Co-authored by: Cory Fox
Recently, the Presidential Commission for the Study of Bioethical Issues (“the Commission”) submitted a report to the President entitled Privacy and Progress in Whole Genome Sequencing (“Report“). The Report attempts to reconcile the potential societal benefit from advances in whole genome sequencing with the privacy risks individuals who share their genomic data may face by making recommendations to the President as to how best to ensure the privacy of sensitive genomic information without stifling medical advances.
Whole genome sequencing is a technique used to determine the complete sequence of DNA in an individual’s cells. While each individual’s genome is unique, variations in certain human genes have been linked to disease. Whole genome sequencing allows researchers to better understand these links by aggregating and comparing large amounts of genetic data from numerous individuals in order to identify the specific genetic variations that lead to disease. By combining the information obtained from whole genome sequencing with other clinical information, researchers are better able to design new treatments for diseases like cancer, heart disease, and diabetes. In addition, whole genome sequencing allows researchers to better identify an individual’s risk of developing certain diseases, and may eventually permit researchers to specifically tailor a treatment based on an individual’s genetic make-up.
While multiple laws and regulations, such as the Health Insurance Portability and Accountability Act (“HIPAA”), the Common Rule, the Genetic Information Nondiscrimination Act (“GINA”), and some state genetic privacy laws are potentially applicable to the privacy of genomic information, the Report recognizes that the protections afforded by these provisions in their current forms are inadequate. HIPAA applies to covered entities maintaining the privacy and confidentiality of protected health information; however, it is unclear whether de-identified whole genome sequences are protected health information, and there is an emerging technological threat that even de-identified whole genome sequences can be “re-identified”. The Common Rule requires, among other things, that federally funded research on human subjects undergo independent review by an institutional review board (“IRB”) and that sufficient procedures minimizing patient risk, including privacy risks, and ensuring informed consent be implemented. The Common Rule has similar limitations as HIPAA regarding de-identified genome sequences. GINA prohibits discrimination on the basis of genetic information in the health insurance market and in employment decisions such as hiring, firing, job assignments, and promotions, but does not address unauthorized disclosure of or access to genomic information. Similarly, under half of the states have adopted genetic privacy laws that expand upon federal protections, but most do not address unauthorized disclosure of or access to genomic information, and the significant variation between states creates uneven and unpredictable privacy assurances.
To address the shortcomings of the existing laws and regulations applicable to the privacy of genomic data, the Report includes the following policy recommendations to the President:
- Create strong baseline protections while promoting appropriate data access and sharing.
- Ensure the security of sequencing data and control access to sequencing databases.
- Maintain consent as a cornerstone of sequencing data privacy.
- Facilitate progress in whole genome sequencing.
- Ensure continued public benefit by sharing genomic advances as broadly as possible.
The privacy issues surrounding whole genome sequencing are sure to generate significant legal and regulatory changes that could impact all institutions conducting research involving human subjects.
