HIPAA’s Individual Right of Access to Genomic Data: Reconciling Safety and Civil Rights

Abstract

In 2014, the United States granted individuals a right of access to their own laboratory test results, including genomic data. Many observers feel that this right is in tension with regulatory and bioethical standards designed to protect the safety of people who undergo genomic testing. This commentary attributes this tension to growing pains within an expanding federal regulatory program for genetic and genomic testing. The Genetic Information Nondiscrimination Act of 2008 expanded the regulatory agenda to encompass civil rights and consumer safety. The individual access right, as it applies to genomic data, is best understood as a civil-rights regulation. Competing regulatory objectives—safety and civil rights—were not successfully integrated during the initial rollout of genomic civil-rights regulations after 2008. Federal law clarifies how to prioritize safety and civil rights when the two come into conflict, although with careful policy design, the two need not collide. This commentary opens a dialog about possible solutions to advance safety and civil rights together.

Main Text

Introduction

Amendments¹ to the Health Insurance Portability and Accountability Act of 1996 (HIPAA)² Privacy Rule³ in 2014 generated ongoing controversy by granting people a legal right to obtain their test results directly from HIPAA-covered laboratories. This HIPAA access right⁴ applies to many types of laboratory test results but has been especially controversial with respect to genomic data, the focus of this commentary. The access right potentially includes not just confirmed, clinically significant genomic test results but also uninterpreted variants and variants of uncertain significance.⁵ With limited exceptions, it applies to data stored at HIPAA-covered facilities, potentially including some research laboratories.^{6, 7, 8}

Placing genomic research results into laypeople’s hands leaves many bioethicists, physicians, and safety regulators uncomfortable, reflecting concerns that research data could be of subclinical quality in the sense of lacking analytic validity, clinical validity, and/or clinical actionability or being prone to “mix-ups” where one person’s test results are wrongly attributed to another person.^{9, 10, 11} The National Academies recently launched a study that people hope might help clarify matters.¹²

The generally accepted consumer safety regulatory paradigm blocks consumers’ access to health-related data unless the data meet quality standards appropriate for clinical care. This paradigm informs how the Food and Drug Administration (FDA) oversees medical devices, how the Centers for Medicare and Medicaid Services (CMS) oversees clinical laboratories under the Clinical Laboratory Improvement Amendments of 1988 (CLIA),¹³ and how many bioethicists view the return of incidental findings and individual research results.^{9, 10, 11} Viewed through the lens of consumer safety regulation, the HIPAA access right seems strange and ill advised, but this commentary explains why that is not the correct lens through which to view it. This commentary positions the HIPAA right of access to genomic data as a federal civil-rights regulation issued in response to a mandate that Congress laid down in the Genetic Information Nondiscrimination Act of 2008 (GINA).¹⁴ Civil rights enjoy special protection in the American system of law, but there are legally permissible pathways for addressing valid safety concerns that surround individual access to genomic test results.

The Development of Genomic Civil Rights

The passage of GINA expanded the United States’ federal regulatory program for genetic and genomic testing to include civil-rights and consumer safety regulations. GINA is best known for banning discrimination in employment and health insurance.¹⁵ Its broader sweep as a civil-rights law is less well understood.

Section 102(a)(4) of GINA defines the “genetic information” that, in Congress’s view, places people’s civil rights at risk. This definition includes all information from genetic tests on a person or the person’s family members, as well as data on manifest disease in the family members.¹⁶ That is far broader than the subset of test results that have a well-understood clinical or reproductive significance. Before GINA, bioethicists debated whether unconfirmed, subclinical-quality genetic test results were even genetic “information.”¹⁷ Although there are a range of bioethical perspectives on this question, there is a fairly broad consensus within the bioethics community that laypeople can be harmed by access to subclinical-quality genomic data.^{9, 10, 11}

The GINA statute recognizes that unconfirmed or uncertain genetic test results have a civil-rights significance, even when they lack clinical significance. People might suffer discrimination if results from another, sicker person are wrongly attributed to them by a laboratory mix-up. Law enforcement might link them to a crime if a research laboratory stores their forensic CODIS markers in its files, and the laboratory’s certificate of confidentiality would not always protect them.¹⁸ Even if a laboratory never deliberately shares people’s data, its files could be hacked, making genomic information a rich tool for re-identifying data stored elsewhere in de-identified form.¹⁹ A laboratory can, without asking people, release their data in de-identified form under the Common Rule and the HIPAA Privacy Rule. Once disclosed to a non-HIPAA-covered entity, there are no further HIPAA protections to prevent de-identified genomic data from being re-identified and redisclosed.¹⁹ A large cast of third parties potentially has access to your whole genome, while ethicists debate whether it is “information”¹⁷ you should have.

By passing GINA, Congress ended that debate. Section 105 of GINA orders the Department of Health and Human Services (HHS) to place genetic information—not just clinically significant health information, but all of it—under the HIPAA regulations by 2009. Earlier, HHS had delegated its HIPAA responsibilities to the Office for Civil Rights (OCR),²⁰ so this was a congressional mandate for the OCR to act as a federal regulator to protect genomic civil rights. Congress ordered the OCR to consult with other agencies, such as the Department of Labor, that have various GINA-related responsibilities, but section 105(b) states that the OCR “has the sole authority to promulgate such regulations.”

On the day Congress enacted GINA, the Privacy Rule already included an individual right of access to health data held by HIPAA-covered entities such as healthcare providers, so access seemingly was one of the HIPAA protections that Congress envisioned: how can you detect and correct another person’s disease variant that is wrongly in your file, and how can you assess your overall level of re-identification risk, if you cannot see the data that a laboratory stores about you? The HIPAA access right enables various other genomic civil rights, including some that enjoy constitutional protection. For example, the First Amendment protects people’s rights to assemble and to petition their government. Empowered by access to their data, people with rare variants of unknown significance can and do use social media to locate others with that same variant and assemble cohorts to help researchers clarify its significance.^{21, 22} They can petition Congress to dedicate more resources to study their variant of interest.²² Blocking people’s access to their genomic data has the potential to deprive them of these and other constitutional rights.

The HHS met Congress’s 2009 deadline to place genetic information under HIPAA’s basic privacy protections through a temporary policy until the Privacy Rule was formally revised in 2013 to reflect GINA’s definition of genetic information.²³ Implementing the access right took still longer, until 2014,¹ because of the state-law issues discussed in the next section. After the 2014 amendments, HIPAA’s access right applies to many types of laboratory test results. Insofar as it applies to genetic information, the OCR was implementing a congressional civil-rights mandate set out in GINA. That fact is sometimes misunderstood in the current debate.

Overcoming Barriers to Access

Creating a new civil right of access to genetic information presented a legal problem: states, rather than the federal government, regulate the practice of medicine, so state law has traditionally controlled whether laboratories should deliver results to physicians or directly to patients. The federal CLIA regulations look to the states to define who is an “authorized person”²⁴ to receive laboratory data, much as federal election law looks to the states to decide who is an eligible voter. As originally designed in 2000, HIPAA’s individual access right did not include access to laboratory data, lest HIPAA access conflict with state-law access restrictions.¹ Federal law was deferring to the states.

When the OCR surveyed the laws of 50 US states and five US territories, it found only nine that expressly allowed direct individual access.¹ To state regulators charged with ensuring patient safety, even clinical-quality laboratory results raise concerns about laypeople’s ability to understand the data: “analyses of health literacy indicate that, on average, US adults have limited health literacy.”²⁵ Laypeople’s health illiteracy, many fear, could lead them to make bad decisions that harm both themselves and society—for example, if people overreact and pursue needless medical treatments¹⁷ or waste healthcare resources to clarify findings they misunderstand.²²

A federal right of access to genomic data would need to displace state laws that block access on the basis of people’s perceived health illiteracy. This echoes past American civil-rights struggles. The Voting Rights Act of 1965²⁶ displaced state laws that required unreasonably difficult literacy tests for voter registration. States with such laws, which were common in the racially discriminatory south, had their voting laws placed under supervision of the US Department of Justice or the US District Court for the District of Columbia.²⁷ This federal intervention eliminated state laws blocking a civil right—the right to vote—on the basis of an entrenched elite’s view of everyone else’s “illiteracy.” Voter registration among African Americans rose from 19.3% to 51.6% over 30 months in Alabama and from 6.7% to 59.8% within 2 years in Mississippi.²⁷

The 2014 HIPAA access regulation was a similar intervention. It eliminated the exception that previously blocked HIPAA access to laboratory data and made conforming changes to the CLIA regulation.¹ The general reporting rules of CLIA continue to look to state law to define who is authorized to receive laboratory data,²⁸ but the HHS emphasized that HIPAA displaces any state law that blocks people’s HIPAA access.¹ Like the right to vote, access to one’s own genomic data is a foundational civil right that empowers people to protect all their other civil rights, and HIPAA displaced states’ power to interfere with it.

The access right went into effect in October 2014. Over 3 years later, a large number of individuals—people whose genomes were sequenced at laboratories operating under the CLIA research exception²⁹—continue to face access barriers. The CLIA research exception lets research laboratories avoid being regulated by CLIA as long as they do not report individual-specific results for clinical purposes. Some research laboratories hesitate to provide HIPAA access because they fear they might fall under the CLIA regulations if they do so. The CMS has suggested that research laboratories that provide HIPAA access need to comply with CLIA because the data “will or could be used”³⁰ for clinical purposes.

Some lawyers believe that the position of the CMS is inconsistent with the CLIA statute, but the practical reality is that a federal regulatory agency’s position, whether or not it is correct, “still establishes the law for all those unwilling to pay the expense, or suffer the ill-will of challenging the agency in court.”³¹ Moreover, it is not clear that research laboratories have any rational incentive to challenge the position of the CMS. Providing HIPAA access is troublesome and costly: the HHS estimated that laboratories nationwide will collectively incur costs of up to $63 million per year to respond to HIPAA access requests.¹ It is plausible that research laboratories that store genomic data could be hit with a disproportionate share of these access requests because people find genomic data intriguing. Laboratories operating under the CLIA research exception understandably might not wish to challenge the view that these amendments tie their hands with respect to HIPAA access. The position of the CMS has had the practical effect of making it harder for research participants to exercise their HIPAA access right. Research participants face an uphill battle, because the HIPAA and CLIA statutes both lack a so-called private right of action^{32, 33} that lets citizens sue to protect their own civil rights, so they depend on regulators to protect them.

Reconciling Safety and Civil Rights

As the federal regulatory agenda expanded after GINA, competing safety and civil-rights regulatory objectives were not successfully integrated. These objectives point to different policies on specific issues, such as whether individual access to genomic data should be narrow or broad. When consumer safety and civil rights collide, safety regulators must carefully craft safety solutions that preserve people’s civil rights.

Section 242 of Title 18 of the US Code exemplifies the high priority that civil rights receive in the American system of law: state and federal regulators cannot take actions “under the color of any law” that would “willfully subject any person … to the deprivation of any rights … protected by the Constitution or laws of the United States.”³⁴ HIPAA access is the sort of right that section 242 aims to protect: it is a right protected by federal law, and it enables the exercise of various other civil rights, including some constitutional rights. The Department of Justice emphasizes that section 242 protects civil rights broadly and is not limited to traditional civil-rights abuses “motivated by animus toward the race, color, religion, sex, handicap, familial status or national origin of the victim.”³⁵ The civil rights that GINA and HIPAA protect are well within its scope. Actions under the color of law include acts that public officials perform lawfully, as well as acts “done while the official is purporting to or pretending to act in the performance of his or her official duties.”³⁵ This means that it is largely beside the point to debate whether the FDA and CMS have legal authority to block HIPAA access. Whether they do or do not, they are expected to fulfill their consumer safety responsibilities in a way that protects people’s civil rights, including people’s right to access their own data.

Suppose, hypothetically, that patients of Polynesian ancestry experience a high rate of serious drug-related injuries when prescribed a particular FDA-approved drug. The FDA has legal authority, at section 355-1(f)(3) of Title 21 of the US Code, to impose use restrictions on drugs. Should the FDA use this power to block physicians from prescribing the drug to patients of Polynesian ancestry? Of course not. Doing so would violate the patients’ civil rights, unless the FDA has proof that every single one of them will suffer the injury, and maybe not even then because they are autonomous agents with different preferences for benefits and risk. The FDA has other tools to address safety risks without blocking access: warnings in drug labeling, medication guides to inform patients directly, “Dear Doctor” letters for physicians, or postmarketing studies to clarify who is at risk. Federal law requires agencies to craft safety solutions that preserve civil rights.

This fact matters most with respect to data generated in the past at research laboratories operating under the CLIA research exception,²⁹ although it also affects the vast array of subclinical-quality findings that clinical laboratories generate as a byproduct of detecting the 200 or so variants that, under current scientific understanding, have a known clinical significance.³⁶ Some observers call for all research laboratories simply to comply with CLIA. Even if research laboratories complied with CLIA prospectively, however, this would not resolve problems with data generated in the past, which can never be made CLIA compliant. So long as old test results are stored and shared for secondary uses, they potentially affect people’s civil rights, and individuals need access. There are various civil-rights-respecting ways to address safety concerns, such as requiring laboratories to disclose problems with data quality or to warn consumers not to use research-quality data for medical decisions without confirmation. Regulators could send “Dear Doctor” letters instructing clinicians that low-quality HIPAA access data are in circulation and to resolve doubts about data provenance in favor of retesting. Regulators could use their public information power to publish reliability scores for the many available genomic interpretation services to help steer the public to good ones.

The deeper problem with requiring all research laboratories to comply with CLIA is that CLIA would not resolve concerns about the quality of research data. Congress enacted the CLIA statute after problems with cervical cancer screening³⁷ and tailored the CLIA requirements to the context of commercial clinical testing. Thus, laboratories are required by CLIA to have a scientifically trained laboratory director as opposed to a business major who might pressure pathologists to interpret too many slides per hour. This same protection adds less value in research settings, where there is little risk that grant sponsors would fund studies led by scientifically unqualified investigators. The CLIA regulations require no proof of clinical validity or utility.³⁸ A laboratory’s analytical validation “is reviewed during its routine biennial survey—after the laboratory has already started testing.”³⁸ At clinical laboratories, this ensures that patients tested after a new test has been in service for at least 2 years will receive an analytically validated test. The CLIA biennial survey might not come in time to ensure the analytic validity of research tests used during limited-term research grants. Even if the proficiency-testing requirements of CLIA were vigorously enforced, which is not always the case,^{39, 40} proficiency-testing materials do not yet exist for many genomic tests, and this might be especially true of novel tests used in genomic research.⁴¹ As for mix-ups, the CLIA requirements for sample and record identification are surprisingly modest—they require just “two unique identifiers,”⁴¹ and mix-ups sadly occur even at CLIA-regulated clinical laboratories.⁴⁰

This is not to deny that the safety of clinical laboratory testing has improved after CLIA, but the research exception exists for good reason and should not be abandoned without careful, reality-based deliberation. This commentary’s reference to section 242 was simply to explain the priority that federal civil-rights laws enjoy in relation to other laws. It was not to suggest that any agency has violated it—yet. Section 242 addresses willful violations of people’s civil rights. Recent barriers to access appear to be the product of a well-intentioned misunderstanding about what the HIPAA access right is.

The Ethical Imperative of Individual Access

Discourse about HIPAA access sometimes conveys a tone of shocked indignation, as if the access right burst out of nowhere and took everybody by surprise. In fact, HIPAA access codifies long-standing ethical principles enunciated in analyses that Congress commissioned at the dawn of the information age in the 1970s⁴² and again in the late 1990s.⁴³ In both cases, legislators were grappling with how to protect people’s rights in an age when storing, sharing, and using personal data offered important societal benefits, and both studies converged on two ethical principles. First, people cannot grant valid informed consent for their data to be used in research if they do not know what their records contain,⁴³ so individual access facilitates socially beneficial data access. Second, there is sometimes ethical justification for using people’s data without consent, but unconsented access implies the need for an individual access right so that people can at least understand and mitigate the resulting risks to their civil rights.⁴² The Privacy Protection Study Commission’s 1977 report specifically examined access to research data and concluded that if research records cannot be “totally protected against the possibility that individually identifiable information in them will be disclosed for any other purpose, the individual's concern is obvious and his access right highly relevant.”⁴²

If policy makers feel that the safety risks of HIPAA access to research data are unacceptable, they can block it prospectively by moving genomic research to non-HIPAA-covered laboratories. There is no access right there. This implies, however, that privacy and data-security policies for genomic research would need to become far stronger than the protections that HIPAA currently provides. HIPAA’s access right is a civil-rights safety net that helps people protect themselves in the face of various HIPAA provisions that leave their civil rights at risk: for example, unrestricted sharing of de-identified data, the lack of mandatory restrictions on downstream re-identification and redisclosure, and the use of institutional-review-board-approved waivers to effectuate research access to people’s data without their permission. These same HIPAA provisions enable socially beneficial uses of data and foster the creation of large-scale data commons to advance public health, precision medicine, and genomic research.^{44, 45} Taking people’s access away would imply that they need tighter control over their data to protect their civil rights. Goodbye, genomic data commons.

Conclusion

HIPAA’s access right is a federal civil-rights law. As such, it merits special respect and care. In GINA, Congress authorized the OCR to make regulations to protect genomic civil rights. Federal law constrains how far other regulators can go to interfere with these rights. Debate about the access right should focus on crafting civil-rights-preserving strategies to address valid, evidence-backed safety concerns. Financial impacts on research laboratories also bear close monitoring. For research laboratories, HIPAA access is an ongoing, unfunded federal civil-rights mandate. Congress created genomic civil rights and might need to authorize funds to help—not just during research grants but also after grants end.

Americans who are old enough still recall the heated debate after Congress passed the 1965 Voting Rights Act. Respected civic and spiritual leaders and grandfathers we loved voiced deep ethical convictions that eliminating literacy tests would subject voters and society to ill-informed decisions and risks of harm. This author’s views are biased by having seen, before the age of 6, that highly ethical people can be wrong about civil rights.