Personalized Medicine - Translational Informatics: Realizing the Promise of Knowledge-Driven Healthcare - page 50

required to apply for access. On the plus side for data access, there has been a recent
movement to enable people who want to share their data to do so. Sicker patients
tend to be less concerned with data privacy and more concerned that their data be
made available to anyone working on a potential cure. Initiatives like the Portable
Legal Consent [ 43 ] and 23andWe [ 44 ] aim to empower individuals to share their
personal health data in meaningful ways.

3.5.2.2 Data Privacy

The unintended consequence of increased data sharing (genomic and otherwise) is
an increased chance of a data breach, and of this information becoming available to
those who would use it against the individual from whom it was derived. One often
cited example is an insurance company refusing to cover someone with increased
risk of a given disease, or charging exorbitant rates for such coverage. GINA, the
Genetic Information Nondiscrimination Act, was passed in 2008 to address some of
these issues, but it only covers employment and healthcare insurance. It does not
extend to life, disability, or long term care insurance [ 45 ]. Another more dramatic
scenario, as offered up in the consent form for the Personal Genome Project [ 46 ], is
that if a person's sequence is known, it could in theory be used to create artifi cial
DNA to be planted at the scene of a crime.
The 18th HIPAA identifi er is defi ned as “Any other unique identifying number,
characteristic, or code, unless otherwise permitted by the Privacy Rule for re-
identifi cation” [ 47 ]. And yet, as of early 2014, the US Department of Health and Human
Services has not issued clear guidance on how the HIPAA Privacy Rule applies to
genetic data nor whether DNA sequence is considered an identifi er under HIPAA [ 48 ].

3.5.2.3 Return of Results

For a patient or research participant who has his or her genome sequenced, should
that information be provided back to the individual? Surely a person should have
access to his or her own data if desired. On the other hand, so much of the data is
of questionable clinical utility or part of the “incidentalome,” analogous to inciden-
tal fi ndings in radiology [ 49 ]. Undiscovered, these traits would remain benign.
Instead, their observance can lead to costly tests, emotional distress, or worse. Will
providing hints of uncertain risk do more harm than good in causing mental or
emotional stress? While most fi ndings from DTC testing are benign, some are not.
For potentially troubling results such as ApoE carrier status or BRCA mutations,
23andMe does not show these results along with the others but requires the user to
click an extra link to “unlock” those results. It is appropriate to enable people to get
their genomic data without the involvement of a clinician? Are people ready to
learn about a life-altering genetic mutation over the internet? Conversely, is it
overly paternalistic to think people should have their own data kept from them?
This is an area of ongoing investigation, but studies to date regarding people's