What guidance does HIPAA offer to providers considering familial risk notification and cascade genetic testing?

Abstract

Background

It is unclear how the Health Insurance Portability and Accountability Act (HIPAA) should be interpreted in the context of sharing of genomic information between family members.

Methods

The authors analyzed the HIPAA Privacy Rule, reviewed the literature and constructed a clinical scenario to inform how HIPAA can be interpreted for multiple forms of patient- and provider-mediated genetic risk notification.

Results

Under HIPAA, healthcare providers can lawfully notify relatives to recommend genetic risk assessment using multiple approaches, including supporting the patient telling their own relatives, contacting relatives directly with the patient’s authorization, or contacting a relative’s provider directly.

Conclusions

Multiple forms of patient- or provider-mediated contact of relatives are already legally permissible under HIPAA, are consistent with ethical obligations of care to patients and their families, and could result in improved population health through identification of clinically actionable disease risk. Unanswered questions remain about implementation and impacts of provider-mediated programs.

I. INTRODUCTION

Cascade genetic screening is the practice of identifying and offering testing to biological relatives of individuals known to carry pathogenic genetic variants. Cascade genetic screening for certain autosomal dominant conditions, such as familial hypercholesterolemia, hereditary breast and ovarian cancer syndrome (HBOC), and Lynch syndrome (LS), involves offering testing to at-risk relatives once one individual has been identified as having a pathogenic variant through genetic testing. Cascade testing generally starts with those at the highest risk (first-degree relatives such as parents, siblings, and children) and then proceeds to the first-degree relatives of those who test positive (e.g., the biological children of the proband’s affected biological siblings and the biological siblings of the proband’s affected biological parents). In this way, testing is always being offered to an individual who has a 50 per cent chance of having inherited the pathogenic variant.

The importance of identifying affected relatives is high, since these variants are considered clinically actionable, and potential intervention—such as enhanced surveillance, early treatment, or preventive surgery—can improve health outcomes or prevent disease for individuals with these pathogenic variants.¹ With the advent of precision medicine and the rapid proliferation of massive amounts of genomic sequencing data, the number of clinically actionable variants is likely to increase, and therefore, the number of individuals who need cascade screening will also increase.

Cascade testing typically involves coordinating counseling and testing for relatives who might not receive care from the same providers as the proband. Questions remain about how providers can communicate to a patient’s relatives about cascade testing in a way that is effective medically while remaining within legal and ethical bounds.

The authors of this paper are medicine, law, public health, genetics, research, and public policy professionals. The group identified a need to summarize how federal law, specifically regulations under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, pertain to contacting the at-risk relatives of patients who carry a pathogenic variant associated with any actional autosomal dominant condition such as familial hypercholesterolemia, LS, and/or HBOC. The group members reviewed HIPAA Privacy Rule regulations, including proposed and final administrative rules, which are relevant to providers’ role in familial risk notification.² The group then created a realistic hypothetical case in which a provider might wish to notify at-risk relatives and encourage cascade genetic testing, along with seven potential clinical actions that could result. The group weighed the clinical actions against HIPAA requirements, sought input from HIPAA experts, and conducted a targeted literature search for evidence on the effectiveness each action.

In this paper, we analyze whether and how the HIPAA Privacy Rule applies to scenarios in which providers wish to encourage cascade testing of their patients’ relatives. We focus on a subsection of HIPAA regarding the treatment of others.³ We first present the current practices employed in the USA to communicate with high-risk relatives. We then discuss and analyze HIPAA in the context of a hypothetical case example. In addition to federal law, state-specific laws might restrict information sharing by providers as well. However, analysis of individual state laws or any case law is beyond the scope of this paper.⁴

II. CURRENT PRACTICES

The current standard in the USA is that providers encourage their patients to inform relatives of potential genetic risk. Each family member is then responsible for choosing to pursue genetic testing. This model is known as indirect or patient-mediated risk notification.⁵

On the opposite end of the spectrum from patient-mediated risk notification is direct or provider-mediated contact, where a provider directly contacts a patient’s relatives. There has been wide consensus that providers have no legal duty to warn relatives directly of potential inherited risk. While lower court cases in the USA found such a duty in the 1990s, these do not create precedent for the vast majority of healthcare providers and there have not been similar cases decided in the USA since.⁶ Despite this, the spector of a legal duty to warn remains a topic of discussion in the USA and across the globe. Indeed, in March 2020, a court in the UK held that healthcare providers legally must balance the interests of patient confidentiality and third-party (family member) risk.⁷

Despite no broad legal duty to warn relatives, providers often report a sense of duty to do so.⁸ A sense of conflicting obligations might be particularly evident when a patient proband cannot or will not notify their own relatives or when a provider cares for multiple biologically related individuals. A survey of US genetic counselors (n = 259) found that 46 per cent of counselors had encountered cases where a patient refused to inform a relative of their risk, and 63 per cent of the total sample endorsed the idea that genetic counselors have an obligation to inform at-risk relatives.⁹ Another study found that 69 per cent of medical geneticists (n = 209) reported an obligation to notify their patients’ relatives of a potential genetic risk.¹⁰

Although a healthcare provider’s legal and ethical duties have always been focused on an individual patient, some literature suggests an expansion of individual-level genomic medicine to include a patient’s relatives. Frameworks include an ‘ethic of care’ that expands the health professional role to include direct communication to relatives of genetic testing patients¹¹ or an expansion of the provider role in genetic medicine to include a ‘family covenant’ that recognizes a physician duty to all family members.¹² The idea of a ‘joint account’ has also been put forward to conceptualize the unique nature of shared genetic information among family members.¹³ A number of clinical recommendations advocate for genetic testing of an individual for the benefit of others.¹⁴

These arguments may challenge the prevailing emphasis on individual patient privacy and autonomy. Further, questions remain about how a provider could simultaneously focus on both a patient and relatives while meeting ethical and legal norms regarding caring for the individual patient. Literature notes the tensions between individual and family interests and interpretation of duty considering the heterogeneity of conditions served by genetic services,¹⁵ along with other questions such as relatives’ right not to know and how best to respect both patient and family privacy.¹⁶

III. HIPAA AND GENETIC TESTING

The principal federal legislation governing providers’ protection of patient privacy is the HIPAA Privacy Rule.¹⁷ This Rule defines whether and how a patient’s protected health information (PHI) may be shared with third parties by ‘covered entities’, which include healthcare providers, health plans, and healthcare clearinghouses. These rules have been extended to apply to ‘business associates’ as well.¹⁸

While HIPAA itself is predominantly an insurance legislation, the HIPAA Privacy Rule establishes regulations for how covered entities must protect individually identifiable health information, called ‘protected health information’ or PHI.¹⁹ Genetic information can be a form of PHI if it is identifiable.²⁰ In general, HIPAA requires written authorization of the individual (patient) for uses and disclosures of PHI but includes a number of exceptions when PHI may be disclosed beyond the provider–patient dyad. These include patient care, law enforcement activities, healthcare operations, oversight and regulation activities, or activities required by medical examiners.

One of the most notable exceptions to patient authorization of health information disclosure is when information is shared for treatment. This allows disclosure between providers for treatment purposes: ‘a covered entity may disclose PHI for treatment activities of a healthcare provider’.²¹ Treatment is defined as ‘the provision, coordination, or management of healthcare and related services by one or more healthcare providers, including the coordination or management of healthcare by a healthcare provider with a third party; consultation between healthcare providers relating to a patient; or the referral of a patient for healthcare from one healthcare provider to another’.²²

Typically, the treatment specification applies to the care of a single patient. A primary care physician, for example, can communicate with a genetic counselor about their patient in order to coordinate a treatment plan. However, in final rules regarding HIPAA regulations and in an accompanying FAQ, U.S. Department of Health and Human Services and its Office of Civil Rights has interpreted this to apply also to the treatment of another individual, such as family members.²³ The Rule permits, but does not require, such disclosure. A patient may request nondisclosure of PHI by filing a restriction, but generally the provider is not required to agree to or comply with the request.²⁴ Further, a covered entity is not required to obtain patient authorization for uses or disclosure of PHI for treatment, payment, or healthcare operations.²⁵

This interpretation of the treatment specification to HIPAA authorizations could expand how providers can approach cascade testing in the USA but is not without its controversy, mainly around the role of providers in direct contact of relatives.²⁶ A primary question is whether it is appropriate for providers to play such an active role in cascade testing, particularly if it is at the perceived expense of their patients’ privacy. What would use of this specification look like in practice? What should it be? What other ways can providers communicate with relatives under HIPAA? The following section explores these questions and others through the lens of a hypothetical clinical case.

IV. CLINICAL ACTIONS RELATED TO CASCADE TESTING PERMISSIBLE UNDER HIPAA

The following is a fictional clinical scenario, intended to be a composite of realistic choices faced by clinicians recommending familial notification for cascade testing. Clinical actions and their permissibility under HIPAA are described in Table 1 and described below in terms of whether each action is patient mediated or provider mediated.

Table 1.

Clinical sharing scenarios

Considering only HIPAA and not any relevant state laws, may the covered entity (provider)…	Answer
Patient-mediated approaches
Scenario 1: provide their patient with a letter or other information to share with her family members regarding their risk and testing options?	Yes. Any disclosure under this scenario would be made by the patient, who is not a covered entity.
Scenario 2: provide their patient with a ‘consent to contact’ form to provide to their relatives?	Yes. Any disclosure under this scenario would be made by the patient, who is not a covered entity.
Provider-mediated approaches
Scenario 3: directly contact their patient’s adult relatives, with authorization from the patient, for the purpose of recommending testing?	Yes. With authorization from the patient, the provider may contact the patient’s adult relatives.
Scenario 4: directly contact a patient’s adult relatives, without authorization from the patient, for the purpose of recommending testing?	No. Direct contact with a relative would not be permissible without authorization from the patient unless state public health law(s) acknowledge genetic risk information for a particular disease or condition as a ‘reportable condition’ for public health intervention.
Scenario 5: directly contact her patient’s adult relatives, over the patient’s objection, for the purpose of recommending testing?	No. If a patient has directed nondisclosure, even under the treatment of others exception, a covered entity is bound by this restriction.
Scenario 6: directly contact the provider of their patients’ relative, for the purpose of recommending testing?	Yes. A covered entity may disclose PHI without authorization for the purpose of treating another patient.
Public health-mediated approach
Scenario 7: directly contact the public health authorities to report a patient’s genetic risk, for the purposes of recommending cascade testing?	No, unless a state public health law acknowledges a particular genetic disease or condition as a ‘reportable condition’ thereby authorizing its disclosure to the public health authority.

Hypothetical case: Mary, after finding out she has breast cancer, receives genetic testing and learns that she has a pathogenic variant in the BRCA1 gene. Dr. G, her physician, recommends that her brother and sister also be tested. However, Mary is not in touch with her brother and is not willing to contact him. While she is willing to tell her sister, Mary is afraid she will not provide the correct information. Dr. G wants to contact Mary’s brother and sister to inform them that they have a 50 per cent risk for inheriting the causative pathogenic variant and to recommend testing. Dr. G knows that the brother is being treated by a colleague in the same health system. Both providers are covered entities.

IV.A. Patient-mediated approaches (Scenarios 1 and 2)

Patient-mediated approaches include those where the main responsibility for informing relatives falls with the patient but where the provider offers support to that process, most typically in the form of providing a letter (Scenario 1) or a consent to contact form (Scenario 2) for the patient to share with their relatives. These are the traditional methods currently used in clinical genetics for notifying at-risk relatives.

Any disclosures under these scenario would be made by the patient. HIPAA regulates when and how covered entities can disclose a patient’s PHI, but the patient is free to disclose their own health information to anyone.

Providers may also provide a letter for the patient to share with relatives, explaining why testing might be important within the family, to notify them about the mutation that has been identified in the family, their risk for inheriting it, the health conditions associated with it, and the benefits of getting tested.

Alternatively, providers might offer the patient a form to pass along to their relatives, where the relative can indicate their consent for the provider to contact them directly. The family member then completes the form and returns it to the clinic. Upon receipt, the provider could then contact the relative directly to recommend testing. This approach avoids any direct disclosure to relatives who might not want to know about their own risks. However, its effectiveness in promoting uptake of testing by relatives might be limited.

IV.A.1. Patient-mediated approaches: evidence for effectiveness

A growing corpus of evidence finds that patient-mediated approaches are not effective at reaching all needed relatives.²⁷ Only half of relatives of people with LS receive genetic testing,²⁸ and uptake of testing for HBOC (BRCA testing) among eligible relatives is only 20–30 percent.²⁹ A systematic review for HBOC and LS found that uptake of testing in at-risk relatives after the standard patient-mediated procedure was low, ranging from 21 to 44 per cent in studies where the genetic center reported testing outcomes in relatives and from 15 to 57 per cent in studies where the proband reported testing outcomes in relatives.³⁰

A relative may always choose to decline testing when offered, but once at-risk relatives receive adequate information, a majority will pursue genetic testing.³¹ However, up to a third of at-risk relatives go unnotified or remain unaware of their potential risk.³² Even studies designed to improve rates of relative testing show minimal improvement, including for consent-to-contact forms.³³ Thus, patient-mediated models ultimately result in missed opportunities: high-risk individuals not receiving recommended screening and follow-up care, potentially resulting in life-threatening disease that could have been prevented or diagnosed earlier.

IV.B. Provider-mediated (direct contact) approaches (Scenarios 3–5)

Provider-mediated approaches include those where the provider communicates directly with their patient’s relatives to recommend cascade testing. Under the HIPAA Privacy Rule, an individual may ‘direct[] the covered entity to transmit [a] copy of protected health information directly to another person designated by the individual’.³⁴ This purpose is separate from both disclosures to individuals involved in the patient’s care and disclosures necessary to identify, locate, and notify family members, guardians, or anyone else responsible for the patient’s care, of the patient’s location, general condition, or death, which are subject to different requirements.³⁵ Thus, if the patient has provided authorization for direct contact, the provider may contact the relative directly (as in Scenario 3).

There is some concern that the covered entity would violate the relative’s right to privacy by contacting the relative without their prior authorization. Some have argued that a relative would need to provide consent to be contacted in the USA³⁶ This concern, however, is not necessarily grounded in the actual text of the HIPAA Privacy Rule and would seem inconsistent with a patient’s ability to direct their own PHI to a third party. Legally, a provider can contact the relative about a patient’s PHI with that patient’s authorization. It is then an ethical, not a legal, question as to whether this would violate privacy norms for the relative. For example, relatives may be uncomfortable to learn of genetic risk from someone outside their care team or that the patient shared their contact information.

Under HIPAA, disclosure of Mary’s PHI to a relative would not be permissible without authorization from the patient (Scenarios 4 and 5). While Dr G does not need Mary’s authorization to contact a family member, the potential issue is in the disclosure of Mary’s PHI. In Scenario 4, the provider did not specifically ask the patient for authorization to disclose test results, for example, at the time of testing or if the patient is now deceased or otherwise unavailable, where the patient neither actively declined nor provided authorization.

Even under the treatment of others specification, a patient may request nondisclosure of their PHI through a request that a covered entity restrict how it uses the patient’s PHI (Scenario 5).³⁷ If the provider agrees to such a request, a covered entity is bound by this restriction except under the public health exception. There are limited instances when a provider must agree to a requested restriction, such as when the patient has paid for the service that generated the information.³⁸

IV.B.1. Provider-mediated approaches: evidence for effectiveness

Data from outside the USA suggest provider-mediated approaches might be both effective and acceptable to patients. One center improved the proportion of at-risk first- and second-degree relatives being tested from 23 per cent (using patient-mediated processes) to 40 per cent of at-risk relatives being tested after implementation of provider-mediated direct contact of relatives in HBOC families through direct mail.³⁹ Another study used direct contact of at-risk relatives in HBOC families who had not come forward for testing after a patient-mediated approach, successfully contacting additional relatives, of whom virtually all decided to have testing.⁴⁰ In both studies, probands had provided their relatives’ contact information to researchers and the provider-mediated contact followed unsuccessful patient-mediated outreach. In Denmark, 66% of directly contacted relatives preferred contact from the hospital rather than from their own relative.⁴¹ Two USA-based studies found that provider-mediated approaches were largely acceptable to patients.^42,43

IV.C. Provider-to-provider approaches

A provider may contact the provider of a patient’s relative to recommend cascade testing (Scenario 6). Under the treatment of others specification and the HHS Office of Civil Rights interpretation of HIPAA,⁴⁴ the Rule permits a doctor to ‘disclose protected health information about a patient to another healthcare provider for the purpose of treating another patient (e.g., to assist the other healthcare provider with treating a family member of the doctor’s patient).”⁴⁵ In this context, it may be possible for genetic information to be disclosed for the purposes of care of multiple family members. However, though permissible, under HIPAA the provider is not required to conduct such outreach or disclosure. Additionally, as in Scenario 5, the patient may request that disclosures be limited and, if the request is agreed to, the provider must abide by this request.

In Scenario 6, the HIPAA treatment of others text is limited to communication between two providers. In this case, contact and information sharing between the patient’s provider and the relative’s provider would be permissible even without patient authorization. Provider-to-provider approaches are not well studied, and their acceptability to patients and relatives is, not well understood. One small study suggested that provider to provider contact might be less preferred than provider-to-relative direct contact.⁴⁶ It is also unclear how information should be disclosed between the relative and the relative’s provider.

IV.D. Public health-mediated approaches

While this paper has focused on the treatment of others specification to HIPAA, another exception could also be important in the context of cascade testing—the public health exception (Scenario 7). Under HIPAA, a covered entity may disclose PHI without patient authorization to a public health authority ‘for the purpose of preventing or controlling disease, injury, or disability’⁴⁷ or directly to any person who may ‘be at risk of contracting or spreading a disease or condition’ if the covered entity is ‘authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation’.⁴⁸ The public health exception has been used primarily in the context of communicable disease, where a standard of imminent harm has been applied given the time-sensitive nature of disease transmission. Countries outside the USA have explored public health approaches to cascade testing.⁴⁹

For the public health exception to encompass genetic risk, a change in law (either a change to the HIPAA exception itself or to authorizing state public health statutes) would be required to acknowledge genetic risk information as a reportable condition. The high risk of disease associated with some pathogenic variants and the effectiveness of preventive intervention (for example, some variants in the BRCA1/2 genes increase breast cancer risk to 45–65 per cent by age 70 years⁵⁰) in addition to the higher rates of transmission (50 per cent to all first-degree relatives), which is much higher than the risks of transmission for most communicable diseases, might one day warrant more active public health involvement in risk notification. If this happens, providers might be required to report certain genetic risk variants to public health authorities, who would then take responsibility for contacting at-risk relatives. Providers may then be permitted or required to intervene directly with at-risk relatives.

V. DISCUSSION

Familial notification of genetic risk is a major part of the promise of genomic medicine, as it might lead to improved health outcomes not just for individuals but for their biological relatives. As genomic medicine enters the mainstream healthcare practice, the current law needs to be clarified on the permissibility of directly contacting relatives and their providers to communicate potential genomic risk. This clarification is particularly needed given the little-known HHS treatment interpretation that disclosures can be made for other individuals without patient authorization. Increased knowledge of this interpretation might greatly expand the ability of healthcare providers to participate in risk notification. Moreover, the current lack of inclusion of autosomal dominant, highly penetrant genetic conditions as ‘reportable conditions’ drastically limits providers’ ability to pursue cascade testing through the public health exception, so in the current state, direct-contact cascade screening programs mediated by providers or health systems may be the only way that providers can reach at-risk relatives.

To date, interpretations of HIPAA have focused primarily on protecting individual patient privacy during the transmittal of PHI between covered entities and payers. Thus, a de facto standard has developed favoring patient-mediated approaches consistent with the strictest interpretation, and thus, the burden of disclosure has fallen to the patient. However, the HHS treatment interpretation, particularly considering the limitations of patient-mediated risk notification approaches, has the potential to drastically alter common conceptions of HIPAA and the goals of protecting patient privacy. Its implications should be carefully assessed.

Our analysis finds that several provider-mediated approaches are currently permissible under HIPAA, including contact of relatives with patient consent and provider-to-provider contact. Several approaches are also not permissible. In cases where the patient does not give permission or explicitly forbids disclosure,⁵¹ the legal authority to override patient objection would need to be clear, so direct contact of relatives over a patient’s explicit objection (Scenario 5) is likely to be unrealistic in most circumstances. The most likely scenario for a provider-to-provider approach (Scenario 6) might be between providers within single covered entity are treating multiple relatives, but provider-to-provider contact could also occur across covered entities.

It is possible that discourse could move toward a public health model for genetic risk (Scenario 7), particularly for conditions associated with very high risk of serious disease and where clinical intervention could alter the natural history of disease. However, this would require legal action, and debates are ongoing about the merits of such an approach.

Many unanswered questions remain around how direct contact programs could be implemented in the USA. For example, it is unclear what information would or should be shared between the relative and the relative’s provider in the provider-to-provider sharing. HIPAA sets forth a requirement that only the minimum necessary amount of information be shared for some allowable disclosures, but this primarily applies to disclosures under payment and healthcare operations.⁵² However, given that the HHS treatment of others interpretation would allow for the sharing of patient information for purposes beyond their own care, we suggest that the minimum necessary standard should be applied both to risk communications between providers for the treatment of relatives and to the information relayed from the relative’s provider to the relative. This would help to maximize privacy (for example, a provider might contact relatives directly to encourage genetic testing, but not include the patient’s name or the exact pathogenic variant), even in a context when the law might allow for broader sharing than patients realize. However, the effectiveness of varying levels of PHI in communicating potential risk to relatives is not well understood. Comparative studies of different approaches to implement such programs are needed.

In the absence of implementation of provider-mediated approaches in US settings, many knowledge gaps remain, including potential unintended consequences. Research needs include evidence on how to operationalize ‘minimum necessary’ information in the context of familial risk sharing; studies of provider-mediated contact in US settings and their impact on providers and health systems as well as patient and family experiences and outcomes; and continued legal and ethical analysis of needs and obligations of individual providers and care teams versus health systems. Special attention should be given to unintended consequences or harms to patients, families, and providers, including an unintended scope of practice creep over time from permissibility to an ethos of duty to warn relatives, and thus liability, which could negatively impact smaller practices in particular.

VI. CONCLUSION

Multiple forms of provider-mediated direct contact of relatives are already legally permissible under HIPAA. These approaches are consistent with ethical obligations of care to patients and families and could demonstrate improved health outcomes through identification of clinically actionable disease risk. Unanswered questions remain about whether this should or could become a legal duty to warn relatives and about the optimal implementation and effectiveness of direct contact programs in improving population health.