Each person's DNA sequence includes health and other information about them and their families. Technological advances mean that it is now cheaper and easier than ever to sequence and interpret genomic information. Whether genomic information is being used for research, clinical or other uses, it is important to consider how best to ensure that individuals' privacy is respected. There are laws and policies that serve to protect the privacy of individuals' genomic information, and there is ongoing debate as to whether further measures are needed.
When conducting genomics research, two essential values of science research need to be balanced - the need to share data broadly to maximize its utility for ongoing scientific exploration, and the need to protect research participants' privacy. Achieving the right balance is particularly challenging for genomic data since each person's DNA sequence is unique (with the exception of identical twins) and a DNA sample therefore can never be made truly anonymized.
To advance genomics research, NIH houses a number of databases through which researchers can share de-identified genomic data. Given the need to consider participant privacy, it is important to minimize the possibility that any research participants are identified. Indeed, a study published in 2013 demonstrated that it is possible to re-identify research participants using genomic data from one such database alongside genealogical databases and public records. NIH therefore controls access to sensitive or potentially identifiable information held in these databases to ensure that the privacy of the research participants is respected. (See Genomic Data Sharing Policy below.) In addition, NIH issues Certificates of Confidentiality to enable NIH-funded researchers to limit access to research participant information held at grantee institutions.
People have a right to keep their medical information, and that of their dependents, private. Yet medical records are a rich source of research data, and it is in the interest of medical research, and thus everyone's health and well-being, that scientists have access to large numbers of participants and quantities of data. How do we strike the proper balance between scientific progress and patient privacy? Federal laws, like the Common Rule and the Health Insurance Portability and Accountability Act (HIPAA) aim to strike that delicate balance.
Specimens collected in medical settings, like blood and tissue taken during biopsies, can serve as excellent sources of samples for genetics research. For example, using the de-identified blood spots taken as part of the newborn screening public health program, scientists can extract DNA to conduct epidemiological, population-based, or other studies on topics as wide ranging as infectious disease to birth defects.
In recent years, parents have raised concerns about researchers analyzing their children's genomic information without the parents' consent. Lawsuits in recent years resulted in the destruction of five million stored blood spots in Texas and in the establishment of new requirements in Minnesota for the retention of blood spots after newborn screening. Most recently, in 2014 Congress passed a law requiring consent for the research use of blood spots from newborn screening (see below).
Ethnically, geographically, and linguistically identifiable populations present particular concerns with regard to privacy, stigmatization, and discrimination, since the ability to protect the privacy of these individuals or groups participating in the research is diminished. For example, members of an identifiable population may be stigmatized or discriminated against if research reveals that the group is at high risk of having a genetic variant associated with a particular disease. For some communities, close family relationships also may make it especially challenging to protect participants' privacy, even if research samples are de-identified.
Because of remarkable advancements in genomics research in recent years, the use of genomic testing has gone from rare to routine in many clinical settings. Yet while there are clear clinical benefits to the patient, this introduces new risks to patient privacy, and patients are potentially vulnerable to the misuse of their genetic information. To address this, in 2008 Congress passed the Genetic Information Nondiscrimination Act to restrict the access of issuers of health insurance and employers to individuals' genetic information, as well as to prohibit genetic discrimination. Concerns remain as to the use of genomic information to discriminate against applicants for life long-term care and disability insurance. In addition to GINA, HIPAA protects patient privacy by restricting the sharing of patients' medical information.
Genomic information is used by law enforcement to investigate criminal acts, and is also employed within the legal system to exonerate those who have been falsely convicted of crimes. CODIS, the "Combined DNA Index System," is the Federal Bureau of Investigation's (FBI's) program of support for criminal justice DNA databases and the software used to run these databases. CODIS is used by law enforcement to compare DNA samples from crime scenes with the DNA of convicted criminals and arrestees, or with DNA detected at other crime scenes, in order to identify and convict perpetrators of crime. CODIS is used to search the National DNA Index system (NDIS), a database populated by DNA profiles submitted by federal, state and local forensic laboratories to the FBI.
The creation of DNA databases such as NDIS has spurred much controversy. There is debate about who should be included in DNA databases, what information should be stored, under what circumstances the information should be expunged, and whether DNA samples should be stored or destroyed. Proponents of DNA databases contend that their expansive use by law enforcement helps solve many serious crimes that otherwise go unprosecuted. Opponents claim that some of the law enforcement practices involved violate people's protections under the fourth amendment of the Bill of Rights against unreasonable search and seizure without probable cause, and that the DNA samples collected could be used for other more harmful purposes.
Most recently, in 2013 in Maryland v. King the U.S. Supreme Court ruled in a 5-4 decision that law enforcement may collect DNA samples from suspects who have been arrested for a crime. The majority determined that the collection of DNA in such circumstances is similar to fingerprinting or photographing. Dissenting justices were troubled by the consequences of the decision for privacy, with Justice Scalia stating, "Make no mistake about it...your DNA can be taken and entered into a national database if you are ever arrested, rightly or wrongly, and for whatever reason."
Surreptitious DNA testing - testing without the knowledge of the person being tested - is another potential threat to the privacy of people's genomic information. Some companies offering DNA testing allow consumers to obtain genetic analyses of various biological samples without requiring the consent of the individual or individuals being tested. DNA samples may come from objects ranging from blood stains to a licked envelope. A variety of tests can be done using these DNA samples, including health-related testing and parentage determination. These tests can reveal sensitive or embarrassing personal information, which could be of significant concern for individuals in the public spotlight.
There is no federal law prohibiting surreptitious testing. Currently about half of the states in the U.S. have laws or regulations governing genomic privacy and illegitimate uses of genomic data. However, there is great variation in these laws. While some states prohibit the unauthorized acquisition or analysis of genetic information, others prohibit only unauthorized disclosure. Whether genetic testing can be performed without the consent of the donor may depend on who conducts the test, what the test attempts to determine, how the results will be used, and in what state the testing takes place. The states also differ regarding the enforcement of these laws.
Published in 1991, The Federal Policy for the Protection of Human Subjects-also known as the "Common Rule"- establishes the baseline standard of ethics for government-funded research in the United States. The Common Rule requires all federally funded research projects to obtain informed consent from each participant prior to their participation. Participants must be informed of all the potential risks of the particular study, including risks associated with release of their private information. Informed consents for genomic research should clarify the uses of research results, including with whom the information will be shared. It has been shown that, when given control over when and with whom their research data is shared, most individuals are eager to participate in research studies, fueling scientific discovery and medical progress. For further information about informed consent in genomics and guidance for researchers or IRB members, please see the Informed Consent for Genomics Research Resource.
The Genetic Information and Nondiscrimination Act of 2008 (GINA) protects the genetic privacy of the public, including research participants. The passage of GINA makes it illegal for health insurers or employers from requesting or requiring genetic information of an individual or of family members (and further prohibits the discriminatory use of such information). More information on GINA is available here.
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes protections to maintain the confidentiality of patients' individually identifiable health information. Such information held by entities covered by HIPAA, such as a health care provider or insurance company, is defined as Protected Health Information (PHI) and there are limits on when and with whom PHI may be shared. In 2013, as required by the passage of the Genetic Information Nondiscrimination Act, the Privacy Rule was modified to establish that genetic information is health information protected by the Privacy Rule to the extent that such information is individually identifiable, and that HIPAA covered entities may not use or disclose protected health information that is genetic information for underwriting purposes. There are no such restrictions on the use or disclosure of PHI that has been de-identified.
Certificates of Confidentiality, issued by NIH, can be used to safeguard the privacy of research participants. These certificates protect investigators and institutions from being compelled to disclose identifying information in any civil, criminal, or other proceeding at federal, state, and local levels. For instance, Certificates of Confidentiality can be used when handling sensitive information that could negatively impact research participants or damage their employability, insurability, reputation, or financial standing. These Certificates aim to promote research participation by assuring participants of their privacy. Individual investigators are encouraged to apply for a Certificate of Confidentiality for their research studies, but are not required to do so. If a researcher is in possession of a Certificate, the release of research information is at the discretion of the investigator and their institution.
Enacted in 1966, the Freedom of Information Act (FOIA) was the first U.S. law to explicitly give citizens the right to access Federal documents upon request. Information falling under one of nine classes of material, or one of three types of law enforcement documentation, is immune to FOIA requests. For types of information not clearly exempt, the passage of additional laws can establish FOIA immunity.
Currently, FOIA does not contain a specific exemption for the genomic information of research participants housed in federal databases. This lack of clarity raises the question as to whether FOIA could be used to access individual level research participant information in controlled information databases. Exemption six of FOIA allows the government to deny requests for information that, "... constitute a clearly unwarranted invasion of personal privacy," and NIH's interpretation is that the release of genomic information datasets in response to a FOIA request would be an unreasonable invasion of personal privacy. However, this interpretation has yet to be tested in the courts. NHGRI is exploring the potential impact of a clear legal exemption of genomic information under FOIA that would not depend on the court's interpretation of genomic information as warranting privacy.
The Newborn Screening Saves Lives Reauthorization Act supports newborn screening programs across the United States and authorizes the Secretary's Advisory Committee on Heritable Disorders in Newborns and Children. The reauthorization law was signed in 2014 and, in addition to continuing existing programs, also requires parental consent for the use of newborn blood spot samples in research. This new consent requirement applies to the research use of blood spots collected after March 18, 2015.
The NIH Genomic Data Sharing Policy sets guidelines on how to protect research participant privacy while still enabling the scientific community access to valuable research data. A key component of the policy is that access to sensitive, individual-level research data held in federal databases is only available to researchers submitting a request. NIH maintains several databases containing such genomic information, such as the database of genotypes and phenotypes (dbGaP), the National Database for Autism Research (NDAR), and The Cancer Genome Atlas (TCGA). To access sensitive data from one of these databases, scientists must request permission for specific uses from Data Access Committees at the NIH or the database's curating body. It is important to note that not all information in these databases is held under 'controlled access,' and that some data is readily accessible.
Posted: April 21, 2015
