We have all heard about the burgeoning opportunities tied to the development of precision medicine (also called "personalized medicine"), which includes the use of an individual's genetic information to design targeted treatments. In fact, these opportunities are now receiving increased visibility due to President Obama's recent push for a "Precision Medicine Initiative." Privacy issues are of critical importance with respect to his administration's Precision Medicine Initiative, as President Obama emphasized in his public remarks on January 30, 2015: "we're going to make sure that protecting patient privacy is built into our efforts from day one."
President Obama announced in his latest State of the Union address that his administration was launching a new Precision Medicine Initiative intended to improve health outcomes by using personalized information. The President's Fiscal Year 2016 Budget, released February 2, 2015, proposes $215 million to launch this Precision Medicine Initiative, which is intended to start:
- A "voluntary national research group" of at least one million individuals;
- The expansion of research to define cancer subtypes and identify new therapeutic targets;
- The modernization of the regulatory framework for DNA-sequence-based diagnostic tests; and
- The enhancement of interfaces for electronic health records and patient-generated data in assessment of individual health and population-level trends.
Key to understanding how these and similar precision medicine opportunities will operate is understanding the unique, complex regulatory framework that governs the privacy of genetic information. The Health Insurance Portability and Accountability Act ("HIPAA") generally governs "covered entities," which includes health plans, health care clearinghouses, and health care providers that electronically transmit health information in connection with transactions. HIPAA generally does not restrict the use and disclosure of genetic information for treatment, payment, health care operations, or research in ways that are more stringent than other protected health information. However, in addition to HIPAA, most states have specific laws intended to protect the privacy of individuals that restrict the collection, retention, use, disclosure, and form of consent for genetic information. These state laws, which are sometimes more stringent than HIPAA, are not legally preempted by HIPAA, and often apply to businesses other than HIPAA "covered entities." The substance of these laws varies considerably from state to state. In fact, some states have enacted laws providing that an individual's genetic data is that individual's property, stating that an individual is the "owner" of his or her own genetic information.
Amendments to the HIPAA regulations in 2013 expanded the opportunities for covered entities to obtain individual authorization for the uses and disclosures of protected health information for future research purposes. Again, researchers must also consider the unique state laws that address research uses of genetic data. Some state provisions address research using so-called "anonymous" genetic data. HIPAA uses a concept of "de-identified" data which is not subject to federal privacy protections. De-identification involves (i) the removal of specific identifiers from genetic information or (ii) an expert determination regarding the risk of identification of the information. However, de-identified data are not necessarily anonymous data – while it is technically feasible to re-identify an individual from de-identified data, data that are "anonymous" means that it is impossible to re-identify an individual from the data. The very notion of anonymous genetic data is controversial, as some experts believe that it is impossible to fully anonymize genetic data. More information about these and other key privacy issues regarding genetic information can be found in Foley's recent white paper.
In addition to the already complex regulatory framework governing the privacy of genetic information, additional privacy restrictions may be coming down the pipeline. A "fact sheet" on the Precision Medicine Initiative recently issued by the White House indicates that the Precision Medicine Initiative will include a review for changes to the current regulatory landscape governing privacy rights. Consistent with this, President Obama indicated in recent public remarks that privacy experts and patients' rights advocates would play a core role in designing the Precision Medicine Initiative. Thus, members of industry and other stakeholders should anticipate expanding federal guidelines governing the privacy of genetic information, particularly if the President's budget proposal for the Precision Medicine Initiative is granted.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
