Posted By: Sara Cullinan, PhD, Deputy Director, AJHG
Each month, the editors of The American Journal of Human Genetics interview an author(s) of a recently published paper. This month, we check in with Barbara Evans of the University of Houston, to discuss her Commentary, “HIPAA’s individual right of access to genomic data: reconciling safety and civil rights.”
Through such Commentaries, AJHG encourages individuals in the genetics community to share their personal views on a policy issue. Distinct from journal editorials and official ASHG statements, it is our hope that these commentaries will help spur discussion within the field.
AJHG: How did you become interested in this topic?
Barbara: Last summer, I was getting a lot of calls from research participants who were having trouble exercising their HIPAA right of access to their own genomic data. The HIPAA Privacy Rule is a U.S. federal privacy law. It grants people a right to obtain copies of data about themselves that is stored at HIPAA-regulated facilities. Since 2013, the Privacy Rule protects genetic data and, since 2014, its access right extends to data stored at HIPAA-regulated labs. People heard that they have a right to see their data, so naturally they wanted to see it. Many were being told “no.” Law professors play an informal role as society’s help line for questions about the laws we write about. I write about HIPAA, so I’m like the canary in the coal mine if a new HIPAA problem is emerging: my phone starts to ring. I checked around, and other HIPAA lawyers were getting those same calls from frustrated research participants. “Strange…why now?” we wondered. It seemed worth looking into—which, for a Law Prof, means you write an article. This is the article.
AJHG: What about this topic most interests/concerns you?
Barbara: Regulatory lawyers are like primary-care docs: when someone shows up with a regulatory problem, you order a battery of diagnostic tests. The first test you run is to trace back in legal history till you find the statute (the Act of Congress) that gave rise to the regulation. Like most people, I always assumed that HIPAA’s access right must flow from the HIPAA statute. That’s true, but with a fascinating twist. As it relates to genetic information, HIPAA’s access right flows from a mandate Congress laid down in the Genetic Information Nondiscrimination Act of 2008. It’s a civil right! That fact has impacts that my commentary explores.
What concerns me most? Under the U.S. system of law, one of the worst ways things can go wrong in a democracy is if government agencies, which are supposed to protect people, take actions that deprive people of their civil rights. Your right under HIPAA to see your own genetic information is a federally protected civil right. That limits the range of actions regulators like the U.S. Food and Drug Administration and the Centers for Medicare and Medicaid Services, which regulates clinical labs, can take to block people’s access to their own genomic data. My commentary hopes to spark a dialogue about ways to address valid safety concerns about individual data access, without violating people’s civil rights.
AJHG: Tell us a bit more about the bigger picture—for scientists and the general public.
Barbara: Using people’s genomic data in research offers huge benefits to society, but it exposes people to privacy risks and other threats to their civil rights. Dating back to the dawn of the information age in the early 1970s, Congress has approved policies that let researchers use people’s data to advance public health and research. The quid pro quo is that Congress has consistently stood by the idea that if researchers have broad access to your data, then you should have broad access, too. Doesn’t that seem fair?
People who want to block individuals’ access to data need to appreciate that, over the past 50 years, Congress gave this matter a lot of thought and commissioned multiple ethical analyses. What they found is that if you want to take people’s access away, you can do so. But in return for taking people’s access away, you would then need to severely curtail researchers’ access to people’s data as an alternative way to protect people’s civil rights. So which world do you want? In World 1, researchers and people both have broad access to the people’s data. In World 2, neither group has access. Those are the two ethical options. It’s just not ethically defensible to have a World in which researchers have broad access to people’s data, but the people do not.
AJHG: What advice do you have for trainees?
Barbara: If your job doesn’t excite you and make you feel useful most of the time, get another job. Risks work out more often than we are led to believe. Take them. You hold your talents in trust, and you have a fiduciary duty to shepherd your talents to a green pasture where they can thrive.
AJHG: And for fun, tell us something about your life outside of the office.
Barbara: It’s generally tranquil, but last year was anything but with Hurricane Harvey, 52 inches of rain, fences down, and administering a portfolio of family interests across Texas. The saving grace is the lack of speed limits on rural Texas highways and discovering—in the fullness of middle age—the joy of really fast cars.
Barbara Evans, PhD, JD, LLM, is an Alumnae College Professor of Law and a Professor of Electrical and Computer Engineering at the University of Houston.