Henrikson, Nora

Abstract Background It is unclear how the Health Insurance Portability and Accountability Act (HIPAA) should be interpreted in the context of sharing of genomic information between family members. Methods The authors analyzed the HIPAA Privacy Rule, reviewed the literature and constructed a clinical scenario to inform how HIPAA can be interpreted for multiple forms of patient- and provider-mediated genetic risk notification. Results Under HIPAA, healthcare providers can lawfully notify relatives to recommend genetic risk assessment using multiple approaches, including supporting the patient telling their own relatives, contacting relatives directly with the patient’s authorization, or contacting a relative’s provider directly. Conclusions Multiple forms of patient- or provider-mediated contact of relatives are already legally permissible under HIPAA, are consistent with ethical obligations of care to patients and their families, and could result in improved population health through identification of clinically actionable disease risk. Unanswered questions remain about implementation and impacts of provider-mediated programs.

A goal of the 3rd phase of the Electronic Medical Records and Genomics (eMERGE3) Network was to examine the return of results (RoR) of actionable variants in more than 100 genes to consenting participants and their healthcare providers. Each of the 10 eMERGE sites developed plans for three essential elements of the RoR process: Disclosure to the participant, notification of the health care provider, and integration of results into the electronic health record (EHR). Procedures and protocols around these three elements were adapted as appropriate to individual site requirements and limitations. Detailed information about the RoR procedures at each site was obtained through structured telephone interviews and follow-up surveys with the clinical investigator leading or participating in the RoR process at each eMERGE3 institution. Because RoR processes at each of the 10 sites allowed for taking into account differences in population, disease focus and institutional requirements, significant heterogeneity of process was identified, including variability in the order in which patients and clinicians were notified and results were placed in the EHR. This heterogeneity in the process flow for eMERGE3 RoR reflects the “real world” of genomic medicine in which RoR procedures must be shaped by the needs of the patients and institutional environments.