We have all heard a refrain much like this one over the last decade, increasingly so, as the cost of genetic sequencing has been drastically reduced with improvements in associated techniques and technologies. Already, discoveries are being made in laboratories that can help doctors determine from which drug a particular patient will receive the most efficacious treatment.Footnote ¹ The working presumption is that, eventually, individuals’ genetic sequence information will be included in each of their personal medical records.

Indeed, the U.S. National Human Genome Research Institute (NHGRI) of the National Institutes of Health has awarded at least $98 million since 2004 to develop near- and long-term sequencing technologies,Footnote ² aiming to get the cost of sequencing for a human-sized genome down to $1000 by 2014. NHGRI's vision in decreasing the cost of whole genome sequencing to $1000 or less is to “enable the sequencing of individual genomes as part of routine medical care.”Footnote ³ As an indicator of the speed at which sequencing technology is developing as the cost is decreasing, in October 2006, NHGRI stated that the cost to sequence 3 billion base pairs was $10 million.Footnote ⁴ Ten months later, the cost was $5 million.Footnote ⁵ Many are now suggesting that the pace of development of sequencing technologies will actually allow scientists to achieve the $1000 genome well in advance of 2014.Footnote ⁶

But just how it will bode to have your own fully sequenced genome in your future electronic medical record is unknown. What is known is how the technologies involved (electronic medical record systems and the genetic sequencing technologies) are developing rapidly and that both sequencing and electronic medical records are a policy priority for the U.S. government.

This article focuses on the seemingly inevitable inclusion of genomic (i.e., sequence) data in electronic medical records.Footnote ⁷ Specifically, I discuss the issues involved in the quest to sequence inexpensively the human genome and some of the incentives being offered to spur the process along, I discuss informational and medical privacy (including the current U.S. regulatory framework for medical information under which sequence data may become part of the medical record), and finally I analyze how the inclusion of genomic sequence data in that medical record does and does not comport with an internationally recognized standard for protecting personally identifiable information. It is important to keep in mind that this discussion mostly pertains to the inclusion of sequence data in medical records and does not account for the very extensive and wholly unregulated uses of medical information that occurs outside the scope of the U.S. medical privacy regulations. It also is important to acknowledge that the possibility of including a whole genome sequence within an electronic medical record is, at least, many years away. That does not diminish, however, the importance of anticipating the types of issues that will arise then, and indeed even before, as individuals undergo increasing numbers of genetic tests that will be recorded in that same medical record.

Pursuing the $1000 Genome

In December 2001, the NHGRI hosted a conference called, “Beyond the Beginning: The Future of Genomics.”Footnote ⁸ At that time, some geneticists suggested that the $1000 genome was possible within 10–15 years. As recently as April 2003 the prospect of a $1000 genome was still characterized by Francis Collins et al. from NHGRI as seeming “so far off as to be almost fictional” (p. 846).Footnote ⁹ Yet less than one year later (February 2004), the NHGRI issued two “requests for applications” (RFA) for grants related to the $1000 genome: one for “revolutionary genome sequencing technologies”Footnote ¹⁰ (i.e., technology leading to the $1000 genome) and the other for “near-term technology development for genome sequencing”Footnote ¹¹ (i.e., technology leading to a $100,000 genome). The same or similar RFAs have continued to be issued in each subsequent year.

In September 2003, J. Craig Venter of Celera Genomics announced a prize of $500,000 to an individual or group of researchers whose technology enabled a human genome to be sequenced for $1000 or less.Footnote ¹² In late 2006, Venter combined his prize with the X-Prize Foundation to offer $10 million to the first private company to map 100 human diploid genomes (i.e., 6 billion base pairs) in 10 days,Footnote ¹³ with each of the 100 genomes containing no more than one error in every 100,000 base pairs (with 98% coverage) and for a cost of no more than $10,000 per genome.Footnote ¹⁴ The Archon X-Prize in Genomics is focusing on whole genome sequencing because they believe it is the only way to understand the functional meaning of the genome, that other methods (such as looking solely for “single nucleotide polymorphisms” [SNPs] of common genetic variation in humans) necessarily missFootnote ¹⁵ or are not designed to look for.

That said, work is still continuing to find and map more SNPs. Recently, the International HapMap Consortium announced the completion of the Phase II HapMap, which contains 3.1 million SNPs (which the Consortium estimates represents 25%–35% of common genetic variations in the populations they surveyed).Footnote ¹⁶ Ultimately, however, it will likely be most clinically informative to do whole genome sequencing for each individual, to gain a solid foundation for understanding the genetic causes of many diseases and the functional aspects of the genome that are not explicitly tied to a particular variation. It is on that basis that the analysis of the application of Fair Information Practices to the genome sequence will unfold.

The Fair Information Practices

In 1980, the Organization for Economic Cooperation and Development (OECD) released a set of guidelines designed to protect individual privacy while facilitating the free flow of personal data between countries in the conduct of commerce. The eight guidelines (addressing collection limitation, data quality, specification of purpose, use limitation, security safeguards, openness regarding data policies and procedures, individual participation, and accountability) are formally called “Guidelines on the Protection of Privacy and Transborder Flows of Personal Data”Footnote ¹⁷ but are more colloquially known as the OECD Guidelines. The United States approved the OECD Guidelines, along with the other member countries, after consensus building and ratification processes. The guidelines are also known as “fair information practices” (FIPs), and have formed the basis for national privacy legislation in many of the OECD member countries. It must be noted, however, that the U.S. government's support of the Guidelines has waxed and waned over the years and that the United States is almost alone among Western (and some Eastern) nations in not having enacted any omnibus privacy laws.

The FIPs are also implicitly at the heart of the medical privacy regulations promulgated by the Department of Health and Human Services (HHS) in 2002Footnote ¹⁸ under the Health Insurance Portability and Accountability Act of 1996Footnote ¹⁹ (HIPAA). In an interim version of the regulations,Footnote ²⁰ HHS acknowledged that

In their inception, the intent was to provide a set of FIPs to govern how personal health information would be used, although there is room to argue about how well the regulations actually implement them. One thing that the medical privacy regulations do is to define who and what are covered by them, including defining “protected health information” (PHI). Essentially, PHI is individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or mediumFootnote ²¹ (Part 160.103), although it does exclude a few classes of records. The regulations define “covered entities” as health plans, health clearinghouses, and healthcare providers who transmit health information in an electronic format (including business associates). These are the entities to whom the privacy regulations pertain.

Fair Information Practices and the Human Genome

The following analysis uses the OECD Guideline FIPs to address the extent to which the sequenced human genome can be incorporated into an electronic medical record (in the United States) while still protecting privacy interests of patients. The discussion focuses on the five most relevant of the eight principles, in turn, as they are presented in the Guidelines, and will also take into account the current U.S. regulatory framework under the HIPAA Privacy Rule.

1. 1. Collection Limitation Principle

   There should be limits to the collection of personal data and any such data should be obtained by lawful and fair means and, where appropriate, with the knowledge or consent of the data subject.

   Physiologically, it is difficult to argue that there is any single type of personal medical data that more comprehensively represents an individual than his or her genome. By definition, therefore, collection limitation vis-à-vis the human genome would seem to be an impossibility. One can plausibly argue that the HIPAA regulations do not implement this Fair Information Practice Principle in any event (i.e., federal regulators may have been loathe to suggest how medicine should be practiced, by imposing a data collection limitation). Nonetheless, there may be ways to limit the amount of the genome that is sequenced and/or included in a medical record, although it is difficult to see at the present time how to determine what should be included and what should not. Moreover, considering that the point of the $1000 genome is precisely to make its “reading” (and, thus, its inclusion in a medical record) economically feasible, inclusion of anything short of the full genome would be missing an opportunity to be fully useful in diagnosing and understanding disease and generally enhancing a person's medical care. This assumes, of course, that there will come a time when care providers gain sufficient expertise in genetics and the meaning of genetic probabilities to make having genomic information in the record worthwhile.

   Additionally, obtaining the data subject's “knowledge or consent” for the data collection in this case also would be problematic. Exactly what would any of us be agreeing to have collected? Although we might know, or think we know, of some of our inherited traits and our family's medical history, how prepared should we be to consent to the collection of personal data, the vast majority of which is utterly unknown to us and will be for some time to come, given the limitations on our knowledge of the meaning of the data? And although we could provide consent, it would be neither informed nor with our understanding. It is difficult to imagine a situation in which an individual could truly understand the implications of consenting to the collection and subsequent use of this information. As it happens, under the HIPAA Privacy Rule, there is no practical role for “consent” in any event—if anything, consent is presumed for treatment, payment, and healthcare operations. (This is discussed in more detail below.) The real question then is whether the genomic sequence data should be collected in the first place, if we know that it will end up in an electronic medical record that has myriad uses that exceed the immediate medical care of the individual patient. An alternate question is whether the regulations should be amended to treat genomic sequence information as deserving of additional or altogether separate protection.

2. 2. Data Quality Principle

   Personal data should be relevant to the purposes for which they are to be used, and, to the extent necessary for those purposes, should be accurate, complete and kept up-to-date.

   In the context of the genetic sequence, what might this principle mean? Consider the following illustration.

   When we see the following string of letters, they make sense and we know exactly what their context is: “twasthenightbeforechristmas"—and there is no question that the spelling is correct. Moreover, we also know exactly what the source of this set of letters is and understand the meaning conveyed by the letters. However, if the letters spelled “twastheniteb4christmas,” it is clear to most people (although perhaps not immediately) not only that there are typographical errors among the letters, but also exactly what those errors are. Moreover, although the meaning might be the same as the correct spelling, there are still misspellings and some letters missing altogether. Unfortunately, genetic codes are not that obvious.

   The following string of letters constitute the first 70 of 81,154 base pair letters comprising the BRCA1 gene: GGAAGTGTTTGCTACCAAGTTTATTTGCAGTGTTAACAGCACAACATTTACAAAACGTATTTTGTACAAT.Footnote ²² The gene is located at Chromosome 17q21 (i.e., on the long arm of Chromosome 17 at position 21, with molecular location of base pairs from 38,449,839 to 38,530,993). So far, researchers have identified over 1000 mutations on the BRCA1 gene, many associated with increased risk of cancer.Footnote ²³ In looking at just the sequence above (let alone the remaining 81,084 base pairs), it is clear that not even a highly trained specialist could look at that string of letters (without relying on technology) and likely be able to discern anything intelligible from it or even know that these are the first 70 base pairs in the gene and not the last 70. Given that no technique is perfect, it is clear that there will be errors in the sequencing, either via transcription, transposition, omission, or addition. Even if we assume an error rate of one error per 1 million base pairs (a low error rate that may not be achievable), there still will be 3,000 potential errors in each sequenced genome. Moreover, although these errors may occur in completely insignificant positions on the genome, there may be no easy or obvious way of determining with certainty (1) that there is an error in the first place, (2) if there is, where the error(s) occurs, and (3) what the error might be (transposition, omission, or addition of base pair letters).

   Even if the error rate decreases as the sequencing technologies improve, there may conceivably be sample-handling errors that will always be present. It is debatable whether the data are accurate enough to be included in a record that might be seen by potentially thousands of people who have nothing to do with the direct clinical care of any particular patient. Note that it is true that other information in a medical record may be (and likely is) in error and may be unintelligible to the subject individual. The difference with genetic sequence information is that there is no one with sufficient knowledge or understanding to make that determination with any certainty and without specialized interpretive technologies. Given the likely improbability of any individual knowing of an error in their sequence transcription, these mistakes would likely remain in the record. Moreover, even these technologies will not be able to determine what is in error without redoing the genome sequence and comparing the two. In this case, mismatches can be identified, but which is correct will still require additional corroboration.

3. 3. Purpose Specification Principle

   The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.

   Strictly within the medical/clinical context, the purpose specification principle is, arguably, a difficult one to satisfy for any sort of medical information. The purpose of collecting clinical information and amassing it into a medical record is for the immediate and longer term care of an individual. It may not be practicable to specify the precise purposes beyond that, especially for chronic medical conditions or simply monitoring aging patients. For genetic sequence data, however, it is arguably unreasonable to claim that the entire genome's data are needed for some specific purpose (or even a general one), at least until such time as the medical profession is actually capable of using it in any meaningful way. Even in that eventuality, it is debatable whether there will ever be a circumstance in which the purpose of having an entire genome's sequence could be specified. A statement of purpose for the collection of genome sequence data would necessarily have to be so broad as to potentially undermine the intent of the principle for specifying the collection purpose. Under this principle, it is much more plausible to make an argument for recording SNP data in the record, by specifying the particular disease with which the SNPs are known to be associated. In that case, there should be a rationale for focusing on specific SNP data, that is, that a care provider has reason to believe that an individual has or may have a particular disease that could be identified via that specific sequence data.

   Another potential issue that flows from the HIPAA regulations vis-à-vis this principle arises because some of the collection purposes that are permissible extend beyond the medical/clinical context. For instance, law enforcement officials may obtain DNA data from medical entities having custody of it for purposes unrelated to healthcare or other than trying to identify or locate an individual (e.g., paternity and criminal proceedings). And once disclosed in this way, law enforcement officials, who are not considered “covered entities” are not obliged under HIPAA to further protect the data.

4. 4. Use Limitation Principle

   Personal data should not be disclosed, made available or otherwise used for purposes other than those specified in accordance with the Paragraph above except:

   1. a) with the consent of the data subject; or

   2. b) by the authority of law.

   The use limitation principle is, perhaps, the most problematic one to address, especially when looking at the current regulatory framework within which medical information is used. Under the current HIPAA privacy regulations, myriad uses of the data would be covered by “the authority of law” (i.e., treatment, payment, and healthcare operations). So, in this case, it is impossible to discuss the principle vis-à-vis genomic information without discussing how the current regulations undercut the very purpose of this principle.

   The privacy regulations do not require patients to consent for the use and disclosure of their medical information for treatment, payment, or healthcare operationsFootnote ²⁴ (Part 164.506), although entities are permitted to request consent, though it serves no purpose under the regulations. The HIPAA privacy rule provides additional protections for only one class of health information: psychotherapy notes (i.e., a therapist's notes that document or analyze the contents of conversations occurring during a counseling session, and which are kept separate from the rest of the patient's medical record [Part 164.501]). Patients must authorize the release of this class of information from their records for treatment, payment, and healthcare operations.

   It is important to understand the scope of activities for which medical information (or PHI) can be used and disclosed, particularly for healthcare operations. Treatment includes the provision of health care and related services (including patient referrals); payment includes determinations of eligibility for coverage and also includes disclosures to collection agencies for accounts in arrears. These uses are not necessarily unexpected in these contexts. Healthcare operations, however, are an entirely different matter. There seem to be few activities that are not included within its meaning (note that the following is not a comprehensive list): (1) quality assessment and improvement, outcomes evaluations, protocol development, case management; (2) reviewing the competence or qualifications of healthcare professionals, conducting training programs for nonhealthcare and healthcare professionals, accreditation, certification; (3) health insurance underwriting, premium rating; (4) conducting medical reviews, legal services, auditing functions, and fraud and compliance programs; (5) business planning and development; and (6) business management and general administrative activities of the entityFootnote ²⁵ (Part 164.501).

   To understand the extent of the uses and disclosures that are permissible under HIPAA, the following analysis will prove illuminating. In the December 2000 version of the HIPAA privacy regulations,Footnote ²⁶ HHS published the number of healthcare establishments considered to be “small businesses” that would be affected by the regulation. (By law, draft regulations must calculate the impact of compliance on small business entities.) The figures then available from the Census Bureau (from 1997), showed that there were a total of 562,916 small healthcare establishments, which represented 82.6% of all heathcare establishments examinedFootnote ²⁷ (p. 82780). In addition, the estimates note that 2,125,000 establishments were “fully insured ERISA,” that is, self-insuring employers under the Employment Retirement Income Security Act, whether employers self-administered their health plans or used third-party service providers for that purpose. So, clearly, approximately a decade ago, there were already a large number of entities affected by the regulations. Note that all of these entities would fall under the functional categories of “treatment, payment, or healthcare operations” for purposes of the HIPAA regulations. In other words, there were close to 3,000,000 establishments that could conceivably receive at least some access to some “protected health information” under the regulation, without the need for patient consent. The draft regulations did not include any estimates of the numbers of employees at these establishments.

   In an effort to update those figures, this analysis took the business codes used in the 1997 figures (then called “Standard Industrial Codes”) and migrated them to the most recent figures available from the Census Bureau: 2004. For 2004, there were 504,541 firms in analogous categories to those identified in 1997 (see Table 1). These include ambulatory healthcare services, hospitals, nursing and residential care facilities, pharmacies and drug stores, and direct health/medical insurers. In addition, there were 1,640 establishments in the medical equipment rental/leasing business. For this category of business, the latest figure available was from 2002. More striking though, is the number of employees associated with all these firms. For the total number of firms and establishments (506,181 [504,541 in 2004 plus 1,640 from 2002]), there were 14,797,499 employees who could, conceivably, be authorized to see some aspect of one's protected health information.

   Table 1.

   Estimate of the number of firms/people likely covered entities under HIPAA

   

   Dates are 2004 (except where noted).

   ^a From http://www.census.gov/epcd/susb/latest/us/US62.HTM.

   ^b From http://www.census.gov/econ/census02/data/industry/E532490.HTM.

   ^c These numbers from 2002.

   ^c From http://www.census.gov/epcd/susb/latest/us/US44611.HTM.

   ^d From http://www.census.gov/epcd/susb/latest/us/US52.HTM.

   To get an idea of the number of ERISA health benefit plans, this analysis relied on data from the U.S. Department of Labor (DOL) from 2000Footnote ²⁸ (p. 70262). According to the DOL, there were 2,802,000 such health benefit plans. Four thousand employers self-administered their health plans, whereas others used service providers to administer them. There were 305,000 plans serviced by such providers in 2000. In 2004, there were 3,497 firms and 130,562 employees providing third party administration of insurance and pension plans.Footnote ²⁹ It must be stressed, however, that employers have a limited ability to get PHI—and they only have that limited ability for their own employees.

   Given these updated figures from the Census Bureau and the Department of Labor, it is clear that close to 15 million people, as employees of the covered entities, could conceivably be in a position to access and use PHI. This is not to suggest that all of these people have access to all medical records. Also note that the figures cited both above and in the December 2000 version of the regulations do not capture many of the other types of covered entities that can also get access to PHI, such as health clearinghouses and medical business associates.

   The fact that millions of people might be authorized to access and potentially further disclose PHI should make us less than sanguine contemplating the inclusion of genomic sequence information in that same health record. Remember that only psychotherapy notes receive special protection under the regulations. Genomic sequence information is not considered to be different from all other medical information. Arguments about the utility of “genetic exceptionalism” aside, the lack of a role for consent under HIPAA, the number of people and entities that might be in a position to get legitimate access to PHI, and the fact that genomic sequence data will be among that which would be routinely disclosed utterly undermines the fundamental purpose of the principle.

5. 5. Security Safeguards Principle

   Personal data should be protected by reasonable security safeguards against such risks as loss or unauthorized access, destruction, use, modification or disclosure of data.

   Strict security measures for PHI (whether or not it includes genomic information) are paramount in order to protect patient privacy. Indeed, the HIPAA regulations cover security standards for handling PHI (Parts 164.302–318). These standards came into effect in April 2005 (April 2006 for small health plans). The standards address administrative, physical, and technical safeguards, along with organizational requirements and policies, procedures, and documentation requirements. The regulations leave open to each entity the specific methodology chosen to satisfy these requirements.

   According to the Privacy Rights Clearinghouse, a nonprofit consumer organization in San Diego, over 226 million records of various U.S. residents’ personal and business transactions have been exposed due to security breaches since January 2005.Footnote ³⁰ Between January and August 2005 alone, nearly 1.6 million medical records were involved in security breaches.Footnote ³¹ From January 2007 through late May 2008, over 8.8 million medical records were exposed through 68 separate security breaches.Footnote ³² (Note that this number is likely much higher—the 8.8 million figure only accounts for those breaches where the actual number of records exposed was available.) The reasons for the breaches included stolen computers/laptops, careless employees or contractors losing data disks or laptops, disgruntled employees, fraudulent employee use of PHI for financial gain, and hackers. In the case of the stolen or lost computers or data disks, the information contained on them generally was not encrypted or password protected, although even these protections might not deter someone who is intent on getting to the data on the PCs/disks. These breaches occurred despite the fact that HIPAA regulations for the security of PHI had been in place for at least 1 to 2 years. If genome sequence data were among the data that was breached, it would most certainly constitute a devastating type of “identity theft” and potentially could be quite a valuable commodity.

   There are criminal and civil penalties under HIPAA. In June 2005, however, the U.S. Justice Department (DoJ) issued a ruling that limits prosecutions of people who violate the HIPAA's privacy provisions. Under their interpretation of the law, the criminal penalties apply only to “covered entities” (i.e., health plans, health clearinghouses, and healthcare providers—most of which would be corporations). Individual employees of the covered entities would likely not be prosecuted for HIPAA criminal violations, although they might be prosecutable under other laws dealing with corporate criminal liablilty.Footnote ³³ To date, no civil penalties have been issued by the DoJ under HIPAA.

What Does It All Mean?

It should be evident at this point that given the nature of genomic sequence data and the current regulatory environment with which it will ultimately interact, it would be premature at best and potentially irresponsible at worst to contemplate adding genomic sequence data to an electronic medical record anytime soon. This does not in any way imply that whole genome sequence data should not be used in clinical medicine, at some point. However, that time may not arrive for several years, and the legal system of privacy protections for protected health information must be modified in anticipation. Moreover, most healthcare providers (like the iconic family doctor, Marcus Welby, M.D.) are not yet fluent enough in genetics and genomics to make effective use of it in the clinic.Footnote ³⁴ Years of additional training could be necessary for that to happen.

Moreover, it is made clear on nearly a daily basis just how much we still do not understand about the genome's functionality. As recently as December 2007, a study produced a new estimate of the number of coding genes in the human genome: 20,500, representing a loss of 4,000 genes from prior estimates.Footnote ³⁵ The implication of that is that there is likely much more interplay among genes and the noncoding portions of the genome and that each gene must play a role in more proteins, traits, and diseases than previously thought. Another paper, published in June 2007,Footnote ³⁶ detailed how what we once characterized as “junk” DNA (noncoding, and hence thought to have little significant purpose) actually gets transcribed into RNA—that is, it is far from being “junk”.

Then there is the matter of the epigenome. The continuing discovery of just how the genome works is reinforcing the fact that genetic expression is not a static “thing” that remains unchanged throughout one's life; and the epigenome is a central reason for that. The epigenome is essentially a layer of biochemical reactions or instructions that turn genes on and off, without altering the DNA sequence.Footnote ³⁷ Epigenetics can help explain, for instance, why identical twins often have different susceptibilities to diseases, despite their identical DNA. The challenge with epigenetics is that the “sequence of the human genome is the same in all our cells, whereas the epigenome differs from tissue to tissue, and changes in response to the cell's environment”Footnote ³⁸ (p. 144). Additionally, epigenetic codes are more vulnerable to environmental influences, which may explain how the environment and exposure to toxic chemicals affects disease susceptibility. It also changes with age, and can be passed from parent to child. As one scientist explained it, “Epigenomics is where genomics was 30 years ago, when everyone was working on part of the puzzle”Footnote ³⁹ (p. 145).

Ultimately, the question that must be asked is this: Is it wise to put genomic sequence data into electronic medical records that are poorly protected, that cannot adhere well to Fair Information Practice principles for privacy, and that can potentially be seen by tens of thousands of people/entities, when it is clear that we do not understand the functionality of the genome and likely will not for several years? John Robertson put it this way: “Unless much more is known about human genes and how they function, having a full human genome sequence would provide limited benefits and probably not justify the costs of rapid sequencing.”Footnote ⁴⁰ Moreover, despite our protestations to the contrary and because we (the public) do not fully appreciate the meaning of genetic probabilities, we are decidedly deterministic in our view of genomic data. We gravitate toward easy explanations to deal with complex phenomena (in many contexts). If we do the same with static genomic sequence data (e.g., as it appears in a medical record over a period of years), we risk not only misunderstanding or misinterpreting the data, we also risk harming the very patients we are purporting to be helping by having the data. As such, at the very least, genomic sequence data should not become a routine, easily accessible part of anyone's electronic medical record. The HIPAA privacy and security regulations clearly do not provide adequate protections for the data, and the federal government has done little to enforce the regulations via civil or criminal sanctions. At a point in time when we more fully understand the functionality of the genome, including the roles of “junk” DNA and the epigenome, and train clinicians on how to interpret the meaning of it all, perhaps then the question can be reconsidered.