Consent Fatigue in a Research Data Repository
A university health system operates a research data repository holding records for 1.2 million patients. The original consent form, signed between 2014 and 2017, authorized 'research use by university investigators.' In 2025 the university wants to share de-identified extracts with three external pharma partners and to train a foundation model on the records. The IRB says the original consent does not cover commercial sharing or model training. Re-consenting 1.2 million people is projected to cost $4.1M and reach only about 30% of patients, skewing toward younger, English-speaking, and urban populations. The research team proposes to proceed under a broad 'de-identified data' exemption and to post a website notice. A patient advocacy group has already raised concerns about the foundation model.
1. Assess whether de-identification resolves the ethical obligation to these patients.
Read the worked answer
De-identification is a legal and technical control, not an ethical release from the promise made. The patients consented to a specific scope - university investigators - and the new uses (commercial partners, model training) fall outside it. Three points matter:
- Consent was scoped, and scope matters. Even where a de-identification exemption is legally available, relying on it to expand use beyond what people agreed to is a breach of the relational obligation. The 2014–2017 signers reasonably read 'university investigators' as excluding pharma partners.
- De-identification is weaker than it sounds. Health records with dates, rare diagnoses, and geography are re-identifiable. A foundation model trained on the records can memorize and regurgitate rare strings. De-identification at the extract level does not automatically de-risk the model.
- The skew cuts both ways. Re-consent reaching only 30% produces a biased sample, but proceeding without consent produces a silent opt-out for the 70% who never see the notice. The website notice is not consent; it is disclosure.
The honest position: de-identification may satisfy the letter of a privacy rule, but the ethical question is whether it honors the reasonable expectations of the people whose data built the repository. It does not, on its own.
2. Propose a governance path that balances feasibility with respect for the original consent, and name the tradeoffs.
Read the worked answer
A defensible path has four parts:
- Tier the uses by distance from the original consent. Internal university research stays under existing consent. External commercial sharing and foundation-model training require a new, affirmative authorization.
- Use an opt-out with real reach for the lower-risk tier, and opt-in for the higher-risk tier. For commercial sharing, a mailed and portal-based opt-out with a 60-day window, multilingual materials, and phone assistance is proportionate. For model training, require affirmative opt-in, given the advocacy concern and the memorization risk.
- Correct for the skew explicitly. Weight or oversample underrepresented groups in outreach, and report the demographic composition of the consenting cohort alongside any model results. If the opt-in cohort is 70% urban and English-speaking, that limitation must travel with the dataset.
- Publish a model card and a data-use agreement that forbids re-identification, restricts onward sharing, and requires partners to report downstream harms.
Tradeoffs to state plainly: the opt-in tier will be smaller and slower, and the foundation model may be less generalizable. That is a cost of honoring consent, not a reason to skip it. The $4.1M re-consent estimate is a real constraint; tiering lets the university spend it where the ethical distance is greatest.