This story was originally published Oct 12.
A federal panel charged with studying privacy issues related to whole-genome sequencing last week released a report offering recommendations on how to ensure individual privacy in an era where whole-genome sequencing is becoming cheaper and more widespread.
In its report, Privacy and Progress in Whole-Genome Sequencing, the Presidential Commission for the Study of Bioethical Issues offered 12 recommendations to improve current practices for protecting privacy.
"Whole-genome sequencing is a powerful new weapon in the arsenal of 21st century medicine," said commission chair Amy Gutmann during a conference call with reporters. But, "we're going to have to figure out how to protect people's privacy and avoid the harm that can come from the misuse of this very personal data," she added.
The panel recommended a baseline standard of privacy assurances, clear penalties for the misuse of genomic data, informed consent standards that clearly communicate how genomic data will be used and who will have access to it — all while enabling genomic data to be shared in order to advance scientific discovery.
The commission came to its conclusions after holding public meetings and gathering input from a variety of stakeholders (CSN 2/8/2012).
One main concern highlighted in the report concerns the lack of standardization and consistency when it comes to regulations protecting privacy.
Privacy protection varies across state lines and also varies depending on whether genomic data is collected in a doctor's office or the research environment.
"Your genome sequenced at your doctor's office is the same as your genome sequenced during research," said Gutmann, but that same genomic data is currently protected by different regulations. A genome sequenced in a doctor's office is protected by the Health Insurance Portability and Accountability Act, while a genome sequenced in a research setting is protected by the organization's specific institutional review board protocol.
The commission recommended that the same privacy protections should apply in all settings, regardless of how the data is obtained.
Jennifer Geetter, a lawyer with McDermott Will & Emery and a member of the firm's Life Sciences Affinity Group and Personalized Medicine Team, told Clinical Sequencing News that this recommendation could result in a re-working of HIPAA or new legislation.
The problem currently, she said, is that it is possible to get your whole genome sequenced by laboratories that are not regulated by HIPAA, so patients have different protections depending on where they get their genome sequenced.
The commission is recommending that the same protections apply no matter where the sequencing is done, so the next step is to determine whether that means "more legislation, different legislation, or just a rethink of the existing legislation," Geetter said.
Privacy protection is also highly variable across state lines, Gutmann said during the call. In about half the states, someone could legally collect DNA from a discarded coffee cup, for instance, sequence it, and use that information to look for disease-associated variants.
Currently, costs are high enough to provide a barrier against such "surreptitious testing," Gutmann said, but as costs continue to plummet, "people could use this in ways that are really detrimental to the people whose genome they learn about."
For instance, insurance companies could use the information to deny coverage, or increase premiums, she said.
As such, the commission recommends that there be strong baseline regulations that protect against such surreptitious testing. While states can implement further regulations or laws as they see fit, the commission urges federal and state governments to develop policies that "protect privacy by prohibiting unauthorized whole-genome sequencing without consent," Gutmann said.
Additionally, the informed consent process should be consistent, regardless of who is collecting the data, the commission said.
Privacy vs. Data Sharing
Gutmann said that while the issue of individual privacy is critical, policies should not undermine scientific progress and should seek to both protect privacy and the misuse of data while encouraging data sharing.
In order to realize medical advances from whole-genome sequencing, not only will hundreds of thousands of people need to be sequenced, but that data will need to be shared, she said.
"Many medical breakthroughs are dependent on the availability of thousands if not millions of whole genome sequences of individuals," Gutmann said.
"You need massive amounts of these data in order to figure out what therapies will work for diseases as varied as Alzheimer's, cancer, heart disease, and many, many more," she added. Therefore it is important that there be "privacy protections for people that do provide their whole genomes for clinicians and researchers."
And these protections will become even more critical the more that is understood about the genome and its associations with disease.
For example, she said, suppose an individual has his or her genome sequenced, and a variant of unknown consequences is discovered, but five years down the line, researchers discover the variant is predisposing to a debilitating disease. "What does it mean that that variant is sitting in a database?" Gutmann said. "Does that mean you won't be able to get long-term care?"
Privacy policies should have to be applied to all parties involved in collecting and storing genomic information. Due to the sheer size of genomic data, third parties will likely be involved in storing the information, so the commission recommended that there be consistent policies across the board, from sample collection, running the sequence, delivering the report, and storing the data.
"All persons who have contact with the data have an ethical responsibility to treat the data with the utmost respect," added Lisa Lee, the executive director of the commission. And "all should be held accountable to state and federal laws if a breach happens," she added.
Finally, the commission's recommendations call for more standardization within the informed consent process. So far, labs and commercial entities have been developing their own informed consent protocols, which are variable.
For instance, the Medical College of Wisconsin and the Children's Hospital of Wisconsin's clinical whole-genome sequencing protocol allows parents of the children to make decisions about what types of results are returned. In all cases, the group will return variants related to the child's condition, as required by state law. But parents also have the option of receiving variants related to adult onset conditions.
However, the results can impact more than just the person whose genome is sequenced, but can have implications for other family members. As researchers at Washington University's Genome Institute found out, figuring out how or whether to return these results to family members can be tricky (CSN 10/12/2011).
In this case, a cancer patient had agreed to have her genome sequenced as part of a research project, but passed away before results were obtained. However, whole-genome sequencing identified that she had germline mutations in genes that predict cancer risk — an unexpected finding that could have implications for her children.
The commission's report suggests more standardized informed consent protocols, so that individuals know how their genomic data will be used, how it will be stored, and will be made aware of the possibility that new information will be discovered about their genome down the road and consent or not to having that information returned.
A number of groups are already studying this issue under an effort funded by the National Human Genome Research Institute. Researchers under the program are hoping tofigure out a best practices framework for returning results, including teams at Columbia University, the University of Washington, and Boston Children's Hospital (CSN 5/30/2012, CSN 6/13/2012, CSN 6/20/2012).