Clinical genomics, big data, and electronic medical records: reconciling patient rights with research when privacy and science collide

TLDR

EHR‑based research is widely conducted without patient consent, and while biospecimen studies have prompted federal proposals for consent, genomic data in clinical records are still treated as de‑identified, creating a regulatory gap that heightens privacy risks. The authors argue that HIPAA entities must no longer treat dense genomic data as de‑identified and that providers should give patients notice and choice before disclosing such data for research. They analyze how the current permissive regulatory environment allows disclosure of clinical genomic data under data‑use agreements and propose specific actions for providers to reconcile patient rights with genomic research.

Abstract

Widespread use of medical records for research, without consent, attracts little scrutiny compared to biospecimen research, where concerns about genomic privacy prompted recent federal proposals to mandate consent. This paper explores an important consequence of the proliferation of electronic health records (EHRs) in this permissive atmosphere: with the advent of clinical gene sequencing, EHR-based secondary research poses genetic privacy risks akin to those of biospecimen research, yet regulators still permit researchers to call gene sequence data 'de-identified', removing such data from the protection of the federal Privacy Rule and federal human subjects regulations. Medical centers and other providers seeking to offer genomic 'personalized medicine' now confront the problem of governing the secondary use of clinical genomic data as privacy risks elevate. We argue that regulators should no longer permit HIPAA-covered entities to treat dense genomic data as de-identified health information. Even with this step, the Privacy Rule would still permit disclosure of clinical genomic data for research, without consent, under a data use agreement, so we also urge that providers give patients specific notice before disclosing clinical genomic data for research, permitting (where possible) some degree of choice and control. To aid providers who offer clinical gene sequencing, we suggest both general approaches and specific actions to reconcile patients' rights and interests with genomic research.