A FAUSTIAN BARGAIN THAT UNDERMINES RESEARCH PARTICIPANTS’ PRIVACY RIGHTS AND RETURN OF RESULTS

Abstract

A 2018 committee report published by the highly respected National Academies of Science, Engineering, and Medicine (the Report) recommends stripping research participants of crucial data privacy rights and discarding decades of carefully deliberated consensus guidelines for the ethical return of results and data from research. This Article traces these disturbing recommendations to three root causes: (1) a statement of task that blocked careful and impartial analysis of a disputed legal matter central to the Report; (2) a piecemeal legal analysis that omitted relevant strands of law; and (3) the inappropriate conflation of two distinct concepts—the return of individual research results (the stated subject of the Report) and privacy-enabling individual access rights, which have a nearly fifty-year legal history long predating the modern debate about return of results. The Report’s recommendations would erect new barriers to the return of results and, simultaneously, dial back a core data privacy right that Americans—including many research participants—currently enjoy. We urge extreme caution in implementing this Report’s flawed recommendations. Congress has elevated the right to see one’s personal information to the status of a civil right in many different data environments. Diminishing individual access in the research context erodes its status as a right more broadly.

Faustian bargain: a pact whereby a person trades something of supreme moral or spiritual importance, such as personal values or the soul, for some worldly or material benefit, such as knowledge, power, or riches…. Faustian bargains are by their nature tragic or self-defeating for the person who makes them, because what is surrendered is ultimately far more valuable than what is obtained, whether or not the bargainer appreciates that fact.¹

Introduction: An Assault on Longstanding Rights to See One’s Own Data

For nearly fifty years, federal, state, and global lawmakers have created rights to access one’s own data as a crucial dimension of privacy rights.² Without the ability to access your data, you cannot spot errors, assess the privacy threat posed by circulation of those data, or determine whether to consent to sharing and secondary uses. In the United States, the Health Insurance Portability and Accountability Act (HIPAA)³ Privacy Rule⁴ has applied this access right to health information, including research-generated information, for nearly two decades.⁵ Yet it continues to meet resistance, motivating some states to threaten (and some to enact) data-ownership statutes.⁶

Meanwhile, on a separate track, commentators since at least 1980⁷ have urged that researchers offer to share with research participants their individual-specific research results and incidental findings in the ethical conduct of research, with endorsement of this practice in consensus reports since 1999.⁸ While the appropriate scope of return has been debated, the basic importance of return of results and incidental or secondary findings is now widely recognized, funded by the National Institutes of Health (NIH) in many studies, and globally practiced.⁹ However, this too continues to meet resistance.

Both of these domains raise questions of science, medicine, law, and ethics. Progress requires rigorous analysis on all fronts. Yet progress is now endangered by a 2018 report from the National Academies of Science, Engineering, and Medicine (the Report).¹⁰ The Academies, a prestigious and highly influential body that has advised the federal government since the Civil War,¹¹ convened a committee to analyze and issue recommendations on return of results and individual access to data. In a stunning departure from the usually excellent quality of Academies reports, this Report failed to provide a thorough legal analysis, thus dooming the Report’s many legal and regulatory recommendations. Worse, the Report conflated the legally separate domains of HIPAA access and return of results. The damage and danger are real. At a time of great progress toward transparency in research, partnership with research participants, and true engagement with research participant communities, the Report threatens to turn back the clock, endangering long-established privacy rights and stalling return of results.

In the domain of privacy, not only has the Report recommended that regulators gut current privacy rights, but the Report adds fuel to a highly problematic movement to grant individuals ownership rights in their own data—a change that would endanger biomedical research and progress. The metaphor of individual data ownership persists in popular discourse about research ethics and data privacy¹² despite fairly wide scholarly agreement that data ownership has serious conceptual and practical flaws.¹³ A few states recognize property rights¹⁴ or have considered doing so¹⁵ for certain kinds of data, most notably genetic information.¹⁶ At the federal level, however, Congress rejected data ownership as a tool for privacy protection almost fifty years ago¹⁷ and instead embraced a civil rights model of data privacy.¹⁸ Instead of declaring that people own their data and letting courts elaborate the rights and duties ownership entails, Congress has tried to enunciate a core set of rights people should have when their personal data are stored, used, and shared by others.¹⁹

These rights are created by federal privacy statutes, such as the Privacy Act of 1974,²⁰ and by privacy regulations Congress authorized when passing other statutes such as HIPAA and the Genetic Information Nondiscrimination Act (GINA).²¹ In many respects, they resemble the same “bundle of sticks”²² people would have if they owned their data²³ but, technically, they are federal civil rights instead of ownership rights. With this artful strategy, Congress was able to provide a federal floor of privacy protections that somewhat resemble data ownership, without inviting challenges by declaring people “owners” of their own data and without encroaching on the states’ traditional prerogative to establish the limits of property law and regulate relationships such as those between individuals and health care institutions.²⁴

One of the privacy rights Congress has consistently protected, dating back to the early 1970s, is the individual’s right of access to one’s own data—that is, a right for people to inspect and receive copies of personal information that others are storing, using, and disclosing about them.²⁵ Individual control, rather than secrecy, is central to the modern paradigm of data privacy,²⁶ and people obviously have no control if they cannot even see what their data contain or gain access to their records. Privacy-related access mimics the right of ingress that inheres in property ownership—a right to enter and inspect one’s property.

Some data holders, for various reasons, resist having to provide this access, and individual access rights are not always vigorously enforced.²⁷ The Academies’ Report observed that providing individual access to data and results at research laboratories is burdensome for researchers and might reduce their productivity.²⁸ The Report stresses that funds for biomedical research “are precious and require careful and responsible stewardship,” so that letting participants have data access “necessarily requires the diversion of some research resources from the primary goal of the research.”²⁹ In short, honoring people’s right to see their own results and data generated during research is inconvenient.³⁰

This kind of failure to provide access enhances pressure for statehouses to enact data-ownership laws to give people desired control over their data.³¹ A patchwork of state data-ownership bills, if enacted, would strengthen individual access but could impede the availability of data for research and other socially beneficial uses. Attempts to weaken existing federal individual access rights thus invite serious unintended consequences for biomedical research, which increasingly relies on data as fuel for discovery.

This Article explores how the Academies’ Report, which is entitled, “Returning Individual Results to Research Participants,”³² would affect research participants’ privacy rights while also undermining the ethical practice of returning results and data. The Academies are independent, private bodies that trace their lineage to a congressional charter President Lincoln signed in 1863.³³ They appoint expert committees to conduct studies of policy questions that require scientific or medical insights and analysis.³⁴ “The reports of the Academies are viewed as being valuable and credible because of the institution’s reputation for providing independent, objective, and nonpartisan advice with high standards of scientific and technical quality.”³⁵ The Academies describe themselves as “the nation’s pre-eminent source of high-quality, objective advice on science, engineering, and health matters.”³⁶

The sponsor of a study—often a federal agency—works with the Academies to agree on a statement of task (SOT) that defines the scope of work.³⁷ “Most studies are funded by those requesting the advice,” with costs ranging “from about $200,000 to more than $1 million,” which is free of any fees for the subject-matter experts serving on the study committee, because they volunteer their time.³⁸ The majority of studies are paid for by federal agencies.³⁹

The Academies generally follow a policy of self-imposed restraint when recommending changes to federal statutes and regulations. The Academies’ criteria for reports thus state that recommendations calling for the adoption of specific legislation are “[o]f particular concern” and “should be avoided unless specifically called for in the study charge.”⁴⁰ This approach displays respect for the rule of law and for the Constitution, which entrusts Congress—and the agencies Congress authorizes—to make our federal laws and regulations.

When a study addresses legal questions, the Academies’ “high standards of … technical quality”⁴¹ demand the same excellence that the Academies require when analyzing questions of science, engineering, and medicine. This means that reports discussing the law should meet legal professional standards. Those standards require accurate statements of law based on thorough legal research,⁴² not just when representing clients in a practice setting, but also when providing “law-related services”⁴³ such as writing scholarly articles or National Academies reports.

Something went off track in the Academies’ Report on return of results. The three sponsoring agencies⁴⁴ for the Report were NIH, the Food and Drug Administration (FDA), and the Centers for Medicare and Medicaid Services (CMS), which administers the Clinical Laboratory Improvement Amendments of 1988 (CLIA)⁴⁵ regulations that promote the safety of laboratory tests used in clinical care.⁴⁶ The Report focuses on questions raised by return of individual research results to people participating in studies that involve analysis of biospecimens⁴⁷ — in other words, studies that include laboratory tests of people’s blood or tissue samples.⁴⁸

This Report deviates from the Academies’ own standards of quality, restraint in legal recommendations, and respect for the rule of law. It is full of legal content and makes multiple legal recommendations and thus needed to meet the professional standards for legal analysis. Yet it makes statements about federal law that prove false when subjected even to cursory legal research.⁴⁹ The SOT expressly instructs the committee not to propose any amendments to the CLIA statute,⁵⁰ yet the Report recommends CLIA regulatory changes that appear unlawful unless Congress amends the CLIA statute.⁵¹ A rudimentary requirement of legal due diligence is to vet any proposed regulatory changes to make sure they would not violate current statutes. However, there is no sign this vetting occurred: some recommendations press agencies to take actions beyond their statutory authority, while others awkwardly call for regulations to be amended to do things the regulations already do.⁵² The Report even presumes to advise one agency—the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR), which holds the delegated authority⁵³ to administer the HIPAA Privacy Rule⁵⁴—to scale back one of HIPAA’s core privacy protections,⁵⁵ even though OCR was not a study sponsor and the Report provides little evidence that OCR was consulted.⁵⁶

The Report “achieved consensus on a number of core issues” including a claimed need to “transition away from firm rules, such as those embodied in … the [HIPAA] regulations, that stipulate when [laboratory test] results must or cannot be disclosed toward a process-based approach.”⁵⁷ The “firm rules” in question include U.S. federal laws, which the Report airily recommends our nation should “transition away from.”⁵⁸

Part I of this Article asks how this happened. We trace the core problem to the Report’s SOT, which incorporated a disputed legal position advanced by CMS, one of the agencies sponsoring the Report. The SOT recited this position as if it were an established legal truth and instructed the committee not to examine the CLIA statute⁵⁹ (which, had it been examined, proves otherwise). Working with sponsor-imposed legal “blinders” on, the Report made two assumptions about federal law: first, that the HIPAA Privacy Rule’s individual access right⁶⁰ is in conflict with the CLIA regulations,⁶¹ so that research laboratories will violate CLIA if they comply with HIPAA⁶² and, second, that the CLIA regulations more broadly bar any reporting of individual-specific research results by non-CLIA-certified research laboratories,⁶³ including established ethical practices such as the return of results and data from research. This Article subjects these assumptions to the analysis that the Academies’ committee was ordered not to provide. Neither assumption withstands legal scrutiny.

Part II of this Article disentangles two concepts that the Report improperly conflated. The first is privacy-related individual access rights, such as those protected by the HIPAA Privacy Rule,⁶⁴ the federal Privacy Act,⁶⁵ various state privacy laws,⁶⁶ and the privacy laws of other jurisdictions such as the European Union.⁶⁷ The second is the return of an individual’s research results as elaborated in the bioethics and scientific literature and in consensus guidelines developed and widely applied over the past twenty years.⁶⁸ These concepts do have a superficial similarity: both have the effect of placing individual test results and data into research participants’ hands. This similarity invites authors—including us at times⁶⁹—to discuss the two in one breath. Here, however, we stress that they are distinct concepts, with different legal histories and rationales that the Academies’ Report failed to acknowledge. This omission, we argue, contributed to a legally flawed set of recommendations.

Part III supplies necessary background on the CLIA statute and regulations—admittedly a dry topic but one that crucially affects research participants’ privacy and ethical rights in research involving laboratory testing. Part IV critiques CMS’s position regarding its jurisdiction to regulate research laboratories under CLIA. Specifically, is the CMS position a permissible interpretation of the CLIA regulations and does it warrant deference? We conclude the answers are “no” and “no.” Part V explains why the Report’s starting assumptions about HIPAA access and the return of results were flawed and then explores how these erroneous assumptions produced problematic recommendations.

What emerges is that the Academies’ Report proposes a sweeping program of regulatory reforms to resolve a presumed regulatory conflict that actually never existed. The Report proclaims support for the ideal of greater participant access to results and data, while recommending policies that would constrict and delay that access. This contradiction may confuse readers on first exposure to this Report. However, careful analysis requires going beyond the Report’s rhetoric to its actual recommendations. The Report champions greater respect for people who participate in research by calling them “research ‘participants,’ rather than research ‘subjects,’”⁷⁰ yet its recommendations fail to trust these people by protecting their access to their own personal information. The Report urges stripping research participants of established privacy and ethical rights.

The Academies’ Report on return of results struck a Faustian bargain.⁷¹ It analyzed a problem under terms that traded away something of supreme importance—the Academies’ 150-year tradition of independence, objectivity, and high standards of technical quality⁷²—and doomed the Report’s legal and policy recommendations.

I. A Troubling Statement of Task

The Report’s SOT states: “Currently, any research laboratory that returns individual-specific research results is regulated by CLIA.”⁷³ This statement assigns controlling weight not to a statute or regulation, but rather to a strange and highly controversial position CMS announced in a lowly PDF file⁷⁴ posted unsigned on its website on or about December 2014.⁷⁵ According to this position, research laboratories cannot report individual-specific results unless the results meet clinical standards of quality⁷⁶— which, according to the PDF file, means that the laboratory must comply⁷⁷ with CLIA. The Report wrongly characterizes this PDF position as a CMS “interpretation” of the CLIA regulations,⁷⁸ seemingly unaware that “interpretation” is a legal term of art. Not every opinion or position put forth by a federal agency is a permissible interpretation of the law. We explain how CMS’s position contradicts the clear⁷⁹ jurisdictional language of the CLIA statute⁸⁰ and is inconsistent with the plain text of the CLIA regulations.⁸¹ Nevertheless, the SOT recites it as an established legal truth.⁸²

The Report admits that CMS’s position is legally controversial, but credits it without any analysis.⁸³ The SOT required this approach, insisting that the committee “not provide any legal interpretation or analysis regarding the scope or applicability of CLIA.”⁸⁴ This barred the committee from conducting elementary legal research—such as checking what the relevant statute says—that would have readily revealed the error in the SOT.⁸⁵

The Report recounts how “[t]he sponsors indicated to the committee that it would be appropriate to include in its description of the current regulatory environment for the return of individual research results CMS’s current interpretation of the scope and applicability of CLIA.”⁸⁶ This was an instruction for the committee to take sides in a legal dispute by describing a contested agency position about the law (the PDF position) as if it really were the law. Accordingly, the Report, in places, ceases to characterize CMS’s position as a disputed agency assertion and instead repeats that position, in the committee’s own voice, as a firm declaration of legal truth.⁸⁷ Doing so lends the Academies’ reputation to an unexamined and, it turns out, legally flawed assertion.

The Report’s SOT is the legal equivalent of having a sponsor instruct the Academies to conduct a scientific study that assumes Π=6 (instead of 3.14159265359 …),⁸⁸ and without asking any questions. It might be appropriate in some circumstances for a study to examine a counterfactual hypothetical, if it is consistently described as a hypothetical. For example, a report by the Academies could conceivably state:

The National Aeronautics and Space Administration (NASA) is planning a mission to a distant galaxy where circles are not round and the usual laws of physics do not hold. Accordingly, NASA has engaged the Academies to advise NASA how to operate in an environment where Π=6. The Academies have agreed to perform this study but take no position on whether Π=6.

It is a different matter for study sponsors to instruct a committee of the Academies to “include in its description” of the truth a federal agency’s disputed version of the truth, without “making any comments, analysis, or conclusions regarding the appropriateness of that interpretation.”⁸⁹ That is what the Academies agreed to do in this Report.

For the Academies to agree to include an agency’s disputed views in the Academies’ own “description of the current regulatory environment,”⁹⁰ with no fact-checking, makes the Academies a captive mouthpiece for a federal agency under fire. Seemingly, all an embattled agency would need to do in order to advance its version of disputed law or facts would be to enter into a contract with the Academies and set ground rules requiring a report to treat the agency’s side of the dispute as reality. An agency could, for example, instruct the Academies to publish a report that “include[s] in its description”⁹¹ that climate change is not real, that smoking does not cause cancer, that nobody in America suffers from hunger or substandard health care, that endangered species are thriving, or that the First Amendment does not protect the freedom of religion. These may seem far-fetched fodder for future Academies reports, but that reaction underscores the importance of scrutinizing the terms an agency imposes. Accepting agency positions and writing them into a committee’s consensus report risks allowing the Academies’ reputation for rigor and independence to be diluted and used to advance contested agency agendas. The potential for mischief is real, especially in an age pundits have christened the “post-truth era.”⁹²

The Academies’ agreement to conduct a study on these terms is concerning, as is the fact that this study proceeded to completion under these strictures. The Academies have procedures in place to correct an SOT that a committee, once it starts work, determines is inadequate.⁹³ Still, the portrait that emerges here is of a sincere and hard-working committee saddled with a deeply troubling SOT. Going forward, the Academies should be very reluctant to bind a committee to a sponsoring agency’s account of the law, especially when that account is mired in known controversy.⁹⁴ The Academies’ well-earned reputation for rigorous analysis should extend to its legal analysis, not just medicine and science.

II. Distinguishing HIPAA Data Access from the Return of Results

Privacy-related individual access rights, such as the rights central to the HIPAA Privacy Rule,⁹⁵ arguably were beyond the scope of the Academies’ Report. The Report’s stated subject matter, as indicated in its title, was the return of individual research results. The Report dragged HIPAA’s access right into its scope by accepting CMS’s position that CLIA prohibits the return of results from non-CLIA-certified research laboratories; this seems to imply that CLIA also prohibits HIPAA access.⁹⁶ The reality is more complicated. HIPAA’s access right differs from the return of results in terms of its history and legal basis, its rationale and purposes, the scope of data disclosure to fulfill those purposes, its administration and enforceability, and the customs and practices surrounding it. By blurring two very different concepts, the Report overreached into subject matter—data privacy law—for which its committee membership was not constituted and which lay outside the jurisdiction of the three agencies sponsoring the Report. This Part highlights key differences between the two concepts.

A. Return of Results: History, Purpose, and Scope

The practice of returning individual research results and incidental or secondary findings⁹⁷ grew out of ethical and pragmatic concerns elaborated in the bioethics and scientific literature for decades and in consensus guidelines over the past twenty years.⁹⁸ Beginning in 1999, consensus recommendations have urged researchers to offer some individual-specific findings to research participants.⁹⁹ Most of these recommendations are based on ethical concepts including respect for autonomy, reciprocity, a limited duty of “ancillary care,” and an ethical duty to warn.¹⁰⁰ No statute or regulation expressly commands return of these findings, but commentators have argued that the federal regulations governing research with human participants articulate relevant duties.¹⁰¹ These include the duty to describe all expected risks and benefits in eliciting consent and the duty to include in the consent form, if required by the IRB, “a ‘statement that significant new findings developed during the course of research which may relate to the subject’s willingness to continue participation will be provided to the subject.’”¹⁰² While health care professionals providing clinical care may have common law duties to recognize and communicate incidental findings of health significance and have been sued for failure to do so, the potential liability of researchers is less clear.¹⁰³ Research records may contain detailed information about participants, including genome sequencing¹⁰⁴ or imaging results,¹⁰⁵ giving rise to an ethical¹⁰⁶ and possibly even a common law duty¹⁰⁷ to warn participants of findings that suggest a need for follow-up clinical testing and evaluation.

There is ongoing debate about how much of the information generated by research ought to be returned. A number of consensus recommendations distinguish findings that should be offered to participants, those that may be offered in the researcher’s discretion, and those that should not be offered.¹⁰⁸ Some commentators confine the first category to results with analytic validity and clinical significance, such as laboratory test results having analytic validity,¹⁰⁹ clinical validity,¹¹⁰ and clinical utility¹¹¹ or actionability.¹¹² This view implicitly grounds “should return” in a duty to warn.

Commentators have long recognized that researchers “may return”—in other words, it is ethically permissible for them to return—a broader set of research findings, even when the clinical significance is unclear.¹¹³ The information in question could include test results that warrant further evaluation such as genetic results that require further clinical evaluation or environmental exposure results whose clinical meaning is not yet well understood. Researchers may also offer findings that may be of reproductive or personal importance, such as the participant’s genetic carrier status or genetic risks (such as risk of developing Alzheimer’s disease) even if there is no efficacious treatment currently available. This view treats the return of information as serving broader health, dignitary, and pragmatic purposes beyond a mere duty to warn of clear danger—for example, displaying respect for participants’ autonomy and agency over information that pertain to them, or enhancing their engagement with the research.

The literature on return of results and incidental or secondary findings has also increasingly acknowledged the importance of recognizing participants’ right to receive their own raw data.¹¹⁴ This may enable participants to follow future progress in understanding data whose meaning is currently unclear. Access can also empower participants to contribute their data to other studies, initiate research studies in partnership with others, and form social networks with similar individuals.¹¹⁵ Surveys show that participants value the return of results and data even when the information is uncertain or lacks clinical significance.¹¹⁶

B. Privacy-Related Individual Access Rights: History, Purpose, and Scope

The HIPAA access right has a distinct history, purpose, and scope. The HIPAA Privacy Rule,¹¹⁷ since it was first finalized in December 2000,¹¹⁸ has always contained an individual access right.¹¹⁹ This is a legally enforceable civil right—specifically, a privacy right—created by federal regulations. Before 2014, however, this right could not be exercised at HIPAA-covered laboratories in all fifty states, because some states had laws limiting individuals’ direct access to laboratory test results, and the federal HIPAA and CLIA regulations were deferring to those state-imposed restrictions.¹²⁰ On February 6, 2014, CMS joined OCR in promulgating a final rule¹²¹ preempting state laws that limit people’s ability to exercise their access rights at HIPAA-covered laboratories.¹²² This made all HIPAA-covered laboratories subject to the access right.

The Academies’ Report never discussed the history of privacy-related access rights. This omission left a false impression that HIPAA’s access right is some sort of recent innovation, an isolated aberration. To the contrary, HIPAA’s access right rests on a fifty-year history of federal privacy laws that treat individual access to one’s own data as a fair information practice and a core element of data privacy protections.¹²³ Indeed, the importance of individual access to data held by others is so well established, that many states have recognized the same right in various contexts.¹²⁴

At the federal level, the Privacy Act of 1974 includes a congressional finding that data privacy is a fundamental right protected by the Constitution¹²⁵ and it describes an individual right to inspect and obtain one’s own data as necessary and proper to protect this privacy right.¹²⁶ These are enacted congressional findings of fact—not just flowery words Congress put in front of the legislation, but an actual part of the legislation itself, passed by both houses of Congress, signed into law by President Ford, and recorded as statutes in the U.S. Code.¹²⁷ The Privacy Act expresses Congress’s conviction that access enables the exercise of fundamental Constitutional rights.

The Privacy Act provides privacy protections (including an access right) only for data held in governmental databases—for example, federally held Medicare data—but it commissioned a Privacy Protection Study Commission (PPSC) to recommend protections for data in private-sector environments.¹²⁸ HIPAA’s access right flows from these PPSC recommendations published in 1977.¹²⁹ The 1996 HIPAA statute¹³⁰ required HHS, by 1997, to prepare a report for Congress on federal health privacy protections.¹³¹ This 1997 HHS report¹³² cited and incorporated the PPSC’s 1977 recommendations in its roadmap for the HIPAA Privacy Rule.

The Academies’ Report enumerates the many purposes that return of individual research results serves,¹³³ but omits any discussion of the well-articulated legislative and regulatory purposes served by privacy-related access rights, so we briefly fill this gap here. Return of results and privacy-related access exhibit some overlapping purposes—for example, both display respect for participants’ autonomy and both empower people to form social networks and contribute their data to other research studies—but their foundational purposes are distinct. As noted in the Academies’ Report, the return of results initially grew out of a perceived ethical duty to warn participants when research detects a potential health risk that the participant might otherwise have no way to know.¹³⁴

In contrast, HIPAA’s access right serves privacy-enabling purposes. These were first articulated in the PPSC’s 1977 report and in the 1997 HHS recommendations to Congress.¹³⁵ HHS, OCR, and CMS further elaborated the purposes of HIPAA’s access right in the preambles to proposed and final rules creating or expanding that right.¹³⁶ Readers are referred elsewhere for a detailed discussion of these sources.¹³⁷ To summarize, the foundational purpose of HIPAA’s access right is to enhance individual privacy protections. Unless people can see the information being stored about them, they cannot assess how much privacy risk the information may pose.¹³⁸ Are the data embarrassing? Is their storage or circulation a source of concern? Are the data even accurate? Might the data contribute to identity theft? Could the data be used to re-identify the individual? Do the data include elements that might implicate them or a loved one in a crime, as recently happened in the case of the Golden State Killer?¹³⁹ People can suffer discrimination or stigmatization based on inaccurate data that have been wrongly attributed to them and, without access, a person has little chance of ever detecting and correcting such errors.

Another foundational purpose of privacy-related access rights is to enable people to give valid, informed consent for secondary use of their stored data. In its 1997 privacy recommendations to Congress,¹⁴⁰ HHS stressed that the “decision whether to disclose a record may depend on what the record says, and so access to the record is integral to making an informed choice to disclose [information].”¹⁴¹ In this respect, the Privacy Rule holds informed consent to a higher ethical standard than does the Common Rule,¹⁴² a major federal research regulation. The Privacy Rule regards people’s authorizations for secondary uses of their stored data as ill-informed, unless they have a way to inspect the data they are being asked to share.¹⁴³ This concept strikes some people as odd, yet it has considerable merit: When consenting to a third-party use of one’s data, being “informed” does not merely mean knowing how the data will be used; it also means knowing precisely what sort of data one is being asked to release to the third party.

The HIPAA Privacy Rule creates a right for individuals to inspect and make copies of all of the data about themselves that a HIPAA-covered entity (such as a hospital, clinic, or HIPAA-regulated laboratory) has stored in each person’s designated record set (DRS).¹⁴⁴ This right is subject only to a few narrow exceptions.¹⁴⁵ The “designated record set” is the legal term of art denoting the HIPAA-accessible records about an individual stored at a particular HIPAA-covered facility.¹⁴⁶ The DRS includes all records “[u]sed, in whole or in part … to make decisions about individuals.”¹⁴⁷ HHS has clarified that this encompasses non-medical as well as medical decision-making and information of a type that the facility uses to make decisions about any individuals, even if that information was not so used when making decisions about the person requesting the data.¹⁴⁸

A person’s DRS is not restricted to information that has clinical significance. In ordinary health-care contexts, for example, the DRS will include a wide range of information, including unverified, speculative doctors’ notes in patients’ charts.¹⁴⁹ People have a legitimate privacy interest in being able to inspect any information ascribed to them, regardless of its reliability or clinical significance. Uncertain and misattributed data that lack any clinical significance can nevertheless place people’s privacy at risk and subject them to stigma and discrimination. Accordingly, the DRS for laboratory data “includes not only the laboratory test reports but also the underlying information generated as part of the test, as well as other information concerning tests a laboratory runs on an individual.”¹⁵⁰ For genomic tests, the DRS could include “the completed test report, the full gene variant information generated by the test, as well as any other information in the designated record set concerning the test.”¹⁵¹

The scope of the HIPAA-accessible DRS is considerably broader than the traditional, more restrictive view of return of results and incidental or secondary findings in service of a duty to warn. It is not, however, all that different from the emerging, broader ethical view of return of results and data in service of values such as respect for research participants’ autonomy and agency over their data.¹⁵²

Many, though not all, research facilities are subject to the HIPAA Privacy Rule.¹⁵³ Their research records are subject to HIPAA’s access right on the same basis that clinical records are—that is, if they fit within the definition of the DRS.¹⁵⁴ Precisely because HIPAA access includes access to research records, the Privacy Rule has always had an access exception letting research facilities suspend research participants’ access rights temporarily during clinical trials.¹⁵⁵ Otherwise, research participants could access their research data while a clinical trial is ongoing and “un-blind” a trial whose validity requires “blinding” during data collection.¹⁵⁶ This exception allows research data to be withheld only if the individual agreed to the temporary denial of access when consenting to the research,¹⁵⁷ and access must be reinstated upon completion of the clinical trial.¹⁵⁸ This exception proves the rule, which is that research results and data held by HIPAA-covered facilities are subject to HIPAA’s access right.

C. Differences in Administration, Customs, and Practices

A number of customs, practices, and guidelines have developed for return of results and data. They are worth noting because they further distinguish this domain from the domain of privacy-related access rights.

As a practical matter, the return of results and data can be initiated by either party—either because an investigator or research institution develops a policy or practice of offering return, or when research participants ask questions. Researchers and their institutions have considerable discretion over whether and how they choose to return results.¹⁵⁹ In contrast, HIPAA access is provided at the request of the individual. With only limited exceptions,¹⁶⁰ HIPAA-covered entities must provide prompt access upon request.¹⁶¹ Failing to do so can lead to administrative sanctions and civil penalties.¹⁶²

Ethics review bodies such as Institutional Review Boards (IRBs) play an important oversight role in return of results and data and IRB, or dedicated return-of-results committees, may be involved in establishing policies.¹⁶³ In contrast, the Privacy Rule does not subject HIPAA access—or any of HIPAA’s other privacy protections—to review or approval by an IRB. IRBs play no role in administering the HIPAA Privacy Rule, except that the Rule does grant covered entities the option of using their IRBs, instead of a special-purpose HIPAA privacy board, to approve waivers of individual authorization for research uses of data.¹⁶⁴ Other than that, the legal protections of the HIPAA Privacy Rule are administered by a federal agency, the OCR, rather than by institutional committees. The Privacy Rule creates federally protected civil rights and does not authorize committees to second-guess or interfere with them.

The ethical conduct of return of results is widely perceived to include a responsibility to provide interpretive assistance (for example, genetic counseling) to help participants make sense of the information they receive and understand recommended next steps such as clinical consultation.¹⁶⁵ These responsibilities may contribute to the Report’s perception that returning results and data “necessarily requires the diversion of some research resources from the primary goal of the research.”¹⁶⁶ In contrast, HIPAA access does not involve interpretive assistance, advice, or counseling. It is a “what’s on file is what you get” right.¹⁶⁷ This flows from the fact that privacy-related access rights are tools for managing privacy risks rather than health risks. The goal is to reveal what is on file, not what it means. Data holders can charge a very restricted cost-based fee to cover some of the costs of access—such as mailing and copying costs.¹⁶⁸ The Privacy Rule allows data holders at their discretion to provide explanations and interpretive assistance under separate arrangements, if the recipient requests such help and agrees to pay the fee, if any, for such services.¹⁶⁹ HIPAA requires data holders to provide information in the DRS, but does not require them to provide advisory services.¹⁷⁰

III. The Scope of CMS‘s Jurisdiction to Regulate Research Laboratories

The Academies’ Report opens with an assertion that HIPAA’s access right¹⁷¹ is in conflict with the CLIA regulations¹⁷² and repeats this assertion throughout the document.¹⁷³ By doing so, the Report embraces a dubious position CMS asserted in its 2014 PDF file: that non-CLIA research laboratories reporting individual-specific results violate the CLIA regulations.¹⁷⁴ The PDF file pays no attention to why the laboratory is reporting the results: Is it reporting them for use in the individual’s clinical care, or to warn a participant to seek follow-up testing and clinical evaluation of a secondary finding from research, or to comply with HIPAA’s access requirement? According to the PDF position, it makes no difference; the mere act of providing the information triggers jurisdiction under the CLIA regulations.¹⁷⁵

The Report characterizes CMS’s PDF file as an “interpretation” of the CLIA regulations—that is, as an interpretative rule¹⁷⁶ or general policy statement¹⁷⁷ (together, “guidance document”¹⁷⁸). The Report seems unaware of the legal implications of characterizing the position stated in the PDF file as an “interpretation.” This characterization, if it were correct, would have important legal consequences. First, it would bear on whether issuing the PDF file was even lawful. Guidance documents do not require notice-and-comment rulemaking¹⁷⁹ under the Administrative Procedure Act (APA).¹⁸⁰ CMS did not follow notice-and-comment procedures when publishing the PDF file. If it was just an interpretive guidance document, then it was lawful, but if the PDF file was something more—such as an attempt to rewrite the CLIA regulations—it violated the APA. Second, the PDF file might be able to escape judicial review, if viewed as a mere guidance document, because of questions about its finality¹⁸¹ and ripeness.¹⁸² If, despite these barriers, the PDF file somehow did come under judicial scrutiny, as guidance documents occasionally do,¹⁸³ CMS would expect to receive deference under Auer v. Robbins,¹⁸⁴ which gives controlling weight to an agency’s interpretation of its own regulations, with only limited exceptions.¹⁸⁵

The Academies’ Report obligingly characterized CMS’s position as an “interpretation” of the CLIA regulations, and accorded it controlling weight.¹⁸⁶ Whether that was appropriate, however, depends on the jurisdictional provisions of the CLIA statute and regulations, which the committee was forbidden to examine.¹⁸⁷ The discussion below supplies the omitted analysis, concluding that the CMS PDF file contradicts the underlying regulation it purports to interpret, attempts to rewrite the CLIA regulations without notice-and-comment rulemaking and, moreover, violates the CLIA statute, and thus cannot be viewed as lawful and controlling.

A. The CLIA Statute’s Jurisdictional Rule

The CLIA statute arose in 1988 when Congress amended¹⁸⁸ an earlier statute, the Clinical Laboratory Improvement Act of 1967.¹⁸⁹ When the House bill that became the 1967 CLIA statute was reported out of the House Interstate and Foreign Commerce Committee, the Chair of that committee explained that there was no intent to regulate research laboratories:

We intend by this legislation to cover those commercial laboratories which are engaged in the business of examining specimens, and provided an exemption for laboratories not directly involved in this type of operation such as those operated by insurance companies.

In addition, it should be pointed out that the bill does not cover laboratories engaged in research where examination of specimens is directed toward that end rather than to the treatment of patients.¹⁹⁰

Congress implemented this intent by enacting the CLIA statute’s jurisdictional provision.¹⁹¹ It states that a facility must comply with CLIA if it fits within CLIA’s definition of a “laboratory,”¹⁹² which is:

a facility for the biological, microbiological, serological, chemical, immuno-hematological, hematological, biophysical, cytological, pathological, or other examination of materials derived from the human body [i.e., biospecimens, such as blood, urine, or tissue samples] for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.¹⁹³

The CLIA statute clarifies that this concept of a “laboratory” denotes a “clinical laboratory.”¹⁹⁴ Other laboratory facilities that do not fit this definition are not subject to CLIA. Figure 1 portrays CLIA’s jurisdictional provision: facilities that meet the condition in the white area of Figure 1 are subject to CLIA; those in the shaded area are not. The laboratory’s intent in providing information from laboratory tests is key.

Fig. 1.

CLIA jurisdiction under 42 USC §263a(a)

Laboratory tests provide information in the form of test results and other data such as genome sequence information. CLIA asks, “For what use is the laboratory providing information?” According to the CLIA statute and regulations, a laboratory falls under CLIA if it is “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings”¹⁹⁵—in other words, if it is providing information for a list of specific clinical uses (see white area in Figure 1).

CLIA jurisdiction depends not just on what Congress said in 42 U.S.C. § 263a(a), but on what Congress refrained from saying. Two textual omissions are important. The first is that Congress supplied no special, technical definition of the word “for,” which appears in the jurisdictional phrase “providing information for diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”¹⁹⁶ Consequently, the word is not a legal term of art and takes its ordinary, everyday meaning.¹⁹⁷ The word “for,” according to its primary dictionary meaning, is “a function word to indicate purpose” and “to indicate an intended goal.”¹⁹⁸ CLIA jurisdiction thus depends on the laboratory’s purpose or intended goal¹⁹⁹ in providing information from a test: Does the laboratory intend for the information to be put to a clinical use (diagnosis, prevention, or treatment, or assessment of health)?

The second and more profound omission is that CLIA supplies no definitions for the terms “diagnosis,” “prevention,” “treatment,” and “assessment of health,” which play a central role in determining the scope of CLIA’s applicability. This omission respects principles of federalism. The federal power to regulate medical practice, a traditional area of state regulation, has been a hot-button issue dating back to the intense legislative debate preceding passage of the 1938 Food, Drug, and Cosmetic Act²⁰⁰ and flaring up most recently in connection with the Affordable Care Act.²⁰¹ There is little doubt that, under modern law, the federal government has authority to touch medical practice issues incident to its federal medical product and clinical laboratory regulations, but Congress and federal agencies make an effort to respect the states’ role.²⁰² The states, through their medical practice acts, other statutes, and common law, define the scope of medical practice and when it begins and ends.²⁰³

The CLIA statute leaves it for the states to determine whether a particular human interaction amounts to diagnosing, preventing, or treating an illness or assessing the person’s health. When revising the CLIA regulations in 1993, the Health Care Financing Administration (HCFA, the earlier name for today’s CMS) affirmed its intent not to regulate laboratories that report results for purposes unrelated to the “patient care context which helps define the scope of the CLIA statute and these regulations.”²⁰⁴ The states, by setting the boundaries of the patient care context, ultimately define the scope of CLIA’s jurisdiction.

To summarize, a laboratory falls under CLIA jurisdiction when it provides information for—in its ordinary, everyday sense of “with the purpose or intended goal of”—“diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings,” as these terms are defined by the relevant states in which these acts occur.²⁰⁵ If the laboratory is providing information for other, non-clinical uses—such as forensic uses or the pursuit of scientific discovery—it is not even a “laboratory”²⁰⁶ under CLIA’s definition, and CLIA does not apply to it. Such a laboratory can operate lawfully without obtaining a CLIA certificate or meeting the conditions to be CLIA-exempt (that is, meeting the conditions required by New York or Washington state).²⁰⁷ Today, some research laboratories voluntarily choose to comply with CLIA, while others maintain non-CLIA status by conducting their analyses for non-clinical uses (such as research) rather than for the clinical uses that trigger jurisdiction under the CLIA statute.

To be clear, the above discussion was merely quoting the CLIA statute (reporting what the statute says), not interpreting it. The Report at times dismissed scholarly works that merely quote statutes as “[r]elying on principles of statutory interpretation.”²⁰⁸ The Report thus embraced a view that “the statute is not the law, but only an [interpretation] of it.”²⁰⁹ By this view, an agency that flouts the plain language of a statute is merely “interpreting” it, and scholars who quote statutes are merely advancing an alternative interpretation.

In reality, what the law is depends on what the law says, with federal statutes sitting near the top of the legal evidentiary hierarchy.²¹⁰ If you want to know the scope of permissible CMS regulation and actions under CLIA, you have to read the CLIA statute. Astonishingly, the Report’s SOT dismissed the CLIA statute as a source of evidence of what the law is, and instead assumed the CMS PDF file to be controlling without analyzing its fidelity to the statute.²¹¹ This should have been a red flag. Until Congress amends the CLIA statute, it is the law. CMS has no authority to take positions in conflict with that law. This fundamental fact is core to any consideration of the topics addressed in the Academies’ Report.

B. Applying CLIA’s Jurisdictional Rule to Research Laboratories—the History

Applying CLIA’s jurisdictional rule to research laboratories raises issues that were considered at the very birth of the current CLIA regulations. HCFA grappled with these complexities during the 1992 rulemaking that drew the contours of today’s CLIA regulations.²¹² This history is enlightening.

Even though Congress disclaimed intent to regulate research facilities,²¹³ many research laboratories sought further reassurance that they would not fall under the CLIA regulations. To allay these concerns, HCFA initially proposed to have the CLIA regulations embed a research exception within their definition of a regulated laboratory.²¹⁴ This proposal drew fire, however, because some research laboratories wanted to fall under CLIA jurisdiction.²¹⁵ A laboratory cannot bill Medicare unless it is CLIA-certified, and these research laboratories wanted “to assure that they can continue to receive reimbursement for tests performed.”²¹⁶ HCFA responded that “[i]f the results of such ‘experimental’ testing are used for individual treatment of the patient tested, the laboratory would be subject to CLIA requirements.”²¹⁷ In other words, if a research laboratory plans to bill a health insurer or Medicare for a test, then it clearly is providing information with an intent for clinical use and, under CLIA’s definition, it is a clinical laboratory.

HCFA ultimately concluded that the CLIA statute’s jurisdictional provision “clearly defines the type of facility subject to regulation and is specific with respect to its applicability to facilities that conduct testing for the medical diagnosis, prevention, or treatment of individuals.”²¹⁸ These words, written after Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc.,²¹⁹ had profound significance. When Congress clearly speaks to an issue there is no room for federal agencies or courts to interpret the statute; they must simply follow it.²²⁰ HCFA understood this legal principle and determined that the statute’s language, being clear, left no room for the CLIA regulations to further interpret the agency’s jurisdiction. Accordingly, HCFA decided that the CLIA regulations should simply repeat—or “parrot”²²¹—the same jurisdictional language that the CLIA statute uses to define a CLIA-regulated “laboratory.”²²² Table 1 compares the statutory and regulatory language.

Table 1.

Parroted Jurisdictional Language

Source	Jurisdiction-triggering conditions: an act + scienter
CLIA Statute 42 U.S.C. § 263a(a)	A facility becomes subject to the CLIA statute by:  “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”223
CLIA Regulations 42 C.F.R. §§ 493.1, 493.2	A facility becomes subject to the CLIA regulations by:  “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”224

The jurisdictional language is identical: The CLIA statute, at 42 U.S.C. § 263a(a), provides that a facility becomes subject to the CLIA statute by “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”²²⁵ The CLIA regulations, at 42 C.F.R. §§ 493.1, 493.2, apply this same rule.²²⁶

Both these passages require two conditions to be met, before a laboratory falls under the CLIA regulations. First, the laboratory must perform an act (“providing information”).²²⁷ Second, the laboratory must perform this act for an enumerated list of purposes: “for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”²²⁸ This second condition amounts to a scienter requirement: it is not merely the act, but the laboratory’s intent when performing the act, that triggers CLIA regulation.

The preamble to the 1992 final rule makes clear that when research laboratories report individual-specific results without an intent for clinical use, they are not subject to the CLIA regulations: “Several commenters [in that proceeding] noted that research laboratories including National Institutes of Health (NIH) laboratories perform experimental tests on human specimens and may include test information in the patient’s medical record for completeness.”²²⁹ These research laboratories were concerned that this reporting of individual-specific results might place them under the new CLIA regulations.²³⁰ HCFA concluded this was not the case and, to reassure them, HCFA inserted CLIA’s research exception at 42 C.F.R. § 493.3(b)(2).²³¹ This exception stresses that the CLIA regulations do not apply unless research laboratories “report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients.”²³² Table 2 compares the research exception to the jurisdictional language of the CLIA statute and regulations.

Table 2.

Parroted language in the CLIA research exception

Source	Jurisdictional conditions: an act + scienter
CLIA Statute and Regulations 42 U.S.C. § 263a(a); 42 C.F.R. §§ 493.1, 493.2	A facility triggers CLIA jurisdiction by:  “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”233
CLIA Research Exception 42 C.F.R. § 493.3(b)(2)	A facility escapes CLIA jurisdiction if it:  “do[es] not report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of … individual patients.”234

The research exception parrots the same scienter requirement seen in the CLIA statute and regulations: The jurisdictional provisions provide that a facility triggers CLIA jurisdiction by “providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”²³⁵ The research exception emphasizes that a facility avoids CLIA jurisdiction if it “do[es] not report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients.”²³⁶

The research exception highlights that reporting “patient specific results” (as opposed to providing information more generally) is the act that potentially raises concerns at a research laboratory.²³⁷ Yet even if a laboratory reports “patient specific results,” it escapes CLIA regulation if the reporting is for non-clinical purposes.

In the 1992 CLIA rulemaking preamble, HCFA explained that reporting patient-specific experimental test results into a patient’s medical record “for completeness” does not, by itself, violate the research exception and trigger CLIA regulation.²³⁸ However, reporting patient-specific results “for individual treatment of the patient tested”²³⁹ would cause the laboratory to fall under CLIA. According to HCFA’s interpretation, reporting individual research results into a patient’s medical record for the sake of record-keeping “completeness” does not amount to “treatment” and is not a clinical use, even though the record in question is the person’s medical record.

HCFA’s 1992 interpretation carries considerable legal weight because it appears in the preamble to a final rule in which HCFA was exercising its congressionally delegated authority to promulgate regulations consistent with the CLIA statute’s jurisdictional language, after notice and an opportunity for the public to comment. HCFA’s interpretation thus would be Chevron-eligible under current doctrines.²⁴⁰ Courts following these doctrines would tend to view HCFA’s interpretation as controlling. According to HCFA, it is not the mere act of reporting individual-specific results, but the laboratory’s reason for doing so, that triggers CLIA regulation of a research laboratory. HCFA’s interpretation closely follows the text of the CLIA statute and its scienter requirement.

IV. CMS’s Recent Position on its Jurisdiction to Regulate Research Labs

In its 2014 PDF file CMS asserts far broader jurisdiction to regulate research laboratories than HCFA claimed in 1992 when the agency promulgated the CLIA regulations.²⁴¹ As recited in the Academies’ Report, CMS’s current position is that “only those facilities performing research testing on human biospecimens that do not report patient-specific results may qualify to be excepted from CLIA certification.”²⁴² By this view, research laboratories operating under CLIA’s research exception²⁴³ will fall under the CLIA regulations if they report individual-specific research results for any purpose, including for non-clinical uses. Part IV discusses CMS’s PDF file and concludes that it is contrary to the CLIA statute and regulations and merits no deference.

A. Ambivalence and Statutory Deviations

During 2014, CMS displayed considerable ambivalence about the position expressed in the PDF file. On February 6 of that year, CMS joined OCR, which administers the HIPAA Privacy Rule and GINA’s genetic privacy provisions,²⁴⁴ in promulgating the final rule²⁴⁵ expanding HIPAA’s individual access right to include data stored at HIPAA-covered laboratories. CMS’s participation in that rulemaking is high-quality legal evidence that CMS saw no conflict between HIPAA’s access right and the CLIA regulations on that date. It is presumed that federal regulators are competent and know what is in the regulations they promulgate and would not knowingly issue a new regulation that conflicts with other laws. On February 6, 2014, CMS apparently felt there was no conflict between the HIPAA and CLIA regulations.

Eight months later, with the new laboratory access right set to take effect on October 6, a group of NIH-funded researchers pointed out that HIPAA’s access right seems to include individual access to uninterpreted (raw) data as well as interpreted genomic test results²⁴⁶—a view that OCR subsequently confirmed in a 2016 guidance document.²⁴⁷ At some genomic research laboratories, the prospect of having to provide access to data and results creates various concerns that the Academies’ Report describes: concerns, for example, that participants might be confused by access to potentially unreliable research data,²⁴⁸ and that implementing the access right could be costly and burdensome for researchers and might reduce their productivity.²⁴⁹ The Report emphasizes that funds for biomedical research “are precious and require careful and responsible stewardship,” and allowing participants to have such broad data access requires resources.²⁵⁰ In short, providing HIPAA access might be costly and inconvenient for researchers

Whether motivated by these concerns or others, CMS abruptly reversed course on or about December 2014, posting the PDF file²⁵¹ on its CLIA web page. The file does not disclose its authorship, leaving it unclear whether it is an official statement by CMS.²⁵² Posting it on CMS’s CLIA web page, however, creates the impression that CMS endorses it. It resembles a guidance document,²⁵³ but it has none of the disclaimers with which federal agencies often adorn guidance documents (such as a statement that it is non-binding).²⁵⁴ It seems to state a position that CMS plans to enforce.

The PDF file implies that there is a conflict between the HIPAA and CLIA regulations, thus supplying a pretext for non-CLIA research laboratories to avoid complying with HIPAA’s access right. This asserted conflict has added to confusion. In the face of this alleged conflict, OCR has seemed reluctant to enforce the access right at research laboratories. Enforcement has long been an issue under HIPAA. The weakness of HIPAA’s administrative enforcement structure²⁵⁵ has been particularly evident throughout this CLIA-HIPAA impasse. The Privacy Rule lacks a private right of action allowing citizen lawsuits to enforce its requirements.²⁵⁶ Enforcement depends on OCR. If this Office for Civil Rights goes wobbly on civil rights enforcement, as it did in this instance, it is difficult for research participants to enlist the federal courts to resolve questions of law such as “Is there, or is there not, a conflict between HIPAA and CLIA?”²⁵⁷ An office committed to diligent civil rights enforcement would have carefully scrutinized the CMS assertion of a conflict between HIPAA and CLIA regulations and, if necessary, would have pressed for rapid resolution of this question. Instead, the impasse has dragged on for four years, with research participants frequently denied a core federal privacy right while it festers.²⁵⁸

To those versed in administrative law, the PDF file had all the markings of an embattled agency seeking to appease its regulated industry by blocking an unpopular new regulation.²⁵⁹ A 2006 report by the U.S. Government Accountability Office (GAO) documented prior incidents in which CMS used informal means to circumvent the CLIA statute to reduce regulatory burdens on laboratories.²⁶⁰ In one instance, GAO found CMS had reduced the frequency of proficiency testing at many laboratories from quarterly, as the CLIA statute requires, to three times per year.²⁶¹ When GAO requested the administrative record on which CMS based this decision, “CMS supplied a brief, undated narrative”²⁶² and justified its deviation from the statute by claiming the “reduced frequency would provide a ‘needed respite’ to both laboratories and proficiency testing providers.”²⁶³ “According to CMS’s justification, experts were divided on the appropriate frequency of proficiency testing generally,”²⁶⁴ suggesting an ethos that federal laws can be ignored if expert option disfavors them.

The current situation with HIPAA access evokes the pattern GAO observed. With its “brief, undated” PDF file, CMS effectively granted research laboratories a “needed respite”²⁶⁵ from a burdensome federal law—HIPAA’s laboratory access right—on which researchers, laboratories, and experts are “divided,”²⁶⁶ as the Academies’ Report shows.²⁶⁷ Research participants had no say in whether they wanted a “respite”²⁶⁸ from their federally protected privacy rights. Finally, CMS did not follow the Administrative Procedure Act’s (APA)²⁶⁹ notice-and-comment rulemaking procedures²⁷⁰ or even its guidance publication requirements²⁷¹ when posting its PDF file, which denied research participants a chance to protest as their newly created access rights were, in practical effect, rescinded.

B. CMS’s Recent Position

The PDF file summarizes CLIA’s research exception in the following manner:

Depending on the circumstances, research testing can be either excepted from CLIA or subject to CLIA. Specifically, testing facilities may qualify to be excepted from CLIA certification if they meet the description of “research laboratories” provided by the CLIA regulation at 42 C.F.R. 493.3(b)(2). In accordance with that regulation, only those facilities performing research testing on human specimens that do not report patient-specific results may qualify to be excepted from CLIA certification.²⁷²

However, the regulatory text of CLIA’s research exception at 42 C.F.R. § 493.3(b)(2) actually says:

(b) Exception. These rules [the CLIA regulations] do not apply to components or functions of…

(2) Research laboratories that test human specimens but do not report patient specific results for the diagnosis, prevention or treatment of any disease or impairment of or the assessment of the health of individual patients … .²⁷³

The PDF file interprets this regulation as if it had a period after the phrase “patient specific results,” so that the twenty-one-word clause appearing after that phrase is inoperant and, in effect, deleted. The PDF file explains this deletion by noting:

In most cases, research testing where patient-specific results are reported from the laboratory, and those results will or could be used “for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings” are presumed to be subject to CLIA, absent evidence to the contrary.²⁷⁴

This explanation interprets CLIA’s research exception as giving rise to a rebuttable presumption that any patient-specific results that a laboratory reports “will or could be” misused for a clinical purpose, with the laboratory bearing the burden of proof to rebut the presumption with contrary evidence. The CLIA regulation creates no such presumption or burden of proof, nor does the CLIA statute.²⁷⁵ In a 2017 public statement, a CMS official went farther and suggested that the PDF file’s presumption that all research laboratory reporting is for a clinical purpose is irrebuttable:

CLIA applies when…

Patient specific results are reported from the laboratory to another entity and the results are available and can be used for health care for individual patients.

In general, when patient-specific results are reported from the laboratory, it is assumed that they will or could be used for patient care purposes; therefore, they are subject to CLIA.²⁷⁶

The PDF file—and the above statement—do not merely “interpret” the CLIA regulation; they revise it. An example demonstrates the point: Suppose a law says, “Motor vehicles can be impounded if they are driven for commission of a felony.” The agency responsible for enforcing this law publishes a written policy statement interpreting this as saying, “Motor vehicles can be impounded if they are driven.” In a public speech, an agency official justifies this policy by noting, “In general, when motor vehicles are driven, it is assumed that they will or could be used for commission of a felony; therefore, they are subject to being impounded.” That is not an interpretation of the law; it is a material change of law.

C. Does CMS’s Position Merit Deference?

When an agency interprets its own regulations, courts generally grant it the highest level of deference, variously called Seminole deference, after the 1945 case, Bowles v. Seminole Rock & Sand Co.,²⁷⁷ or Auer deference for a later case that explained it well.²⁷⁸ Some scholars view Auer deference as being even stronger than the Chevron deference agencies often receive when interpreting statutes.²⁷⁹ The rationale for the heightened deference is that the agency that originally wrote a regulation is particularly well qualified to interpret its meaning.²⁸⁰

Under Auer, courts would treat an agency’s interpretation of its regulation as controlling unless that view is “plainly erroneous or inconsistent with the regulation”²⁸¹ or violates a statute or the Constitution.²⁸² The PDF file, as just described, is inconsistent with the text of the regulation it purports to interpret.²⁸³ As the HHS Secretary’s Advisory Committee on Human Research Protections (SACHRP) noted in its own analysis of the situation, CMS’s position “seems at odds with the plain language of the regulation, which prohibits performing a non-CLIA-certified laboratory test for purposes of diagnosing or treating a person, but does not prohibit data releases required by law or for other purposes.”²⁸⁴ This inconsistency precludes Auer deference.

If that were not enough, an additional exception to Auer deference is pertinent. The 2006 case of Gonzales v. Oregon²⁸⁵ recognized an exception to Auer deference when an agency is interpreting a regulation that simply parrots, or incorporates, statutory language.²⁸⁶ The rationale for Auer deference—that the agency is interpreting regulatory language that the agency itself wrote—breaks down when an agency interprets statutory language written by Congress. In this situation, the interpretive question is “not the meaning of the regulation but the meaning of the statute”²⁸⁷ that the regulation copies. The appropriate level of deference would ordinarily be Chevron, but because the PDF was not generated through a notice-and-comment proceeding, the lesser deference described in Skidmore v. Swift & Co.,²⁸⁸ or Skidmore deference, is warranted.²⁸⁹

CMS’s 2014 PDF file falls squarely in this latter exception to Auer deference. The PDF file discusses regulatory language drawn verbatim from the CLIA statute. In one place, it mentions the phrase, “for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients” that appears in the CLIA research exception. Yet the PDF file eliminates this phrase when it states that “only those facilities performing research testing on human specimens that do not report patient-specific results may qualify to be excepted from CLIA certification.”²⁹⁰ The phrase in question came directly from the CLIA statute; it is not CMS’s language to toss away.

Because CMS published the PDF file without notice-and-comment procedures, its interpretation of this statutory language is only eligible for Skidmore deference.²⁹¹ Under Skidmore, the PDF file would receive respect proportional to its “power to persuade”²⁹² and courts would consider the thoroughness, logic, and expertness of the agency’s interpretation when deciding whether to defer to it.²⁹³ The PDF file offers no discussion or explanation of why it is inconsistent with the statute it purports to interpret. Its silence is thuddingly unpersuasive.

Moreover, CMS’s position does not reflect a “fair and considered judgment on the matter in question,” which Justice Scalia once argued (albeit in a dissent) should warrant Chevron deference regardless of whether an agency followed notice-and-comment procedures.²⁹⁴ Far from being a “considered judgment,” CMS’s December 2014 PDF file was a hasty flip-flop reversing a position CMS took ten months earlier when it promulgated the final rule expanding HIPAA’s access right. Moreover, the PDF file contradicts the longstanding HCFA interpretation announced in the original 1992 CLIA rulemaking.²⁹⁵

Finally, the inconsistency between the PDF file and the CLIA statute goes to a matter of special sensitivity: the scope of CMS’s jurisdiction to regulate research laboratories. Congress, by statute, placed a limiting condition on CMS’s jurisdiction: CMS can regulate research laboratories only if they provide information “for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings.”²⁹⁶ The PDF file assumes that a research laboratory that reports results for any use is doing so for clinical use, because the results “could be” misused by third parties downstream of the point when the laboratory reports them to the individual.²⁹⁷ The surplusage canon of textual construction favors the view that every word of a statute or regulation should be treated as operant, with none ignored.²⁹⁸ As one justice put it, “These words cannot be meaningless, else they would not have been used.”²⁹⁹ The PDF file treats Congress’s scienter requirement as functionally meaningless.

CMS’s position ignores the limiting condition Congress placed on CMS’s jurisdiction, by assuming that condition to be met absent evidence to the contrary. Assuming it to be met removes a crucial constraint that Congress imposed on CMS’s authority to regulate research laboratories. Eskridge and Baer, in their empirical study of case outcomes, found that courts look more harshly on agency statements when the agency “is interpreting its own jurisdiction or authority” rather than statements in which an “agency applies its regulations to a matter of detail, [and] is not interpreting its own jurisdiction or regulatory authority.”³⁰⁰ This again counsels that CMS’s current view of its jurisdiction to regulate research laboratories is suspect.

CMS’s PDF file does not go to a matter of detail. It reflects an agency significantly expanding its jurisdiction and doing so “on the sly”³⁰¹ by posting an undated PDF file instead of acting openly and transparently through appropriate APA notice-and-comment procedures.³⁰² Note, however, that even if CMS had followed APA rulemaking procedures, agencies cannot do what the PDF file attempts to do. Even with APA rulemaking, agencies cannot amend federal statutes, which only Congress can do.

The position stated in the PDF file does not merit Auer deference. In fact, the PDF attempts to assert regulatory authority over research laboratories that Congress never granted the agency. The Report’s SOT, and the Report itself, erred by assuming the PDF reflects current law.

V. Erroneous Assumptions Produce Flawed Recommendations

The Report bases a sweeping legal reform agenda on an assumption that two federal regulations—the HIPAA Privacy Rule and the CLIA regulations—are in conflict, so that non-CLIA research laboratories cannot provide HIPAA access to individual-specific data without becoming subject to CLIA.³⁰³ The Report further assumes that researchers cannot return results from non-CLIA labs without risking the same violation. A basic legal analysis would have proved these assumptions wrong.

A. The Report’s Flawed Assumptions

Complying with HIPAA’s access right causes a HIPAA-regulated research laboratory to fall under CLIA only if the laboratory does so intending to provide data for clinical use.³⁰⁴ A research laboratory reporting data pursuant to a HIPAA access request has intent, first of all, to comply with federal privacy law and, secondarily, to promote the legislative and regulatory objectives the Privacy Rule serves.³⁰⁵ A research laboratory providing information for HIPAA-compliance purposes lacks the scienter—intent to provide data for clinical use—that gives rise to CLIA jurisdiction. If a research laboratory is not otherwise subject to CLIA, the mere act of providing HIPAA access will not cause the laboratory to fall under CLIA.

Similarly, the mere act of returning research results and data will not trigger the need for CLIA compliance. What matters is the laboratory’s purpose in reporting those results and data. If the purpose is to produce results and data for direct use in diagnosis, prevention, treatment, or health assessment, then CLIA is triggered. However, if the laboratory is not providing results and data for these purposes, but as part of the ethical conduct of research, CLIA is not triggered and the CLIA research exception applies.

Congress recognized, as it passed the 1967 CLIA statute, that research activities may or may not cause a laboratory to fall under CLIA. Congress intended for CLIA not to cover “laboratories engaged in research where examination of specimens is directed toward that end” but wanted CLIA to cover research laboratories where testing was directed at “treatment of patients.”³⁰⁶ In some research, especially clinical research,³⁰⁷ laboratories are generating results to be directly used in clinical care and use of a CLIA-compliant laboratory is necessary. However, in other research, the laboratory results are not intended for direct use in clinical care.

Over the past two decades, researchers have worked in close collaboration with ethicists and legal scholars to develop consensus guidelines to ensure appropriate return of results mindful of CLIA requirements.³⁰⁸ It is essential to understand how these guidelines work. They envision three scenarios, corresponding to three separate pathways for the return of results and data from research laboratories.

In the first scenario, a laboratory generates a research result or data intending its direct use in clinical care without any further confirmatory testing at a CLIA-certified clinical laboratory. If this is the case, the research laboratory must comply with CLIA: the laboratory has the scienter that triggers CLIA regulation. Thus, the first pathway for return of results is simply to conduct research using a CLIA-compliant laboratory. That way, if any of the research results raise clinical concerns, they can be freely repurposed for clinical use without violating CLIA, because the research laboratory already complies with CLIA. This is a pathway many research laboratories follow.

As the Academies’ Report notes, however, it is not practical or cost-effective for all research laboratories to comply with CLIA.³⁰⁹ When a non-CLIA research laboratory encounters a finding that raises potential clinical concerns, there are two remaining options. The second pathway for returning results is for the laboratory to arrange confirmatory testing at a CLIA-compliant laboratory before returning the results.³¹⁰ This second pathway is also widely recognized.³¹¹ It ensures that information ultimately returned is from a CLIA-compliant laboratory. Here again, there is no dispute that this pathway achieves appropriate CLIA compliance. The primary objection is that it entails incremental costs for the research laboratory, contributing to the perception that returning results diverts funds from the goals of the research.³¹²

Responsive to this concern, there is a third pathway—the clinical hand-off—which does not require confirmatory testing prior to return. Instead, the research laboratory advises the participant—or the participant’s physician, or both—that a research finding suggests a need for follow-up clinical testing and evaluation. The research laboratory is careful to communicate that the research finding is from a non-CLIA laboratory and requires clinical confirmation in a CLIA-compliant laboratory and clinical evaluation, and stresses that the research findings should not be used in clinical care without that confirmation and evaluation. The research laboratory carefully avoids rendering any diagnosis or making any treatment recommendations based on the research result, leaving that to the clinician.

According to the CMS position, all three scenarios constitute a clinical use of research data, so the third scenario, which conveys research findings to trigger a CLIA-compliant clinical evaluation, violates CLIA. This is simply incorrect. As explained earlier,³¹³ the CLIA statute and regulations defer to state law to define the scope of clinical care. State law recognizes a distinction between referring a patient for clinical care and providing clinical care.³¹⁴ Under state law, an activity is medical practice only if there is a provider–patient relationship and clinical care is taking place within the scope of that relationship.³¹⁵ Physician–patient relationships are contractual in nature: “the express or implied consent of the physician is required” in order for a physician–patient relationship to come into being, and “the physician must take some affirmative action with regard to treatment of a patient for the relationship to be established.”³¹⁶ Even assuming the researcher happens to be a physician, returning results for the narrow purpose of making a clinical referral does not involve the critical treatment step: “A physician-patient relationship is not established by the mere act of a physician agreeing to see a patient at a later time or suggesting that the patient contact another physician.”³¹⁷ Reporting a research result for the purpose of referring a person for clinical testing and evaluation is not itself a clinical use,³¹⁸ and therefore does not give rise to CLIA compliance obligations.

Thus the CLIA statute and regulations, properly understood, already allow all three pathways. It is the CMS PDF file that has gone off track. The agency—in effect—assumes that federalism does not exist and that CMS itself, rather than the states, has authority to decide what is and is not a clinical use of test results. That is incorrect. When promulgating the CLIA regulations,³¹⁹ HCFA also expressed its intent “to allow States to determine who is authorized to order tests.”³²⁰ Congress has not authorized CMS to preempt state law in this area, and Congress certainly has not authorized CMS to preempt state law by posting informal PDF files.³²¹ Under state law, it does not constitute clinical care for a non-CLIA-compliant research laboratory to provide information for the purpose of recommending follow-up clinical testing.³²²

B. Recommendations on Data Privacy

The Report assumes a HIPAA-CLIA regulatory conflict that does not exist and then proposes sweeping changes to the Privacy Rule to resolve the imagined conflict.³²³ Table 3 summarizes three of the Report’s recommendations that raise particular concerns.

Table 3.

Legally problematic privacy recommendations in the Academies’ Report³²⁴

Rec. 12A	“[T]he Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) should define the DRS to include only individual research results generated in a CLIA-certified laboratory or under the externally accountable quality management system for research laboratories (see Recommendation 2).”325
Rec. 12B	“OCR should require all HIPAA-covered entities that conduct research on human biospecimens to develop a plan that is reviewed and approved by the IRB for the release of individual research results in the designated record set to participants in a responsive manner when required under HIPAA.”326
Rec. 12C	“CMS should revise CLIA regulations such that when there is a legal obligation under the HIPAA access right to return individual research results, a laboratory will not be considered in violation of CLIA and need not obtain CLIA certification before satisfying this legal obligation.”327

The Report’s Recommendation 12C is that “CMS should revise CLIA regulations such that when there is a legal obligation under the HIPAA access right to return individual research results, a laboratory will not be considered in violation of CLIA and need not obtain CLIA certification before satisfying this legal obligation”³²⁸ This recommendation strangely calls for CMS to amend the CLIA regulation to make the regulation say what it currently already says. A more appropriate recommendation would be for CMS to revise its PDF file to bring it into harmony with CMS’s existing CLIA regulations and with the CLIA statute.³²⁹

Recommendation 12B suggests that “OCR should require all HIPAA-covered entities that conduct research on human biospecimens to develop a plan that is reviewed and approved by the IRB for the release of individual research results in the designated record set to participants in a responsive manner when required under HIPAA.”³³⁰ This would embroil IRBs in administering the Privacy Rule and would mark a major, fundamental change to Congress’s overall scheme of federal privacy enforcement, which relies on administrative enforcement by OCR rather than on IRBs.³³¹ HIPAA access is a legally enforceable privacy right, with only narrow grounds for a covered entity to deny a person’s request for HIPAA access.³³² HHS has stated that it intends for covered entities to invoke these access exceptions “rarely, if at all.”³³³ IRBs are often staffed by personnel who work for the research institution that is storing people’s data and may prefer not to release it to them. The Academies’ Report emphasizes that many institutions view HIPAA’s privacy protections as costly and burdensome.³³⁴ Recommendation 12B takes a vested federal legal right and reduces it to a right that can be denied, on a case-by-case basis, based on ethical review by potentially conflicted private actors. A legal right so restricted is no longer a legal right.

Recommendation 12B also is at odds with the 2017 Common Rule revisions³³⁵ effective in January 2019.³³⁶ A major goal of the 2017 Common Rule revisions was to disentangle research safety regulation from data privacy regulation.³³⁷ The revised Common Rule focuses IRB oversight on the physical risks of research.³³⁸ The Common Rule—and its IRBs—no longer will provide oversight for HIPAA-regulated uses and disclosures of data for research, public health, and health-care operations.³³⁹ This is to avoid duplication in cases where data privacy is already protected by HIPAA.³⁴⁰ HHS devoted more than six years of rulemaking effort to reduce IRBs’ role in privacy oversight, for which HHS considers IRBs poorly qualified.³⁴¹ The Academies’ Report recommends upending that effort and embroiling IRBs in administering the HIPAA Privacy Rule³⁴²—a role they have neither the time nor the special knowledge to fulfill.

Recommendation 12A is surpassingly problematic from a legal standpoint. It states that “the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS) should define the DRS to include only individual research results generated in a CLIA-certified laboratory or under the externally accountable quality management system for research laboratories (see Recommendation 2).”³⁴³ This recommendation calls on OCR to violate three federal statutes: GINA’s privacy provisions³⁴⁴ and sections of the Public Health Service Act³⁴⁵ and the Social Security Act³⁴⁶ that GINA introduced. Recommendation 12A, in effect, is a call for Congress to repeal the genetic privacy protections that Congress mandated under GINA. It calls on OCR to take steps that are unlawful, unless the statutes are repealed.

It is unclear how the Academies got into this awkward position. The Academies’ Report included an appendix that discusses GINA’s antidiscrimination provisions³⁴⁷—a puzzling inclusion in a report about giving people their own data, because people do not discriminate against themselves. The Report never discussed GINA’s privacy provisions, which were highly pertinent to the Report’s subject matter because they shaped today’s HIPAA access right.³⁴⁸ By enacting GINA, Congress recognized that storing genetic information can place people’s privacy and civil rights at risk even if the information is uncertain or lacks clinical significance. The Public Health Service Act, as amended by GINA, defines “genetic information” very broadly as including all information and raw data from genetic tests conducted on an individual or the individual’s family members, including from tests conducted in research settings.³⁴⁹ This definition indisputably includes non-clinically-significant test results and raw data in addition to clinically significant findings.³⁵⁰

GINA’s Section 105 ordered HHS to place all such information under HIPAA’s privacy protections and amended the Social Security Act to include a Congressional mandate that genetic information, as defined by GINA’s broad definition, “shall be treated as health information” for purposes of the HIPAA Privacy Rule.³⁵¹ Thus, Congress deemed non-clinically-significant genetic information and data to be “health information” for purposes of receiving protection under the HIPAA Privacy Rule, even though such information and data might not be regarded as “health information” in other legal contexts such as Medicare billing or state medical practice regulations.

Recommendation 12A seeks to reverse GINA’s mandate to place all “genetic information,” as defined by the Public Health Service Act, under HIPAA’s privacy protections, which include HIPAA’s access right. This is not something OCR can do through regulations. Only Congress could make such a change, which seems unlikely. GINA is recent legislation—from 2008—passed by overwhelming margins in both houses of Congress; GINA passed the Senate by a vote of 95-0³⁵² and the House by a vote of 414-1.³⁵³ Discussion in the Senate and House before those votes confirms that Congress viewed GINA’s privacy provisions as an important element of the overall legislation.³⁵⁴ This dispels any suggestion that Congress somehow passed GINA’s privacy provisions inadvertently in the course of enacting GINA’s larger antidiscrimination package.³⁵⁵ After the House and Senate voted to enact GINA, the statute has continued to enjoy strong bipartisan support. President George W. Bush signed GINA into law in 2008,³⁵⁶ and the Obama administration labored from 2009 to 2014 to craft regulations to implement GINA’s genetic privacy mandate, including an individual right of access to genetic information held at HIPAA-covered laboratories. Recommendation 12A asks OCR to ignore this mandate.

A final problem is that the Report ignores HIPAA’s interaction with state privacy laws. The HIPAA Privacy Rule sets a federal floor of medical and genetic privacy protections: state laws providing “more stringent” privacy protections are not preempted by HIPAA.³⁵⁷ HIPAA regards a state privacy law as “more stringent” if it grants individuals greater access to their own data than the Privacy Rule provides.³⁵⁸ Some states provide individual access rights as part of their privacy laws,³⁵⁹ and a few states have passed data-ownership laws³⁶⁰ which, under common law principles, seemingly imply an individual right of access to the owned res (the data).

Weakening HIPAA’s access right—as the Academies’ Report recommends—would not necessarily liberate research laboratories from having to respond to individual access requests. Instead, it might increase the number of state access provisions that qualify as more stringent than HIPAA’s access right. This, in turn, could increase laboratories’ regulatory compliance burdens. Instead of a uniform, national regime of individual data access under HIPAA, laboratories might be forced to comply with a complex patchwork of un-preempted state access requirements.

C. Recommendations on the Return of Results and Data

Recommendations for return of research results have been published for twenty years, beginning with the recommendations of the presidentially appointed National Bioethics Advisory Commission in 1999.³⁶¹ Remarkably, the Academies’ Report fails to consider the full set of recommendations germane to its focus,³⁶² return of results from research involving human biospecimens. Moreover, the Report mischaracterizes the recommendations already in print. In a particularly egregious example, the Report attempts to depict its work as a rejection of past recommendations and a new effort to prioritize what research participants value:

In a notable departure from the approaches of past expert groups, the committee has chosen to deemphasize the respective influences of clinical and personal utility in decisions regarding the return of individual research results by focusing more inclusively on results that have “value to participants,” with the understanding that the value of a result from the perspective of the participant might entail either clinical utility or personal utility or both and may also arise from the result having personal meaning … .³⁶³

This characterization of past expert reports is incorrect. Multiple past expert reports have emphasized the importance of assessing the value of a result from the perspective of the participant. For example, well-known recommendations produced by an NIH-supported project group state:

We show respect for research participants’ objective welfare as well as their subjective interests by including [incidental findings] of likely health or reproductive importance to the participant… .

… [W]e define “utility” to include information that a research participant is likely to find important, even if clinicians cannot use that information to alter the participant’s clinical course … . This rejects an approach to utility grounded solely in what a clinician would find useful.³⁶⁴

Based on this inadequate analysis, the Report makes multiple recommendations on return of results that do not advance participants’ interests in access to results and data, but instead create roadblocks as well as raising serious legal problems. Three of the more problematic recommendations are shown in Table 4.

Table 4.

A subset of problematic recommendations on return of results in the Academies’ Report³⁶⁵

Rec. 2	NIH should lead an interagency effort … to develop an externally accountable quality management system for non-CLIA-certified research laboratories testing human biospecimens.366
Rec. 3	To provide confidence in the quality of research test results disclosed to participants, institutions and their IRBs should permit investigators to return individual research results if:  A. testing is conducted in a CLIA-certified laboratory; or  B. results are not intended for clinical decision making in the study protocol … and testing is conducted under the externally accountable quality management system for research laboratories once established (see Recommendation 2); or  C. results are not intended for clinical decision making in the study protocol … and the IRB determines that   1. the probability of value to the participant is sufficiently high and the risks of harm are sufficiently low to warrant return;   2. the quality of the laboratory analysis is sufficient to provide confidence in the result to be returned, as determined by a review process independent of the laboratory; and   3. information will be provided to the participant(s) regarding limits on test validity and interpretation … .367
Rec. 12D	CMS should revise CLIA regulations to allow research results to be returned from a non-CLIA-certified laboratory when they are not intended for clinical decision making in the study protocol … and the laboratory conducts its testing under the quality management system with external accountability or the IRB has approved the return of results (as described in Recommendation 3).368

Taken together, these recommendations would have the effect of reducing the return of results below levels allowed under current ethical guidelines. Recommendation 2 calls on the NIH to lead an effort to develop a “quality management system,” or QMS, for “non-CLIA-certified research laboratories testing human biospecimens.”³⁶⁹ The Report envisions the QMS would play a pivotal role in determining whether participants can receive return of results from non-CLIA-compliant research laboratories.³⁷⁰ The Report’s Recommendation 3 thus urges that research results be returned only when generated by a CLIA-compliant laboratory, produced by a laboratory that complies with a QMS that does not yet exist, or approved by an IRB.³⁷¹

The Report claims to champion return of results to research participants.³⁷² Yet Recommendation 3 creates roadblocks to return from non-CLIA laboratories. The recommendation would allow return from a non-CLIA laboratory if the laboratory complies with the QMS or if the IRB approves the return (subject to various restrictions).³⁷³ This would have the practical effect of restricting return more narrowly than current consensus guidelines allow.³⁷⁴ Also, it conditions return on the success of future efforts to create the QMS, which is far from assured and may take years to complete, leaving return of results from non-CLIA research laboratories in limbo. Under current guidelines, a non-CLIA research laboratory can return results subject to pathways 2 and 3 discussed above—that is, by seeking confirmation of the results to be returned at a CLIA-certified lab, or by a clinical hand-off for clinical confirmation and evaluation.³⁷⁵ Moreover, it is lawful to return results and data from a non-CLIA laboratory for non-clinical uses (such as to enable participants to contribute their data to other research studies). The Report suggests that these perfectly lawful and ethical current practices should be put on hold, pending implementation of the QMS or IRB approval “case-by-case.”³⁷⁶

In addition to creating these practical roadblocks to return of results, the Report seeks to alter the law itself. Recommendation 12D calls on CMS to “revise the CLIA regulations to allow research results to be returned from a non-CLIA-certified laboratory” if it complies with the QMS or if an “IRB has approved the return of results (as described in Recommendation 3).”³⁷⁷ This recommendation presents a number of legal problems.

The Report indicates that CLIA statutory amendments lay outside the committee’s statement of task.³⁷⁸ However, it would not be lawful for CMS to implement Recommendation 12D, unless Congress first amends the CLIA statute. CMS lacks the authority to impose requirements on research laboratories that are not currently subject to CLIA. Congress would need to amend CLIA’s jurisdictional provisions, in order for CMS to have such authority.

Moreover, CMS has no authority to rely on a QMS or IRB approval in circumstances in which CLIA compliance is already required. The QMS program in Recommendation 2 is in the nature of a “CLIA-Lite” program, designed to be less onerous for research laboratories than regular CLIA certification would be. The current CLIA statute does not recognize such an alternative: if a laboratory falls within CLIA’s jurisdiction, then the only way to comply with CLIA is to comply with CLIA. The CLIA statute envisions just two ways to comply: either obtain a CLIA certificate,³⁷⁹ or else meet the criteria to be CLIA-exempt.³⁸⁰ CLIA exemption is only available to laboratories in certain states (currently New York and Washington) that have state licensing requirements that HHS has determined are equivalent to CLIA.³⁸¹ Recommendation 12D calls for CMS to create a new exemption for laboratories that comply with the QMS or follow the report’s IRB-review policies.³⁸² CMS lacks statutory authority to create new exemptions from the CLIA statute’s compliance requirement. Only Congress can create new exemptions from CLIA’s requirement that CLIA-regulated laboratories must obtain a CLIA certificate. Once again, Recommendation 12D is not lawful without CLIA statutory amendments.

When research laboratories do provide information intended for direct use in clinical care without further confirmation, they need to comply with CLIA. CLIA-Lite compliance is insufficient to ensure patient safety in that scenario. Recommendation 12D would allow research laboratories to return research results, even for immediate use in clinical care, if they comply with the QMS system or obtain IRB approval. This would violate the current CLIA statute and set a lower standard of patient safety than is required in pathways 1-3 of the current guidelines (as all three of the currently recognized pathways would generate CLIA-compliant results before those results were used in clinical care).

Finally, the Report recommends that NIH lead development of the QMS.³⁸³ Yet this new quality system is envisioned as a massive effort to govern the conduct and quality of all research involving human biospecimens. The proposal reaches far beyond return of results and far beyond laboratories conducting NIH-funded research. The QMS and the Report’s recommended CLIA amendments would affect privately funded, commercial research laboratories as well as NIH-funded laboratories. However, the National Institutes of Health, which was a sponsor of the Report, is not the right entity to govern the laboratories whose research it funds plus competing laboratories in the private sector. NIH has an obvious conflict of interest. In addition, NIH has no authority under the current CLIA statute and regulatory scheme to govern the quality of private laboratories that receive no NIH funds and to apply a QMS as a condition of return of results. Finally, NIH is not the appropriate entity to govern consumer safety in laboratory practice, as NIH would ultimately bear the costs of imposing more stringent safety standards on its funded researchers. Congress has entrusted CMS to serve as the consumer-safety regulator.

Conclusion

Despite CMS’s menacing PDF file, some research laboratories have continued to respect the rights of research participants by providing HIPAA access and offering return of research results according to established ethical guidelines.³⁸⁴ This response has required three things: (1) an unwavering commitment to research participants’ rights and to strong data privacy protections; (2) courage; and (3) access to qualified legal counsel.

Agency guidance documents, such as the PDF file, have no binding legal force independent of the regulations they interpret or implement.³⁸⁵ A laboratory with qualified counsel would know that guidances are non-binding and is likely to know when a guidance misstates the law, as the PDF file does. This does not imply, however, that such a laboratory will necessarily resist an erroneous agency position statement. A non-binding guidance often induces “grudging compliance, ‘even when the doubts as to the lawfulness of the [guidance] are substantial.’”³⁸⁶ The practical reality is that even a flawed guidance document “still establishes the law for all those unwilling to pay the expense, or suffer the ill-will of challenging the agency in court.”³⁸⁷ When this happens, the guidance is said to be “practically binding”³⁸⁸ even though it is not legally binding in the sense that the agency would be able to enforce it.³⁸⁹

The practical binding effect of a flawed guidance, such as CMS’s PDF file, may be even more pronounced in the case of research laboratories, staffed by scientists without training in the law, who are driven by the quest for scientific truth and funded by grants that include no budget for legal counsel. Research laboratories may comply out of a mistaken belief that anything a regulator says must be the law.

One of the most unfortunate aspects of the Academies’ Report is that it undercuts the reasoned positions of laboratories that have done their homework, analyzed the law, and courageously continued to honor research participants’ rights. The Academies’ Report has exacerbated the confusion in an already confused legal landscape by reciting CMS’s position as if it were legally correct and following instructions from the study sponsors “to include in its description of the current regulatory environment for the return of individual research results the CMS’s current interpretation of the scope and applicability of CLIA.”³⁹⁰

We urge policymakers, investigators, and institutions to exercise extreme caution in implementing the regulatory recommendations of this Report. This Article has tried to fill some of the gaps in legal analysis that produced a set of flawed—and, in some cases, unlawful—recommendations. Further case-specific legal due diligence is advisable before acting on the regulatory recommendations of this Report.

The root causes of this problem included a flawed statement of task that misstated federal law and constrained the committee’s ability to conduct a thorough, complete, and professional legal analysis. This Report represents a rare deviation from the Academies’ usual, rigorous policies surrounding the preparation of reports. This Article strives to illuminate the root causes in the hope that shedding light on what happened might help keep it from happening again. Agreeing to abstain from analyzing a highly disputed position asserted by an agency sponsoring a committee report endangers the quality of the report, the persuasiveness of its recommendations, and ultimately the Academies’ reputation. Legal analysis, like medical and scientific analysis, demands rigor. In law, as in mathematics, Π does not equal 6.

The harm of these recommendations extends beyond the narrow context—biomedical research—on which the Academies focused their Report. In an unbroken line starting with the Fair Credit Reporting Act of 1970 and extending through GINA in 2008, Congress has consistently treated the individual right of access to one’s own data as a foundational civil right—a core privacy protection that enables people to exercise many other rights including some enjoying constitutional protection. By advancing a view that privacy rights can be discarded when they grow burdensome, costly, or detrimental to productivity, the National Academies’ Report sows confusion about what rights are and why they matter. This confusion, emanating from so respected a source, diminishes Americans’ privacy rights more generally.

A recent article on the front page of the New York Times illustrated the pivotal importance of honoring rights of access to one’s personal information. The article discussed the plight of China’s Uighurs, subjected to unconsented genetic testing as a tool of social control:

The authorities called it a free health check. Tahir Imin had his doubts. They drew blood from the 38-year-old Muslim, scanned his face, recorded his voice and took his fingerprints. They didn’t bother to check his heart or kidneys, and they rebuffed his request to see the results.

“They said, ‘You don’t have the right to ask about this … .’”³⁹¹

Even in the United States, many individuals, after consenting to genomic research, still encounter barriers to seeing their test results and data. Like the Uighurs in China, they are frequently told, “You don’t have the right to ask about this.” Access to one’s own personal information is an essential right protected by multiple statutes Congress has enacted since 1970. The recent Report of the National Academies undermined rights that are protected by American law and crucial to the ethical conduct of research.