoing targets for diversity and inclusion in the program. Anyone can access the full complement of outreach and enrollment materials, including templates of informed consent documents, through the research program website or through the web mobile application. The web application will be compatible with modern major browsers. The mobile application will be available free of charge for iOS operating systems within the Apple App Store and for the Android operating system on the Google Play marketplace. Prior to download, individuals may review a high-level description of the research program posted on the Apple App Store and Google Play marketplace. After downloading, individuals can review educational content about the research program, including templates of informed consent forms (Appendix F) within the mobile application. The Journey through the All of Us Research Program is summarily illustrated in Figure 6–1: Participant Journey. Figure 6–1: Participant Journey

Note that DV enrollees who are not in a state supported by an HPO will not be asked to share their EHR until the technology to acquire their EHR is in place. Instead, they will be shown a few screens about the value of EHR information to the program and asked if they would consider sharing access to their EHRs in the future if we have a mechanism to collect them.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

31

Recognizing that individuals may not have their own device for accessing these materials, HPO sites may provide tablets, wired computers, laptops, and/or smartphones pre-loaded with the relevant materials to consult on site.

6.3 Account Creation Account creation begins after clicking the “Join Now” button on the website or mobile application. Account creation requires entering one’s first and last name, an email address, or mobile phone number, creating a password and confirming it, and choosing a preferred language from a drop- down menu. This enables people who do not have or rarely use their email to be part of the program. Contact from the research program will use the phone number and/or email address used for creating the account. As with other information containing personal identifiers, this contact information will be stored securely in the Raw Data Repository (RDR). The RDR is described in depth in Section 13. Figure 13–1: All of Us Research Program Connections and Data Flow. Access to the participant’s account information will be available only to a select number of trained staff for data validation and regulatory purposes. The DRC will generate a unique internal participant identification code, represented as a random 10-character string (format P000000000) that is used to access participant information without using explicit personal identifiers. Currently, all individuals must create their AoURP account electronically. We recognize this presents some technological challenges. It could limit participation by some individuals and impact diversity and inclusion within some communities. Trained AoURP staff on site or at the Support Center will be able to facilitate this process and accommodate individuals with differing levels of technological capability.

6.4 Information Collected Prior to Informed Consent Following account creation, persons wishing to enroll in the program will need to answer the following questions in advance of providing informed consent:

- They will be asked to confirm they meet each of the eligibility criteria (e.g., Are you age 18 or older?)

- They will be asked their state of residence and the state where they receive most of their health care. This enables compliance with state-specific requirements, such as disclosure of the California Experimental Bill of Rights (Appendix E3) to individuals participating in California.

- They will be asked if they are members of any of the research program affiliates within their state of residence or the state where they receive most of their health care. This enables pairing the individual to a partner site that is most convenient for them. This also allows customization of the app based on specific sites’ readiness and preferences.

6.5 Informed Consent Overview

Informed consent of participants is fundamental to the ethical practice of human subjects research. Disclosure, voluntariness, and decisional capacity make up the core of valid informed consent processes. All persons wishing to participate in AoURP will complete an informed consent process (Error! Reference source not found.). Through this process, participants will learn about the program through text and visual aids, and unambiguously indicate their decision to participate. The

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

32

materials presented will be consistent across the research program but may be customized based on an individual’s geographic location, enrollment method, or affiliation (DV or HPO). The informed consent process will initially be administered and documented electronically. It is designed as a living process, with information loops and opportunities for periodic updates. The electronic consent process is self-paced, and there is no time limit to complete it. Individuals can rapidly navigate, repeat, pause, and review according to their own information needs. The consent process can be experienced as a self-navigated, supported, or hybrid process. Individuals will be able to choose their preferred informed consent experience by (a) navigating the consent process through the web or mobile research program application, either alone or with the assistance of another person, (b) soliciting in-person support from trained site staff, or (c) calling the Support Center. Informed consent materials will be available in English and Spanish at launch and in additional languages thereafter. Translated materials will be generated through an IRB-approved translation procedure and provided to the IRB for their records. Verbal translation into languages without official translation will not be allowed. Any awardee institution wishing to use approaches to informed consent other than those described here will submit their site-specific plans to the IRB as part of the Institution-Specific IRB Application (ISIA).

6.5.1 Considerations for On-Site Enrollment Individuals who are enrolled at an HPO site will be provided information on how to download the mobile app and/or navigate to the web application (see screenshots in Appendix B). An on-site kiosk or tablet/iPad may be available at some locations to review the eConsent and audiovisual content. Interested individuals will be clearly informed that their decision to participate in the research program will not impact the care they will receive. Site staff will be trained to approach only individuals who are stable, coherent, and able to carry on a conversation freely.

6.5.2 Additional Modalities of Consent To ensure the accessibility, inclusivity, and diversity of the research program, the current electronic informed consent process will be adapted to meet the presentation needs of variable learning styles and health literacy levels. These plans include a video-only consent, a paper-based consent process, and the incorporation of kinetic elements into the consent process to aid comprehension and support autonomous decision. These procedures will serve those with low technology proficiency and/or without access to an online infrastructure and/or other preference or challenge that prohibits enrollment via the electronic process. These additional modalities of consent do not preclude person-to-person contact for questions and/or concerns. Trained personnel are available on site and at the Support Center to address questions or concerns about the program. Regardless of the approach to consent, participants will be given access or receive a copy of the consent form for their records.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

33

6.5.3 Supported Consent As previously described, the consent process may be self-navigated or completed with support. There are circumstances where individuals intellectually capable of providing informed consent may require or prefer assistance with the consent process due to physical, social, educational, or other limitations. For example, facilitated consent will be offered to persons who are visually impaired or those unfamiliar with electronic technology. AoURP site staff experienced in facilitating informed consent procedures will be available to facilitate AoURP consent procedure. They will utilize approved electronic consent visual aids and text, and will engage the prospective participant in a discussion of informed consent to answer any additional questions or concerns a participant may have. Trained site staff who facilitate the consent process are required to co-sign the informed consent document. The Support Center will also have a standardized procedure for a remote fully facilitated consent process; a separate amendment will be submitted for IRB approval at that time. In addition, the program will develop a procedure to consent-by-proxy adults without the decisional capacity to consent and children who cannot legally consent to research without authorization of a parent/guardian or legal representative. Separate amendments will be submitted to the IRB prior to implementation of any new consent modality.

6.6 Electronic Consent Using an electronic informed consent process throughout the program ensures consistency of the consent information. This strategy also allows for rapid scaling of consent. The electronic consent process includes information on the detailed nature, purpose, procedures, benefits, and risks of and alternatives to participating in the All of Us Research Program. Due to the longitudinal nature of the study and the patchwork of state regulations regarding research – and to provide a flexible participant experience – the AoURP informed consent is modular. Each module requires an electronic signature from the participant:

1. Primary Consent: The primary consent module gives an overview of all program activities. Signing the primary consent indicates general understanding of the research program and approval to take part in the PPI, Data Linkage, Physical Measurements, Biospecimen Collection, Biobanking, Biomarker assays, Genomic Testing, and Sensor/Wearable Technology activities if invited.

2. HIPAA Authorization for Research EHR/Part 2 Supplement: This module gives details about allowing the research program access to a participant’s electronic health records, including health records protected by 42 CFR Part 2 (drug and alcohol abuse patient records), referred to as “Part 2” records. State-specific versions of this form are developed as needed to meet state laws and regulations regarding the release and use of health record data.

3. Return of Genomic Results (ROGR): This module, which is currently in development, will

explain the potential risks and benefits from receiving genetic/genomic results from the program. It is anticipated that variations on this module will be required to satisfy state- specific regulations regarding the return of genetic/genomic results, although all efforts will be made to keep the consent process as consistent as possible.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

34

Note that while the program seeks to deploy a primary consent that includes consent for genomic testing, such testing will not be initiated without prior implementation of the ROGR module. This will ensure that individuals’ genomic data can be returned to them before or simultaneously with its availability to users of the All of Us Data Resource. Each module is comprised of three information-giving components:

1. eConsent screens 2. Formative evaluation 3. Form requiring signature

The modules can be arranged to meet the needs of member organizations with local populations in various states of readiness while also providing consistent, multimodal informing content to participants.

6.6.1 eConsent Screens The eConsent screens present key ethical concepts through a set of visual icons, short videos, and concise, highly structured text blocks (Appendices E). The development of the eConsent screens is informed by electronic consent design literature and formatting principles. These formatting principles aim to deepen participant attention and facilitate comprehension, especially for participants who are self-administering consent. The videos associated with the eConsent facilitate elaboration on key aspects of the research program without increasing reader burden for those of low literacy or those who learn best from non-text-based presentation of information. Brief audiovisual segments describe elements of research program participation, such as answering health questions, being measured, or giving samples, as well as data sharing and privacy. Each video segment is deigned to play when the person navigates to the appropriate eConsent screen. The person will not be able to navigate forward until that video segment is complete, ensuring a more uniform informing experience for all participants. More customizable approaches to eConsent are planned to enable at-will toggle between listening to the audio of the video or reading its transcript. Consistent with the design of the modular consent, there are three core eConsent screen sets:

• Primary eConsent Screens. Present an overview of the All of Us Research Program and information on all procedures and aspects of participation (Appendices E1, E5).

• HIPAA Authorization for Research EHR/Part 2 Supplement eConsent Screens. Present a more detailed look at EHR/Part 2 data donation, including scope, limits, risks, and benefits (Appendix E3).

• Return of Genomic Results (ROGR) eConsent Screens (in preparation). Will present a more detailed look at the return of genetic/genomic results, including scope, limits, risks, and benefits.

Additionally, to mitigate informedness decay over time, there are two eConsent “refresher loop” screen sets:

• Physical Measurement and Biospecimen Refresher eConsent Screens. For participants for whom physical measurement and biospecimen donation is separated in time from the

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

35

primary eConsent, this refresher will remind participants of the scope, limits, risks, and benefits of these procedures (Appendix E4).

• Sensor and Wearable Technology eConsent Screens (in preparation). Will present a more detailed look at sensor/wearable technology participation, including scope and limits. These screens will specifically address the reasons for the collection of this data, as well as distinguishing between the baseline privacy and confidentiality risks of using sensors and any additional risk from their use in the All of Us Research Program. Participants may be able to designate what data is collected from their devices as part of participation.

To further enhance transparency and enable autonomy, near the end of each of the eConsent modules (Primary Consent, HIPAA Authorization for Research EHR/Part 2 Supplement, and Return of Genomic Results) – and after viewing the related consent forms – participants will be required to complete a brief formative evaluation prior to being able to electronically sign the consent form and thereby complete a consenting interaction. A formative approach was chosen to reinforce key concepts and specifically target common misconceptions in human subjects research (e.g., therapeutic misconception). Topics included in the formative evaluations have been informed by existing empirical research (Beskow et al., 2015). As each question is presented, individuals are asked to choose between two response options. Following their selection, individuals will receive immediate feedback on whether they have answered correctly or incorrectly. An educational reinforcing screen will be presented back to all individuals, regardless of correct or incorrect response. Individuals answering incorrectly will not be penalized. This format is designed to create an opportunity for pauses and repeated promotion of key concepts to prospective participants. At the end of the formative evaluation, the number of correct answers out of the total number of questions is presented. Individuals are then able to self- assess and self-determine their next step: Navigate onward to sign the consent form, revisit consent materials, or seek additional support. Participants enrolling at an HPO enrollment site will have the option to ask trained program staff at the site for assistance. Both HPOs and DV participants will also have the option to contact the Support Center for assistance. This formative approach supports participant informedness prior to consent and serves as a self-check on a participant’s understanding, especially for those participants self-administering consent.

6.6.2 Consent Form and Supplements Requiring Signature To meet regulatory requirements, a primary informed consent form and a HIPAA Authorization for Research EHR/Part 2 Supplement form have been drafted. Another supplemental form describing the return of genetic/genomic results will be developed. These forms will be readily available for review through the All of Us Research Program website and through the app without any registration for access. Each form will be presented to participants following the related eConsent screen set. Participants will electronically sign these forms using either their finger on a touch screen, using a computer mouse, or typing into an electronic text box and completing their profile. Trained AoURP site staff who assist participants in completing the consent process will co-sign the consent form. Participants will receive a PDF version of their signed consent document by email or in printed form from site staff at the time of an in-person visit if requested. They may also view, download, or print the document from their account at any time. The participant’s signature at the end of the primary consent form indicates that the person is consenting to PPI and data linkage. Additionally, this form documents consent for physical measurements, biospecimen collection, biobanking and genomic analysis, and sensor or wearable

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

36

technology data collection, should that person be invited and choose to participate in those modules of the All of Us Research Program. A signature on any consent document does not constitute a “contract” of promised data donation by the person nor that the research program will invite that person to any specific part of the research program A signature on the HIPAA Authorization for Research EHR/Part 2 Supplement form is required for release of electronic health records and Part 2 health record data. Participants can revoke their HIPAA Authorization for Research EHR/Part 2 Supplement consent at any time and for any reason, without leaving the program. Like their authorization, valid revocation requirements may vary per state regulation (for example, whether it requires a witness). Another signed consent supplement will be required to authorize the return of genetic/genomic results. This consent supplement form and workflow for the return of genetic/genomic results is currently under development and will undergo legal review for compliance with the diverse state laws and regulations governing return of genetic/genomic results in research prior to submission to the IRB. Participants may be required to sign additional documents (e.g., the California Experimental Subject’s Bill of Rights [Appendix E3]), as mandated by state law. Because the primary consent form and any supplement will contain personal identifiers, these forms will be kept separate from the data in the All of Us Research Program Research Hub that will be queried and analyzed by researchers. The signed consent forms’ data will be stored in the Participant Portal host database, and copies of the signed informed consent forms will be stored securely in the Raw Data Repository (as described in Figure 13–1: All of Us Research Program Connections and Data Flow), like other forms containing personal identifiers. Access to this data will be available to trained program staff via HealthPro (see Section 6.10.1) for management purposes and for data validation and regulatory purposes.

6.6.3 Refresher loops Due to the longitudinal nature of the cohort and to recognize that informed consent is not a discrete process but a long-term engagement between participants and researchers, the All of Us Research Program will include “refresher loops” to guard against informedness-decay. These refresher loops will be eConsent screens, or similar modalities, and designed to reinforce key concepts, especially for research program activities that may be separated in time from the primary consent module. There will be a physical measurement/biospecimen refresher loop (Appendix E4) and a sensor/wearable technology refresher loop (in planning). Additional refresher loops will be developed over time, depending on participant and research needs.

6.6.4 Considerations for American Indian/Alaska Native Individuals Enrollment of American Indian/Alaska Native (AI/AN) participants will occur on a limited basis at the initial launch of the program. There will be no recruitment efforts focusing on AI/AN individuals or Tribes at the initial launch; however, if individuals who identify as AI/AN decide to participate because of the national DV marketing campaign or a general HPO recruitment campaign, the program will welcome them if they are otherwise eligible and able to complete the consent process.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

37

AoURP may specifically engage AI/AN individuals to enroll after the program has carried out a thoughtful engagement process with Tribal communities. To further this effort, the program has launched a Tribal Collaboration Working Group (TCWG) of the All of Us Research Program Advisory Panel in October 2017, which includes Tribal leaders, members of the AI/AN communities, and providers from Tribal clinics and AI/AN biomedical researchers. The TCWG has been charged with providing expert insights on how All of Us can develop meaningful and culturally sensitive collaborations with AI/AN populations, which will then be shared with Tribal leaders for further feedback through a government-to-government consultation process. The options presented by the TCWG will be considered by the program and, as necessary, may be translated into protocol amendments (some of which may be site specific) and submitted to the IRB for review and approval. Amendments may include additional information to be added to the consent form, such as special practices for the collection, maintenance, and destruction of biospecimens from AI/AN individuals or special provisions for access to data by AI/AN individuals. The amendments for recruitment and enrollment of AI/AN participants will then apply to the DVs and all HPOs, unless the program and the IRB approve additional site-specific amendments that apply to AI/AN participants Some HPOs are bound to specific consultation agreements with Tribes. As such, these HPOs are in the process of consultations with local and regional Tribal nations whose members could likely be enrolled through that HPO. As those Tribal consultations are completed and agreements are reached to partner with a specific Tribe, site-specific amendments to the protocol and consent form, if needed, will be obtained from the IRB as part of the Awardee-Specific Application Process. To ensure that AI/AN concerns are not overlooked within the consent process for the initial launch, we have initiated several specific actions to engage the community. Materials developed by the national All of Us Consent Working Group have been shared with AI/AN community representatives across the United States, All of Us Research Program AI/AN community representatives attended the Community Partners’ Workshop in D.C. in September 2016 to discuss the research program with program leadership, program leadership have presented an overview of and updates on the program at several meetings of to the NIH Tribal Consultation Advisory Committee, and Program leadership and consortium members engaged in a dialogue with regional Tribal representatives at a conference hosted by the University of Arizona. These were first steps in the program’s AI/AN consultation and engagement process.

6.7 Data Oversight and Choice of Law The considerable number of distinct state laws and regulations governing the collection and use of various data types collected by the research program have prompted the All of Us Research Program to seek guidance from the NIH Office of General Counsel and the Office of Civil Rights. These offices will provide recommendations on the appropriate application of state regulation in the context of this national research program. This consultation is especially important given the long duration of the study, along with the well-documented mobility of the United States population and, specifically, the higher mobility of those who are poor and non-white (U.S. Census Bureau CB 16- 189). Further, the program will involve populations traditionally underrepresented in biomedical research who have exceptionally high mobility, including migrant workers, the homeless, and sexual and gender minorities. Understanding of these state-by-state variations will be essential to meeting our ethical obligations to mobile populations. The research program will use this guidance in revisions of participant materials, consent, and workflow for all future submissions.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

38

6.8 Monitoring Enrollment We will monitor enrollment throughout the various program modules. The overall enrollment targets for Core Participants with regard to race and ethnicity from the consortium are based loosely on the United States 2040 census projections and compared to HPO and DV catchment demographics proposed by each awardee institution. Multiple enrollment sites have been selected, in part, based on their geographic distribution and proposed race/ethnicity recruitment targets to ensure that the diversity of enrolled individuals will be reflective of the United States population. Initial consortium and site-specific enrollment targets for race/ethnicity distribution of All of Us Research Program are provided in Appendix B . Individual sites will monitor their recruitment to ensure the enrolled population reflects their stated race and ethnic recruitment goals. A robust enrollment-monitoring plan, developed as a collaboration between the consortium partners and the NIH All of Us Research Program staff, is in place throughout the participant enrollment period. The plan employs specific mitigating actions for sites to address under-enrollment (relative to site-specific goals for both number and diversity of participants). Mitigating actions will increase based on deviation from stated enrollment targets. These actions can be implemented at any time by enrollment sites through continuous self-monitoring, consortium monitoring, and program oversight. The mitigation plan will be enforced through the ongoing awardee Principal Investigator/NIH Program Officer relationship, based on quarterly reporting of enrollment data and/or milestone completion (which are verifiable by NIH Program Staff access to DRC administrative dashboards and custom reports). The enrollment-monitoring plan is in place to track performance of enrollment sites. This plan includes:

1. Site self-monitoring of enrollment metrics through the HealthPro dashboards and through custom reports from the DRC will occur at least monthly. Real-time reporting is also available. The research program dashboard includes displays of aggregate study data to help monitor various aspects of the research program. The dashboard is available to authorized AoURP site staff who were vetted by the site administrators.

2. Monthly monitoring of site enrollment by the All of Us Research Program Steering

Committee. The Steering Committee reviews recruitment trends and progress toward goals, and it can see the flow of participants through the various stages of All of Us Research Program.

3. Oversight and monitoring of enrollment partners by the program Principal Investigator (PI)/NIH Program Officer and mandatory quarterly reporting to NIH, as required in the terms of the award.

Through the dashboard and daily emails, HPO sites will monitor the number of people consented on a daily basis. They will track people who consented, those who are unsure, and those who declined to participate. Individuals who are unsure may be asked again in the future if they would like to participate. People who declined may become interested at a different point in time after initial approach. However, they will not be re-approached immediately about joining the All of Us

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

39

Research Program. This monitoring of “yes,” “maybe,” and “no” will be documented within outreach and enrollment partners monitoring systems. Local PIs will be able to adjust their recruitment efforts based on the national recruitment numbers and diversity goals computed by the DRC. Local PIs will add or reduce the number of trained program staff in clinics according to clinic demographics to meet specific enrollment goals. For example, if a PI determines that the awardees need to enroll more women to meet an enrollment goal, they may add AoURP staff to a clinic with a higher proportion of women members. This approach would ensure that, overall, more women are approached and given information about the All of Us Research Program. Alternatively, if at the national level there is a gap in certain demographics (e.g., 20- to 30-year-old males), all awardees can adjust to help work towards the goal of closing that gap.

6.8.1 The DRC HealthPro Portal The DRC has created the HealthPro Portal that will be used by the designated trained AoURP site staff to (a) log the results of physical measurements (Appendix K1), (b) process the biospecimen collections, (c) view individual-level participant operational data, and (d) export a report on individual-level participant operational data. Participant operational data are defined as a small set of participant information that enables authorized, trained AoURP site staff to contact and engage with consented participants affiliated with their enrollment site (e.g., contact information, demographic information, and completion status for PPI surveys and PM&B). Only authorized, AoURP site staff can access HealthPro. The DRC and trained AoURP staff approved by the PI at each HPO and DV partners manage access to HealthPro.

6.8.2 Avoiding Potential Undue Influence The agreement between NIH and the HPO/DV sites links funding to a variety of factors, including collaboration across the research program; participation in the governance; accepting and implementing recommendations made by the Steering Committee, Executive Committee, and Director; adhering to physical, technical, and policy safeguards for data that will ensure state-of-the- art security for all program data and systems; and establishing enrollment benchmarks. This funding structure is not unique to the All of Us Research Program, but the use of enrollment metrics may raise the concern of an apparent conflict of interest. The ISIA solicits specific information regarding avoiding undue influence. The research program arranged a separation between PI leadership and enrollment activities, to create a “firewall” for potential conflicts of interest. Local PIs and other members of program leadership will be responsible for reaching their enrollment benchmarks, but they will not directly be approaching or consenting potential participants. Instead, trained AoURP site staff will be the ones approaching eligible potential participants. The following precautions will be utilized to ensure that there is no undue influence on potential participants to join the All of Us Research Program or onsite staff responsible for recruitment of interested parties:

• Most potential participants will learn about the research program through IRB-approved communications (website, email, flyers, and other communication modalities) and will

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

40

enroll and consent through their computer or smartphone. This method of enrollment uses the digital platform, rather than trained program staff, to administer the consent procedure.

• All AoURP site staff will have completed applicable training as appropriate for their role on the All of Us Research Program. Training may include formal human subjects protection trainings, such as those offered through the Collaborative Institutional Training Initiative (CITI) Program (e.g., “Human Subjects Ethics,” “Responsible Conduct of Research,” and/or “Good Clinical Practice”) in addition to the stringent program-specific and diversity and sensitivity training specific to the population they serve.

• Site staff responsible for the recruitment of interested parties will be evaluated based on trends of how many eligible people they approach and discuss the research program with, while emphasizing the overall diversity targets. Site staff will not be reviewed, incentivized, or promoted based on how many people they consent and/or enroll in the research program.

• Trained site staff recruiting potential participants in an inpatient setting will be required to have the approval of a patient’s care team prior to approaching the potential participant to ensure that the patient has capacity to consent. Approval of the care team will take into consideration a person’s safety, fitness to consent, comfort, and potential for coercion (either perceived or real).

• In cases where students or employees wish to enroll in the program, the Program has placed additional safeguards to minimize the potential risk of undue influence or coercion, where:

o Participation in the All of Us Research Program should not negatively or positively impact an individual’s grade or course credit in any way

o Participation in the program should not become a mandatory requirement of employment, and an employee’s decision to join (or not join) the program should have no impact on his/her employment status or promotion potential

o Employers and faculty should not inquire as to the status of an individual’s participation in the program

• In cases where a non-HPO member wishes to enroll at an HPO site, the NIH program staff have placed additional safeguards through the terms and conditions of award to minimize potential risk of undue influence or coercion, where: o HPOs will not make enrollment and PM&B visit contingent on getting care at the HPO o HPOs assure that they will not add DVs’ names or contact information to an HPO

patient network distribution list o HPOs will not distribute offers or recruit for new patients based on connection to the All

of Us Research Program enrollment systems o HPOs agree to guide non-HPO members who undergo AoURP PM&B at an HPO site in

obtaining their EHRs through the established mechanisms (e.g., S4S or other approach) o Any individual undergoing PM&B at an HPO will count towards the HPO enrollment

numbers and will be retained through the HPO program. Similarly, the DV program will receive attribution for assisting in the participation of an HPO enrollee where applicable.

In summary, plans include all the following:

1. A firewall to prevent conflicts of interest between PIs who are responsible for enrollment numbers and potential participants

2. Stringent training for site staff who have contact with participants 3. Goals focused on number of potential participants approached 4. Monitoring of those who say yes, maybe, or no 5. Adjustment of the number of trained staff at each site based on overall diversity target goals

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

41

7 What Is Involved? Program Procedures Once an individual has confirmed their decision to join the All of Us Research Program by completing the informed consent process, that person is eligible to start contributing information to the program. Since some participants may complete the consent process and one or more PPI questionnaires online prior to being invited to a clinic visit at an HPO or DV site, trained AoURP site staff will follow site-specific policies and procedures to confirm the participant’s identity (confirmation of name and contact information, photo ID, etc.) at the beginning of their appointment and confirm that the participant wishes to move forward with study procedures listed in the consent document. The process for confirming identity at each site is defined in the site-specific ISIAs. The time to complete the participant journey in one setting ranges between one and three hours (excluding time required for consent). As noted above, some participants may complete certain PPI modules ahead of time; therefore, the time required in one setting may be significantly less than two hours (Table 7–1: Estimated Duration of Participant Journey). These times are not intended to reflect time for transportation to the site or wait times prior to initiation of data collection. Table 7–1: Estimated Duration of Participant Journey

Domain Description of Content Duration

Enrollment Create account via website or mobile application 5–10 minutes

Informed Consent

From website or mobile application: • View primary eConsent screens • Review primary consent form • Complete primary formative evaluation • Sign primary consent formAs appropriate, view

refresher loops and/or complete additional consent modules

Primary: 15–45

minutes

Additional informing content: 5–15 minutes

Participant-Provided Information

• Basics (sociodemographic information) • Overall health • Lifestyle (personal habits) • Personal medical history • Medications* • Family medical history • Health care access and utilization

5–20 minutes each (see below, Table 7–2)

Check-In

• Verify address or key personal information • Verify consent is e-signed before visit • Summarize what to expect of the visit; answer any

questions • Instruct participant to remove bulky clothing

5–10 minutes

Pre-Measurement Verifications

• Verify completion of PPI • Collect limited information relevant to the

measurements and biospecimen collection (e.g., what time did the person last eat anything?)

5–10 minutes

Physical Measurements

• Sit for 5 minutes • Conduct program core physical measurements, to

include: o Blood pressure and pulse—6 minutes o Height and weight—3 minutes

15–20 minutes

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

42

o Hip and waist circumference—2 minutes

Biospecimen Collection • Perform blood draw • Collect urine specimens • Collect saliva samples instead of blood (optional)

10–45 minutes

Check-Out

• Verify the completion of measurements and biospecimen collection

• Provide printout and/or digital measurement data, as well as results, to the participant

• Discuss what to expect post-visit, and answer any questions

5–15 minutes

* PPI in preparation

7.1 Participant-Provided Information (PPI) In addition to contact information and data for creating an account, the program plans to obtain extensive information about a participant’s health status through self-completed surveys. This participant-provided information (PPI) will include data relevant and necessary for scientific research studies (e.g., personal and family medical history, socioeconomic factors, and health care access and utilization). Most questions will be selected, or modified, from various health-focused surveys previously validated in large cohorts and cross-sectional studies (e.g., the National Health and Nutrition Examination Survey [NHANES], the National Health Interview Survey [NHIS], the Behavioral Risk Factor Surveillance System [BRFSS], the Million Veteran Program, and UK Biobank.). Throughout the program, new modules will be developed in the English language via a dedicated Participant Provided Information Committee and expert task forces for each prioritized content area. The questions will be further refined through testing using standard cognitive interviews and online user assessment. This phase also enables exploration of the understandability of the survey, accuracy of responses among members of diverse groups, and identification of gaps in survey coverage of issues important to participants. The IRB-approved English-language versions of survey modules will be translated in other languages, starting with Spanish, using the IRB-approved translation procedure. All translated modules will be tested in each language.

7.1.1 PPI Readability Analysis Consistent with the guiding principles of the program, each PPI is assessed for readability using the Flesch–Kincaid Grade Level scale and refined by reading-level experts to ensure it is broadly comprehensible by the greatest number of residents of the United States. Questions are edited where needed to improve readability and clarity, in line with current best practices to use language at the fifth- to sixth-grade reading level. Additional directions and concept explanations are also added to complement question-and-response options as needed to improve clarity. Following readability analysis, each PPI is re-reviewed to ensure that essential meanings and concepts are fully retained. There are three surveys available to participants at baseline: (“The Basics,” Lifestyle, and Overall Health) are presented in Appendices G1, G2, and G3. Prior to the physical measurements and biospecimen collection, participants may complete these three self-administered questionnaires. Participants will be able to save their answers and return to complete each survey later if needed. On average, it takes about 10 minutes at the median and about 30 minutes at the longest to complete (Table 7–2: Survey Completion Times]).

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

43

Table 7–2: Survey Completion Times

The All of Us Research Program Survey Average (min:sec) Median (min:sec) Range (min:sec) The Basics 8:11 6:30 2:00–17:51 Lifestyle 3:23 1.23 0:17–7:05 Overall Health 3:10 2:00 0:14–6:06 Personal Medical History 11:23 9:20 2:24-25:23 Family Medical History 10:15 9:52 0.08:37:19 Health Care Access and Utilization 21:36 20:02 7:59-46:45

Participants will be invited to complete additional surveys about their health throughout the duration of their participation. Additional surveys include: Personal Medical History, Family Medical History, and Health Care Access and Utilization. Surveys in domains such as Diet, Physical Activity, Medications, Environmental Exposures, Mental Health, and Sleep are also planned. They will be developed on an ongoing basis and will be submitted to the IRB for review and approval prior to implementation.

7.2 Use of Personal Health Technologies Data from sensors and software applications can give researchers a clearer view into health- influencing factors and health-related outcomes that have previously been difficult to capture with accuracy. Digital health technologies can offer unique advantages to both participants and researchers. The technologies that passively collect data produce minimal participant burden and avoids biases related to retrospective self-reporting. Technologies that interactively collect data are nonetheless controlled by the participant and are often used in a participant’s normal environment. Both passive and active modalities collect data independent of clinical or technical staff and thus lower the threshold for allowing participants to share frequent and longitudinal measurements. It is anticipated that, throughout the life of the program, an array of sensor technologies will enable the longitudinal collection of physiologic and environmental data. Some of these sensors are already built into smartphones, such as those that can measure motion, sound, or visual data like nutritional barcodes. Others will include wearable sensors, including but not limited to wristbands and watches that can measure activity, sleep quality, heart rate, and respiration. Additional sensor technologies may include those placed within a participant’s residence or automobile that can passively monitor environmental parameters such as temperature and air quality and track a variety of biometrics. As these technologies continue to evolve, it is anticipated that many more factors that influence health will be able to be monitored. The overall strategy for use of DHT and specific DHT initiatives are described in the suite of appendix O.

7.2.1 Sensor Data Types Depending on the technology, sensor data may include:

1. Smartphone data provided by:

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

44

a. Hardware-based sensors existing in smartphone handsets (including but not limited to data provided by gyroscopes, accelerometers, barometric pressure meters, touch screen features, cameras, microphones, and GPS).

b. Software-based sensors resulting from in-phone features provided by other participant- authorized software (including but not limited to screen tracking, app use patterns, battery life, and in-device feature classification of activities).

2. External device data may be provided by: a. Physical devices that transmit to the participant’s smartphone, using Bluetooth or other

similar wired or wireless networking technologies, including but not limited to: i. Consumer-grade technologies (including but not limited to Fitbit, Withings,

Phillips, Apple, Samsung, and Garmin). ii. Medical-grade technologies like telemetry and continuous glucose

monitoring (CGM) devices. b. Devices that transmit data from a participant-authorized server using an application

programming interface (API) that may be Internet connected (including but not limited to Facebook, Maps, FourSquare, Weather Data, Location Service GIS data, data provided from IoT [Internet of Things] devices, and environmental technologies like home automation tools).

7.2.2 Sensor Evaluation

Due to the rapid pace of technological innovation in this space, it is impossible to list all the possible hardware- and software-based sensor technologies that may be used during the duration of the All of Us Research Program. Technologies added to the program will follow the general categories listed above and, before deployment, all new sensor technologies will be evaluated for:

1. Compliance with All of Us Research Program security policies and practice. 2. Effect on inclusion and diversity of the program. 3. Relevance to stated program objectives and research questions. 4. Impact of collecting this data on a participant’s user experience with the All of Us Research

Program applications. 5. Impact of collecting this data on the participant’s use of their own devices (e.g., cost of

mobile data plans, impact on device battery life, performance of user device, and cost). 6. Relationship to innovation in health data collection and return to users independent of

known research questions.

7.2.3 Risks and Security

The DHT initiative may include de novo modules and applications created to answer a specific question or to reduce barriers to participation. Participants will be informed of the specific risks of each DHT module.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

45

The main risk of participating in DHT is loss of privacy and data confidentiality. Data that is generated via a third-party vendor will not only be sent to AoURP, but may also be sent to the application/device provider. The participant will have had to agree to the third-party Terms of Use and Privacy Policy prior to authenticating within their Participant Portal. Participation in some of the DHT Modules may also impact an individual’s data plan and mobile hardware battery. Participants will be encouraged to use WIFI setting whenever possible. Lastly, there is also a risk that the application/ sensor may result in atypical measurements, such as blood pressure. This may be stressful or confusing. Participants will be reminded that the DHT is for research purpose only. While the program cannot guarantee absolute privacy and data security, multiple redundant measures to enhance privacy and data security are in place within the Participant Portals that host the digital health technology applications and data.

• All data within the Participant Portals are encrypted and sent over Transport Layer Security

• Each user has a unique login with access granted to only those resources that are needed

• Participant Portals data and server application tiers are hosted on Amazon Web Services and monitored internally and externally for attacks and unhealthy resources

• Participant Portal hosts are compliant to Federal Information Security Management Act of 2002 (FISMA) and follows Federal Risk and Authorization Management Program (FedRAMP) and Defense Information Systems Agency (DISA) guidelines (Section 13, Confidentiality, Privacy, and Security)

7.2.4 Access Many individuals across the United States already routinely utilize a variety of DHTs (i.e.wearable and other wireless sensors). Participants will also be invited to provide the data from these devices to the program. This model for data contribution from an existing device, known as “Bring Your Own Device” (BYOD), will take place via the Participant Portals, with the above considerations documented in detail in supplementary implementation protocol submissions for each sensor technology. To extend the reach of sensor-based technology to populations that do not currently utilize them, the All of Us Research Program may conduct pilot studies that provide a device to the participant. These studies will be described in separate DHT protocols found in Appendix O. To annotate and classify specific sensor data during longitudinal data collection, participants may be expected to complete PPI modules related to this data. These PPI modules may be used to develop algorithms based on these sensor data by using modern data mining and machine learning techniques.

7.3 Physical Measurements Participants will have a standardized set of physical measurements collected and recorded in HealthPro. The same core set of baseline measurements will be carried out irrespective of enrollment through an HPO or as a DV.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

46

The inclusion and exclusion of specific measurements as part of the baseline physical measurements were determined based on their potential relevance to research, widespread reproducibility in all enrollment settings, the time and training requirements needed to carry them out appropriately, and the resources required to obtain them. In total, it is anticipated that the components to be included in the baseline physical measurements will require 15 to 20 minutes to complete. In some circumstances, a home visit by a trained site staff member may be necessary to enable the physical measurements. The baseline physical measurements will include physiologic (e.g., blood pressure and heart rate) as well as anthropometric (e.g., height, weight, waist and hip circumference) measurements. Body mass index will be calculated automatically from measured height and weight. Obtaining these physical measurements will confer minimal risk to study participants, as outlined in Section 8 (Risks/Benefits Assessment). The trained AoURP site staff member conducting the measurements will record the information on a dedicated HealthPro platform. Participants will have access to their physical measurements through the Participant Portals. In addition, if they wish, participants will receive their physical measurements in writing before they leave the HPO/DV site. Trained site staff will be notified immediately upon entering of any measurements that are deemed actionable based on deviation from population norms in HealthPro (Appendix K1). HealthPro will provide clear guidance to trained site staff regarding next steps, including referral for additional evaluation. See Section 10, Access to Individual-Level Information for Participants, for additional details.

7.4 Biospecimen Collection Understanding the relationships between circulating biomarkers or genetic variation as they relate to disease prevention is a primary aim of the All of Us Research Program. The objective of the program regarding biospecimens is to collect samples that would allow the broadest range of clinical and research assays that could be envisioned for the future and to avoid collection, processing, or storage approaches that would inherently preclude such assays. The Biobank will be responsible for working with the DRC and HPO/DV sites to develop standard operating procedures and kits for the collection, initial processing, and transfer of the biospecimen to the Biobank. Initially, adult participants may provide up to 50 mL of blood and 50 mL of urine. In cases where it may not be possible to obtain a blood sample, a saliva sample may be collected instead for the purposes of isolating DNA. It may be necessary to modify the sample collection protocol to enable new scientific opportunities. Any change that is within the 50-mL threshold for either blood or urine collection will be implemented once the infrastructures for the change are in place. Sites may convert to a new sample collection protocol on a rolling basis over time. Therefore, there may be times when more than one version of the sample collection is effective across AoURP. Updated records of sample collection protocols and the types of sample collection tubes will be provided to the IRB. Changes that increase the blood or urine collection volume above 50 mL or add new sample types will be submitted to the IRB for review and approval prior to implementation.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

47

For individuals who enroll via designated HPOs, the physical measurement and biospecimen collection visit may occur at the initial enrollment visit, following consent and completion of the sociodemographic PPI module (the Basics). Individuals who enroll remotely will travel to a designated HPO or DV partner facility of their choice for their clinic visit. In some circumstances, a home visit may be necessary (e.g., individuals who report limited mobility, whose health prevents commuting, and those who live in an area where there is no DV partner site within a reasonable distance).

7.4.1 General Approach to Sample Collection

The Biobank procedures included in a separate Manual of Procedures specify the samples to be collected, the preprocessing requirements, shipping temperatures, the transport of samples to the Biobank, and the processing, aliquoting, and storage of each sample type. For the blood collection:

1. The amount of blood collected from healthy, non-pregnant adults who weigh at least 110 pounds may not exceed 550 mL in an 8-week period, and collection may not occur more frequently than 2 times per week.

2. The amount of blood collected from other adults and children may not exceed the lesser of 50 mL or 3 mL per kg in an 8-week period, and collection may not occur more frequently than 2 times per week.

3. The maximum number of needle sticks by the phlebotomist is three. If unsuccessful after the first two needle sticks, and only with the consent of the participant, one additional attempt will be made, ideally with a new phlebotomist.

4. If the first collection attempt is not successful, the participant may schedule an additional visit to complete the biospecimen collection.

5. If the sample collection is not successful after two attempts, or if the participant is not able to return for a second visit, the phlebotomist will propose to collect a saliva sample for DNA.

If the minimum blood draw of a 4-mL EDTA tube is successfully drawn, the blood draw will be considered successful and saliva will not be sought. The participant’s health and the total volume of blood drawn on any single day need to be considered. Recognizing that some participants could be recruited from outpatient HPO sites where other specimen collections may occur for standard of care, ambulatory participants who weigh over 110 lb and are healthy or in stable medical condition should not have more than 500 mL mL of blood drawn in a single day. Table 7–3: Questions to Participants Prior to Scheduling the Blood Sample Collection

Question to ask participant If answer is “yes” If answer is “no” In the past week have you donated blood (e.g., to a blood bank or Red Cross), platelets, or plasma?

Participant will need to schedule their biospecimen collection at least five days past the initial donation date

Research specimen collection to occur as normal

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

48

In the past six months, have you had a blood transfusion?*

Participant will need to schedule their biospecimen collection at least six months past the initial date of blood transfusion

Research specimen collection to occur as normal

*Blood transfusion excludes other blood products, such as platelets and plasma.

To address this issue, along with concerns around potential contamination, participants will be asked a series of questions pertaining to blood draw and transfusion at three distinct times: at the time of registration, during scheduling, and immediately prior to blood draw. Based on the participant’s responses, trained program staff will then adhere to the procedures described in site- specific Policies and Procedures (Table 7–3: Questions to Participants Prior to Scheduling the Blood Sample Collection). Potential risks to the participant are expected to be minimal, as outlined in Section 8, Risks/Benefits Assessment.

7.5 Biospecimen Processing and Storage Biospecimens will be shipped to Mayo Medical Laboratories (MML) for initial unpacking, accessioning, and sorting. They will be processed and stored in the centralized Biobank at Mayo Clinic. Samples will be held at the centralized Biobank indefinitely unless an individual participant withdraws from the study. The centralized Biobank will be responsible for facilitating collection, shipment, processing, DNA isolation, sample aliquoting, storage, and future access to biospecimens. Initial sampling processing will be performed at the site of collection followed by a shipping protocol that maintains the cold chain needed to prevent specimen degradation.

7.5.1 Processing Methodology The collection site will perform minimal sample processing as described in the Biobank standard operating procedures. All specimens will be stored refrigerated until shipped. Specimens will be shipped to the Biobank within 24 hours of collection and processed by the Biobank within 40 hours. The shipment and processing timeline will be met in all circumstances, including holidays and weekends. All blood tubes will be processed at the Biobank as described in the Biobank standard operating procedures. Information on all aliquots, including the volume for each, will be recorded in the laboratory information management system and linked to a unique Biobank ID. The unique ID is used to reconcile all specimens recorded in HealthPro and the MML records.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

49

Figure 7–1: Biospecimen Flowchart

7.5.2 Transport of Biospecimens All biospecimens will be shipped to Mayo Clinic in Styrofoam containers containing a cool pack to keep samples cool. For HPOs, a Mayo Medical Laboratories (MML) courier will be responsible for the packaging materials and containers, packing samples, and adding the cool packs in the shipping container. The logistic capability provided by MML will be used to transport the specimens from the HPO sites to the Biobank. MML utilizes a network of couriers, coupled with a direct arrangement with FedEx and other carriers, to enable daily domestic and international specimen shipment from clients to the performing laboratories in Minnesota, ensuring that shipments are

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

50

made in accordance with all federal, state, and international regulations. For DV partner sites, a kit will be provided to all collection sites. The kit includes the supplies required for a complete blood draw and urine collection, including the Styrofoam container, a cool pack, and shipping instructions. Completed kits will be shipped back to Mayo Clinic via FedEx courier.

7.5.3 Reliability of Sample Tracking and Identification The collection sites will utilize MayoLINK, a Mayo Clinic application that provides connectivity to Mayo Medical Laboratories (MML) to order the participant’s biospecimen collection. The Biobank laboratory information management is built on software developed by LabVantage Solutions, Inc. (www.labvantage.com). Core capabilities include kit tracking, sample accessioning and annotation, sample processing and testing, storage, and shipping. All aspects of the sample lifecycle are tracked. Security within this application is robust and multilayered to keep participant and sample data secure. The enrollment sites will utilize HealthPro, a web-based application developed and managed by the DRC to record information from participants’ physical measurements and to complete the biospecimen ordering workflow. Within HealthPro, authorized and trained AoURP site staff will be able to view the first name, last name, date of birth, and zip code of a participant to verify participant identity during the measurements and biospecimen collection. The Biobank ID will also be displayed. Prior to sample collection, a sample manifest and labels for the collection tubes will be printed via the HealthPro Portal. The collection tube labels will contain the unique Biobank ID but no other participant identifiers. The Biobank ID will be linked to the participant ID by the DRC. Security will meet FISMA Moderate Authorization and Accreditation standards.

7.5.4 Sample Receipt, Verification, and Routing

Samples will first be transported to MML. Trained staff will triage incoming shipments by shipment time. Specimens will be taken from their original shipping containers and stabilized at the correct temperatures. The specimens will then be expedited to the internal operations area for order processing and receipt verification before being routed to the Biobank. Operators manage the automation and specimens’ receipt and processing. The validated transportation temperature is maintained at all times during pre-analytic processes, and specimens will be promptly delivered to the Biobank at the same temperature used for shipping.

7.5.5 Long-Term Specimen Storage Processed blood samples will be stored in robotically controlled ‒80°C freezers, and whole blood samples will be stored in vapor phase liquid nitrogen units. Most prepared specimens will be stored at the primary site in Minnesota; the Jacksonville, Florida, Biobank facility will serve as the off-site, secondary storage site for approximately 25% of the samples. Both Biobank sites have a comprehensive disaster recovery and business continuity plan.

7.5.6 Destruction of Biospecimens Participants in the All of Us Research Program may withdraw from the program. In some cases, participants may wish to have stored biospecimens destroyed as part of this process. The procedure for destruction and disposal of biospecimens is outlined in Section 9.4, Destruction of Specimens)

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

51

7.6 Electronic Health Records (EHRs) Participants will be asked to authorize linkage of their EHR information if available. Although such linkage involves moderate risk to a participant’s privacy and data confidentiality should the data security protocol be compromised (see Section 8.1, Risks), longitudinal tracking of health outcomes through EHRs is an important component of the All of Us Research Program. EHR data may be sent directly by the participant’s health care providers to the DRC or sent by the participant to the program through Sync for Science (S4S) and/or other vendors. EHR data will be sent to the DRC periodically throughout the life of the program. The initial data types to be included are demographics, visits, diagnoses, procedures, medications, laboratory tests, and vital signs, but will be expanded to all parts of the EHR, including health care provider notes, radiology, messaging, reports, and other testing (e.g., electrocardiograms), if applicable. The feed may include information about mental health, HIV status, substance and alcohol use, and genetic/genomic information stored in the EHR. Participants will need to complete and sign a separate informed consent module per relevant state regulations to authorize access to their EHRs. We will create an informatics infrastructure to clean and standardize data from disparate EHR systems across the United States; this broadly applicable system will be a key contribution of the All of Us Research Program to health informatics research efforts nationwide. For participants enrolled by HPOs, the site will extract data from the participant’s EHR, format it according to the DRC’s data model (currently based on the Observational Medical Outcomes Partnership [OMOP] Common Data Model version 5 at www.OHDSI.org), and transfer it to the DRC using secure protocols (as described in Section 13, Confidentiality, Privacy, and Security). We will continuously adapt the data models as necessary to accommodate All of Us data, such as PPI data. Although obtaining EHR data from DV participants presents unique challenges, early pilot studies have demonstrated the feasibility of such an approach. For example, the S4S project launched by NIH and the Office of the National Coordinator for Health IT is creating a technology that aims to make it easy and safe for people to securely share their EHR data for research. S4S has been adopted by AoURP and initially will be enabled in a small pilot for DV participants at S4S-enabled DV sites. DV participants who have enrolled at one of these pilot sites will be able to sign into their health care provider’s patient portal by using the S4S workflow and authorizing the sharing of their EHR data with the program. Their health care provider’s system will provide a secure application program interface (API), which will be used by the All of Us Research Program (rather than the provider sending data out) and transmitted to the DRC. Important gaps in current methodologies include the ability to acquire EHR information from:

1. HPO enrollees who obtain some of their care outside of the HPO 2. DVs who either do not have an EHR or possess an EHR that is not readily shareable

The goal is to have S4S or other technology available to all participants.

7.7 Data Linkage Linkage of diverse data streams may enhance the analyzable dataset from a given individual. The All of Us Research Program will obtain PPI data, EHR data, physical measurement data, and biospecimen data. Linking these data to additional data sources relevant to the individual may present a more complete picture of the health of the individual.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

52

Most data linkage approaches use common identifiers (e.g., first name, last name, date of birth) to uniquely associate information from various sources from a given person. Algorithms for deciding if one person is the same as another can be either deterministic (i.e., exact match) or probabilistic (likelihood of match). Use of identifiers in a human-readable form is referred to as “clear text” linkage method. Most current data linkages in health care are using clear text. Individual record linkage can also be achieved using record linkage methods to protect privacy—for example, using “hashed” identifiers for linkage. In this method, a person’s specific attributes are replaced with a unique code that cannot be reversed to yield the original identifiers.

7.7.1 Geolocation Data Linkage An alternate means to link data to a participant is through a home (i.e., residential) address or another location-based proxy. “Geocoding” of a participant to a specific geographic region enables inclusion of spatially dependent data, such as census, weather, or pollution data. We will build a geographic profile for participants who provide their residential and employment addresses through the PPI. All addresses will be prospectively geocoded into latitude/longitude coordinates. We will securely map addresses to geolocations through corresponding census tracts, block groups, and ZCTAs (ZIP code tabulation areas). Other data elements, such as percent urban/rural and population will be linked to participant geographic profiles. A set of social, community, and environmental variables has been prioritized to populate an initial core linked dataset. This core set includes American Community Survey Census data, USDA (U.S. Department of Agriculture) Food Access Research Atlas, Environmental Protection Agency (EPA) outdoor air quality and air toxicity data, National Oceanic and Atmospheric Administration weather and climate data, and health care facilities information from the Area Health Resources File. Each of these datasets will be downloaded into the program’s secure environment (for their entire covered regions) and matched to each participant without sharing participant geolocations with these external entities. In time, more variables may be added to the core set as they are identified. We will also investigate mapping in more complex environmental datasets from the EPA or other resources, such as daily air particulate matter readings, which are not constrained to standardized formats and have varying frequency of data collection. Many of these data elements may require complex modeling and curation and would be included based on investigators’ interests in such data. The DRC will facilitate the necessary linkages between the needs of investigators and the complex environmental data sources to generate relevant and interpretable datasets. Over time, these linkages may lead to methods or curation that will allow for complex environmental datasets to be considered “core” variables and thus available to all investigators.

7.7.2 Other Types of Data Linkage Examples of data sources that may be valuable to link within the All of Us Research Program in the future include:

• CDC National Death Index or Social Security Death Master File. The CDC and Social Security Administration generate lists of deceased people in the United States. Although in recent years updates to the file have been delayed, linkage to this file can identify people whose death is not documented within an EHR.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

53

• Pharmacy system data. Pharmacies, pharmacy benefit managers, and health information networks often contain medication prescription and dispensation data beyond any single institution’s EHRs. Early conversations with SureScripts, a health information network provider, revealed that SureScripts is under a Business Associate Agreement with institutions holding the original data and would need additional approval from participants to share data for linkage with the program. SureScripts does use an internal Master Patient Index for purposes of linkage and can use this for linkage with the All of Us Research Program data. A Master Patient Index is a database that tracks all the possible identities for individuals within a system.

• When available, we would seek to include claims data. Private and public payers collect service and payment data on care received that may span multiple care sites. These data may lack some clinical details but often provide broader coverage of the providers, procedures, and costs associated with the care of the individual. Access to these data is often restricted and requires significant additional approvals and cost. Note that many insurers make some electronic claims data (e.g., Explanation of Benefits) available directly to patients, who can decide whether to share the data downstream.

• Health registry data. Most states and territories require mandatory reporting of cancer cases to a central, non-public registry administered by the CDC. These data cover 96% of the United States population and may provide more detailed data related to cancer cases (e.g., tumor type or stage) than found within the EHR. Additionally, many sites also maintain cardiothoracic, device, and other registries. When available, we would seek to include health registry data in data uploads from HPOs or through obtaining other national health registries derived from clinical data.

While the primary consent encompasses data linkage, it is anticipated that prior to linking participant data with external sources, an amendment will be filed with the IRB for any linkages to “health registries” or “claims data” that require the DRC to share participant-identifying information to an outside entity. Such submissions would detail the data to be linked and the general methods for doing so. No additional participant consent will be undertaken. The consent discusses that identifying information may be shared in this process.

7.8 Early and Long-Term Participant Involvement

7.8.1 Early Communication Workflow A communication workflow sample is provided to give IRB members a snapshot or “wireframe” of the business logic and strategies to keep our All of Us participants actively involved as they complete stages of the data collection process (see Figure 7–2: Data Workflow Sample for Participants). The Participant Portals will deliver a message to the participant following successful consent. The transactional notification message sent post-consent will define the purpose and content of the PPI module. The message will also welcome the participant to start the first PPI module. If the participant is inactive for a certain amount of time while working on a started PPI module, the Participant Portals will generate a message informing the participant of the inactivity.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

54

Figure 7–2: Data Workflow Sample for Participants

In contrast, if an individual has signed out without completing a started PPI module, a single message will be sent indicating a session timeout. Reminders for users will be sent out depending on the completion status of PPI modules.

7.8.2 Long-Term Communication The All of Us Research Program is designed to allow and encourage participants to remain actively involved for up to a decade, if not more. Following the collection of data at enrollment through PPI, physical measurements, and collection of biospecimens, we will cultivate ongoing connection to the participant through the following two-way communication outreach strategies: Opportunities to participate in:

• Newly developed PPI modules to obtain new and updated health-related information annually.

• Connecting their EHR data to the program using S4S or other mechanisms on a regular basis to maintain timeliness of EHR data.

• New studies that are part of the program for which the participant might be eligible—for example, studies of wearable sensors or specific genetic/genomic studies.

• Regular brief snap questions or health-related information designed to take no more than 2 or 3 minutes and provide participants with comparative health and wellness information that would be of interest to them, details on utilizing program data, and the scientific underpinnings of the program.

Program updates: • Regular participant newsletters (bimonthly or quarterly that could include program

milestones, new program features, enrollment numbers, events, or new findings.)

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

55

• Notifications, such as EHR reauthorization and security alerts.

AoURP plans to publish testimonials from people willing to share personal reasons for joining the program to raise awareness about why others have joined the program and what benefits they have experienced from the program.

7.8.2.1 Participant Communication Preferences A central tenet of long-term involvement is that the participant will control both the frequency and method of communication from the program. Program communications will primarily be conducted electronically (e.g., email, in app messaging). In the portals, participants can choose whether they want the program to communicate via email, SMS (short message service, which is also referred to as text messages), and/or in-app messages. There will be a notification center (wall feed) in the Participant Portals for general messages and a banner on the home screen for high priority alerts (e.g., invitation to schedule the physical measurement and biospecimen collection visit). If a participant chooses SMS as their communication preference, they will see a message in their Participant Portal account informing them that they may incur data and messaging fees. Once the participant verifies that they want to receive SMS, they will receive a message confirming their decision. This text will also include information on how to unsubscribe from receiving SMS messages. Participants will also be able to go into their Participant Portal account at any time and opt out of receiving SMS messages. Participants will be able to choose what type of communications they wish to receive. For example, the participant can choose not to be informed of some types or all types of new studies or ask not to receive the newsletter. Participants will also be able to unsubscribe to all future communications except for required notifications (such as essential security alerts, if applicable). Those who select this option would no longer be contacted directly or invited for follow-up procedures. This option would allow continued use of information and samples already provided and would still authorize further collection of electronic health record information from their automated database linkage.

7.8.2.2 Content and Review of Communications Emails and SMS will generally cover topics in these four categories:

• participation, which will confirm or remind participants of the steps they need to take for full participation, such as completing a survey;

• data sharing, which will share information from the program or alert the participant that information about them is available in their Participant Portal account;

• emergent event, which will cover data breaches or other events that impact the participant or their data in the program, and

• account management, which will cover issues such as password resets. AoURP will follow these main guidelines regarding email and SMS communications:

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

56

• Email and SMS messages must clearly convey the main message (such as a reminder to complete surveys).

• The total length (including links and spaces) of an AoU text message will be 160 characters or less. The Program will send the minimum number of messages required for the optimal Participant experience. When it is absolutely necessary to have more than one SMS message the first SMS message in the series must inform the participant that the program is sending them multiple messages.

• SMS and emails that are a part of the same communications campaign or strategy must convey the same message. This is to ensure that participants receive equivalent information regardless of what communication method they choose.

• All email and SMS messages must be reviewed and approved by the NIH Communications team.

As the email and SMS communications strategy evolves, AoURP will continue to build upon the information listed in this section (see Appendix J3).

8 Risks/Benefits Assessment There may be risks, discomforts, and inconveniences associated with participation in research; these deserve careful scrutiny. The All of Us Research Program is not a medical treatment study. Joining the All of Us Research Program does not include activities associated with the risk of harm to participants nor adverse medical events, with a few exceptions.

8.1 Risks

8.1.1 Loss of Privacy/Confidentiality The primary risks are the potential loss of a participant’s privacy and the loss of confidentiality of a participant’s personal health information. These risks will increase as a participant contributes more data to the All of Us Research Program. Over time the risk of re-identification becomes greater as there are more data sources to triangulate a participant’s identity.

8.1.1.1 Privacy

All data collection—including administration of questionnaires—will be conducted in a private room or area in a location of the participant’s own choosing, if they use the web or phone application. All participants, regardless of path of entry (HPO or DV), may choose to complete the consent modules and PPI in a private location of their choosing and are not required to complete these activities on site.

8.1.1.2 Confidentiality

All directly identifiable information will be protected by systems meeting or exceeding the Federal Information Systems Management Act (FISMA) Moderate standards and authorized to operate by NIH and the NIH Office of the Chief Information Officer (OCIO). The HPO-owned devices used to register and collect participant information will be shut down automatically after a few minutes of non-use. Transmission of information between sites also complies with high standards of security

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

57

and is included under the review and approval purview of the NIH OCIO. Detailed information regarding security of data is contained in Section 13, Confidentiality, Privacy, and Security There is a risk that a third party may ask the All of Us Research Program to disclose information about a participant without their permission as part of legal or other claims. The NIH has issued Certificates of Confidentiality to all program awardees, including HPOs, DV sites, and vendors that cover activities related to the All of Us Research Program. Under these Certificates of Confidentiality, anyone using or in possession of copies of the data is prohibited from disclosing, except in specific circumstances, the names of research participants or any information, documents, or biospecimens that contain identifiable, sensitive information collected or used in the research program, including in response to a subpoena. The research program expects awardees and sub- awardees to protect participants’ privacy and use all available legal measures to oppose such requests. However, if data are disclosed for any reason, that information is inadmissible in any legal, administrative, or other proceeding.

8.1.2 Physical Measurements

Participants may feel uncomfortable with some of the physical measurement procedures and/or results from those measurements. The weight and waist/hip circumference measurements themselves, plus others such as blood pressure and pulse, may lead to embarrassment or concern by participants. These procedures are standard medical procedures and pose no additional risk to participants other than their discomfort of potentially working with someone who is not their personal health care provider. To minimize these risks, all physical measurement procedures will be performed by trained AoURP site staff and will be carried out in the most respectful way possible. Participants will be reminded at the beginning of their physical measurements that they may opt out of some or all physical measurements without any impact on their ability to still participate in the program.

8.1.3 Participant-Provided Information (PPI) Sensitive information may be revealed while completing the PPI and/or during the study. Completing the surveys or questionnaires may cause fatigue, frustration, anxiety, or boredom with the time it takes; participants will be reminded that they may take a break at any point. Completing the questionnaires may cause some people to feel emotional distress. All health survey questions will be optional; therefore, participants do not have to answer questions they choose not to answer.

8.1.4 Biospecimen Collection Blood sampling risks include bruising of the arm and fainting. The modest amount of blood drawn, up to 50 mL, should not have any adverse physiological effects, nor should it lead to any long-term distress. Risks for blood-borne pathogens from accidental needle sticks and during sample processing exist. With venipuncture, approximately 5% of people may faint, feel nauseous, or feel dizzy; a bruise may also form at the puncture site. The risk of a blood clot forming in the vein is about 1 in 100, while the risk of infection or significant blood loss is 1 in 1,000. Trained AoURP staff will use standard sanitary biological specimen collection safety protocols for collection and processing of samples (e.g., antiseptics, gloves, and appropriate clothing). All objects that come in contact with bodily fluids will be disposed of in appropriate biohazard waste containers.

8.1.5 Access to Electronic Health Records

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

58

Throughout the All of Us Research Program, trained AoURP staff will access participant’s EHR data. There is a risk of loss of confidentiality, as described above. This risk will be further minimized through robust standard operating procedures regarding EHR access and abstraction. In addition, program staff will complete the required training relevant to their activities, such as training regarding Human Subjects Ethics, the Health Insurance Portability and Accountability Act (HIPAA), Responsible Conduct of Research, and Good Clinical Practice as is appropriate for their role in the All of Us Research Program.

8.1.6 Participant Re-Contact Participants will be re-contacted from time to time for follow-up. This may be annoying to participants over time; however, they will be reminded that their participation is voluntary, and they do not have to participate in any procedures. Participants can choose the frequency with which they are contacted, they can pause their communication from the program, and they can elect to withdraw participation.

8.1.7 Unknown Risks Participants will be informed that the study may include risks that are currently unknown. When possible, the All of Us Research Program will inform the participant if new risks are identified that could affect their decision to participate.

8.1.8 Incidental Findings The required physical measurements may uncover an abnormal value that may be actionable. See Section 10.4, Individual-Level Information Access Processes, for procedures for managing emergent and urgent medically actionable findings. Participants may experience stress as a direct result of receiving health findings/measurements that may be indications of illness or be inconsistent with their understanding of their health status. Cost for emergency services and/or follow-up care associated with a value that is deemed to require attention will be the responsibility of participants. The All of Us Research Program does not assume responsibility for fees associated with responding to any emergent or urgent situations for medical care or transportation associated with existing conditions uncovered during the course of participation in the research.

8.1.9 Digital Health Technologies There are additional activities or modules that take place within the scope of DHT, which may result in an increased risk to the participant. Some of the potential risks include loss of privacy, atypical measurements, and changes to a participant’s data use and/or hardware battery. Prior to deciding whether or not they would like to participate in a DHT module, participants will review each DHT initiative, including its scope, purpose, usage instructions and the potential risks and benefits of using the technology.

8.2 Benefits

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

59

The All of Us Research Program has potential societal benefits as a robust research resource that can facilitate the exploration of biological, clinical, social, and environmental determinants of health and disease. The program aims to enroll one million or more participants across diverse populations from across the United States to provide insight into the substantial inter-individual differences in physiology, risk of disease, and response to therapy. The information and biospecimens collected will become a useful resource for researchers to investigate why some people develop certain health conditions while others do not. The All of Us Research Program invites participants to become partners in the data gathering and research process through various means, including through data return and as community scientists investigating the data. Community scientists are individuals interested in science and contributing to discovery. Participant involvement will occur at all levels of the All of Us Research Program, including oversight, design, implementation, and evaluation. The combination of a highly engaged participant population and rich biological, health, behavioral, and environmental data will provide a key resource for social, behavioral, and biological influences of health investigations capable of ushering in a new and more effective era of American health care. We anticipate that the societal benefits stemming from the All of Us Research Program will accrue over time and will primarily advance future disease prevention and treatment strategies. There is no guarantee, expectation, or assertion that a participant will directly benefit. However, potential indirect benefits to participants in the All of Us Research Program include:  A chance to learn about health indicators and access own data  An opportunity to help develop new treatments and screening approaches to fight disease

and improve the health of future generations  An opportunity to ensure that your community is included in research studies that may

lead to new understanding and new treatments  The chance to be part of a movement, to make our healthcare more precise, more personal,

and more effective  Have the potential to be invited to participate in future studies involving All of Us

participants

8.2.1 Access to Information Participants will have access to their physical measurements and PPI responses via their Participant Portal account. As additional information types are collected, we will seek to provide access via the Participant Portals in the spirit of the program’s value and in the hope that by empowering participants with information and data they may improve their own health.

8.2.2 Screening Physical Measurements Participants who undergo physical measurements will receive their personal data, along with information about the normal ranges. They will be told when their measurements are outside the norm. Participants may benefit from increased awareness of their health status and identify issues that warrant discussion with a health care provider (e.g., elevated blood pressure that, if confirmed, may warrant lifestyle modification or antihypertensive medication).

8.2.3 Opportunity to Participate in Ancillary Studies

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

60

Depending on their chosen communications preferences, eligible participants may be contacted about opportunities to participate in future research studies. They may also be invited to participate in clinical trials of targeted interventions and therapies.

8.2.4 Digital Health Technology Potential benefits specific to a given DHT will be outlined in the DHT module protocols, which will be reviewed by participants prior to deciding whether or not they want to participate in the module. In some cases, the DHT experiments may provide wearables to participants. In such instances, details about the risks and benefits of the wearable will be provided to the participant at the time of enrollment into the DHT module. Some of the other benefits include participating from the ease of their own environment, access to health-based tracking or measurement technology and apps, and increased engagement with AoURP.

8.3 Risk/Benefit Analysis The goal of the All of Us Research Program is to create a public resource for scientific investigation and a research infrastructure that can be leveraged to improve human health. As noted above (Section 8.1, Risks), we acknowledge potential risks that may be incurred by study participants as well as strategies in place to minimize these risks. Although benefit to individual participants is not a specific aim of the All of Us Research Program, participants may nonetheless derive indirect benefits (Section 8.2, Benefits). Taken together with the scientific value of the program, the overall benefits outweigh the risks of participation.

9 Issues to Consider The program will be conducted in accordance with the Belmont Report and OHRP Common Rule.

9.1 Payment for Participants

9.1.1 Payment for Participation Participants will be offered $25 for their participation, following completion of the in-person physical measurements and biospecimen collection visit. Participants who need to complete these procedures in multiple visits may receive the $25 upon the final visit. Provisions will be made for participants who are unable or unwilling to complete the full physical measures and biospecimen protocol while at the site. Payment decision will be recorded. In addition to the $25 payment, participants may be eligible for transportation or parking costs, based on the site-specific business practices of their enrollment location. If the participant withdraws his/her participation, s/he will not be expected to return the $25.

9.1.2 Intellectual Properties and Rights to Royalties Data collected in the All of Us Research Program may be used to discover or create new products, or tests, and some of these may have commercial value. NIH, the program, scientists, or institutions that may benefit from these commercial products will not compensate participants whose data have been used to create these products or tests. The All of Us Research Program data will not be

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

61

sold/distributed for commercial benefit or for marketing purposes. The CAPS will serve as the steward of the resource, except in the case of demonstration and QA/QC projects, which will be governed by a subcommittee within All of Us and ultimately by the DRC and AoURP consortium leadership, as proposed in Section 12 (Access to the Resource for Research).

9.1.3 Compensation for Injury No serious injuries are anticipated as a result of participating in the All of Us Research Program. However, if a participant is injured as a direct cause of their involvement in the All of Us Research Program:

• Trained site staff will assist the participant in obtaining immediate care if warranted by the injury.

• The All of Us Research Program HPO awardees or DV partners will pay for the cost of immediate medical care to treat the injury and take responsibility for answering any liability claims regarding the injury; institutions may bill the participant’s insurance at their discretion.

• The participant’s injury will be evaluated according to institution-specific protocol to determine whether the injury was a direct cause of participation in the program.

• If the research injury requires medical care beyond the immediate treatment, cost of follow- up care will be the responsibility of the participant and their insurance company; if the participant does not have insurance or if the insurance company will not pay, the participant will be responsible for these costs.

• Participants will not be otherwise compensated for their injuries.

9.2 Handling On-Site Reportable Events The All of Us Research Program clinical partners will provide applicable accreditations and policies and procedures—and will ensure relevant training of all program staff—to assure appropriate processes are in place for responding to situations when physically working with the All of Us Research Program participants in their clinics or at their facilities. These policies and procedures will be collected by the NIH Program Officers and filed as part of Institution-Specific IRB Applications to this Core Protocol. It will be important to ensure that clinical partner sites have procedures in place for responding to incidents such as:

• Physical injury that occurred while on site or during the act of the physical measurements and/or blood draw. For instance, known risks associated with specimen collection are: o Blood draws: The more common known risks of drawing blood include discomfort or

pain, bruising, bleeding at the site, nausea, lightheadedness, and fainting. o Saliva: No known foreseeable risk in the collection of saliva o Urine: No known foreseeable risk in the collection of urine

• Verbal and nonverbal indications that the individual may be a victim of physical and/or emotional abuse

• Indications of suicidal thoughts • Misconduct on the part of the participant that negatively affects the center/clinic or its

patrons

Unexpected adverse events and unanticipated problems which are not consistent with the known or foreseeable risks of adverse events associated with the research procedure or the expected natural

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

62

progression of any underlying disease, disorder, or condition of the person experiencing the adverse event will be documented by sites PIs. These reportable events will be filed with NIH and the IRB in accordance with HHS requirements for disclosing reportable events and unanticipated problems.

9.3 Participation options: Deactivate and Withdrawal Procedures

Participants may, at any time, stop their participation from the All of Us Research Program without giving a reason and without penalty. They may do this on their own by editing their participant status on their Participant Portal account or by contacting the Support Center, who will guide them to withdraw through their Participant Portal (see withdrawal flow in Appendix H). In addition, investigators may deactivate or withdraw a participant, if necessary and for any reason, including ineligibility arising during the program or retrospectively if overlooked at enrollment or inappropriate actions directed toward AoURP staff. For instance, until incarcerated populations are eligible to participate, if we learn that a participant has become incarcerated, we will suspend their participation. Participants will receive an email and/or letter to confirm recording of their updated participation status. They will also be informed that it may take up to two business days to propagate changes to their participation status throughout the AoURP system. A summary of participation options AoURP plans to implement is presented below (Table 9–1: Suspension and Withdrawal Options) followed by details for each option. Participants are informed during the consenting process that the program will maintain their name and basic contact information for regulatory requirements and quality control (e.g., as part of archived consent forms). Similarly, all the records contained in the All of Us Biobank laboratory information system must be maintained. However, such information will not be shared with researchers accessing the AoURP resource. Participants are also informed that data and specimens already used in research cannot be recalled nor destroyed. For instance, it is not possible to destroy all sample remnants and information already distributed or analyzed. An abbreviated version of the participant’s record will be maintained on HealthPro with limited data, such as participant ID, first name, last name, date of birth, date of consent, and date of un- enrollment or withdrawal. Other data will be removed from the HealthPro record. The purpose of maintaining this subset of data in HealthPro is to have an accurate record of participation status for site staff to consult. Staff can thus take care to not proactively approach or otherwise contact via any modality (phone, email, or text) deactivated or withdrawn participants and can maintain records of all participants to whom $25 was distributed. Table 9–1: Participation options

Withdraw EHR

Consent

Stop Participating

Deactivate Withdraw Deceased

Data collection

User Access to their Participant Portal Account

User Contribution to their Participant Portal Account

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

63

Researcher access to data and samples for new research studies

Messages from AoURP

Reactivation (re-enrollment)

☐ Yes ☐ No

9.3.1 Withdrawal of EHR Consent At any time, participants have the option to stop contributing their EHR data to the Program. No new EHR data will be transferred to the AoURP. Their data which is already contained in existing versions of the research database will remain available in archived database versions to promote reproducibility but will be removed from future versions of the research database. Participants that withdraw their EHR consent will be able to keep and contribute to their account on their Participant Portal and will still receive messages from AoURP.

9.3.2 Deactivate Participants will be able to deactivate or “pause” participation if they wish to suspend active participation but authorize continued use of their existing data and biospecimen for future research. No new data will be collected either actively or passively (i.e. through data linkage or personal health technology) after the effective date of deactivation. The participant’s record on HealthPro will be flagged to indicate that the participant no longer wants to be contacted about follow-up opportunities. Ideally, deactivated individuals will be able to keep their account on their Participant Portal. However, their account will be frozen so that participants cannot submit any new data (feature in development). Re-enrollment in the program is allowed but requires re-consent. Once the feature is developed, any new data collected will be linked and appended to a participant’s original dataset if they re-enroll using the same name and email address.

9.3.3 Withdrawal The withdrawal option is for participants who wish to leave the program and do not want their data and biospecimens to be available for new research in the future. Withdrawal status will be documented in the program database with a copy of the consenting document for proper regulatory compliance. No new data or samples will be collected, and the participant will not be contacted about follow-up program opportunities. Data from withdrawn participants already contained in existing versions of the research database will remain available in archived database versions to promote reproducibility but will be removed from future versions of the research database. Stored biospecimens that have not been analyzed or distributed to qualified researchers will be destroyed. However, if samples have already been distributed to researchers, those samples will not be subject to recovery and destruction.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

64

Like for deactivated individuals, participants who withdraw will be able to keep their account on their Participant Portal. However, their account will be frozen. No new information, data, or results will be added (feature in development). If a participant wishes to re-join the All of Us Research Program at a later date, they may do so. However, they will need to create a new participant account, re-consent, answer the PPI surveys, and donate new biospecimens. Their new data will not be appended to their prior account, even if they use the same name and email address. They will not be eligible to receive another $25 for their participation following completion of the new in-person physical measurements and biospecimen collection.

9.3.4 Withdrawal After Death As a default, existing data and biospecimens from deceased individuals will continue to be available for future research. However, AoURP is considering giving participants the choice to indicate their preference to be withdrawn from the program after their death. Participants who select this option would have all links between their identifying information and their research data broken and their specimens destroyed from the Biobank upon confirmation of their death. Our planned process includes confirmation of death through an annual query of a national death index with the participant’s identifying information (including social security number, for those participants who have provided it). However, this process may not be sufficiently timely or accurate to ensure participant directives are followed. Participants would be informed in the process of selecting this option that automated linkages to death indices are imperfect, and about the importance of receiving a death certificate. The participant’s family could contact AoURP with a death certificate to initiate withdrawal from the program. Family requests would be honored exclusively for participants who had selected this option. At the point of receiving a death certificate or affirmative linkage via a death index, AoURP would follow the same procedures as a standard withdrawal.

9.4 Destruction of Specimens Because blood samples could potentially contain biohazardous materials, the central program laboratory (i.e., Mayo Medical Laboratories) will not be able to return unused specimens back to participants or their families. In the event that samples collected do not meet the criteria to be sent to the central laboratory, sites will follow their institutional policies for sample destruction. In an effort to respect participants’ values and beliefs, AoURP will enable a cultural ceremony performed by an accredited tribal healer or medicine man to administer blessing or last rites to samples prior to their destruction. It is estimated that such cultural ceremonies will take place twice a year at the central laboratory. Samples tagged for destruction under this option will be stored until the ceremony takes place. Additional site-specific processes for culturally sensitive practices may be developed and approved through Institution-Specific IRB Applications. The central laboratory will dispose of biological specimens in accordance with Occupational Safety and Health Administration (OSHA) medical waste disposal guidelines.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

65

10 Access to Individual-Level Information for Participants

10.1 Principles of Individual-Level Information Availability The All of Us Research Program information access procedures, including access to data and results, will adhere to principles outlined by the White House’s Precision Medicine Initiative: Privacy and Trust Principles and Data Security Policy Principles and Framework, including transparency, timeliness, and participant empowerment.

• Uncertainty of meaning or concern about impact on participants should not be a reason for the All of Us Research Program to withhold information from participants.

• Where possible, information must be presented in a culturally appropriate and language- specific manner.

• The default bias for information access must always be to make the information available to participants as soon as possible.

• The choice to access and review information will be at the discretion of the participant; when possible, participants must be able to set preferences for the type, method, and frequency of information they may receive and will be allowed to change these preferences at any time.

As individual-level information becomes accessible, it needs to be readily and easily available to participants in an array of data-specific and results-specific formats and interfaces that may include: Data-specific formats and interfaces:

• Hard copy of the physical measurements. A template form will be used to give participants their physical measurements.

• Machine-readable/structured data available for direct download and through application program interfaces (APIs).

Results-specific formats and interfaces: • Visual/interface-based tools and interactive dashboards. Participants can view results

through their program account on the secure Participant Portals. • Multiple information-sharing platforms and interfaces will be created to provide flexibility

for access to individual level results (e.g., infographics, web-based dashboard, mobile apps, newsletter, email, mail). These platforms may also be used to return group- and program- level results.

We anticipate that participants’ access to their own information—including their experience throughout that process—is a critical component for maintaining their long-term engagement with the program.

10.2 Individual-Level Program Information The All of Us Research Program will gather and generate a tremendous amount of information about each participant as an individual. Individual-level program information falls into two categories: data and results.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

66

Individual-level data includes all information that participants contribute (e.g., PPI, physical measurement data, EHR data) as well as data that is generated from biospecimens (e.g., genetic sequence data from a participant’s sample) (Section 10.2.1, All of Us Research Program Individual- Level Data). Consistent with the core principles of the program, participants will have access to the individual-level data they contribute. Figure 10–1: All of Us Research Program Individual-Level Information: Data and Results

The second category of individual-level program information is results. Individual-level results are the interpretation of specific participant data. These results fall into two main categories: medically actionable and not medically actionable.

10.2.1 All of Us Research Program Individual-Level Data Consistent with the core values of the All of Us Research Program, participants will have access to all their contributed program data and individual results. Participants may contribute:

• PPI responses • Physical measurements • Electronic health records and Part 2 records • Biospecimens • Other types of data in the future, such as sensor measurements

Data derived from these contributions, such as genetic sequencing data and wearable sensor data, are considered individual-level data. In addition to instances of aggregate-level readouts of the individual-level data, data will be available to participants without interpretation except where explicitly stated otherwise by AoURP. Participants are empowered to decide if and when to access their individual-level data. They will not have to receive such information but will have the option to do so. The exception to this would be data derived from studies whose data is not necessarily resolvable at an individual level or is not considered a test with high validity.

10.2.2 All of Us Research Program Individual-Level Results

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

67

Medically actionable results are results that could be used to inform the medical care that participants seek or receive to maintain their personal health. Participants may need to complete a supplemental consent process or some other informing interaction prior to unlocking their medically actionable results. An example is an emergent blood pressure measurement. Not medically actionable results are results that could inform participants’ decision making but not directly inform the medical care that participants seek or receive to maintain their personal health. Examples of not medically actionable results are:

• Measurements within an expected range (i.e., “normal” cholesterol) • Recreational results, such as taste aversion • Experimental results from novel assays

It is important to note that not all participants will choose to receive their individual-level results. Participants will be free to share their results with anyone they choose. The rationale for not contacting the participants’ health care providers directly include:

1. Not all participants will have a health care provider 2. This is not health care, or a clinical trial; it is an observational study. 3. All participants should be treated with the same standardized protocol; participants

should have the freedom to make the decision of if, when, and how to communicate individual-level results information to their health care provider

To facilitate understanding and sharing their results, we will develop easy-to-read templates.

10.2.3 Return of Results: Framework The All of Us Research Program is beginning to develop a framework and set of processes for returning results to participants. This framework will:

• Lay out the principles for returning All of Us Research Program data and results to participants

• Establish guidelines for applying the framework to existing and new data as well as result types

• Develop data and results type-specific access and return policies (which will grow over time), allowing for a participant’s individual preferences of the types of data they would like to see or have actively returned to them.

10.3 Information Access Technologies

10.3.1 All of Us Research Program Participant Portals

The core public-facing program enrollment and communication tools are the program’s Participant Portals. In addition to providing program updates and messages to participants as described above, participants will be able to access their individual-level information on their personal account using their portal account. Participants will have access to their responses to PPI questionnaires, the values from their physical measurements, their responses to snap surveys, notifications that they have provided EHR data, and potentially information about the wearables they’ve chosen to integrate.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

68

Figure 10–2: Data Flow for Participants and HPO Staff

Access to certain data types, such as genomics, will be a multi-step process. For instance, participants will need to first consider the pros and cons of obtaining their genomic information and unambiguously consent to unlocking access to these data through the Participant Portals. Genetic counselors may be called upon to explain certain genomics results to the participants when their genomics data is first unlocked; planning for how to provide this service at scale is currently underway in the AoURP Omics Committee and will be presented at a later time to the IRB. The Participant Portal User Interfaces are being updated. It will integrate the IRB-approved materials such as the enrollment and consent process, site-pairing and visit scheduling, PPI, measurements, and notifications. Screenshots of the Participant Portals illustrating the user experience will be submitted to the IRB as a protocol supplement. A Future portal version will include a dashboard where participants can view some of their data compared to the aggregated data generated through the All of Us Research Program. Furthermore, the DRC will maintain the Research Hub to enable access to the program data, according to the data access procedure described in Section 12 (Access to the Resource for Research), including a public portal where participants will be able to view aggregate data and a registered access portal where participants, as community scientists, will be able to access data with personal identifiers removed.

10.4 Individual-Level Information Access Processes

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

69

10.4.1 Physical Measurements—Access to Information

In the spirit of the All of Us Research Program values (Section 2.1, What Is the All of Us Research Program?), all physiologic and anthropometric measurements logged through the physical measurement process will be stored in the “Participant Record” and will be accessible by the participant through the Participant Portal feature . The physical measurements data may also be given to participants in hard copies provided by trained AoURP site staff at the time of the physical measurement visit. A template form (hard copy) will be used to give participants their physical measurements in a consistent manner. As described above (Section 7.3, Physical Measurements), the physical measurements will include physiologic (e.g., blood pressure, heart rate) as well as anthropometric (e.g., height, weight, waist and hip circumferences) measurements. Body mass index will be calculated automatically from measured height and weight. Participants will also receive the aggregate-level measurement values from publicly available information until there is a critical mass to provide an equivalent comparison using program data. Another goal of the All of Us Research Program is to couple the information with educational materials to promote understanding. These educational assets may include:

• Normative values and evidence-based guidelines for components of the physical measurements specifically focused on the individual’s demographics, such as sex, age, and race

• Links to websites (e.g., WebMD, PatientsLikeMe) that provide information pertaining to each measurement

• Educational videos, produced by the All of Us Research Program (to be developed), that provide background information on the various components of the physical measurements collected through the program

The All of Us Research Program is an observational study, and therefore none of the information provided constitutes clinical recommendations. Information returned to participants, including those considered medically actionable, would need to be confirmed independently. As we develop modules to return information, we will develop unambiguous language to remind participants that the All of Us Research Program is an observational study and is not designed to diagnose or treat any medical condition or serve as a substitute for regular medical care. Modalities for participant information access will provide a disclaimer that the participant may wish to consult a health care provider to follow up on physical measurement information, and any questions the participant has about the impact of program-related information on their personal health or clinical management should be directed to their health care provider. If a participant does not have a regular provider, the trained site staff will provide referrals at participant request to appropriate organizations that work with underserved populations in their region. As the public-facing and individual participant information dashboards are developed, they will be presented as an amendment to the Core Protocol, to provide the IRB with the opportunity to provide guidance.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

70

10.5 Physical Measurements—Return of Medically Actionable Results Although the physical measurement component of the All of Us Research Program does not constitute clinical care, we anticipate that a small but important percentage of individuals will have medically actionable results that, if left unaddressed, might have adverse consequences for the participants’ health. Clinically actionable findings from the physical measurements are limited to blood pressure and heart rate, as defined below (Table 10–1: Medically Actionable Findings at the Time of Baseline Physical Measurements). Trained AoURP site staff will record physical measurements via HealthPro. If a measurement falls outside the range considered “normal” per the All of Us Research Program protocol, a message will pop up on the HealthPro screen. After confirming the measurements, the trained staff will ask the participant whether these measurements are typical. A script was developed to guide discussion about measurement findings with the participant and to draw attention to certain measurements (Appendix K1). Participants requiring immediate and expedited referrals will be managed per institution-specific policies and procedures, as declared in the Institutional-Specific IRB Application. Similarly, if, in the opinion of the trained site staff performing the physical measurements, the participant appears to be clinically unstable for any reason, site-specific policies and procedures will be followed. Emergent and urgent actionable findings will not be sent to a provider. Instead, a “Physical Measurement” document or card will be provided to the participant with their physical measurements, along with any urgent or emergent findings specifically called out. The participant can use this card to follow up with a provider of choice. Trained AoURP site staff will use the script above to call the participant’s attention to any emergent or urgent actionable findings listed on the card. Table 10–1: Medically Actionable Findings at the Time of Baseline Physical Measurements

Emergent Urgent Systolic Blood Pressure*

● >200 mmHg

● <100 mmHg and any symptoms of hemodynamic instability***

● 180–200 mmHg

Diastolic Blood Pressure*

● >120 mmHg

● <60 mmHg and any symptoms of hemodynamic instability***

● 110–120 mmHg

Heart Rate** ● <60 or >100, not known to be usual for the participant, and any symptoms of hemodynamic instability***

● <60 or >100 and hypotension (systolic blood pressure of <90 mmHg) without symptoms of hemodynamic instability***

● Asymptomatic heart rate <50 beats per minute or >120 beats per minute, not known to be usual for the participant

● Heart rate >100 beats per minute and irregular

● Pulse unable to be determined via digital cuff (following verification

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

71

by manual pulse determination when possible) unless confirmed by participant that an irregular heart rhythm is already a known condition

Minimum Site Response

Participant is immediately advised of the need of emergent care, and if agreed to by participant, trained AoURP site staff will refer the participant to emergency care (e.g., site-specific emergency room or 911); refusal will be documented according to site-specific policies and procedures

Participant is advised to seek medical attention and to notify their provider. Trained AoURP site staff may offer to help locate an urgent care facility and help coordinate transportation to the facility as needed

* Based on Eighth Joint National Committee (JNC 8) recommended blood pressure goals. [Abel et al. 2017- doi:10.4103/1947- 2714.168669] ** Based on the American Heart Association recommended target heart rates. ***Hemodynamic instability is defined by, and will be prompted within HealthPro at the time of data entry meeting numeric criteria, to include (1) changes in mental status (reduced alertness and awareness, confusion, possible loss of consciousness), (2) chest pain, (3) shortness of breath and/or rapid breathing, and/or (4) cold, clammy skin. HPOs/DV sites can access the template for the “Physical Measurement” card via the Wondros All of Us Asset Portal. The card is also included in the biospecimen kit for the DV sites.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

72

Figure 10–3 Example of Physical Measurement Card—Co-Branded

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

73

Figure 10–4 Example of Physical Measurement Card—5 x7 format

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

74

10.6 Participant-Provided Information and EHR Participants will provide various types of information to the program through questionnaires and other modules, which may include demographics, disease state, health information, lifestyle, data type, and/or location. A future version of the Participant Portals will include a dashboard where participants will be presented with a comparison of how their information lines up with aggregate- level information from the All of Us Research Program. EHRs from DV participants will be integrated into the platform at a future date; see Section 7.6, Electronic Health Records (EHRs).

10.7 Access to Biospecimen-Derived Information (Non-Genetic)

10.7.1 Biospecimen Collection—Access to Information In the spirit of the All of Us Research Program values (Section 2.1, What Is the All of Us Research Program?), information derived from a participant’s biospecimen by the program will be made accessible to the participant in an appropriate, IRB-approved manner. Participants will be able to access their biospecimen-derived information upon request. There will be information about the status of the biospecimen and information pertaining to biospecimen- derived data (if applicable), as described below.

10.7.2 Information on Biospecimen Status Participants who opt to keep informed about their biospecimen status via their secure Participant Portal account may receive the following (feature in preparation):

• A message thanking them for their donation • Notification that their biospecimen has been received by the Biobank (e.g.,

“Congratulations, your specimen is in the Biobank”) • Information pertaining to the “journey” that their biospecimen donation will take

10.7.3 Biospecimen-Derived Data—Notice of Future Addenda to Core Protocol

Due to the wide number of assays that may be performed on biospecimens over the course of the program, it is impossible to account for all potential types of information that may be generated, including “normal” and “abnormal” range findings and potentially clinically actionable information. Therefore, the program will implement a process whereby, as a specific assay is being planned, an information access plan will be developed in tandem and submitted to the IRB for review prior to initiation of that assay. Note that the AoURP will not allow HIV assay or testing of any type without the express written consent of participants, consistent with the law(s) of their state of residence. This approach does not prohibit the study of HIV status, as participants could self-enter their HIV status through future PPI modules or have it indicated via their EHR record or other linked data.

10.8 Access to Genomic results

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

75

Many participants will consent and contribute to the research program without being invited to provide biospecimens. For the subset of participants who are invited and elect to contribute biospecimens, DNA will be isolated and genomic analysis conducted. Participants will decide whether or not to receive the results. A separate return of genomic results consent process, policies, and procedures will be submitted to the IRB at a later date and will govern the return of results from select assays (Section 6.6, Electronic Consent )

11 Creation of the All of Us Research Program Resource A primary end product of the All of Us Research Program is a curated dataset that will be made available through a Research Hub to support scientific investigation. The DRC is responsible for aggregating, managing, and curating the data that is made accessible through the Research Hub. Multiple streams of data will flow into the DRC, including PPI, data from physical measurements, biospecimen measurements, EHR data, data obtained through linkage with distinct external datasets (e.g., the Social Security Death Index) as outlined in Section 7.7, Data Linkage (Figure 13–1: All of Us Research Program Connections and Data Flow), and data from custom-built digital health technologies. The DRC collects these data streams into a Raw Data Repository (RDR). New individual-level datasets get merged with existing data from the same participants in the participant’s study record, direct identifiers are removed from structured and unstructured data streams, and once curated, the data gets organized into a Curated Data Repository (CDR). This transformation approach will include validation and implementation of phenotyping algorithms that extract variables of interest (e.g., diagnosis of coronary artery disease). The CDR is accessible through the Research Hub according to the AoURP Data Access framework. All data are encrypted at rest and during transfer, either from the source or to Consortium partners.

11.1 The Raw Data Repository The RDR functions as a flexible, “append only” data repository capable of storing a variety of data in its originally received format. The primary role of the RDR is to act as the main data repository for the program and the final “source of truth.” The secondary role of the RDR is to facilitate the consistent and secure transfer of data to and from external systems, including Participant Portal hosts, All of Us HPOs, DV partners, the Biobank, and approved external digital health technologies. The RDR contains many disparate sets of AoURP participant data, including identifiers like the participant’s name and contact information. Data are never destroyed from the RDR, including after participant withdrawal, for regulatory and quality assurance purposes. The RDR is not accessible to anyone outside of a very limited number of RDR-authorized All of Us staff.

11.2 The Curated Data Repository The curated dataset is the subset of the raw data that has been curated into tiers to enable its sharing with researchers and the public. The tier system accommodates sharing data under more or less stringent conditions to protect the privacy of individuals from whom the data is derived (see Section 12, Access to the Resource for Research). New CDR datasets are periodically generated from the RDR. As part of this process, personally identifiable information (PII) is removed from participant data as follows: PII from structured fields (e.g., Yes/No questions, selecting a birthdate, rating an experience from 1 to 10) will be replaced with code. Data from unstructured fields (e.g., doctor’s notes, responses to open-ended questions) will be scrubbed with natural language processing, but

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

76

100% removal of PII from these fields cannot be guaranteed. For this reason, access to this free-text data will be highly controlled. The CDR dataset remains on a distributed cloud-based data platform enabling authorized researchers to deploy computing resources and run analysis without moving the data to a new location. The end-to-end security and privacy measures of the cloud infrastructure support the confidentiality and integrity of the data. Researchers will be able to query the CDR data and execute their analysis code using the cloud infrastructure in the DRC’s Research Hub. Advantages of this approach include:

1. Security: Significant centralized resources can be brought to bear to secure copies of the data, and access can be more easily monitored and tracked by removing data “handoffs”

2. Cost: This approach avoids the need to store multiple copies of the massive dataset 3. Accessibility: Few groups have the infrastructure needed to support data on this scale,

limiting its utilization 4. Elasticity: We can provide a pool of compute resources for needs that vary over time

11.3 The Participant Portal Data Repositories

The Participant Portal hosts also collect and retain copies of participant’s data, including data from the Participant Portals, AoURP custom-built digital health technologies, and S4S-enabled EHRs (or other technology-enabled EHRs where applicable). In addition, they collect standard log information and digital usage data (e.g., how individuals use the Participant Portals, pages accessed, amount of time per page, overall navigation.) Data are stored at the Participant Portal hosts for several reasons:

1. To support a user-friendly experience with the Participant Portals 2. To support quality improvement testing 3. To enable quality assurance testing

All data are encrypted at rest and during transfer either from the source or to the DRC. Personal Identifiable Information like first name, last name, date of birth and/or address collected during consent and account creation is encrypted along with all the other data on the Participant Portal host data repository.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

77

Figure 11–1: Curated Dataset

12 Access to the Resource for Research All of Us will be a resource that is both broadly accessible to qualified researchers and respectful of the interests of research participants.

A fundamental goal of AoURP is to ensure the quality and utility of this resource for accelerating science and medicine. Toward this end, a diverse group of qualified researchers will be able to access the resource, ranging from academic scientists to researchers at commercial organizations to interested community scientists. Access will be granted in a manner that ensures that no organization or person has preferential or exclusive access based on affiliation. Researchers who wish to access the resource for research purpose will undergo the same process, irrespective of whether they are affiliated with AoURP. However, an essential function of the DRC is to maintain the platform and assure high quality of the data throughout the life of the program. Such operational activities may include quality assurance (QA) or quality improvement (QI) work and/or demonstration projects. Demonstration projects are research projects limited in scope, whose intent is to demonstrate the quality, utility, and validity of AoURP data and tools via partnership with the AoURP consortium. Demonstration projects are not intended to produce novel, generalizable science. Both QA/QI work and demonstration projects (i.e. operational activities) may be published to communicate the reliability, validity, and utility of the data and tools to the broader research community. Additionally, workspaces utilized in these projects may be deleted or the program may

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

78

preserve artifacts (complete workspaces, pieces of code, etc) from the user’s work for use in support materials for the Research Hub. As a condition of data access for operational purposes, any DRC personnel or consortium partners having direct access to the data for operational activities, will have to complete training in data privacy and security and will be required to adhere to a data use agreement and AoURP Code of Conduct. As part of this agreement, individuals will be asked to sign that they agree to access and/or work with participant data from the All of Us Research Program for approved user testing, quality control, quality assurance, demonstration project, data characterization, and/or data validation purposes only. This additional restriction on the acceptable use of data and systems applies to all users accessing and/or working with research data during the user testing period. At the conclusion of the user testing period, user access will be removed, and subsequent access to All of Us research data will be subject to All of Us Research Program Data Use Agreement, access policies, and procedures. The DRC and AoURP consortium leadership will be responsible for overseeing operational access to the data and ensuring that this is not an opportunity for any exclusive or early access to the data with the intent of conducting novel research.

12.1 All of Us Data Access Governance All of Us data access will be governed by a two-tier structure. The Committee on Access, Privacy and Security (CAPS) will establish the policy and provide oversight. It will be responsible for developing and implementing fair, transparent, and streamlined procedures for timely access to the data; safeguarding the resource; and preventing improper access and use. The Resource Access Board (RAB) will review access requests and assess instances of malfeasance. Efforts will be taken to ensure the membership of CAPS and the RAB will represent the interests and diversity of All of Us participants. The current framework for data access is meant to be an iterative process with the expectation that lessons learned from operating under the data access framework will improve policies and processes to assure privacy and security.

12.1.1 CAPS Responsibilities and membership CAPS responsibilities include:

1. Determining the criteria for parsing the data resource (i.e., assigning data to tiers for research access (Table 12–1: Data Access by Type)

2. Determining the criteria for researcher access to the resource 3. Establishing policy and operating principles to be used by the RAB 4. Providing oversight of RAB activities 5. Establishing policies regarding access to samples, data not available through the research

database, and participant re-contact; it is anticipated that this level of access would require local IRB approval

The CAPS includes representation from the AoURP awardees, NIH, a bioethics expert, and participant representatives.

12.1.2 RAB Responsibilities and membership

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

79

The RAB will be responsible for operational activities including, but not limited to:

1. Registering new users and validating user identities 2. Validating the status of user eRA Commons accounts or other backing, if they are requesting

access to controlled data resources 3. Reviewing study proposals from users concerned about the potential for their study to be

considered stigmatizing to research participants. 4. Reviewing studies where a participant, user, or member of the community raises concerns

about the possible stigmatizing nature of a study or about breaches of the All of Us Code of Conduct

5. Notifying CAPS and AoURP steering committee when it determines a breach of the Code of Conduct has occurred and sanctions are to be considered

6. Implementing policies and reviewing requests for access to biological samples or participant contact

RAB membership will be based on the following two guiding principles:

1. That the makeup of the RAB should reflect the broad desired demographic diversity of the larger All of Us Research Program

2. That the makeup of the RAB should achieve the broad range of skill sets and experience levels needed to properly execute its mission

Ideally, the RAB will be composed of:

• Four initial members, each with expertise in human subjects research o One representing The Participant Center o One representing the Data and Research Center o One representing the Health Provider Organizations o One representing the Biobank

• One NIH member • Three individuals representing the diversity of All of Us participants, with at least one

representing an underserved population in biomedical research. • One individual with expertise in ethical, legal, and social issues • One individual with expertise in data privacy and security • One representative of the community scientists

The work of CAPS and the RAB will be facilitated by appropriate administrative support to handle pre-screening applications and validate researchers’ identities. This administrative support will coordinate the development of appropriate ethics training materials and ensure that researchers who wish to access the resource have completed this training.

12.2 Access and Use of Data The All of Us Research Program data will reside on a distributed cloud-based data platform, enabling qualified researchers to deploy computing resources and run analysis without downloading the data. The end-to-end security and privacy measures of the cloud infrastructure will support the confidentiality and integrity of the data. Authorized users will be able to query the data and run their analysis code using the cloud infrastructure.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

80

12.2.1 Data Tiers All of Us data will be made available via a researcher-based, rather than a project-based, mechanism. In this model, qualified researchers will not need to re-apply for access with each new project but will be granted a “data passport” for accessing data resources. However, the data workspaces will require public disclosure of the contributors to a workspace, the tier of data accessed, the purpose for which that access was granted, and a description of the study to be undertaken in that workspace to meet the requirement of the 21st Century Cures act. Data will be made available via a tiered system, such that access to increasingly detailed data on research participants requires an increasingly stringent approval process for requesting researchers. While it is the policy of the All of Us Research Program to promote sharing of data and content with as few restrictions as possible, the tier system allows for sharing data under more stringent conditions when required to protect the privacy of individuals from whom the data is derived. There will be three tiers of data:

• Public access data. Includes aggregate summary statistics that anyone, whether or not they are an authorized user, can browse or search in an unrestricted manner on the All of Us Research Program Research Hub. Summary statistics will be defined through a systematic process to ensure no individual-level information is provided.

• Registered access data. Includes aggregate or individual-level data that authorized users (including community scientists) who have registered with, and been approved by, the All of Us Research Program (via the Research Hub) can access with minimal risk of participant re- identification. These authorized users must accept the terms of data access established by CAPS and sign the All of Us Research Program Data Use Agreement (DUA), which includes an affirmation to abide by the All of Us Code of Conduct. Authorized users will receive a unique login and password, enabling them to access all public and open data within the All of Us Research Program Research Hub, as well as the data in the Registered Access Tier.

• Controlled access data. Has more sensitive information that confers an inherently higher risk of re-identification. Controlled access data may be accessed only after the researcher is approved by the RAB and has completed all data access requirements, including institutional sign-off. Access will still, however, be via a "passport" model, rather than researchers applying anew for each research project. Initially, approved researchers must possess an eRA Commons ID to gain access to controlled access data resources; however, CAPS will establish a process by which community scientists and other non-traditional investigators will be able to apply for controlled access data with some form of accreditation. These authorized users must accept the terms of data access established by CAPS and sign the AoURP Data Use Agreement (DUA), which includes an affirmation to abide by the AoURP Code of Conduct. Authorized users will receive a unique login and password, enabling them to access all public and open data within the Research Hub, as well as the data in the Controlled Access Tier.

12.2.2 Data Use Considerations

We expect some studies—such as those requiring exact birthdates, precise geocoded information, etc.—may require additional approvals, likely including local IRB review. CAPS may periodically revise the tier assignment of some datasets in response to scientific, technical, and legal developments to maintain compliance with the All of Us Research Program ethical and privacy policies and the PMI Privacy and Trust Principles.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

81

Some research purposes have the potential to stigmatize certain research participants or groups of participants, especially vulnerable populations. Investigators concerned their work might be stigmatizing will be encouraged to submit their studies for RAB review and approval (this applies for public, registered, and controlled access datasets alike). While RAB review for potentially stigmatizing research is voluntary, researchers will be incentivized to pursue it when uncertain, as investigators who perform research judged to be stigmatizing without RAB review risk the loss of continued access to All of Us data resources or other sanctions. Nevertheless, anyone—including other authorized users, AoURP participants, and members of the public—may request RAB review of projects with summaries posted on the AoURP Data Resource.

12.2.3 Data Access Types Table 12–1: Data Access by Type

Type of access

Type of data Risk of re-identification Requirements for access

Public Summary statistics via web interface

Minimal risk of re-identification. Small counts suppressed.

None (public resource)

Registered Aggregate or individual- level tabular data

Explicit identifiers removed. Small counts not obfuscated. Minimal risk of re-identification. Re-identification prohibited under Code of Conduct.

Registration Acceptance of code of conduct and data access policy Review of bioethics training module

Controlled Individual-

level data, including rich phenotype and outcome data and genomic data

Some explicit identifiers may be present. Risk of re-identification (with sufficient effort). Re-identification prohibited under Code of Conduct.

Same as for “Registered” tier plus: Access request application Approval by RAB

To access and use non-public data from the All of Us resource, researchers need to register with the RAB (see Table 12–1: Data Access by Type). The registration procedure includes:

1. Providing identifying information and proof of identity 2. Signing the All of Us Research Program DUA and agreeing to follow the All of Us

Code of Conduct, which includes proscription against attempting to re-identify research participants or redistributing All of Us data.

Registered and controlled access data will allow for both web-based access and computational analysis for research studies but will not include explicit identifiers (e.g., names, personal identifying numbers such as social security numbers and medical record numbers.) Access to clinical notes and narrative data will also be suppressed in Registered Access but will be available in the controlled access tier after computational algorithms are employed to scrub the direct identifiers.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

82

12.3 Access and Use of Biospecimens

Biospecimens are finite, exhaustible resources requiring carefully coordinated and controlled access. Biospecimens may be made available to qualified researchers with some explicit identifiers (particularly for satisfying CLIA requirements, if applicable) and may be considered to pose a risk of re-identification of participants with sufficient effort. CAPS will establish policies for access to biospecimens. This policy may include procedural steps, such as evaluating the scientific and ethical merit of each request, as well as privacy and security safeguards for any identifiable data that may be generated that must be in place before granting access to biospecimens. Researchers will submit a request for biospecimens that includes the following elements:

• A description of the research • The scientific rationale for using the biospecimens • The potential scientific impact of the data generated for the All of Us resource • Required quantity and type of specimens • A materials transfer or user agreement • Attestations required for registration and access to controlled data • Approval by a local IRB

The program will require that researchers adhere to the terms stated in the informed consent that participants will not share in the profits from any commercialization. CAPS will adjust the requirements for the request as needed. The Biobank will track the sample requests and aliquots distributed. Researchers will be required to contribute the results of biospecimen analysis back to the program for potential use by other future researchers. Additional policies will be developed to govern the return of researcher-generated results and any possible embargo time for use by other researchers. The list of sample recipients, institutions, and purpose of the approved specimen analyses will be posted publicly for transparency.

12.4 Contacting Participants Qualified researchers accessing the data and/or biospecimens may wish to invite participants with certain characteristics to join specific research opportunities or community outreach projects that may be of interest to the participants. Other reasons for re-contacting participants may include to collect new biospecimens or information (e.g., more detailed phenotype questions, requests to collect device or sensor data, or more detailed continuous location information) and to seek consent for data or specimen uses that fall outside the existing consent. CAPS will develop policies about the process and required elements needed to gain authorization to contact research participants. Initially this may include:

• A list of participants they would like to contact, defined by disease status, demographics, or other factors or by discrete record identifiers

• The scientific investigation to be performed, including: o The project proposal o What is being asked of participants o What is required from the All of Us DRC, Participant Portal hosts, and/or Biobank o The scientific value of the effort

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

83

Requesting researchers will also be asked to assert that all data generated from the effort will be deposited in the DRC within a year of generation, where other RAB-approved researchers can access it. The RAB will then review the proposal regarding:

1. Ethics and safety to participants 2. Technical feasibility 3. Scientific merit

If the proposal is successful, the researcher will then work with TPC, the Participant Portal hosts, and the DRC to operationalize contact of participants in concordance with the proposal. No authorized user will directly contact the research participants. Although commercially oriented researchers will be able to apply for access to the data, re-contact for commercial advertising will be prohibited. Participants will be able to request removal from the re-contact list at any time, and to select their communication preferences.

13 Confidentiality, Privacy, and Security Maintaining data security and privacy within the All of Us Research Program will be paramount to maintaining participants’ trust and engagement. Extensive regulations, policies, governance, compliance, and technical safeguards are being implemented to ensure that participant data security and privacy are appropriately protected. Specifically, the Participant Portal hosts and the DRC are both implementing standards at the FISMA moderate baseline, which is described in more detail below. Figure 13–1 describes various All of Us Research Program components, their connections, and associated data flows.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

84

Figure 13–1: All of Us Research Program Connections and Data Flow

13.1 Security Posture The program’s security approach is a combination of regulations, policies, governance, compliance, and technical safeguards being implemented across various data flows and data types. In the case of the DRC and the Participant Portal hosts, we apply an iterative risk-based approach to implement security at all layers of the system. We leverage components from the NIST Risk Management Framework (NIST SP 800-39), the NIST Cybersecurity Framework, and the Security and Privacy Controls for Federal Information Systems and Organizations (NIST SP 800-53 rev4). Based on the risk to the system and the data contained in the system, we implement controls at the FISMA moderate baseline and select additional enhancing controls where needed, using a “pure” information security perspective to prioritize best-of-breed security methods.

13.2 FISMA and Its Significance to the All of Us Research Program The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations, and assets against natural or manmade threats. FISMA was signed into law as part of the E-Government Act of 2002 (https://www.dhs.gov/fisma). FISMA assigns responsibilities to various agencies to ensure the security of data in the federal government. The act requires program officials and the head of each agency to conduct annual

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

85

reviews of information security programs, with the intent of keeping risks at or below specified acceptable levels in a cost-effective, timely, and efficient manner. The National Institute of Standards and Technology (NIST) outlines nine steps toward compliance with FISMA:

1. Categorize the information to be protected 2. Select minimum baseline controls 3. Refine controls, using a risk assessment procedure 4. Document the controls in the system security plan 5. Implement security controls in appropriate information systems 6. Assess the effectiveness of the security controls once they have been implemented 7. Determine agency-level risk to the mission or business case 8. Authorize the information system for processing 9. Monitor the security controls on a continuous basis

The program is working with internal and external independent third-party security experts to define the system and its security needs, to assess whether security controls are implemented, to monitor and test that controls continue to be effective, and to respond appropriately to incidents or anomalies to address and resolve any issues.

13.2.1 Relation to PMI Data Security Principles and Framework We will adhere to the Data Security Policy Principles published by the White House. These principles utilize four proven design concepts:

• Authenticate: All components require authentication • Authorize: All data, other than public data, requires explicit authorization to access • Audit: All data access is logged (to a different system), with alerts for anomalous events • Encrypt: All data in transit and all data at rest is encrypted

By following this principled approach, combined with meeting the FISMA compliance requirements, we will implement the core data security functions of identify, protect, detect, respond, and recover at all times. Consistent with the guidance, the DRC and the Participant Portal hosts are implementing the system to meet the PMI Security Principles and show alignment with the PMI Data Security Framework. This will be achieved through the implementation of a system accreditation process following the NIST Guide for Applying the Risk Management Framework to Federal Information Systems (NIST SP 800-37). The system will be authorized at the FISMA moderate classification and will be assessed by a third party to meet the moderate baseline security controls in NIST-800-53, with a concentration on continuous monitoring and audit controls. Using those controls and more, it is our goal to identify likely threat sources (see Table 13–1: Threat Assessment), protect against those threats, detect incoming attacks, respond to those attacks, and recover the full integrity of all systems along with accurate event reporting.

13.2.2 Multiple Levels of Data Security and Privacy

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

86

We take a multilayer defense-in-depth approach to security. The DRC and Participant Portal hosts group work independently and in parallel, with shared security philosophies and approaches, though some implementation details will differ. Below are specifics on how we will, over the project lifetime, implement our various layers of security.

13.2.2.1 Perimeter Security

All external-facing properties for both the DRC and the Participant Portal hosts will have signature- and non-signature–based intrusion detection and protection systems and will be scanned regularly for vulnerabilities.

13.2.2.2 Resilient Infrastructure

DRC uses the Google Cloud Platform (GCP), which is run and maintained by Google and protected by Google’s security engineering team. This platform is undergoing FedRAMP evaluation, with portions already having received an Authority to Operate (ATO) and used in several FISMA moderate projects. See https://cloud.google.com/security/whitepaper for more details. The Participant Portal hosts use Amazon Web Services (AWS) East/West cloud infrastructure. The AWS cloud system is FedRAMP authorized and has been determined to have a security categorization of moderate. See https://aws.amazon.com/compliance/fedramp/ and https://aws.amazon.com/security/ for more details. Both of these cloud environments enable extreme redundancy and the ability to recover from lost computing assets.

13.2.2.3 Hardened Access Controls

DRC’s infrastructure and applications use Google’s Access Control for both authentication and authorization, including two-factor authentication. This leverages Google’s existing well-tested protections of this service, used for Google internal employees and external users (e.g., Gmail). The Participant Portal hosts’ infrastructure components utilize Amazon’s Identity and Access Management (IAM) for authentication and authorization, including two-factor authentication. Application authentication use tokens signed and validated with latest recommended cryptographic algorithms (such as JSON Web Token). Across all applications and infrastructure, no user will be authorized to access participant’s data within the development environment without human action to approve their access, with the exception of public data. Users will only have the lowest necessary access. By default, authenticated users can see nothing other than their own data. They must be explicitly authorized to access resources. All privilege escalations are logged.

13.2.2.4 Continuous Auditing and Monitoring The Participant Portal hosts and the DRC use various auditing and monitoring tools, such as Google’s StackDriver platform and CloudWatch/CloudTrail/Splunk, for handling logs. Error and anomaly detection is forwarded to both visual dashboards and real-time alerting systems to support system health remediation and security assessments.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

87

Our systems are built on “REST APIs,” so all commands are basic web requests. All requests— external and internal—will be logged. Logs containing personal identifiers (e.g., searches for named participants from HealthPro) will be treated as PII. A limited number of administrators and auditors will have access to log data, and all access to logs will itself be logged. Exceptions, errors, and stack traces will be sent to a specialized handler and will alert response personnel, since software failures are often a precursor to an attack.

13.2.2.5 Secure Deployment and DevOps

The All of Us Research Program platforms—the Participant Portal hosts and the DRC—will be created, destroyed, and deployed by automated code per our software development lifecycles. To reduce errors, utilizing repeatable, auditable, and remediable processes will minimize direct interaction with resources.

13.2.2.6 Code Testing Before Deployment

The program will use three testing methodologies: 1. Traditional tests 2. Static code testing utilizing automated programs (such as SoniqCube) 3. Dynamic code testing, such as running attacks against automatically instantiated fully

functional environments

13.2.2.7 Continual Attacks

In addition to dynamic code testing, AoURP employs both automated and human-based penetration tests across all assets on a regular basis to look for problems and to ensure our detection systems are working as expected.

13.1 Overview of Privacy and Data Confidentiality Protections

PMI Privacy and Security Principles. The PMI Privacy and Trust Principles and the PMI Data Security Policy Principles and Framework will apply to all organizations participating in the All of Us Research Program. HIPAA Privacy and Security Rules. The HPOs already implement, or will be required to adhere, to the relevant privacy and security standards under HIPAA. Some components of the DV operations in the Participant Portal hosts will also be HIPAA-compliant. In accordance with the PMI privacy, trust, and security principles, HPOs and the DV sites will obtain—and will not waive—participant approval for sharing of EHR data.

Security Assessment and Authorization Process. The Participant Portal hosts and the DRC will adhere to a security assessment and authorization process that is consistent with FISMA and NIST guidelines. The Participant Portal hosts and the DRC are developing a system security plan that will be reviewed by both NIH and an independent party to ensure that controls are commensurate with the assessed risk; if the plans are satisfactory, NIH will issue an Authority to Operate (ATO). The

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

88

program will continuously monitor system security. The program will also use interconnection security agreements for data transferred to the DRC from the HPOs, DV partners, the Participant Portal hosts, and the Biobank. Table 13–1: Threat Assessment

Threat Sources and Events Assessment (Reference NIST 800-30)

Threat Actor/Type

Motivation/ Description

Mitigating Security Controls

Likelihood/ Impact/ Risk Level

Comments

Adversarial Nation- State

Desire to acquire large datasets at low marginal cost

Access control, Incident response, Continuous monitoring, Boundary protection

L: Moderate I: High R: Moderate

Sophisticated nation-state actors with effectively unlimited resources are known to target for specific data and to “vacuum” large data sources over time for later examination. By having a multilayered approach to security and continuously attacking our own test environments with third-party engineers, we hope to find flaws in advance. This approach should protect us across the board—not just for this threat.

Adversarial Groups

Groups concerned with genetic manipulation or experimentation

Contingency planning, Incident response, Continuous monitoring, Boundary protection

L: Low I: Moderate R: Low

Such groups do not want to steal but rather to destroy or corrupt data or to interrupt operations.

Adversarial Nation- State/ Orgs

Modification of source code to allow access or to contaminate data processing

Access control, System integrity

L: Low I: High R: Low

Code modification could lead to data access, loss, or contamination. We have centered on GitHub as our source repository and will have very strict controls on editing the code.

Adversarial Individual: Privileged Insider

Disillusioned or compromised privileged insider as a vector for other threat sources

Personnel screening, Insider threat training

L: Low I: High R: Low

A motivated insider with privileges could provide data to outside entities, such as a nation-state or competitor. We also utilize separation of duties to ensure that no one person has “all” the power in the system.

Accidental Privileged User

Unintentional addition of users to incorrect access groups

Audit and accountability, Access control

L: High I: Moderate R: Moderate

An administrator could accidentally add a user to, for example, a Google bucket, allowing access to data ready for delivery after processing.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

89

Authority to Operate (ATO). An Authorization to Operate (ATO) is a formal declaration by a Designated Approving Authority (DAA) that authorizes operation of a product and explicitly accepts the risk to agency operations. After completing a security assessment, the head of an agency (or their designee) can authorize the system for use or grant an ATO. An agency grants an ATO according to a risk-based framework that analyzes how a vendor has implemented the security controls within their IT environment. For the All of Us Research Program, NIH is the DAA. Both the Participant Portal hosts and DRC infrastructures have received ATO from the NIH. The Common Rule. The Common Rule will apply to or will be followed by the DRC, the HPOs, the DVs, TPC, and the Participant Portal hosts. All participants will provide informed consent to participate in the program, as well as the future research use of their specimens and information that has been stripped of explicit identifiers (e.g., personal names and Social Security Numbers), as well as additional attributes that could disclose a participant’s identity with minimal effort (e.g., full residential address). NIH has established a central IRB for exclusive use by the program, which will approve research only after first determining that there are adequate provisions to protect the privacy of human subjects. Certificates of Confidentiality. To protect participants from having their information disclosed as part of any legal demand (such as a court order or a request from federal, state, or local law enforcement) or other claims, all All of Us Research Program awardees, including subawards, subcontracts, and vendors, will be covered by Certificates of Confidentiality. NIH will issue Certificates automatically to all primary awardees to cover the activities and work product of themselves and their sub-awardees. Certificates prevent the disclosure, except under specific circumstances, of any identifiable, sensitive information collected or used during the program. These protections extend to copies of All of Us data and prevent disclosures of such information by anyone in guardianship or possession thereof. The program expects all awardees and sub-awardees, program partners, subcontractors, and vendors to use any and all legal measures at their disposal to fight legal demands for All of Us data protected by a Certificate of Confidentiality. Nevertheless, should such All of Us information be disclosed, either legally or illegally, the Certificate makes this information immune from the legal process, without consent of the individual to whom the information pertains. Transparency and Participant Control. Members of the program will be able to set preferences about when and how they receive information or are contacted by the program. They will also be able to obtain copies of information held about them. Once enrolled, participants will also have the right to withdraw from further participation and to have their information and specimens withdrawn from further use by the program, with some limitations. Account Maintenance and Review: Each site will set qualifications for job functions, hire and train qualified people, and assess their competence in job tasks. To ensure that only authorized personnel are able to access the system, staff access to the system will require authorization from the site’s PI or point of contact. Access can be revoked or updated as needed to accommodate transfer or termination (voluntary or involuntary). Upon departure from the program or the HPO, staff credential will be revoked and the DRC system administrator will be notified. In addition, as an added security, account review and maintenance will take place every six months. Technical Measures. As mentioned above in Section 12.2 (Access and Use of Data), researcher access will be to the curated data repository, which will be electronically scrubbed of explicit

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

90

personal identifiers. Researchers wishing to access data will be required to agree to the conditions outlined above. Data transferred to the DRC will contain links to the participants and may contain identifying information, including health care providers’ clinical notes. In all cases, data will be transferred with encryption and kept on secure servers. The DRC will aggregate the data from all sources to create a comprehensive record for each participant. Figure 13–2: Data Flow and Privacy Protections

At the DRC, the health information collected will be assigned to the participant by their participant ID, Personal identifiers (e.g., names) will be removed from this information for creation of the curated dataset. Personal identifiers will not be attached to stored biological samples. Information linking the study codes to participants’ identities will be stored in a secure manner and will be accessible to specific individuals overseeing this program, including those involved with securing the identity of individuals. At the time of biological sample collection, all specimens are assigned a computer-generated research ID number that can be represented by a barcode. A myriad of security systems, protocols, rules, and practices to safeguard participants’ information are being implemented and are documented in submissions to the appropriate authorizing bodies. There are many measures in place to safeguard participant information and to prevent improper access. The Participant Portal host applications protect participant information by requiring secure

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

91

passwords and verification of email information for participants with emails. This approach protects against hacking of user accounts and allows for password reset verification. In addition to forcing secure user passwords to prevent improper access, policies and procedures are in place to prevent the use of social engineering to access the system. The Support Center must verify multiple components of users’ data to verify their identity, such as email address and phone number. The DRC systems are restricted to use by system operators and qualified researchers, whose access is controlled, audited, and protected, using the security mechanisms described above (see also Section 12, Access to the Resource for Research). Both applications are bound by FISMA, which requires procedures, techniques, and processes for protecting data (see also Section 13.2, FISMA and Its Significance to the All of Us Research Program). To limit the risks of deletion or tampering – whether accidental or malicious – all Participant Portal hosts and DRC administrative accounts are required to have multifactor authentication configured prior to accessing resources. As described above, the Participant Portal hosts and DRC architectures use a defense-in-depth approach to protect against accidental and malicious risks from a variety of actors, including the principle of least privilege (POLP), so that users must be explicitly authorized to take any action affecting participant data and maintenance of auditable access logs. Data security incidents or security vulnerabilities detected during intruder testing, as defined in our FISMA compliance documentation and policies (SSP—system security plans), will be reported to relevant parties at NIH program leadership and a Participant Data Protections and Incident Notification Board (see below), who will take further action as needed. The Participant Data Protections and Incident Notifications Board is constituted as an expert committee to oversee All of Us Research Program responses to data security incidents and risks to participant privacy resulting from such incidents. The board’s responsibilities, as described in additional documentation, do not include technical oversight (provisions and conditions specified by FISMA and the ATO) but instead involve program response in the event of a data security incident, as well as communication to participants of any resultant risk to their privacy. The primary responsibilities of the Board are to serve as the body reviewing and recording security incidents and providing notifications to the IRB, to act as the arbiter for data breach liability, and to serve as the authority for the important determination that a security incident requires notification of participants. A reportable breach is any breach where data is exposed to unauthorized parties. If the Board, the IRB, and the program determine that a breach has occurred to the extent that participants should be notified, the Participant Portal hosts and the DRC will work with all program partners as necessary to notify participants according to their preferred method of contact. The Board will contain members from the All of Us Research Program awardees; participant representatives; at least one individual with ethical, legal, and social issue expertise; at least one individual with privacy and security expertise; and NIH personnel. A formal operations protocol is being developed for this Board. Conflicts of interest will be mitigated with Board members.

14 Post-Enrollment Engagement Strategy

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

92

The mission of the All of Us Research Program is “to enable a new era of medicine through research, technology, and policies that empower patients, researchers, and providers to work together toward development of individualized care.” Meaningful post-enrollment engagement with and retention of participants is critical to fulfilling this promise. For the purposes of the program, “engagement” is used as an overarching inclusive term to describe the broad range of bidirectional interactions between the program, people, and awardees and other organizations. Engagement includes information sharing, consultation, involvement and collaboration in decision-making, and empowered action in informal groups or through formal partnerships. Consistent with the program’s values, the engagement strategy is focused on empowering individuals and communities through greater access to information and data. This participant-focused engagement strategy may also improve the quality and quantity of data contributed to the All of Us Research Program. Specifically, post-enrollment engagement differs from outreach for recruitment in that engagement provides the opportunity to interact with partners, where the outcome may be a bidirectional increase of general knowledge and increased partner input. “Retention” describes efforts to encourage and support ongoing contribution to the program by participants. “Contribution” includes a broad set of actions to improve the amount and quality of data in the repository—from the donation of additional participant-provided information and reflection on and refinement of participant records by participants themselves, to the sharing of experiential feedback for the improvement of the program. Effective retention will improve the quality and quantity of data provided by participants and as such will improve the value of the All of Us Research Resource for all scientific uses. Retention will also benefit engagement efforts in that the repository may then be a more meaningful resource for participants as individuals and at the community and national levels. Given the unprecedented scope and scale of AoURP, we recognize that there is currently no proven, effective long-term engagement or retention strategy for this type of very large longitudinal cohort program. Whenever possible, all strategic initiatives on engagement and retention will be designed as learning programs to enable effectiveness testing and will be informed by existing research efforts in community-engaged research.

14.1 Conceptual Framework Framework discussions about engagement and retention often begin with examinations of motivation: Is someone extrinsically or intrinsically motivated to participate? Extrinsic motivations often take the form of direct payment but can also be longer-term “games” in which people accrue tokens such as points, badges, or “swag” in return for continued participation. Intrinsic motivations are often described via conceptual frames, such as relatedness, autonomy, proficiency, or purpose. Within the Community Engagement Studios performed at Vanderbilt to inform development of the project, participants did not hesitate to ask for extrinsic “incentives” to encourage their participation. Many of the populations interviewed for these community engagement studios have traditionally been underrepresented in research and/or have histories of negative experiences with medicine/research (with little to no intrinsic or extrinsic benefit). They also often face greater barriers to participation, such as time and transportation. Extrinsic incentives are part of a sign of respect to these communities for their participation.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

93

Intrinsic motivations are generally found to last longer, increase engagement, and increase adherence compared to extrinsic motivations (Boundless, 2016). Extrinsic incentives are known to improve retention rates (Booker et al, 2011; Brueton et all, 2014) but they are also commonly used for blood donors (which many cite as an example of altruism) (Costa-Font et al, 2013; Farrugia et al, 2010; Glynn et al, 2003). The balance between intrinsic and extrinsic motivating forces in research leans away from extrinsic motivators and skews heavily to intrinsic motivation as a way of avoiding the hazards of undue influence and involuntary participation. By contrast, modern digital apps are designed for “stickiness”—the ability of an app to repeatedly bring its audience back into the app. We present a prototype for assessing approaches against an engagement and retention conceptual framework in Appendix J1. In our complete engagement and retention plan, we will list the various approaches, with notations on where there are complex interactions between them, as well as mitigation strategies where appropriate. Working from this conceptual framework allows us to specifically examine outreach efforts to ensure the program is motivating but not coercive— honoring the principle of informed consent in human research.

14.2 Approach to Engagement The All of Us Research Program explicitly values participants as partners in research. We strive toward that partnership by creating an engagement strategy with participant partnership built intentionally into its structure. Engagement in the program will be a systematic, considered process, with the express purpose of working with groups of people—whether they are connected by geographic location, special interest, health condition, affiliation, or identification with issues affecting their well-being. The overarching goal of our engagement strategy is to create a program reflecting the needs, preferences, and priorities inclusive of the range of age, social, racial, ethnic, cultural, geographical, and health statuses of individuals across the program. Participants and their advocates will be involved in all aspects of the program, including governance, oversight, design, conduct, dissemination, and evaluation. We aspire toward maximum inclusiveness to ensure that all communities are respected and represented. The word “community” is broadly intended to define groups of people such as participants, stakeholders, special interest groups, and citizen groups. Communities for the program may develop due to shared circumstances or interests of any kind—for example, geographic location, racial/ethnic identity, cultural group, shared beliefs, or experience with or interest in particular health conditions. The engagement strategy will be designed to encourage multidirectional communication and participation in the program by individuals – those participating, their advocates, and interested community members – and organizations. As such, engagement strategies will be threaded through awareness, recruitment, enrollment, and retention activities. Key elements of the strategy include but are not limited to the following:

• Regular reminders to sites’ Principal Investigators and point-of-contact people of the program’s core values

• Verification of budget allocation to support impactful and inclusive engagement and retention strategies at all stages of the program

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

94

• Having 1 or 2 key personnel who are knowledgeable, culturally competent, sensitive, and personally accountable for the successful implementation of the engagement efforts

• Working collaboratively with engagement experts and sharing information and best practices

• Promoting a Community Emotional Quotient Approach (EQ) that resonates with the population served—i.e., designing an engagement approach that incorporates key elements attuned to and responsive to the needs of the community

• Designating key engagement voices as representatives on participant-facing committees, task forces, and work groups

We present some example engagement activities that will be undertaken at launch but that do not represent the complete or final engagement plan, outlining some initial tools and methods. We will submit a more developed engagement plan, including assessment metrics, to the IRB.

14.2.1 Examples of Interpersonal Engagement Activities At the interpersonal level, we will leverage existing community health infrastructure to support meaningful engagement. For example, the New York Regional Medical Center (RMC) will use its “Each One Teach One” programming, where health topics are identified by a steering committee of community members; health information is then delivered back to the community via person-to- person conversation and through the web by medical experts. The Pittsburgh RMC created the multimedia Pitt+Me engagement platform to provide information about research generally and raise awareness of specific studies that may be of interest to community members. Overall, these regional initiatives promote personal positive experiences with study participation, fostering empowerment at the interpersonal level.

14.2.2 Examples of Community-Level Engagement Activities Awardees will leverage local health centers and community gathering places (e.g., local pharmacies, blood banks, churches), including the specifically designed Mobile Engagement Asset (MEA) described previously, to engage participants at the community level. For example, New York’s “Come meet All of Us” will be its first engagement event and will include both an introduction to the All of Us Research Program and an opportunity for community members, scientists, providers, practitioners, and partners to meet and interact with the team who are bringing the program forward in the community. Pitt’s partnership with the Urban League of Greater Pittsburgh and more than 150 community organizations through its CTSA program will be leveraged to promote the All of Us Research Program at the community level throughout western Pennsylvania. The VA intends to provide connection to the All of Us Research Program through informational/conversational kiosks at various community gatherings and events, in addition to other material relevant to the health of veterans. The program will collect community and participant input through surveys (see Appendix J) and shared stories. More engagement opportunities will be developed with partners as part of the funding proposal: https://www.nih.gov/research-training/allofus-research-program/funding/all-us-research-program- engagement-partners-ot2.

14.2.3 Examples of National-Level Engagement Activities At the national level, we have many dissemination channels for official program materials. Most

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

95

RMCs have tailored websites that have the capacity for two-way communication. Wondros’ All of Us Research Program campaign, which will include digital messaging, will be used to engage participants. Targeted special campaigns would also help keep communities of shared interests together. The VA plans to engage well-known, well-respected leaders in the veteran community to discuss the importance of the All of Us Research Program to veterans across the country; this approach could be expanded to other national-level communities who are joined by special interest or identity.

14.3 Retention Long-term retention of participants is by far the greatest challenge to achieving the most ambitious scientific goals of the All of Us Research Program. There are several notable examples of successful longitudinal cohort studies with high retention rates over decades, such as the Framingham Heart Study and the Nurses’ Health Study, both with around 90% retention of study participants two to three decades after enrollment. Both of those programs require active involvement by participants only every two years, with the Framingham cohort undergoing an in-person exam and the Nurses’ Health Study by mail. The All of Us Research Program poses unique challenges relative to these successful examples, well beyond its much greater size. Unlike in Framingham, the participants in AoURP will be far more geographically diverse, scattered across the United States and U.S. territories, and without the benefit of required recurring in-person visits. The Nurses’ Health Study differs in that it is made up of a relatively homogeneous population of individuals with a professional tie to health care, unlike the diversity of backgrounds of participants sought for the All of Us Research Program. Due to the scale and geographic spread of the program, retention strategies will be primarily digital but will also include “analog” outreach to ensure retention of the broadest cohort of participants.

14.3.1 Digital Approaches to Retention A digital retention strategy is made possible by today’s ubiquitous connectivity via mobile technologies, including smartphones—which are currently owned by two thirds of all adults in the United States—and personal computers. Due to the scale and geographic range of the program, we anticipate that most long-term interactions with the program will be digital; thus, the web and mobile application have been designed to be user-friendly and engaging, with a responsive and intuitive user interface. Snap Questions are an example of digital engagement activity designed to enhance participant retention. These are optional multiple-choice poll questions with a view of aggregate responses from other participants and brief relevant facts. Snap Questions are designed to be brief, engaging, and changed regularly. We will use Snap Questions as one way to attract participants to their Participant Portal to view and complete study-related activities (e.g., new PPI modules, Digital Health Technology activities). We will post three or more new Snap Questions on a health- or wellness-related topic to the Participant Portals at regular intervals, based on participants’ engagement level (see Appendix J2). At first, we will change the Snap Questions monthly. Every AoURP participant will have the option to respond to the Snap Questions at any time during that month and see how their responses compare to aggregated responses from the rest of the respondents. The Snap Questions will also include a brief fact sourced from public domain trusted information sources (e.g., National Library of Medicine,

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

96

NIH institutional websites) about that month’s health-related topic and how it relates to precision medicine, health, or wellness. Those who wish to learn more will have the option to click on a link to additional information on that topic (viewable on a pop-up window within the portals). This layered approach to the return of information is meant to satisfy participants with different health and reading literacy levels. Individual-level data will be securely stored on the Participant Portal hosts database and transmitted to the DRC. The AoURP will use the data for quality improvement to better understand and improve the user experience (e.g., share findings about topics or questions that are most engaging). Aggregate data may be included in program communications, such as in program newsletters or social media channels for participant engagement.

14.3.2 Non-Digital Approaches to Retention Digital connectivity is not sufficient to establish a high level of retention. For example, the largest experience with mobile device medical research, Apple’s ResearchKit, has shown active retention rates of close to only 10% in the months following initial enrollment. Further, non-digital methods will facilitate the retention of those who may not be comfortable with technology. The non-digital methods will include the Support (Call) Center, site-specific touchpoints/services, and other site- specific outreach. The success of long-term retention activities may vary based on the sociodemographic of the region where participants are enrolled. The suite of activities should include methods focusing on multiple levels (individual, interpersonal, community, national). Materials created to engage participants at these levels should be made available to all enrollment sites as best practices. Non-digital retention strategies successfully employed by other long-term cohort studies include:

• Provision of a small card that has the name of the project with a toll-free contact number that participants can call to update locator information or see information on the project

• Reminder calls to participants to keep them engaged in the project • Birthday cards to participants from the program; cards would provide the toll-free project

number and encourage participants to stay in touch • Outreach telephone calls to a participant-designated friend or family member (if consented

to contact) • Home visits by trained program staff • Exit packets

o Enrollment certificates (recognition) o Referral cards for friends and family

Summary of retention strategies implemented within AoURP

1. Periodic/Annual communication to participants from site staff i.e. phone calls, emails, birthday cards, or mailing of AoURP promotional materials such as letter, brochure and invitations to events.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

97

2. Periodic printed newsletters or e-newsletters with local updates about the program. The newsletters may include profile of participants/ researchers/ research staff, answers to common questions and promotion to community events.

3. Use of Social Media (Twitter, Facebook, etc.) to engage and update participants on study progression and promote program-related events.

4. Periodic Participant Appreciation Event to thank AoURP research participants and maintain relationship between the program and participants.

5. Health and science educational events: science cafes, health fairs, or seminars where researchers discuss their current research and how it pertains to AoURP while also promoting health literacy, and where participants can meet the research staff.

6. Town Hall with presentations by site PIs and/or site staff, and Q&A sessions with the audience.

7. AoURP Wallet Card to track completion of study activities and/ appointment reminder. 8. AoURP Scorecards to help participants track their physical measurements and share this

information with their health care providers for further management. 9. Welcome/Exit Packages are IRB-approved communication assets to assist in informing

and engaging participants on different aspects of AoURP. They are a great opportunity to show appreciation and provide participants with additional information on using the AoURP Participant Portals.

10. Post-Enrollment Survey mailed or emailed to participants after they have completed the enrollment process. The survey solicits feedback on different aspects of the enrollment process and identifies opportunities for improvement. The survey results can be tracked over time and provide valuable metrics on participant satisfaction.

14.3.3 Retention Metrics To measure when, where, and how well retention efforts working inside All of Us, we plan to develop metrics for assessing retention over time. Some metrics will be similar across all sites—for example, counting the number of survey modules completed. Other metrics will be specific to subpopulations within the program. For example, for those who download and use the program’s mobile application, we will be able to measure electronic interactions such as login frequency and time spent in the app. Additional retention metrics may include:

• Responsiveness to requests to share additional participant-provided information, indicated by either actively accepting or declining an invitation (electronic or in person)—for example: o Invitation to provide routine updates regarding health status o Invitation to provide updated contact information as needed

• Responsiveness to communications for involvement in the All of Us Research Program by opening or viewing such communications

Additionally, it is recognized that there is no one-size-fits-all retention strategy, so part of the learning process will be how to best individualize retention strategies to meet the needs of the individual.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

98

15 Site Monitoring, Record Keeping, and Quality Assurance

The All of Us Research Program has chartered:

• A central IRB specific to the All of Us Research Program • An Advisory Panel (composed of members with expertise across all aspects of the All of Us

Research Program) • Robust quality assurance procedures • A governance structure that includes working groups and incorporates participants in all

aspects • HPO and DV site-specific participant boards

15.1 HPO and DV Enrollment Site Monitoring

Enrollment targets will be mutually established with NIH and each awardee. This will establish the yearly targets for diversity categories such as race and ethnicity, sex, age, income, education, etc.). NIH will work with each of the awardee to establish green (>90% of target accruals), yellow (80%– 90% of target accruals), and red zones (continuously below 80% of accruals). Enrollment targets will be reported using the monthly report from awardee to NIH. NIH will collaborate and establish mitigation action plans with each awardee to address any associated under-enrollment issues of targeted demographics per site-specific metrics and site visits.

• Green zone. Accrual is at or above 90% of target enrollment numbers. • Yellow zone. Accrual is 80% to 89% of the target but still at or above the minimally

acceptable levels: NIH program staff will request an analysis of recruitment barriers (i.e., the reasons why enrollment numbers are lower than expected) and a corrective recruitment action plan, with budget, for NIH program staff to review. The corrective action plan will include logistical plans for achieving targeted enrollment numbers and timelines for getting back up to target enrollment. Consequences may include increased frequency of enrollment monitoring, restricting funds already awarded, and/or withholding funds not yet awarded until they are needed to support enrollment costs.

• Red Zone. Accrual is below 79% of target and below minimally acceptable levels. Program will engage in similar requests as in the yellow zone, and the enrollment monitoring will be conducted at least bi-weekly on phone calls with NIH program staff and HPO program staff. Weekly enrollment monitoring updates and a site visit by NIH program staff will be required if enrollment is below 79% of target enrollment in a three-month period.

If there are consecutive benchmarks that are below 79% across the milestone reports, the All of Us Research Program team will consider a variety of options, including re-establishing milestones, facilitating mitigation plans for the awardee to get back on track, temporarily restricting funds already awarded, reducing or withholding funds not yet awarded, or permanently discontinuing funding. Overachievement of enrollment targets in diversity categories will be considered as a “bonus” such that, if overall enrollment numbers are lower than expected and underrepresented racial or ethnic

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

99

minority diversity numbers exceed expectations (>5% above target numbers for each category), a leniency of consequences will be considered within reason.

15.2 Training expectations Training is mandatory for all awardees and will be renewed annually. All existing training content is currently 508-compliant and available on the existing Training Resources for All of Us Confluence page, including:  Training FAQs for Principal Investigators (PIs) and Study Coordinators  Training PowerPoint of the protocol  Training Knowledge Check (Quiz)  Certification of Completion (for those scoring 80% or higher)  Additional resources address the following:

o Supplementary AoURP Protocol, Informed Consent, and Training Policy & Resources

o Data, Security, & Privacy o Participant Outreach, Engagement, & Retention o Cultural Competency & Diversity Training o HealthPro Training o Physical Measurements & Biospecimen Collection o Consortium Updates: In the News

Please Note: The training implementation process differs for HPOs and DVs depending on roles and responsibilities at the local site. The following initiatives have been taken to vastly improve the current training available to All of Us Research Program awardees and the consortium as a whole: Streamline the training into real-time e-training modules for multiple users and interfaces Expand our reach to make sure that we acquire relevant content that will meet the needs of the program Initiated a collaboration with the Network of the National Library of Medicine (NNLM) to enhance and enrich the training platform and experience Moving forward, the NNLM will not only provide training resources for the awardees and study staff, they will also help identify other educational and training materials that we can adopt and adapt to the AoURP. Once the NNLM is up and running (by Summer of 2018), we will migrate the existing Training Resources for All of Us Confluence page and training materials to the NNLM to coordinate. Record Keeping Digital and physical records will be retained throughout the life of the program. Those records may include: Training materials: HPOs will indicate in the site-specific IRB application how they will manage their record keeping for training materials. Accomplishment of necessary training will be included in quarterly progress reports sent to NIH for HPOs. Quarterly reports: Reports from all sites will be maintained in the official grant folder for each HPO, as will correspondence between NIH and HPO PIs regarding material included in the

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

100

quarterly progress reports. Stored data: Data will be stored in the DRC’s raw data repository in FISMA-authorized, cloud- based systems. Examples of these data include responses and associated metadata (date and time stamp, version information, etc.) for the following: Documentation of consent PPI Withdrawal Physical measurement data Biospecimen collection data Data collected via the Support Center EHR data and details of EHR transmissions Quality Assurance Management for the Biobank The biospecimen processing laboratory has implemented a robust quality management system (QMS) modeled after the quality system implemented within the Department of Laboratory Medicine and Pathology (DLMP) at Mayo and the Clinical Laboratory and Standards Institute. The quality and regulatory experts at DLMP have utilized QMS for almost 20 years. QMS is the gold standard in the clinical industry; it is extensive and is designed to meet all federal and state regulatory requirements for highly structured clinical laboratories that fall under the purview of the Clinical Laboratory Improvement Amendments (CLIA). Implementation of this QMS by the Biorepositories Program has prepared the laboratories for College of American Pathologists (CAP) accreditation. Within the Biorepositories Program laboratories, one quality management coordinator and three quality specialists support QMS. This system includes 12 quality system essentials: Continual Improvement—The laboratories identify opportunities for improvement and use quality management tools to improve processes Customer Focus—The laboratories determine customer needs, provide customer feedback, and use this information in the design, implementation, and evaluation of its products and service Documents and Records—Document creation, use, and maintenance are controlled; accurate, complete, and legible records are created and archived; more than 650 Standard Operating Procedures have now been implemented Equipment—The laboratories select appropriate equipment; perform installation qualification; and operate, calibrate, and maintain equipment according to established schedules and procedures Event Management—The laboratories detect and document events; investigate, categorize, and analyze event information; and take appropriate improvement measures Facilities and Safety—The laboratories ensure safe environmental conditions for employees and visitors Information Management—The laboratories validate new and changed software before use and have contingency plans in place in case of outages Monitoring and Assessments—The laboratories use a scheduled, systematic process for measuring and evaluating the effectiveness of the QMS and each work unit’s path of work flow Organization and Leadership—The laboratories have assigned responsibility for oversight and execution of the QMS Personnel—The laboratories set qualifications for job functions, hire and train qualified people, and assess their competence in job tasks Process Management—The laboratories ensure work processes and procedures are consistently performed and meet defined objectives and the customer’s needs Purchasing and Inventory—The laboratories ensure that the reagents and supplies used have the

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

101

quality and availability necessary to provide finished products or services These Quality System Essentials have been implemented within the biospecimen processing laboratory and are an integral component of the quality assurance program for all aspects of All of Us Research Program operations.

16 References • Abel N, Contino K, Jain N, et al. Eighth Joint National Committee (JNC-8) Guidelines

and the Outpatient Management of Hypertension in the African-American Population. North American Journal of Medical Sciences. 2015;7(10):438-445. doi:10.4103/1947-2714.168669.

• American Heart Association. Target Heart Rates. http://www.heart.org/HEARTORG/HealthyLiving/PhysicalActivity/FitnessBasics/Target- Heart-Rates_UCM_434341_Article.jsp#. Updated January 2015. Accessed July 24, 2017.

• Agency for Heatlhcare Research and Quality. The AHRQ informed consent and authorization toolkit for minimal risk research. Rockville, MD. 2009.

• Belanger CF, Hennekens CH, Rosner B, Speizer FE. The Nurses’ Health Study. Am J

Nurs 1978;78(6):1039–1040. • Bentley JP, Thacker PG. The influence of risk and monetary payment on the research

participation decision making process. J Med Ethics 2004;30(3):293–298. PMID: 15173366

• Beskow LM, Lin L, Dombeck CB, Gao E, Weinfurt KP. Improving biobank consent

comprehension: a national randomized survey to assess the effect of a simplified form and review/retest intervention. Genet Med 2017;19(5):505–512. doi: 10.1038/gim.2016.157. PMID: 27735922

• Beskow LM, Dombeck CB, Thompson CP, Watson-Ormond JK, Weinfurt KP. Informed

consent for biobanking: consensus-based guidelines for adequate comprehension. Genet Med 2015;17(3):226–233. doi: 10.1038/gim.2014.102. PMID: 25144889

• Booker CL, Harding S, Benzeval M. A Systematic Review of the Effect of Retention

Methods in Population-Based Cohort Studies. BMC Public Health. 2011;11:249. https://doi.org/10.1186/1471-2458-11-249

• Boundless. Incentive theory of motivation and intrinsic vs. extrinsic

motivation. Boundless Psychol 2016.

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

102

• Brueton VC, Tierney JF, Stenning S, et al. Strategies to Improve Retention in Randomised Trials: a Cochrane systematic review and meta-analysis. BMJ Open. 2014;4:e003821. http://dx.doi.org/10.1136/bmjopen-2013-003821

• Costa-Font J, Jofre-Bonet M, Yen ST. Not All Incentives Wash Out the Warm Glow:

The Case of Blood Donation Revisited. Kyklos. 2013;66(4):529-551. DOI: 10.1111/kykl.12034

• Farrugia A, Penrod J, Bult JM. Payment, Compensation and Replacement – the Ethics and Motivation of Blood and Plasma Donation. Vox Sanguinis.2010;99:202-211. DOI:10.1111/j.1423-0410.2010.01360.x

• Glynn SA, Williams AE, Nass CC, Bethel J, Kessler D, Scott EP, et al. Attitudes Toward

Blood Donation Incentives in the United States: Implications for Donor Recruitment. Transfusion.2003;43:7-15.

• Mueller E. What is DevOps? Updated December 2016. Accessed July 24, 2017. • Doerr M, Maguire Truong A, Bot BM, Wilbanks J, Suver C, Mangravite LM. Formative

evaluation of participant experience with mobile eConsent in the app-mediated Parkinson mPower study: a mixed methods study. JMIR Mhealth Uhealth 2017;5(2):e14. doi: 10.2196/mhealth.6521. PMID: 28209557

• Doerr M, Suver C, Wilbanks J. Developing a transparent, participant-navigated

electronic informed consent for mobile-mediated research. April 25, 2016. Accessed July 24, 2017.

• Dunn LB, Gordon NE. Improving informed consent and enhancing recruitment for

research by understanding economic behavior. JAMA 2005;293(5):609. doi: 10.1001/jama.293.5.609. PMID: 15687316

• Huang E, Cauley JM, Wagner JK. Barred from better medicine? Reexamining

regulatory barriers to the inclusion of prisoners in research. J Law Biosci 2017;4(1):159–174. doi:10.1093/jlb/lsw064

• Flesch R. A new readability yardstick. J Appl Psychol 1948;32(3):221–233.

doi:10.1037/h0057532. • Mahmood SS, Levy D, Vasan RS, Wang TJ. Framingham Heart Study and the

epidemiology of cardiovascular diseases: a historical perspective. Lancet 2014;383(9921):999–1008.

• Grant RW, Sugarman J. Ethics in human subjects research: do incentives matter? J

Med Philos 2004;29(6):717–738. doi: 10.1080/03605310490883046. PMID: 15590518 • Joosten YA, Israel TL, Williams NA, et al. Community Engagement studios: a

structured approach to obtaining meaningful input from stakeholders to inform

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

103

research. Acad Med 2015;90:1646–1650. doi: 10.1097/ACM.0000000000000794. PMID: 26107879

• National Quality Forum. NQF: Implementing a National Voluntary Consensus Standard

for Informed Consent: A User’s Guide for Healthcare Professionals. Washington, D.C.; 2005.

• Singer E, Couper MP. Do incentives exert undue influence on survey participation?

Experimental evidence. J Empir Res Hum Res Ethics 2008;3(3):49–56. doi: 10.1525/jer.2008.3.3.49. PMID: 19385770

• U.S. Department of Commerce, National Institute of Standards and Technology. Guide

for Applying the Risk Management Framework to Federal Information Systems. February 2010. Accessed July 24, 2017.

• U.S. Census Bureau. Americans moving at historically low rates, Census Bureau

reports. Updated November 16, 2016. Accessed July 24, 2017. • The White House. Precision Medicine Initiative: Privacy and Trust Principles. Updated

November 9, 2015. Accessed July 24, 2017. • The White House. (2015). Precision Medicine Initiative: Data Security Policy Principles

and Framework. Updated May 25, 2016. Accessed July 24, 2017. • Racherla P, Furner C, Babb J. Conceptualizing the implications of mobile app usage

and stickiness: a research agenda. SSRN Electron J 2012.

17 List of Terms and Acronyms Term Meaning

All of Us

AoURP

All of Us Research Program

All of Us Research Program

AURAC

CE Studios

All of Us Resource Access Committee

All of Us Community Engagement Studios

CP community partner

DLMP Department of Laboratory Medicine and Pathology

DRC All of Us Data and Research Center

DV direct volunteer

EC All of Us Executive Committee

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

104

ECO WG Engagement and Communication Working Group

FQHC federally qualified health center

HPO health care provider organization (RMC, FQHC, and/or VA)

MEA All of Us Mobile Engagement Asset

MML Mayo Medical Laboratories

MOP All of Us Manual of Procedures

PMI Precision Medicine Initiative

PM&B Physical Measurement and Biospecimen Collection

PPI participant-provided information

PR participant representative

PTSC All of Us Participant Technology Systems Center

RAC All of Us Resource Access Committee

RMC Regional Medical Center

S4S Sync for Science

SC

TPC

All of Us Steering Committee

The Participant Center

UBR underrepresented in biomedical research

VAMC Veterans Affairs Medical Center

Acronym Definition

AA African American

AI/AN American Indian or Alaska Native

API application programming interface

ATO authority to operate

AWS Amazon Web Services

BRFSS Behavioral Risk Factor Surveillance System

CGM continuous glucose monitoring

CLIA Clinical Laboratory Improvement Amendments

COC certificate of confidentiality

COI conflict of interest

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

105

DAA Designated Approving Authority

DUA data use agreement

EHR electronic health record

EMR electronic medical record (see EHR)

FISMA Federal Information Systems Management Act

HIPAA Health Insurance Portability and Accountability Act

IAM Identity and Access Management

IoT Internet of Things

IRB institutional review board

ISIA Institution-Specific IRB Application

LGBTQ lesbian, gay, bisexual, transgender, queer

MEA mobile engagement asset

NDA non-disclosure agreement

NHANES National Health and Nutrition Examination Survey

NHIS National Health Interview Survey

POLP principle of least privilege

QMS quality management system

SME subject matter expert

SMS short message service

SSP system security plans

ZCTA ZIP code tabulation area

Acronym Organization

AHRQ Agency for Healthcare Research and Quality

BCBSA Blue Cross Blue Shield Association

CAP College of American Pathologists

CDC Centers for Disease Control and Prevention

CITI Collaborative Institutional Training Initiative

CMS Centers for Medicare & Medicaid Services

DHHS Department of Health and Human Services

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

106

EPA Environmental Protection Agency

FDA Food and Drug Administration

HRSA Health Resources and Services Administration

ICs NIH Institutes and Centers

NIH National Institutes of Health

NIST National Institute of Standards and Technology

OCIO NIH Office of the Chief Information Officer

OHRP NIH Office for Human Research Protections

OMOP Observational Medical Outcomes Partnership

OSHA Occupational Safety and Health Administration

STSI Scripps Translational Science Institute

USDA Department of Agriculture

VA Department of Veterans Affairs

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

107

18 List of Appendices

Appendix A Awardees and Participating Centers- Retired Appendix B Enrollment Targets Appendix C Outreach Materials

C1: Outreach Strategy C2: Ad Campaign C3: Website Copy C4: Native App C5: Video Materials C6: Partner Toolkit and Welcome Packet C7: Testimonial Supplement C8: Photos C9: Illustrations

Appendix D Frequently Asked Questions Appendix E eConsent Process Screens

E1: Primary—Updated E2: Primary Consent Video Storyboard E3: HIPAA Authorization/EHR E4: Refresher Loop PM & B E5: eConsent Video Scripts E6: DV Interest in Sharing EHR Survey

Appendix F Informed Consent Form and Supplement F1: Primary Consent Form—Updated F2: HIPAA Authorization/EHR Consent Form F3: California Bill of Rights

Appendix G Participant Provided Information—Survey Modules G1: Overall Health G2: Lifestyle G3: Basics G4: Health Care Access G5: Personal Medical History G6: Family Health History

Appendix H Withdrawal Screens Appendix I Mobile Engagement Asset Appendix J Framework for Retention and Engagement

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

108

J1: Long-Term Engagement Framework J2: Snapshot Surveys—Updated J3: Emails J4: Scripts

Appendix K HealthPro Screens—Updated K1: HealthPro Screens K2: Sample Collection

Appendix L AoURP Knowledgebase- Retired Appendix M Pilot Demographic Appendix N Readability Statistics Fig7.1 Appendix O Digital Health Technologies

O1: DHT Umbrella O2: DHT Education Module

19 Protocol Versions Version Date Significant revisions Pre-v1.0 28 Oct 2016 Overview of vision and approach V1.0 23 Dec 2016 Modular consent process, program activities V1.1 26 Feb 2017 Details about pilot, outreach and enrollment materials, RoR V1.2 09 Mar 2017 Update Figure 10.1 V1.3 07 Apr 2017 Proposed composition and role of the AURAC, reorganization of

the eConsent process, RoR for urgent and emergent findings from Physical Measurements (with HealthPro Screens), updated appendices

V1.4 10 May 2017 Updated first 3 PPIs, details about data handling after withdrawal, responsibility for cost of injury related to participation in AoURP, updated eConsent process and forms

V1.5 19 May 2017 Language revision for clarity, updated appendices V1.5 20 May 2017 IRB Approval V1.6 pre01 08 Dec 2017 Amendment #1- V1.6 pre02 22 Jan 2018 Addressed IRB comments. Added details on the role of

participant representatives and community engagement efforts, clarified the role of the RAB and updated the sample collection tubes.

V1.6 13 Feb 2018 IRB Approval

All of Us Research Program—Protocol v1.11 pre02 IRB Approval Date

109

V1.7 pre01 20 Feb 2018 HPO-supported DV enrollment; un-enroll and withdrawal options; data repositories and dataflow; retention with snap questions.

V1.7 pre02 14 Mar 2018 Maximum blood amounts to collect under expedited review. New participation levels

V1.7 28 Mar 2018 IRB Approval V1.8 pre01 29 Jun 2018 Facilitated Consent, in-patient recruitment V1.8 11 Jul 2018 IRB Approval V1.9 pre01 21 Sep 2018 Updated core values, edited and formatted for 508 compliance,

added clarifying text about max daily blood volume collection, inclusion/exclusion criteria and RAB composition. Updated illustration of LIMS systems.

V1.9 18 Oct 2018 Administrative update V1.10-pre01 6 Dec 2018 Clarify program-wide engagement, enrollment, and retention

strategies; account creation with a mobile phone number; V1.10-pre02 30 Jan 2019 Added student and employee enrollment policy. Clarified DV

ability to collect PM&B at events. Changed phrase “citizen” scientists to “community” scientists. Removed HPO 5% cap on recruitment of non-members.

V1.10-pre03 05 Mar 2019 Corrected editing mistake p22 V1.10 05 Mar 2019 IRB Approval V1.11-pre01 02 July 2019 Updated awardee PIs, added details on roles and duties of the

Steering and Executive Committees, clarified SMS/Email communication and process, included more information on DHT risks and benefits, updated appendices, updated appendix H

V1.11-pre02 31 July 2019 Clarified the withdrawal and stopping participation process in appendix H and section 9, added in more detail about providing DHT wearables, updated SMS language, updated appendices

V1.11 12 Aug 2019 IRB Approval V1.12-pre01 26 Aug 2019 Added details to clarify difference between data access for

operational needs and research activities, changed phrase “researcher portal” to “research hub”

V1.12-pre02 16 Oct 2019 Responded to IRB letter of comment regarding demonstration projects and updated language to reflect more than one Participant Portal host

V1.12 23 Oct 2019 IRB Approval