MYRIAD AFTER MYRIAD: THE PROPRIETARY DATA DILEMMA

Abstract

Myriad Genetics’ long-time monopoly on BRCA gene testing was significantly narrowed by the Supreme Court’s decision in AMP v. Myriad Genetics, Inc., and will be further narrowed in the next few years as many of its still-valid patents expire. But these developments have not caused the company to acquiesce in competition. Instead, it has launched a litigation offensive against a number of actual and potential competitors, suing them for infringement of numerous unexpired patents that survived the Supreme Court case.

A parallel strategy may have even greater long-term significance, however. In announcing expanded operations in Europe, Myriad has emphasized that it will rely less on patents and more on its huge proprietary database of genetic mutations and associated health outcomes—a strategy that could be used in the United States as well. Myriad has built that database over its many years as a patent-based monopolist in the BRCA testing field, and has not shared it with the medical community for more than a decade. Consequently, Myriad has a unique ability to interpret the health significance of patients’ genetic mutations, particularly in the case of rare “variants of unknown significance.”

This article reviews the current state of Myriad’s patent portfolio, describes its ongoing litigation offensive, and then analyzes its proprietary database strategy. The article argues that Myriad’s strategy, while legally feasible, undercuts important values and objectives in medical research and health policy. The article identifies several ways in which the research and health care communities might fight back, but acknowledges that it will be a difficult uphill fight.

I. Introduction

In the summer of 2013, the Supreme Court’s decision in Association for Molecular Pathology v. Myriad Genetics¹ took a significant bite out of Myriad Genetics’ patent portfolio. Now, almost a year later, the inexorable process of patent expiration is poised to take an even bigger bite. The invalidation of surviving patents in ongoing litigation—most of it started by Myriad—poses yet another threat.

But Myriad is not waving a white flag. On the contrary, the company is on the offensive. In the United States, it has sued almost every competitor that has sprung up in response to the Supreme Court’s decision invalidating its genomic DNA patents. In Europe, where its patents have been more limited in scope, Myriad has opened a major new testing laboratory with more investment promised. Investor response has been steady: while Myriad’s stock fell with the rest of the market after the 2008 financial crisis, it was not significantly affected by the Supreme Court’s decision and, as of April 7, 2014, is trading at a post-crash high.²

What lies behind Myriad’s confidence and the apparent support of its stockholders? Part of the answer may be a genuine belief in the strength and economic significance of its surviving patents as well as in the superiority of its testing services. A more likely answer, however, is that Myriad has an ace up its sleeve. During its years of patent-based monopoly in the market for testing the BRCA 1 and 2 genes, which are associated with susceptibility to breast and ovarian cancer, Myriad has built up an immense proprietary database.³ Myriad’s unparalleled array of data correlating gene mutations with health outcomes, family histories, and other phenotypic factors gives it a unique ability to interpret BRCA gene test results, especially those that yield ambiguous findings, or variants of unknown significance (“VUS”). This advantage will long outlive the expiration and invalidation of Myriad’s remaining patents.

Myriad’s proprietary database gives it a key competitive advantage in breast and ovarian cancer risk prediction. As personalized medicine continues to grow and the market for personal health risk prediction expands, more companies will create proprietary databases containing information about genes and other biomarkers. Whether clinical data should be protected as trade secrets, despite the fact that access to this information can have important health consequences for individual patients, is a profound ethical and legal dilemma.

The purpose of this Article is to explore the legal, business, scientific, and policy ramifications of Myriad’s database. Part II reviews the state of Myriad’s patent portfolio after the Supreme Court’s decision, while Part III describes Myriad’s post-Myriad patent litigation offensive. Part IV presents a detailed analysis of Myriad’s apparent plan to maintain its database as a proprietary asset, including a consideration of the relevant trade secret law. Part V describes several ongoing third-party efforts to replicate Myriad’s database and assesses their prospects for success. Part VI concludes by addressing the ultimate policy questions of whether Myriad should and could be compelled to share its data.

II. The State of Myriad’s Patent Portfolio

On June 13, 2013, the Supreme Court decided Association for Molecular Pathology v. Myriad Genetics, Inc. (“Myriad”).⁴ Partially reversing the Federal Circuit,⁵ it held unanimously that genomic DNA (“gDNA”) merely isolated from the human body is not patent-eligible (or “statutory”) subject matter under section 101 of the Patent Act,⁶ but complementary DNA (“cDNA”), which is synthesized in a lab and lacks the non-coding regions present in naturally-occurring gDNA, is.⁷ The Court did not review the portions of the Federal Circuit’s ruling that dealt with the statutory subject matter status of Myriad’s method claims. The lower court had invalidated claims to methods for “comparing” a patient’s DNA at the BRCA gene to a normal, or wild-type sequence, while upholding a claim to a method of assessing the efficacy of a drug by growing a cell with a cancer-predisposing mutation in the presence and absence of the drug.⁸

Together, the Federal Circuit and Supreme Court invalidated only ten product and method claims out of Myriad’s vast patent portfolio. The company’s post-decision press release stressed that it still has “more than 500 valid and enforceable claims in 24 different patents conferring strong patent protection for its BRACAnalysis test.”⁹ Claims to cDNA, primers, and various testing and diagnostic methods were unaffected.¹⁰ On the other side, however, even the cDNA claims that the Supreme Court expressly approved and the method claim upheld by the Federal Circuit¹¹ have survived only the preliminary test of patentable subject matter. Those claims (and all others in Myriad’s portfolio) remain subject to challenge—indeed, credible challenge¹²—on grounds of novelty (section 102),¹³ obviousness (section 103),¹⁴ and failure to satisfy section 112’s written description requirement.¹⁵ Moreover, the invalidated gDNA claims were Myriad’s broadest and most powerful: they prevented anyone—would-be competitors, researchers, or clinicians—from using isolated genomic versions of the BRCA genes for any purpose without Myriad’s permission. Those that survive are narrower and therefore, by definition, easier to work around. Finally, Myriad’s surviving patents begin to expire this year, and most will expire in the next few years.¹⁶ In sum, while it is true that from a claim-counting perspective most of Myriad’s portfolio is intact, that portfolio is vulnerable, has been significantly narrowed in scope, and has a limited life expectancy.

III. Myriad’s Post-Myriad Offensive

A. The Post-Myriad Lawsuits

Beginning in the summer of 2013, Myriad filed patent infringement suits against a number of gene-testing competitors, including Ambry,¹⁷ Gene-by-Gene,¹⁸ Quest,¹⁹ Invitae,²⁰ Labcorp,²¹ and GeneDx.²² All the cases have been filed in federal court in Salt Lake City, Utah, where Myriad is based, and the complaints are essentially the same, with some custom tailoring to the businesses of the individual defendants. The first two, against the relatively small companies Ambry and Gene-by-Gene, were immediately consolidated; the Quest and GeneDx cases have recently been consolidated with the original two.²³ The Gene-by-Gene case was settled in February 2014 on terms that have been characterized as an unconditional surrender by the defendant.²⁴ Gene-by-Gene reportedly agreed to cease “selling or marketing” BRCA gene tests, either on a stand-alone basis or as part of a broader panel, although it did retain the right to offer whole genome or whole exome testing, as well as certain “custom” products.²⁵

In addition, Counsyl,²⁶ which Myriad had not sued because it has not started offering genetic tests, Quest,²⁷ and Invitae²⁸ all filed declaratory judgment actions in their respective home federal courts in California. The Quest and Counsyl actions have been consolidated with the other Myriad cases pending in Utah.²⁹ The three companies seek judgments (1) invalidating patents with which Myriad has or is likely to threaten them and (2) declaring that they are not infringing any Myriad patents that survive the validity challenge. Declaratory judgments are a common tactic in intellectual property disputes.³⁰ A company that thinks it may be sued for infringement—a prospective defendant, in other words—jumps the gun and asks a court to rule in advance on the defenses it would raise if it were sued for an infringement. By filing the declaratory judgment action, the prospective defendant, now a plaintiff, normally gets to choose both the time and the court that will rule on these issues. These objectives have been frustrated by the recent consolidation order in these cases, however, since the critical pretrial issues will now be decided in the court that Myriad chose.³¹

The suits against Ambry and Gene-by-Gene have progressed the farthest, while the other cases are earlier in the pleading stage. Myriad’s complaints sought preliminary injunctions against Ambry and Gene-by-Gene,³² and the defendants responded with antitrust counterclaims alleging complex theories of actual and attempted monopolization.³³ Myriad’s motions for preliminary injunctions were extensively briefed and argued in the fall of 2013, and the surviving motion against Ambry was denied on March 10, 2014, as discussed below in more detail.³⁴

Because the various infringement cases have a great deal in common, it is instructive to take a closer look at those that have progressed the farthest: Ambry and Gene-by-Gene (bearing in mind that the latter has been settled). The defendants are two small gene-testing companies that announced that they would offer BRCA 1 and 2 tests almost immediately after the Supreme Court’s decision.³⁵ Myriad has not, of course, sued on the gDNA claims that the Supreme Court invalidated, nor on the method claims that were rejected by the Federal Circuit in the part of the case that the Supreme Court did not review.³⁶ Instead, Myriad alleges that the defendants’ tests will infringe a number of other claims in ten different patents that cover, among other things, cDNA (in stretches as short as fifteen nucleotides), primers, and methods for screening mutations and evaluating or diagnosing patients.³⁷ They are clearly everything-but-the-kitchen-sink complaints. Nonetheless, many of the allegations seem plausible in the limited sense that the claims asserted appear to cover (or “read on,” in patent jargon) what the defendants are probably doing or planning to do.

Ambry responded to Myriad’s complaint not only by raising the expected defenses of invalidity and non-infringement, but by asserting a counterclaim under the Sherman Antitrust Act,³⁸ charging Myriad with both attempted and actual monopolization of the BRCA testing market.³⁹ Ambry alleges that Myriad has gained and maintained its market position through “exclusionary and anticompetitive conduct”⁴⁰ that includes “bad faith enforcement of its facially invalid patents.”⁴¹ Myriad then filed a motion to dismiss the antitrust counterclaims.⁴² Myriad argues that Ambry must show that Myriad’s patent infringement claims have been “objectively baseless,” and that Ambry cannot possibly carry that burden.⁴³

In September and early October of 2013, the district court held three days of hearings on Myriad’s motion for a preliminary injunction (“PI”) ordering Ambry and Gene-By-Gene to cease BRCA testing.⁴⁴ As Judge Shelby recounted in his PI opinion, a plaintiff bears a heavy burden in supporting a motion for a PI.⁴⁵ That burden has four elements: (1) That the plaintiff is likely to succeed at on the merits; (2) that the plaintiff will suffer irreparable harm if it does not get the PI; (3) that the balancing of the equities favors the plaintiff; and (4) that the public interest favors the grant of the PI.⁴⁶ Myriad persuaded Judge Shelby on issue (2) but failed on issues (1) and (3), with issue (4) unclear. As a result, the PI was denied.⁴⁷

The major legal issue was Ambry’s anticipated defense that the patent claims Myriad is suing on are invalid. Ambry raised a range of invalidity arguments: that Myriad’s patents do not recite patentable subject matter (section 101), that they lack novelty (102), that they are obvious (103), and that they fail to satisfy the written description requirement (112).⁴⁸ The court based its decision solely on section 101, finding the other arguments redundant.⁴⁹ Specifically, it found that Myriad failed to show probability of success on the merits because Ambry had raised a “substantial question” about the validity of the relevant Myriad patent claims.⁵⁰

Judge Shelby grouped the Myriad claims into two categories: “Primer Claims,” which are product claims relating to single-stranded DNA primers used in the polymerase chain reaction (PCR) replication of BRCA 1 and 2 genes, and “Method Claims” that cover screening BRCA genes for mutations by comparing the sequences of patient samples with wild-type, or normal, sequences.⁵¹ The judge found that the Primer Claims might not comprise patentable subject matter because they fell within Myriad’s rejection of claims on merely isolated DNA, even though the primers in question are composed of cDNA, not gDNA.⁵² This finding may be controversial on appeal, as the conventional wisdom has been that the Supreme Court had barred patents only on isolated gDNA.⁵³ But Judge Shelby focused on two sentences in the Myriad opinion in which the Supreme Court said: “cDNA is not a ‘product of nature’ and is patent-eligible under § 101, except insofar as very short series of DNA may have no intervening introns to remove when creating cDNA. In that situation, a short strand of cDNA may be indistinguishable from natural DNA.”⁵⁴ Judge Shelby thought that the Myriad primers were just such “short series of DNA,” and hence likely to be patent-ineligible.

With respect to the Method Claims, Judge Shelby found them indistinguishable from the claims rejected in the Supreme Court’s Mayo v. Prometheus⁵⁵ decision and the Federal Circuit’s method claims rulings in AMP, which were not reviewed by the Supreme Court. Specifically, the judge held that “[a]side from the patent ineligible, naturally occurring nucleotide sequence of the BRCA1 and BRCA2 genes, the other steps set forth in the Method Claims are conventional activities that were well-understood and uniformly employed by those working with DNA.”⁵⁶ That is, just as the Mayo claims added only conventional medical activity to a law of nature,⁵⁷ the Method Claims add only conventional interpretive activity to a product of nature. Thus, there was no patentable subject matter in either case. Myriad has already appealed the PI denial to the Federal Circuit.⁵⁸

Because the denial of Myriad’s PI request is by definition preliminary, it is difficult to prognosticate about the outcome of this case, let alone to extrapolate to Myriad’s other lawsuits. Nonetheless, there are three further issues worth noting, albeit in a speculative way.

First, Myriad has repeatedly emphasized in its filings against Ambry and its public statements that the previous Federal Circuit and Supreme Court litigation invalidated only 10 of the 520 claims in its multi-patent portfolio.⁵⁹ But now most of the rest of the claims are squarely at issue, which means that the stakes for Myriad in these cases are extremely high.

Second, Judge Shelby’s PI ruling relied only on the threshold issue of patentable subject matter, not addressing the question of whether the challenged claims satisfy the other requirements for patentability, including novelty and nonobviousness. He will have to do so in the future, however, as Ambry has thrown the legal kitchen sink at Myriad’s patents, raising all potential objections to validity.⁶⁰ The novelty and obviousness challenges have serious potential, and they should be watched carefully. There has long been controversy over whether Myriad actually discovered the BRCA genes, with competitors in both the U.S. and the U.K.⁶¹ With respect to obviousness, many in the scientific community have claimed that Myriad did nothing more than apply widely known techniques to a thoroughly studied problem.⁶²

Finally, what might one read into Gene-by-Gene’s capitulation? The surrender might reflect respect for the strength of Myriad’s position or be driven by the financial realities of a small company waging a patent war against an adversary as rich and aggressive as Myriad—or perhaps both. Outsiders simply cannot know.

B. Tactical Considerations

Another set of questions is tactical. First, why did the companies that Myriad has sued choose to jump into the BRCA testing market right after the Supreme Court decision? The question is especially compelling in the instances of Ambry and Gene-by-Gene, which are far smaller than Myriad. The various defendants had to be aware that Myriad has other patents that would likely read on their respective testing activities. Given that, there seem to be three hypotheses to explain their behavior: (1) they did not believe that Myriad would sue them, given the significant risks and disincentives it faced;⁶³ (2) they thought that if they showed some willingness to fight, Myriad would back down and settle (that is, license its patents) on acceptable terms; or (3) they thought that Myriad’s patents were vulnerable and were prepared to spend a lot of money to invalidate them. Hypothesis (1) has been disproved by events, as Myriad did choose to file suit. Hypotheses (2) and (3) are related: defendants in any kind of litigation, especially smaller defendants, usually get good settlements only after they make a convincing showing that they will fight and might win—and they rarely can get to that point without spending significant money in the litigation. Here, the defendants apparently thought that the war chests they had accumulated were sufficient to get them to that point.

That leads to a related question: why did Myriad sue Ambry and Gene by Gene, and then the other companies? An obvious answer is to tell the market—loudly—that it is not ready to concede its patent-based monopoly on BRCA testing. The first two defendants, Ambry and Gene-by-Gene, who made splashy entries moments after the Supreme Court ruled and might be vulnerable to a war of attrition, presented themselves as inviting targets. It was reasonable for Myriad to predict that they might not present aggressive defenses or might settle quickly on terms favorable to Myriad. The first of these predictions has been proven wrong in the Ambry case—Ambry has asserted massive counterclaims and has fended off Myriad’s PI motion. The second has been borne out with respect to Gene-by-Gene—it began by joining in Ambry’s counterclaims but has subsequently settled without any apparent concessions from Myriad.

A related issue is the downside risks that Myriad might have foreseen. One possible risk is the public relations damage these lawsuits continue to cause, with Myriad portrayed as a predatory monopolist unconcerned about patients.⁶⁴ But all this was being said before and immediately after the Supreme Court case,⁶⁵ so Myriad probably concluded that the further damage to its image would be marginal at worst. Moreover, there is no evidence that bad publicity has hurt the company financially.⁶⁶

The real danger Myriad should have foreseen is that, as noted above, many of these patent claims are vulnerable, and might be invalidated if any of these cases proceeds to its conclusion.⁶⁷ Most claims would probably survive patentable subject matter scrutiny, although—as the Ambry PI order indicates—some might not, including the short cDNA sequences and some of the method claims.⁶⁸ But even those that survive the subject matter test would still have to satisfy the more demanding novelty, nonobviousness, and written description standards, and many of them might not.

Myriad probably thought that it had no choice but to sue. Myriad had already seen that competitors were acting as if they now could ignore its patents. Its confident, if not bellicose, post-Supreme Court statements⁶⁹ had accomplished nothing. The only escalation available was infringement litigation. Faced with a choice between putting its patents at risk by suing and having them ignored, it may have seemed an easy call: use ‘em or lose ‘em.

IV. Myriad’s Proprietary Data Plan

To the accompaniment of much promotional fanfare, Myriad opened a large new German testing lab in early 2012.⁷⁰ Speaking publicly (almost always a carefully orchestrated performance in a publicly traded company), its executives emphasized that this was just the beginning of a major European expansion.⁷¹ In response to questions about its patents, which had previously been upheld but considerably narrowed in Europe,⁷² Myriad had indicated that it would rely on “other competitive advantages”—not patents—and especially its ability to offer patients unparalleled speed and accuracy.⁷³ This claim was surely based on its vast and unique interpretive database, derived from a patent-based U.S. testing monopoly going back to the late 1990s and involving more than one million patients.⁷⁴ While the claims of competitive advantages related specifically to Europe, it is reasonable to assume that Myriad will pursue a similar strategy in the U.S. when it has finally lost its patent portfolio to expiration⁷⁵ and further invalidation.

A. The Variants of Unknown Significance Dilemma

Recent advances in genetic sequencing technologies are generating vast amounts of genomic data that have the potential to improve human health. However, genomic information is of little worth to improving the health of individual patients if the medical community cannot interpret this information. The clinical and genomic data generated by large numbers of other patients is one factor that allows doctors to assess the potential health risks facing individual patients.⁷⁶ Testing companies that collect genomic information from numerous patients are able to determine the clinical significance of genomic variants that may be unknown to others.⁷⁷ If a company retains such information as proprietary data, a patient who needs to know the clinical significance of a particular genomic variant may have no choice but to use the services of that company.⁷⁸ But patients, especially the still-uninsured, may not have access to these companies or the resources to afford their services.⁷⁹

These realities lie at the core of Myriad’s apparent business plan as it expands its BRCA testing efforts in Europe. Most patients who get BRCA testing have results that can be interpreted in a relatively straightforward manner—either no variations from the normal or “wild type” harmless sequence variations or a clearly deleterious mutation.⁸⁰ In a significant minority of tests, however, mutations are difficult to interpret.⁸¹ These are VUSs. Myriad has claimed that the fraction of cases resulting in a VUS is 3% in its hands, versus 20% for its European competitors,⁸² although some experts think the 20% claim is far too high.⁸³ This discrepancy is due at least in part to Myriad’s vast proprietary database, which allows it to interpret ambiguous results that others must relegate to the VUS category.⁸⁴

Myriad has used its patent-based monopoly as the sole BRCA 1 and 2 test provider to develop, at its own cost, an extensive database that relates VUSs to phenotypes, details the frequency of VUS in various populations, and includes genetic studies on patient families.⁸⁵ There is no comparable public database.⁸⁶ To its credit and the benefit of patients, Myriad has used its database to reduce the frequency with which it reports a VUS.⁸⁷ When Myriad finds a new VUS—or one previously identified but whose clinical significance is not yet understood—it offers free testing to the patient’s family members in an effort to help determine the variant’s significance.⁸⁸ Myriad encourages the person with the VUS to contact others in their family, providing a model letter that patients can send their relatives.⁸⁹ Myriad collects data regarding the clinical outcome associated with that VUS, and a VUS may ultimately be reclassified as deleterious or neutral as more is learned; conversely, deleterious or neutral mutations are occasionally reclassified as VUSs.⁹⁰

Myriad essentially stopped contributing to public databases in late 2004.⁹¹ Myriad scientists have published some papers since then, but these typically describe Myriad’s approach to “calling” VUSs without listing gene sequences or detailing the company’s interpretive algorithms.⁹² Myriad’s proprietary approach led to a “reprimand” by the policy committee of the European Society of Human Genetics in late 2012.⁹³

Note that data access is asymmetrical: Myriad has access to public databases in interpreting mutations, but outsiders do not have access to Myriad’s database.⁹⁴ Even if all Myriad’s patents are invalidated, or new alternative testing technologies do not infringe them, Myriad’s patent-based competitive advantage will persist. Until the requisite data and interpretive algorithms are recreated in publicly accessible form, competing services will be able to manage VUS results in only two ways: by having samples analyzed at Myriad, or by rendering less adequate interpretations based upon incomplete public data and algorithms. The former perpetuates Myriad’s exclusivity even after the expiration of its patent rights,⁹⁵ while the latter is unacceptable from a clinical perspective.

B. Legal Strategy

If Myriad does pursue this data exclusivity strategy, the legal approach should be straightforward: trade secret protection for its database. Under the Uniform Trade Secrets Act (“UTSA”)⁹⁶ in force in forty-seven U.S. states,⁹⁷ a trade secret can consist of any kind of information that derives economic value from not being generally known and is the subject of reasonable efforts to maintain its secrecy.⁹⁸ Myriad’s thus-far proprietary VUS data would clearly satisfy this definition. The official commentary to UTSA provides that “reasonable use of a trade secret including controlled disclosure to employees and licensees is consistent with the requirement of relative secrecy.”⁹⁹ Myriad can easily satisfy this requirement by imposing written duties of confidentiality on its employees and any outsiders to whom it chooses to gain access while avoiding publication and contributions to public databases, as it has done for the last ten years.¹⁰⁰ From an American legal standpoint, Myriad’s database is a medical version of the Coca-Cola formula, which has enjoyed trade secret protection since the late 1800s.¹⁰¹ One difference seems salient, however, in that Myriad’s data are about its customers’ genomes, not the secret formula for a soft drink.

The legal theory for protecting trade secrets is not as clearly defined in Europe. According to a recent OECD report,¹⁰² trade secret protection in the United States is more robust than in any other country in terms of the clarity of its definitions, the scope of its coverage, and the efficacy of its remedies.¹⁰³ Nonetheless, on a practical level, it is clear that Germany (where Myriad has established its new lab) and other European countries would give meaningful protection to Myriad’s proprietary database under the conditions described in the previous paragraph.¹⁰⁴

Myriad thus has an effective legal regime for protecting its proprietary database in the United States and Europe. A separate question is whether regulatory authorities, public and private payers, or others might have back-door ways to compel disclosure. Part VI explores that issue, after a discussion of ongoing third-party efforts to replicate the Myriad database.

V. Third-Party Efforts to Replicate Myriad’s Database

A number of stakeholder groups have made efforts to promote data sharing of genomic information. For example, the goal of comprehensive initiatives like the National Human Genome Research Institute’s (“NHGRI”) 1000 Genomes Project, The Human Gene Mutation Database in Wales, MutaDATABASE, and the Human Variome Project is to promote the creation of central databases of shared data about genetic variants so that the medical community can use this information to provide a “faster diagnosis, more accurate prognosis and … better treatments ….”¹⁰⁵ Other public databases are specifically targeting BRCA 1 and 2 variants. The Breast Cancer Information Core is maintained by the National Human Genome Research Institute.¹⁰⁶ Robert Nussbaum’s Sharing Clinical Reports Project (“SCRP”) is contributing to public databases such as ClinVar.¹⁰⁷ SCRP asks cancer clinicians to contribute “limited,” deidentified data on patients whose Myriad test results showed a positive finding for a deleterious mutation.¹⁰⁸ SCRP is representative of a nascent “Free the Data” movement, currently centered on BRCA mutation data.¹⁰⁹ The Evidence-Based Network for the Interpretation of Germline Mutant Alleles, or ENIGMA, started in 2009 and funded by the National Institutes of Health, is an interdisciplinary, international consortium of clinicians and researchers that seeks to collect data and develop analytical techniques “to assess the clinical significance of rare unclassified sequence variants.”¹¹⁰

An obvious initial question is how long such initiatives will take to catch up with Myriad. In an April 2013 interview, Nussbaum, the SCRP leader, estimated that his project had collected about 1,000 mutations, or about 1.5% of what Myriad has collected.¹¹¹ ENIGMA claimed, in a 2012 article, to have collected over 3,000 unique variants of the BRCA 1 and 2 genes.¹¹² Informal estimates by experts in the field suggest that the various public databases combined have replicated about 20–25% of Myriad’s data.¹¹³ A public alternative to Myriad is thus not immediately forthcoming.

A related question concerns the quality of this alternative data. For example, the SCRP data submission form calls only for the gene name and test, result, and interpretation.¹¹⁴ This is a far cry from Myriad’s compilation of health outcomes, family histories, and other phenotypic factors. Part V.A pursues this practical question of what kind of patient data needs to be shared. Then, Part V.B considers the legal and ethical issue of protecting patient privacy when sharing this information.

A. What Kind of Clinical Data Must Be Shared?

There is current debate in the field of genomics about what kind of information needs to be collected and made available in order to reliably translate research about genetic variants into clinical practice. Some have pointed out that there is a lack of standards for assessing the clinical significance of genetic variants.¹¹⁵ Others have noted that the “identification of genetic risk prediction studies in public bibliographic databases is hindered by inconsistencies in terminology” and that “there is a lack of key information necessary to understand fully the studies, enable comparison between them, and replicate and apply the prediction models in other populations.”¹¹⁶ Yet others have emphasized the importance of identifying “modifier genes and protective alleles, which would titrate or counterbalance the risk of known susceptibility markers ….”¹¹⁷ There have also been warnings that environmental factors may play an important role in risk prediction due to their impact on the epigenetic regulation of gene expression, and thus must be taken into account when translating genetic variant research into clinical practice.¹¹⁸

The clinical significance of a genetic variant depends on whether it is a predictor of poor health.¹¹⁹ Determining whether a genetic variant is a predictor of poor health requires access to data from numerous individuals who have that particular genetic mutation.¹²⁰ If a sufficient number of individuals (“clinical data subjects”) with that mutation generally develop symptoms or diseases, then there is evidence that the mutation is clinically significant.¹²¹ Computational models also may be used to predict the possible impact of a genomic variant, but these still ultimately require access to information from clinical data subjects, and even with such information, they are not able to make reliable final determinations that can be used to guide patient care.¹²² As Hatice Duzkale and colleagues have put it, computational models are “useful in guiding classification, [but] they are not able to determine or rule out pathogenicity.”¹²³

The field of genomics is in the middle of what some have called a “gold rush”—a dash to identify as many clinically significant genomic variants as possible in order to alert patients, develop treatments, and prevent disease.¹²⁴ One of the ways this is being achieved is through genome-wide association studies where groups of patients with a particular disease are compared to groups of healthy patients in order to determine what genomic variants differentiate them.¹²⁵ For example, a recent BRCA 1 genome-wide association study identified novel genetic loci associated with risk of breast and ovarian cancer.¹²⁶

The genomics gold rush is thus helping to identify numerous genetic variants with potential clinical significance.¹²⁷ The next step is to learn to use this wealth of information in the care of individual patients—to achieve “personalized medicine,” or care that is customized to a patient’s genomic profile.¹²⁸ Not every patient who has a known “harmful” genetic variant will eventually develop symptoms or disease.¹²⁹ In fact, a number of studies of the genomics of healthy aging have shown that long-lived individuals do not necessarily carry fewer genetic risk variants than the average person.¹³⁰ Some researchers hypothesize that these individuals have longer and healthier lives because harmful mutations are “buffered” by protective genes or environmental factors.¹³¹

In the breast cancer context, the difficulty of translating general tendencies into individually relevant recommendations means that some of the women who are informed that they have an ostensibly harmful BRCA 1 or BRCA 2 genetic variant will undergo psychological harm, health care costs, and even medical interventions such as double mastectomy and bilateral oophorectomy, which could all be unnecessary.¹³² In order to avoid these unnecessary harms, researchers and laboratories will need to collect and make available more clinical data that will help identify protective factors.¹³³ Some of these protective factors may have to do with other genes that interact with the harmful genetic variant; others may be environmental, such as diet, exercise, sleep, and limited exposure to stress, childhood trauma, or tobacco smoke.¹³⁴ Therefore, the sharing of extensive patient personal information may be necessary to develop dependable personalized genomic risk prediction models that will help guide the care of individual patients.

Moreover, emerging research suggests that these environmental and genomic clinical data may be essential to accurately predict an individual’s genomic-based risks for some of the most harmful and common diseases.¹³⁵ Common diseases such as most types of cardiovascular disease and cancer, schizophrenia, depression, and diabetes, and widespread conditions such as obesity, are considered complex diseases.¹³⁶ Complex diseases do not have a single gene or genetic variant that is strongly predictive of the disease but rather have numerous genes that have a “relatively small effect, but act in concert or with environmental influences to lead to clinical disease.”¹³⁷

Therefore, in order to realize the promise of personalized genomic medicine in the specific case of the BRCA1 and 2 genes, or more broadly, researchers and laboratories will need access to a large amount of genomic and personal health information that can help develop accurate genetic risk prediction models for individual patients. However, sharing this clinical data would lead to major concerns about patient privacy protection that must be addressed in order to promote the sustainable growth of personalized medicine.¹³⁸

B. Sharing Genomic Data and Patient Privacy

The Institute of Medicine (“IOM”) recently stressed the importance of transparency in the development of genomic-based clinical technologies that are used to determine patient management, emphasizing that tests must be reliable for different kinds of populations.¹³⁹ To achieve this transparency, the IOM recommended that developers of genomic-based technologies should “[r]elease … data, code, and the fully specified computational procedures.”¹⁴⁰ Initiatives like the 1000 Genomes Project, Robert Nussbaum’s SCRP, and the Human Variome project also promote clinical data-sharing in order to help advance personalized genomic medicine.¹⁴¹

Clinical data-sharing helps promote more reliable risk prediction in clinical practice, which is ultimately beneficial to every patient.¹⁴² However, clinical data-sharing can also compromise patient privacy. The IOM recognized this as a potential obstacle to the development of reliable risk-prediction testing, particularly when dealing with genetic data.¹⁴³ The Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule protects the privacy of individually identifiable patient health information, also known as protected health information (“PHI”).¹⁴⁴ Genetic data is considered PHI under the HIPAA Privacy Rule.¹⁴⁵

The Privacy Rule only applies to covered entities such as health plans, health care clearinghouses, and health care providers.¹⁴⁶ Researchers and entities such as genetic testing companies, including direct-to-consumer genetic testing companies, are generally not considered covered entities under HIPAA.¹⁴⁷ However, if health care providers use a company’s genetic testing products, or if researchers want to obtain clinical data from health care providers, the Privacy Rule would cover that exchange of information.¹⁴⁸ Therefore, the Privacy Rule can be a significant obstacle for clinical data-sharing in the development of reliable genetic risk prediction tests.

Nevertheless, the Privacy Rule allows covered entities to share PHI for research purposes if the patient provides authorization or if the patient health information is de-identified.¹⁴⁹ De-identified PHI is health-related information which “does not identify an individual and with respect to which there is no reasonable basis to believe that the information can be used to identify an individual ….”¹⁵⁰ HIPAA lists a number of details that should be removed to help ensure proper PHI de-identification.¹⁵¹ These include names, patient geographic information smaller than a state, the initial three digits of the patient’s zip code if the geographic unit contains 20,000 or fewer people, telephone numbers, social security number, medical record numbers, and electronic mail addresses.¹⁵²

Some might argue that de-identification is a relatively simple and effective solution for clinical data-sharing in the context of genetic risk prediction research and development.¹⁵³ However, just as genomic technologies have progressed immensely in the last couple of years, so too has computer science. In fact, a recent report published in Science described how the identities of subjects whose “anonymous” genomic data was made available by the NHGRI’s 1000 Genomes Project were re-identified by using free publicly available genealogical web sites and other public Internet resources.¹⁵⁴ Even the identities of many of the participants’ relatives who had nothing to do with the 1000 Genomes Project were found.¹⁵⁵ To make matters worse, even if no personally identifiable data is purposely made available, privacy breaches and illegal access to digital databases have become commonplace.¹⁵⁶

Some commentators argue that computer science has made it so easy to re-identify information that at this point “[d]ata can be either useful or perfectly anonymous but never both.”¹⁵⁷ As mentioned above, the information required to develop reliable personalized genomic risk prediction models could potentially include not only genomic data, but also environmental clinical data such as diet, exercise, sleep, exposure to stress, childhood trauma, tobacco smoke, and other biomarkers.¹⁵⁸ Given the personal nature of such clinical data, attempts to sufficiently de-identify it would often compromise its value for developing reliable individual genomic risk prediction models.

There are some ongoing efforts to promote genomic clinical data-sharing while minimizing patient privacy concerns. For example, Robert Nussbaum’s SCRP project¹⁵⁹ asks providers and patients to submit the de-identified results of patients’ BRCA 1 and BRCA 2 tests in order to make available the interpretation of genomic variants in the freely accessible public archive ClinVar.¹⁶⁰ SCRP minimizes concerns about patient privacy and violations of the HIPAA Privacy Rule by asking patients and physicians to submit copies of BRCA 1 and BRCA 2 laboratory results without information that would identify the ordering physician, the patient, or the laboratory that performed the test.¹⁶¹ The idea is to limit the shared data to details such as test data, report data, genetic variants, the interpretation of genetic variants, a description of the type of analysis performed, and a description of the findings.¹⁶² The information requested is limited in such a way as to limit the threat of patient re-identification and allow ordering physicians to submit the reports without violating the HIPAA Privacy Rule.¹⁶³ Accordingly, on its “Frequently Asked Questions” page, SCRP states, “[o]ur interpretation is that there are no [HIPAA] restrictions on the use or disclosure of such de-identified health information ….”¹⁶⁴ SCRP further claims that the project does not require Institutional Review Board approval because it is clinical, not research, and that no California state-law limits apply.¹⁶⁵

SCRP helps promote data-sharing, but its narrow scope is both its principal strength and its greatest weakness. Collecting such limited information may overcome patient privacy concerns and thus encourage data submission, and it may help in developing a general sense of the significance of particular genomic variants. However, the lack of more detailed information about clinical data subjects can make it difficult to contextualize the results and extrapolate from the general findings to individual patients and diverse populations.

Furthermore, even if a limited clinical data sharing approach proves helpful for well-researched genes, such as BRCA 1 and BRCA 2 that are relatively highly predictive of diseases,¹⁶⁶ it will be much less useful for interpreting the clinical significance of genomic variants in the multiple genes associated with complex diseases. This is because with complex diseases, single genes typically make only small individual contributions to disease risk, particularly when compared to the contribution of environmental factors.¹⁶⁷ Therefore, environmental information about clinical data subjects may be essential for developing reliable personalized inferences about the clinical significance of a genetic variant in individual patients.

Looking forward, the problems associated with proprietary clinical data, clinical data-sharing, and patient privacy are only just beginning. Many believe that advances in genomics, along with other developments in medical biotechnology, are giving rise to a paradigm shift that will take health care from a reactive approach to a proactive approach where medicine will be predictive, preventive, personalized, and participatory (“P4 medicine”).¹⁶⁸ Champions of P4 medicine argue that “[i]n 10 years, everyone will have his or her genome sequenced” and “a virtual cloud of billions of data points will surround each patient.”¹⁶⁹ Their idea is that patients’ genomes will be reviewed every year for new actionable genetic variants.¹⁷⁰ In addition, biomarkers and environmental factors such as diet, exercise, and sleep will be continuously monitored through patient self-reporting and hand-held devices “that can prick your finger, take a fraction of a droplet of blood and quantify several thousand organ-specific proteins in five minutes.”¹⁷¹

Proponents of P4 medicine argue for the “‘democratization’ of data-generation and data-analysis tools; that is, making these tools accessible to all individual scientists so that they may carry out either big science or small science projects.”¹⁷² However, we have seen this movie before: some call for data-sharing, some see an opportunity to make a profit by treating clinical data as trade secrets, others worry about the ethical, legal, and social implications of both data-sharing and proprietary clinical data, some do a little bit of each, and everyone says they want to promote medical science for the benefit of the people. Who are the heroes and who are the villains is anyone’s guess, but comprehensive public policy solutions must be crafted because these problems are here to stay.

VI. What Can We Do about It? Policy Options for Building a Genomic Commons

Policies to create incentives to share the data needed to interpret the clinical and scientific meaning of genomic variation are being proposed at several levels. Some policies address norms and practices among clinicians and patients. Others center on contributing data to databases from laboratories. Yet others focus on product regulation through the Food and Drug Administration (or equivalents in other countries). Finally, payers and health plans could use their coverage and reimbursement policies to help build a more robust evidence-based system of health care.

A. Options for Patients and Clinicians Ordering Tests

The SCRP project focuses on clinicians and laboratories that order tests for patients.¹⁷³ The “Free the Data” movement, based at the Genetic Alliance and supported by a coalition of organizations, includes SCRP but is broader and also includes individual patients who have received test results.¹⁷⁴ These are efforts to capture extant data and channel them into public databases where they can inform clinical interpretation of test results. A more recent variation is a principled call for patients and health professionals to order tests only from laboratories that share data with public databases, where the data can inform clinical interpretation for future patients. The Yale Genetic Testing Lab, for example, issued a statement on February 24, 2014 that emphasizes open data access:

Whenever possible we will choose laboratories that have pledged to make all of their past, present, and future gene data publicly available in order to allow this important information to be freely accessible to all clinicians and researchers, to further the advancement of medical knowledge and to best serve patient care. We will not support laboratories that hoard data.¹⁷⁵

The European Society of Human Genetics issued a statement in October, 2012, that specifically chided Myriad for not sharing clinically relevant information.¹⁷⁶

These are actions that individual patients and health professionals can take, but they are limited in that they are voluntary and incomplete (SCRP and Free the Data) or mainly hortatory rather than binding (exhortations and normative statements). These efforts at the individual and clinical level address the problem directly but lack the power of law and mainly focus on the first step of data access, which is necessary but far from sufficient.

B. Options for Testing Laboratories

In June 2013 the American Medical Association passed Resolution 519 that calls for laboratories “to place all clinical variants and the clinical data that was used to assess the clinical variations that can impact the public’s health.”¹⁷⁷ The ClinVar database is undertaking a major effort to make it easy to contribute data that have been vetted for clinical significance into a publicly available database, and many laboratories have pledged to participate.¹⁷⁸ ClinVar lists those who submit data and the number of genes and submissions each has contributed, an incentive based on “credit for contribution.”¹⁷⁹ ClinGen projects have been funded to build pipelines for interpretation in a consistent way with consensus standards.¹⁸⁰ They have also been working to develop the requisite infrastructure. If these and other efforts to establish a clinically useful database of clinically relevant genomic variants (ClinVar) and methods to interpret those variants (ClinGen) succeed, they will become the core of a “genomic commons” and a reliable foundation for clinical use that is broadly available, thus supplanting the proprietary database model and indeed limiting its value. These efforts are, however, nonbinding. They thus bring together a coalition of the willing but do not address business models incompatible with open and collaborative science.

Another policy option entails making data access and independent verification of interpretation a criterion for laboratory accreditation. Seeking accreditation is, by definition, voluntary—a step down from formal regulation.¹⁸¹ But accreditation is also often linked to coverage and reimbursement.¹⁸² If data access and verifiable interpretation become accreditation standards, then a laboratory may be free to opt out, but some payers may not cover or reimburse its tests. This was floated as an option at a February 3, 2013 Institute of Medicine workshop.¹⁸³ Participants noted that the College of American Pathologists, an important accreditation body for laboratory medicine, is considering data access and verifiable interpretation among its laboratory standards.¹⁸⁴

C. Premarket Approval Regulation

At the next level of stringency, regulators and payers could formally make data access and verifiable interpretation a condition of approval for market through premarket approval of medical devices. AMA Resolution 519 (June 2013) included a recommendation to this effect, urging “payers, regulators and providers to make clinical variant data and their interpretation publicly available through a system that assures patient and provider privacy.”¹⁸⁵ The statutory authority for the FDA or its non-U.S. equivalents to compel access to data and methods is a subject of both discretion and debate.

The FDA is highly protective of proprietary data submitted for the purposes of evaluating the safety and effectiveness of a product.¹⁸⁶ The agency generally requires the submitter’s authorization before releasing any proprietary data, and the unauthorized release of proprietary data by any FDA employee is considered a crime.¹⁸⁷ On the one hand, this policy promotes disclosure of important safety information to the FDA because applicants have some level of assurance that they will maintain any competitive advantage provided by their proprietary data. However, this policy often conflicts with the FDA’s responsibility to advance “public health by … helping the public get the accurate, science-based information they need to use medicines and foods to maintain and improve their health.”¹⁸⁸

VUS data are essential to discerning the clinical significance of genetic variants revealed by genetic tests. Therefore, independent access and validation of this information is necessary for the safe and effective use of genetic technologies. Pressure to improve the disclosure of safety and effectiveness data for drugs and medical devices led Congress to pass Section 801 of the Food and Drug Administration Amendments Act (“FDAAA 801”).¹⁸⁹ This section mandates the report and public disclosure of clinical trial data for drugs and medical devices regardless of source of funding.¹⁹⁰ The results reporting requirements are relatively limited, but this initiative promotes independent verification of results and safe and effective use of medical devices. VUS data collected by genetic testing companies in the course of their business generally will not constitute a clinical trial for the purpose of FDAAA 801.¹⁹¹ However, withholding VUS data as trade secrets will foreseeably result in unnecessary harms to patients because these data are necessary to make appropriate decisions about patient management. Therefore, the FDA should be provided the authority to establish broader disclosure requirements that will allow it to address the safety challenges of emerging genomic technologies.

D. Publication Standards

Robert Merton most famously articulated the features of science that distinguish it from other human endeavors: communalism, universalism, disinterestedness, and organized skepticism.¹⁹² These features drive the publication standards applied by scientific journals, including the norm that publications be based on transparent research supported by accessible data. The furor over access to data arising in the February, 2001, publications of a draft human reference genome led to a National Research Council report on publication standards that recommended rapid access to data and underlying methods, the UPSIDE Principle: Uniform Principle for Sharing Integral Data and Materials Expeditiously.¹⁹³ Some journals, including the Proceedings of the National Academy of Sciences, adopted the standard forthwith.¹⁹⁴ The centerpiece of the debate was another business model surrounding another proprietary database, in this case, the human reference sequence and related software developed by Celera, which had raced with the public Human Genome Project to a conclusion that was declared a tie in a June, 2000, ceremony with announcements in the White House and 10 Downing Street in London.¹⁹⁵ Science editor Donald Kennedy’s decision to publish the article from the Celera group was highly controversial, and so the NRC study was commissioned to address the responsibilities that accompanied publication in scientific and medical journals.¹⁹⁶

The debates about access to data and research transparency have not entirely tamped down. The International Committee of Medical Journal Editors has espoused a set of recommendations for publication that has been regularly revised but emphasizes access to data and research transparency.¹⁹⁷ Many of the principles are subject to interpretation. The Eggington article cited above, for example—which reports Myriad’s 2.1% rate of VUS results, down from 12.8% in 2002—describes how Myriad conducts its interpretation.¹⁹⁸ It does not show the underlying data, however, nor report the list of variants in a way that allows replication. Neither does it include interpretive algorithms or models that drive the interpretation and the numbers reported. There is no reason to doubt Myriad’s veracity, but there is equally little solid evidence to meet the standards of reproducibility, and this article clearly falls short of the ICJME and UPSIDE principles recommended by the National Research Council. Yet this article was published in a clinical journal in December 2013. Myriad was not obligated to publish at all, and its description of VUS calling is useful, but it is not independently verifiable or replicable. The choice of publication outlet was presumably colored by the journal’s standard for comporting with scientific norms. For example, the article clearly does not meet the standards recently announced for Public Library of Science journals,¹⁹⁹ but Myriad nonetheless found a clinical journal willing to publish a descriptive article without access to underlying data or methods. This highlights two limitations of relying on publication practices to ensure data access and verifiable interpretation: (1) publication is voluntary, and (2) standards may be public, but they are variably interpreted and implemented among journals and other publications.

E. Coverage and Reimbursement

A final option, and one that would drive incentives through all the previous steps, would be for payers (both public and private), national health systems, and health plans that directly pay for goods and services to incorporate criteria for data access and verifiable interpretation into decisions about coverage and reimbursement. The philosophy behind such a move is spelled out in two recent National Academies reports, one centered on “Omics,”²⁰⁰ and the other on laying a foundation for “Precision Medicine.”²⁰¹ Both reports note the central importance of access to data and sharing of algorithms, models, and methods as bedrock principles. They underscore the importance of replicating results in science and the move toward “evidence based medicine” in establishing clinical validity. Whether and how payers will begin to take up such recommendations and implement them into coverage and payment decisions will arguably be the most powerful determinant of whether and to what degree open science norms and practices drive adoption of genomic technologies.

VII. Conclusion

Myriad built a proprietary database out of its patent estate and converted it into a source of competitive advantage. Myriad’s service monopoly for genetic testing of BRCA genes is an outlier case in many respects. BRCA testing is far more common than other genetic tests, and a blockbuster patent-dependent business model made BRCA testing highly lucrative. The decision to stop sharing data about genomic variants in 2004 did not attract attention until the Myriad case drew attention to it. Few other companies may be able to garner such market power via a patent monopoly and then leverage that service monopoly into a proprietary database conferring commercial advantage. The situation may be rare. Or it may not be, depending on the nature of proprietary databases that might proliferate as DNA sequencing and other genomic technologies become ubiquitous.

Whether proprietary databases become a major systemic problem for health services that demands policy change will depend on whether a “genomic commons” will emerge to weaken the commercial value of proprietary data strategies. The size, stability, and utility of the genomic commons will in turn depend on the degree to which data about and methods for interpreting the clinical significance of genomic variants are shared. The extent of such sharing will ultimately be determined by choices made by individual patients, health professionals, testing laboratories, regulatory bodies, and payers. The current controversy over Myriad’s proprietary database is an early and compelling case study over whether a genomic commons can survive and thrive in the current legal and policy environment.