Differences across Domains:

Liability is a major concern in the fast-evolving field of medical genomics.^{Reference Marchant, Lindor and Cheung25} Yet the contours of potential liability vary significantly across the four domains we are addressing. These differences can lead to gaps and confusion, as the scenarios below suggest.

Clinical genomics is the familiar domain of malpractice suits brought under state law. In such a suit, the patient must demonstrate that the defendant owed them a clinical duty (as in a physician-patient relationship), that the clinician breached their duty by failing to meet the applicable standard of care, and that this breach cased harm compensable in damages. State statutes often impose special rules on malpractice suits (such as statute of limitations restrictions) that do not apply to suits for negligence in the research context.^{Reference Marchant26}

Human participants in genomic research may fail to recognize that their ability to sue for research-related harm and their likelihood of receiving compensation are less than what patients have in the context of clinical care. In research there is no individual cause of action under the federal Common Rule and FDA regulations on human participant research.^{Reference Wolf, Paradise and Caga-anan27} A research participant's options for suit are a product of state law and thus vary from state to state. Research participants generally must claim research negligence and may have a difficult time establishing the relevant standard of care in research and that its breach caused compensable harm.^{Reference Pike28} Researchers and their institutions typically face less liability exposure for research than for clinical care. A larger threat is often administrative sanctions from the federal Office for Human Research Protections (OHRP) and funders, including loss of funding.

In public health genomics such as newborn screening, state actors loom large.²⁹ Newborn screening may be carried out by clinicians in a private health care institution, but the process is governed by state law. Public health laboratories and authorities, including the state department of health or equivalent, usually play a large role. Individuals (such as parents, in the newborn screening example) can sue for malpractice, for violations of state law, or for state or federal constitutional violations, and some have successfully done so. But sovereign immunity protects state actors who are performing ministerial functions and thus limits or precludes many lawsuits that could be brought against public health officials or other state actors.^{Reference Jackson30}

The liability rules in DTC genomics are unclear. Customers may not be able to sue for malpractice, as there may not be a physician involved in their testing. Even if there is, there may not be a physician-patient relationship to ground liability or that relationship might be substantially limited by contract.^{Reference Hogarth31} Liability is more likely under state law on negligence and products liability. However, in many states a products liability suit may fail because the DTC company is regarded as selling a service, not a product.^{Reference Ossorio32} States differ on where to draw the line between product and service.³³

Focusing on compensation for harm in the four domains highlights the differences. In the clinical domain, patients have a clear avenue to compensation for wrongful harms by bringing a lawsuit, even though empirical studies (such as the Harvard Malpractice Study) show that in reality the malpractice system does a poor job in generating compensation for the patients negligently harmed.^{Reference Localio34} Research participants generally do not have clear access to compensation for research-generated harm, though participants can try to sue under state tort law.³⁵ In the context of public health genomics, sovereign immunity may prevent compensation in state-run programs. The compensation available to DTC customers remains unclear.

Illustrative Scenarios:

This brief sketch of differences across the four domains of research, clinical care, public health, and DTC suggests the problems that can erupt when scenarios cross these domains. For example, a research project may be studying how best to integrate genomic sequencing into clinical care. In this first scenario, the project may be enrolling affected patients and placing results intended for use in clinical care into the medical record.^{Reference Henderson36} If a participant-patient alleges malpractice in variant analysis and interpretation, it may not be clear whether research rules, clinical rules, or both apply. This can make a big difference, as the state's statute of limitations for malpractice may preclude suit (depending on how much time has passed), leaving the participant-patient dependent on negligence law alone.³⁷

A second scenario raises a different conflict — between DTC and clinical care — that may arise when a customer purchases genomic sequencing from a DTC company using a laboratory compliant with the Clinical Laboratory Improvement Amendments (CLIA), if the DTC company issues a report that incorrectly interprets a clinically significant genomic variant as benign. The customer then brings the DTC report to their primary care physician, who relies on the report and thus fails to pursue a cancer risk variant, leading to potential harm because the patient loses her chance to follow-up with testing and prevention. In this scenario, the customer may or may not have a cause of action against the DTC company, depending on state law. The physician may argue that the DTC error was the sole cause of the harm and no malpractice was involved. Whether that argument will succeed in absolving the physician may depend on whether state law or the court determines that physicians have a duty to consider DTC reports presented and a duty to order re-testing or variant reinterpretation.

A third scenario pits the research framework against the public health one. In this scenario, a state launches research using second-tier newborn screening tests and fails to notify parents that their newborn tested positive in this research.³⁸

Applying the Guidelines:

The first scenario is one illustration of the confusion that can result when research and clinical genomics overlap. Though a big literature addresses ethical issues that can arise due to this overlap (such as therapeutic misconception), there is little literature on the legal issues. Investigators seeking consent for participation in such trials should address both the ethical and legal issues. This means making clear to participants in a concrete and appropriate way what aspects of the interaction are research governed by research ethics and research law, what aspects of the interaction are clinical care governed by those ethics and law, and where potentially both apply. This clarity addresses the first two guidelines above by identifying the problem of conflicting domains of law and educating the prospective participant. This kind of clarity on the hybrid nature of the first scenario and its implications for the potential participant is part of seeking informed consent to participate in the research. The prospective participant needs to understand potential harms that may flow from participation and what recourse will be available.

The third guideline calls for examining the law in both domains to assess whether it is “fit for purpose.” Improving requirements for research consent, as suggested, will advance the law and regulations of research to ensure more fully informed consent. The bigger problem is that the law of research deemphasizes accountability to research participants for harm, while relying to a great extent on Institutional Review Board (IRB) and sponsor prevention of harm, as well as penalties imposed by OHRP and funders. Neither mechanism has been shown to be fully effective in preventing harm and neither purports to redress harm already caused. Significant problems plague the law of liability and compensation in the realm of clinical care as well. There, empirical studies show a poor correlation between expert-adjudged malpractice and the legal system's judgment that malpractice has occurred.^{Reference Studdert39} Thus, in both the research and clinical domains, more work is needed to improve the way law supports prevention, identification, and accountability for harm.

Some proposals for improvement in both domains would lead to greater harmonization, in keeping with the fourth guideline. For example, proposals to create a system of no-fault compensation for harm caused in both the research and clinical domains would reduce the differences.^{Reference Henry, Studdert and Brennan40} Another option is to apply the fifth guideline and assure research participants that harm caused in the portions of the protocol that are both research and clinical care (such as incorporating genomic findings intended for clinical care use into the medical record) will be governed by the law of clinical care. This applies the decision rule in the fifth guideline as it avoids restricting the individual's access to the courts to adjudicate claimed harm.

Differences across Domains:

Each of the four domains takes a different legal approach to the question of what kind of consent or decision making is required from the person undergoing genomic analysis. In research genomics, the federal Common Rule on human participant research generally requires consent when investigators interact with participants or perform research on readily identifiable material; the regulations have detailed requirements for the consent process and consent documents.⁴¹ Consent to genomic sequencing in research is complex, due to the many issues that need to be addressed and differences in research design and population.⁴² In addition, 2017 revisions to the Common Rule have expanded consent options by adding the option of broad consent to current and future research use of individual data and biospecimens. State law on research may also specify requirements for consent and who is authorized to consent when the research participant is a minor or lacks capacity. Consent failures may trigger IRB, institutional, funder, and administrative penalties. Individuals attempting suit will generally use state tort law (negligence) and state law on research (where that is robust enough). Investigators must generally seek participants' consent to a proposed plan regarding providing or withholding return of results and secondary or incidental findings. In Maryland, the Grimes case found a cause of action for failure to communicate individual results.⁴³ In Ande v. Rock, the Wisconsin court rejected a malpractice action against researcher-physicians for failing to communicate results, as the court found no physician-patient relationship.⁴⁴

In clinical genomics, patients or their surrogates must consent to genomic sequencing and analyses. Though federal law and regulations play a large role in governing research consent, consent requirements in clinical care are primarily governed by state law, both common law and statutes or regulations. States may apply a reasonable-patient standard to govern consent disclosures, may rely on medical custom, or some combination of the two. Some states also have specific statutes on consent to genetic testing, though these statutes have been criticized as inadequate to fully address the issues that arise in clinical genomic sequencing.^{Reference Spector-Bagdady45} Failures to obtain informed consent may ground individual suits for malpractice or negligence under state law. The American College of Medical Genetics and Genomics (ACMG) has noted the near-inevitability of incidental findings in clinical sequencing (depending on the scope of analysis)⁴⁶ and has recommended that clinicians routinely test for a roster of secondary findings in clinical sequencing, unless patients opt out.^{Reference Green, Kalia and Wolf47}

Public health genomics, such as newborn screening, is governed by specific provisions of state law. These statutes and regulations specify the mandated approach to parental decision making — mandatory screening, routine screening with opt-out (most states) or opt-in.^{Reference Ross48} State public health power and the state's police powers to protect the vulnerable create a different context for consent and can limit individual rights to refuse. Individuals have sued under state law arguing that certain aspects of newborn screening require specific opt-in consent, namely retention of newborn blood spots and subsequent research.⁴⁹

In DTC genomics, customers elect whether to purchase DTC genetic or genomic testing and interpretation services. This is a commercial transaction in which the company offers goods and services for a fee. When customers agree to purchase the company's genomic analyses, they are entering into a contract with the company, subject to the terms of use stated by the company. The law on DTC genomics is in flux.^{Reference Dick and Novy50} There is debate about what law and rules govern the advertising and contracting process, that is, the informed consent.^{Reference Spector-Bagdady51} In seeking the customer's business, the company must clearly and accurately describe the services offered; misrepresentation or fraud may be actionable under state law or ground investigation and penalty by the Federal Trade Comission (FTC).⁵² The FDA may impose labeling and consent requirements.⁵³ To the extent that the company is deemed to be marketing medical services, state law on clinical informed consent will apply and individuals can sue for malpractice.^{Reference Marietta and McGuire54}

Illustrative Scenarios:

This brief description of the different approaches to consent and different bodies of law implicated in the four domains suggests the difficulties involved when genomic analyses cross two or more of these spheres. Multiple scenarios can illustrate those difficulties. In a first scenario, state public health authorities require newborn screening based on an opt-out consent regime. However, they also plan to use the dried blood spots generated in screening for research unrelated to the newborn screening program. They offer the collection of dried blood spots to university researchers for research involving whole genome sequencing, without seeking parent/guardian consent. It is unclear what deidentification will occur and what steps to avoid potential reidentification. (Note that several features of this hypothetical scenario distinguish it from the practices challenged in Bearder, for example, where blood spots were collected for the purpose of NBS but excess samples were retained and some used in research related to improving the state's NBS program as well as unrelated research, most of the research used de-identified samples, and with no indication that whole genome sequencing was involved.) In this scenario crossing the spheres of public health and research, the state's opt-out regime for NBS is in tension with the usual requirements of opt-in consent to research, as the collection of dried blood spots was for two distinct purposes: newborn screening and unrelated research.

In a second scenario, cancer patients may have consented to large-scale clinical genomic sequencing in order to identify molecular targets to guide their treatment. Researchers within the institution then analyze deidentified biospecimens from those patients and find clinically actionable pharmacogenomics variants. The researchers would like to trigger re-identification in order to convey the findings to the relevant patients and their clinicians. However, the patients were never asked to consent to the pharmacogenomics research because their specimens were deidentified. This scenario thus crosses the clinical and research domains.

In a third scenario, customers sign up for a DTC genetic testing service offering WGS and encouraging them to submit updated health information and diagnoses going forward. The company is approached by a large pharmaceutical company seeking access to the database and accruing health information for research and development. The DTC company sells access to both. The DTC company fails to seek customer consent for inclusion in this database. In the research context, participants would have been asked for consent to this research use and the potential for commercial sale of participants' data would have been disclosed.

Applying the Guidelines:

The first scenario illustrates the tension that can arise between the opt-out approach that most states use for NBS and the tremendous research potential of a population-wide archive of newborn blood spots that can be subjected to genomic sequencing analysis. The rationale for departing from the full autonomy protections of opt-in consent in the context of NBS is that screening newborns for genetically based conditions that must be recognized and treated from birth to avoid harm is a public health function for the benefit of those children. Including a condition on the NBS list means that analysis has already yielded the conclusion that the preconditions for population screening have been met^{Reference Wilson, Junger, Johnson and Wise55} and that the benefits of screening outweigh the harms.^{Reference Andermann56} In the absence of objection, parent/guardian consent is assumed, and the parent/guardian must take the step of opting-out of screening in order to deprive the child of the benefits. Moreover, states may limit the grounds on which parents can opt-out.

Opt-out consent in NBS contrasts with the general requirement for opt-in consent to research involving human participants. The Common Rule does not require consent to research with materials that were not collected for research and cannot be readily re-identified; that is not considered research with human participants.^{Reference Wolf57} In this scenario, the intent in collecting the biospecimens was dual — NBS as well as unrelated research — and it is not clear that the bio-specimens provided to the researchers were deidentified. Moreover, the 2017 revision of the Common Rule recognizes that changing technology may increase the re-identifiability of biospecimens and data, especially when the researchers are conducting WGS. The revised Common Rule thus creates a process for periodic reassessment of whether materials have become more readily identified and consent to the research is needed.⁵⁸ In addition, legal challenges to retention and research uses of newborn blood spots have hinged on state law; for example, in Bearder the Minnesota Supreme Court interpreted the consent provisions in the state's Genetic Privacy Act to require parent/guardian consent to sample retention and dissemination to researchers.⁵⁹

Applying the first two guidelines would suggest educating parents/guardians, clinicians, researchers, and public health authorities about the multiple potential uses of blood spots, including NBS-related research and research beyond NBS. This requires transparency about the benefits as well as the risks to parents/guardians and children. The third guideline suggests that although opt-out consent makes sense for NBS, if broad research uses are also contemplated at the time the blood specimens are collected — research uses beyond NBS improvement and quality control — and maintaining public trust and support is important, there is a significant argument for seeking more explicit consent for that wider research.^{Reference Shayeb60} The third guideline also suggests considering release of only deidentified specimens for research. However, even if specimens are deidentified, seeking consent also protects future research use of deidentified biospecimens in genomic research if the review process set up by the revised Common Rule yield a future determination that re-identifiability (especially after WGS) has become easier and consent is thus required. Consent innovations such as the “broad consent” endorsed by the revised Common Rule⁶¹ and public educational programs on the health benefits that can be generated by such research can help harmonize consent in the public health and research spheres, in keeping with the fourth guideline. And erring on the side of seeking at least broad consent follows the fifth guideline's decision rule to resolve conflict between the rules in conflicting domains by applying the rule more protective of individual rights and interests.

Differences across Domains:

The question of how to ensure the appropriate quality of genomic analysis and interpretation in different domains (research, clinical care, public health screening, and DTC testing) is complex. In genomic research with human biospecimens and data, a central question guiding quality requirements is whether the laboratory analysis is undertaken in order to generate results for direct clinical use in diagnosis, treatment, prevention, or health assessment. If so, then CLIA applies and the laboratory must be CLIA-certified or CLIA-exempt (together, “CLIA-compliant”). However, much research on human biospecimens and data is undertaken for research purposes without the intent that the results will be directly used in clinical care. In such protocols, the laboratory's activity is beyond the reach of the CLIA statute and regulation that recognizes a research laboratory exception applies.^{Reference Evans and Wolf62} Consequently, the laboratory need not be CLIA-compliant. It is widely recognized that CLIA is often a poor fit for research analyses, which may use advanced technologies beyond what CLIA contemplates. In research, there are multiple other mechanisms in place to achieve the quality of analyses and interpretation needed. These include funder and peer review of research plans and quality in awarding grants, professional society guidance on laboratory practice and variant interpretation,^{Reference Richards63} projects such as ClinVar and ClinGen creating central resources to support sound variant interpretation,^{Reference Landrum and Landrum64} efforts within multi-project consortia and other research confederations to achieve consistency in analysis and interpretation (such as CSER variant “bake-offs” comparing results across research groups^{Reference Amendola65}), and peer review prior to publication.

When a genomic assay is used in a clinical trial or other research investigation involving human participants, the device may need an Investigational Device Exemption (IDE) under FDA rules before the research can commence.^{Reference Micheel, Nass and Omenn66} An IDE permits a device to be transported in interstate commerce and used in clinical research even though the FDA has not cleared or approved it for marketing. If an IRB deems the device a “non-significant risk” (NSR) device, then clinical research can commence after IRB approval; the device is considered to have an approved IDE.⁶⁷ If the IRB determines the device is a significant risk device, its sponsors must file an IDE application with the FDA and clinical research cannot begin until the FDA has approved the application.⁶⁸ A device with an approved IDE is an “investigational device” and the Federal Food, Drug and Cosmetics Act requires that it be labeled as such.⁶⁹ This labeling is referred to as “investigational use only” (IUO) labeling.⁷⁰ The purpose of IUO labeling is to ensure that devices that are not cleared or approved for marketing are not used in clinical care (outside of a FDA-regulated clinical study). Genomic assays that are still in the laboratory stage of development can be sold, shipped, and used without an IDE, but such assays cannot be used for clinical purposes or in a clinical research.⁷¹ They can be labeled “research use only” (RUO). Genomic assays that are not intended for clinical use may also be sold with the RUO label. The purpose of RUO labeling is to prevent health care providers from inadvertently using the device to diagnose or manage a patient, and to prevent researchers from using such a device in clinical research without an IDE. The RUO label should also prevent manufacturers from marketing a device for any purpose other than laboratory research.

In clinical genomics, laboratories must be CLIA-compliant. In addition, professional societies such as ACMG, the Association for Molecular Pathology (AMP), and the College of American Pathologists (CAP) issue guidance for laboratory analysis and variant interpretation. The FDA regulates devices used in laboratory genomic analysis, including many of the software and algorithms incorporated. Developing a regulatory approach for next-generation sequencing has required FDA innovation. Because of the scale of the genome and quantity of base pairs that may be analyzed, the FDA has moved away from validating each separate gene test to validating the analytic pathway.⁷² The FDA considers not just analytic validity, but also the clinical validity of variant calling and interpretation. These latter functions involve software and algorithms utilizing databases to interpret the genome. The FDA has issued guidance on the quality and use of such databases.⁷³ Federal, state, and private payers also provide quality oversight in deciding what clinical genomic testing to fund or reimburse.

Public health genomics (e.g., newborn screening) utilizes CLIA-compliant laboratories for primary testing and second-tier labs. In addition, the Centers for Disease Control and Prevention (CDC) provide quality guidance for newborn screening.⁷⁴ However, the goal of population (or subpopulation) screening differs from the goal of clinical patient testing. In screening, the goal is to identify individuals who may need further evaluation and individual testing, within a screening framework that aims to provide net benefit on a population-wide basis. In NBS, this means striving to avoid missing a child who may be positive for the conditions under scrutiny, and thus tolerating a certain level of false positives on initial screening.

The quality of analysis and interpretation appropriate to DTC genomics remains controversial. Those laboratories performing DTC analyses for diagnosis, treatment, prevention, or health assessment must comply with CLIA to provide quality assurance of analytic validity; DTC companies whose laboratories are performing analyses for other uses need not comply. State law may regulate DTC companies.⁷⁵ The FDA famously shut down 23andMe's ability to market genetic and genomic analyses, until the company sought premarket approval for and met standards for FDA approval of several types of testing (including Bloom syndrome and limited BRCA risk assessment). The FDA then proceeded to grant additional approvals test-by-test. Eventually the FDA indicated that it would no longer grant approval test-by-test, but instead would require premarket approval of an initial test, allowing additional tests to be added without further approvals, though with “special controls” specified. In October 2018, the FDA approved pharmacogenomics (PGx) testing with the special control that clinicians refrain from relying on DTC PGx test results in making prescribing and dosing decisions.⁷⁶ As a consequence, clinicians need to reconfirm DTC PGx results through clinical testing before use.

Illustrative Scenarios:

In a first scenario, investigators offer research results to participants and their clinicians with an alert that these results were not generated in a CLIA-certified lab and should not be used for diagnosis or treatment, but should be confirmed and evaluated in a clinical context. This offer of non-CLIA research results, because of their potential clinical implications and the communication of those results to the participant for potential pursuit in the clinical sphere, appears at first glance to create a conflict between research and clinical quality rules.

In a second scenario, a clinician diagnoses her patient with a rare cancer and seeks genomic analysis of the patient's germline and tumor to guide treatment. The health center's laboratory is CLIA-certified but inexperienced in analyzing the genetics associated with this cancer. The clinician would prefer to refer the patient to the county's leading research laboratory studying this cancer. That research laboratory, which has an outstanding reputation, is not CLIA-certified, but claims to have excellent tracking and analytic procedures. This scenario again seems to create a conflict between the quality rules in research and those in clinical care.

In a third scenario, a patient brings her DTC printout to her primary care clinician, who is unsure what confidence to attach to the findings. The printout states that the results were generated in a CLIA-certified lab, but the clinician hesitates to use them in clinical care without reconfirmation. This scenario shows a potential conflict between quality rules in DTC genomics and in clinical care.

Applying the Guidelines:

The first scenario illustrates a widely recognized tension between the research and clinical domains. Return of research results to participants due to their potential clinical implications will involve no conflict when the research laboratory is CLIA-compliant; results generated will meet CLIA standards for analytic quality that allow their direct use in clinical care. Similarly, if a non-CLIA research laboratory confirms results in a CLIA-compliant laboratory before return, there will be no quality conflict. That conflict becomes a question only when non-CLIA research results are communicated to the participant or clinician to trigger clinical evaluation. However, the well-recognized resolution is to make clear that these are non-CLIA research results communicated for the purpose of triggering a clinical process of reconfirmation and patient evaluation.^{Reference Burke, Evans, Jarvik, Wolf and Evans77} Return of results to trigger clinical evaluation is not the same as returning results that are suitable for clinical use. Under the CLIA statute, only returning results for the latter purpose — use of those results in diagnosis, treatment, prevention, or health assessment — requires CLIA compliance.

This scenario demonstrates that careful analysis is crucial to understanding whether there truly is a conflict and how to navigate between two domains — in this case, research and clinical care. Recognizing the potential for conflict comports with the first guideline. The second guideline, calling for clarity and education, emphasizes the importance of the participant, researcher, and clinician understanding when results are suitable for immediate clinical use and when instead they require reconfirmation and evaluation prior to clinical use.

The third guideline is a reminder of why some research results are appropriately generated in non-CLIA laboratories. Requiring that all research be conducted in CLIA laboratories would violate this principle saying that law in each sphere should be “fit for purpose.” It is widely agreed that requiring all research laboratories to comply with CLIA would be unrealistic and would burden them with expense and regulatory requirements that would detract from their ability to make research progress. Moreover, CLIA is a poor fit for many research laboratories conducting novel and exploratory research, and CLIA has done a poor job of keeping pace with advanced research technologies. Finally, the CLIA statute limits required CLIA compliance to those laboratories conducting and reporting analyses for use in clinical care. CMS has no authority to require additional laboratories to comply.

The fourth guideline urges an effort to harmonize or reconcile the approach in separate domains. Recognizing that research laboratories may seek CLIA confirmation of the subset of results they wish to offer participants or may communicate non-CLIA results for purposes of CLIA confirmation and evaluation in the clinical domain creates mechanisms to reconcile the two spheres of research and clinical care.

The final and fifth guideline offers a starting point for resolving differences between the two domains by recognizing that results should be CLIA-confirmed before they are actually used in clinical care. Researchers may themselves initiate this reconfirmation before returning results or they may communicate results to trigger consideration of this reconfirmation process in the clinical domain. Either pathway leads to respecting participants' well-documented interest in receiving research results while ensuring CLIA confirmation of results before their use in clinical care.

Differences across Domains:

Privacy encompasses a number of different issues, two of which are particularly pertinent here. The first is the ability to limit who has access to data and information about an individual. The other is the ability of the individual to obtain data about him- or herself. These two issues are related; unless a person can see the information being held on them, they cannot assess the privacy threat posed by retention and circulation of that information and cannot make informed decisions about whether to authorize further use and sharing of that information.^{Reference Evans78} Access to one's own information is a well-established part of privacy protection in multiple areas of the law.⁷⁹

Illustrative Scenarios:

In a first scenario, a healthy participant undergoes WES as part of a research protocol in an academic health center (AHC). One year later, she has puzzling symptoms suggestive of a genetically-based neurological disorder. She seeks access to her genomic data and interpreted results in order to convey them to a well-known health care center specializing in that disease. She also wishes to contribute her data and interpreted results to a DTC company formed by a major patient advocacy group to facilitate research on that disease. However, the original research took place in a HIPAA-covered AHC. She knows that HIPAA guarantees access to clinical results, and wonders whether she can request access to these research results. This scenario raises questions about an individual's rights of access under the HIPAA Privacy Rule and their ability to move data and results from traditional research settings to clinical care contexts as well as citizen-driven DTC research platforms.

In a second scenario, a consumer uses DTC genomics for genome sequencing, in part due to her concern about Alzheimers disease in her family. She tries to decipher the company's policies on privacy from their website and terms of use but finds it difficult. The DTC company sells access to their database of consumers' genomic results to a pharmaceutical company for research use in a widely publicized deal generating millions of dollars for the DTC company. Her brothers, who are also interested in their genomics, purchase DTC WGS and contribute their results to a public database. The original consumer becomes concerned that the pharmaceutical company and any researchers with whom they share her data will now be able to re-identify her by comparing her brothers' posted sequences. In this scenario, the approach to privacy in two types of DTC companies (one posting publicly and the other not) as well as privacy protections in pharmaceutical research that may be subject to FDA rules on research with human participants pose issues.

In a third scenario, an individual volunteers to participate in a large-scale population research study focusing on precision medicine in order to advance public health. The study involves collection of multiple data types, from genomic and other–omics data to physiological, behavioral, and environmental information including geolocation. The study commits to protection of participant privacy, but with so many data types being collected, the participant worries that this protection will ultimately fail. This scenario demonstrates the tension between privacy protections in research and the demands of population studies collecting multiple and diverse data types to advance biomedical understanding and public health.

Applying the Guidelines:

The first scenario focuses on an individual's right to access information collected about them. As noted above, federal privacy statutes have included this right of access since at least the Privacy Act of 1974 and many state privacy and public records statutes also provide this access right. The core purpose of these provisions is to allow individuals to see what information is being held on them and circulated. This allows them to challenge information that appears to be inaccurate and to evaluate the privacy risks associated with storage and circulation of that information.

HIPAA is only one of the statutes that provide a right of access, but is important in the research and health care arenas. HIPAA entitles individuals to see the contents of their designated record set (DRS) in each HIPAA-covered institution that maintains such records.^{Reference Lye105} The DRS includes records “used…by and for the covered entity to make decisions about individuals,”¹⁰⁶ not just about the particular individual requesting access. This encompasses “a broad array of health information about themselves…including medical records, billing and payment records, insurance information, clinical laboratory test reports, X-rays, wellness and disease management program information, and notes.”¹⁰⁷

One might argue that although HIPAA confers a right of access to clinical materials in the DRS, it should not confer a right to access to research materials if those were not generated according to clinical rules and standards, such as CLIA. However, this apparent difference between access rights in the clinical versus research sphere diminishes on careful consideration. “[A]ny research records or results that are actually maintained by the covered entity as part of a designated record set would be accessible to research participants unless one of the Privacy Rule's permitted exceptions applies.”¹⁰⁸ Indeed, as noted above, HIPAA makes clear that the access right includes research information by allowing investigators to pause access during a clinical trial. The DHHS Secretary's Advisory Committee on Human Research Protections (SACHRP) recommends that, “If a HIPAA-covered entity believes that a non-CLIA laboratory test result may have clinical significance such that the entity may use it to make decisions related to the individual, then the result is part of a designated record set and must be released upon the individual's request.”¹⁰⁹ SACHRP further urges that, “If a covered entity may use a test result from a non-CLIA-certified laboratory to encourage an individual to provide a new specimen or to get tested at a CLIA-certified laboratory, then the entity is using the primary test results to make a decision about the individual.”¹¹⁰ Finally, the Public Health Service Act (PHSA), as amended by GINA, is clear that HIPAA's protections cover genetic information broadly; the PHSA definition of “genetic information” includes genetic information generated in research.¹¹¹

In addition, 2014 regulatory changes to HIPAA, CLIA, and the HITECH Act gave individuals the right to directly access completed laboratory reports. This expansion of individual access rights extends to non-CLIA research analyses, as part of the stated objective was to remove barriers to access in an era of “personalized medicine initiatives.”¹¹² The CLIA statute and regulations pose no bar to accessing results that were not generated and reported for direct clinical use, though CMS has tried to block this with a document posted on its website. SACHRP has advocated honoring the access right and removing the CMS document, with regulatory clarification that honoring the HIPAA access right does not violate the CLIA rules.¹¹³ This approach resolves the purported conflict between access provisions in research and clinical care by recognizing the importance of the access right in both spheres, as well as the stated federal commitments to the importance of this right.

The individual in the first scenario should thus be able to access her research information for purposes of contributing this information to further research. Given the fact that she wishes to contribute to research on a DTC platform, she should carefully review the privacy protections and access rights provided by that platform, as HIPAA may not apply.

Our first and second guidelines would suggest that researchers recruiting participants explicitly address both privacy protections and the scope of their access rights. Similarly, patients need to understand both, as do DTC customers. The third guideline emphasizes that privacy protections and access rights in each sphere should be “fit for purpose.” As DHHS, SACHRP, and many others have emphasized, research participants have a strong interest in being able to participate as partners in research, especially in the more engaged models of research increasingly emerging.¹¹⁴ Their interests extend to being able to contribute their data to additional research. In the clinical sphere, there is already robust recognition in law of the importance of privacy and access. The DTC domain lags, offering inconsistent and often opaque protection for privacy and access interests.

The approach we commend above attempts to reduce and harmonize differences across the research and clinical spheres, in keeping with the fourth guideline. And SACHRP's recognition that individuals' access right should be honored in the research sphere as well as the clinical sphere offers one way of following the fifth guideline, by protecting individuals' right of access across both domains.