DISCLOSURES OF PRIVATE GENETIC INFORMATION
Sec. 111. DISCLOSURE OF PRIVATE GENETIC INFORMATION
(a) REQUIREMENT OF WRITTEN AUTHORIZATION. - Except as provided in section 115 and section 132(b) no person who, in the ordinary course of business, practice of a profession, or rendering of a service, creates, stores, receives or furnishes private genetic information may by any means of communication disclose private genetic information except in accordance with a written authorization as provided in section 112.
(b) REDISCLOSURE PROHIBITED. - Redisclosure of private genetic information which has been disclosed to any person pursuant to a valid written authorization is prohibited.
This section states the general rule that any person who creates, maintains or furnishes private genetic information as part of their ordinary business or professional activities may disclose such information only in accordance with written authorization. (Exceptions to this general rule are presented in sections 115 and 132(b) and are discussed below.) These provisions apply to health care providers, lab technicians, genetic counselors, researchers, insurers and anyone else whose activities fall within the description in this section, regardless of the number of individuals on whom they have information. Section 111 also prohibits redisclosure of information received pursuant to a valid authorization.
Not all disclosures of private genetic information are prohibited by this or any other section of the Act. For example, nothing in the language of this statute prohibits a friend, neighbor, relative or any other person not engaged in such business activities from repeating genetic information that is learned directly or indirectly from a sample source or someone knowledgeable about the sample source. Consequently, anyone who wants to recover for unauthorized disclosures of information by such individuals will have to look to common law torts or other statutes for a cause of action and a remedy.
The Act does not carve out an exception for disclosures of genetic information without the individual's authorization, as do some other statutes that deal with medical information. Where some statutes governing medical information permit breaches of confidentiality by professionals in emergency circumstances to prevent harm to another individual,[20] the Act does not permit disclosure of private genetic information without authorization, regardless of how well-intentioned the purpose of the contact with another individual. A full discussion of the common law on this issue appears in the Appendix.
Therefore, when it is anticipated that the analysis of one person's DNA will reveal that a second individual (usually a close relative)is or may be at risk, the individual who has authorized an analysis should be encouraged to share the information with other family members who might benefit from it.
Sec. 112. AUTHORIZATION FOR DISCLOSURE OF PRIVATE GENETIC INFORMATION
(b)COPY. -- A copy of the authorization shall be provided to the person making the authorization.
(c)REVOCATION OR AMENDMENT OF AUTHORIZATION. -- A sample source or the sample source's representative may revoke or amend the authorization, in whole or in part, at any time.
(d)NOTICE OF REVOCATION. -- A sample source may not maintain an action against a person for disclosure of private genetic information made in good faith reliance on a valid authorization if the person had no notice of the revocation of the authorization at the time the disclosure was made.
(e)IDENTIFICATION OF INFORMATION AS PROTECTED BY LAW. -- Each disclosure made with the written authorization described in subsection (a) must be accompanied by the following written statement:
"This information has been disclosed to you from confidential records protected under the Genetic Privacy Act and any further disclosure of the information without specific authorization is prohibited."
(f)EFFECT OF GENERAL AUTHORIZATION FOR RELEASE OF MEDICAL RECORDS. -- A general authorization for the release of medical records or medical information shall not be construed as an authorization for disclosure of private genetic information.
This section sets forth the requirement for a valid authorization which must be specific and in writing. The purpose is to prevent disclosures of genetic information under blanket releases of information and overly broad and unnecessary access to highly personal information.
The individual who authorizes the disclosure may revoke it at any time. However, anyone who does not receive notice of a revocation, and who makes a disclosure in good faith reliance on the authorization, will not be liable for violating this Act [section 112(d)]. The individual may only be able to express a revocation orally, so a written revocation is not required. However, when possible and to prevent the holder of the authorization from denying awareness of revocation, it would make sense for any individual who intends to revoke authorization, or to amend the provisions of an authorization, to do so in writing.
Those governed by the provisions of sections 111 and 112 would, at a minimum, include researchers, independent databanks, clinical laboratories, medical care providers and insurers. Although few insurers at the present time routinely request or require DNA analysis in the course of processing applications, some insurers are interested in obtaining access to private genetic information that already exists.[21] They can do so by directly asking applicants if they have had genetic analysis and by obtaining information contained in medical records. While most applicants are not likely to have had any DNA analysis done prior to an application for insurance, this may change in the future. This change could be precipitated by several factors, including the identification of genes that predispose individuals to common diseases such as cancer and the development of readily available and cost effective predictive testing for such disorders.[22]
When an individual has had a DNA analysis and the resultant private genetic information is entered into medical records, an authorization for disclosure that meets the requirements of this Act is required before such information can be disclosed. The Act specifically provides that a general authorization for disclosure of medical information does not fulfill this requirement [section 112(f)]. Consequently, a provider disclosing medical information to an insurer, an employer, or any other person, must be careful that private genetic information is not disclosed along with other information unless it has been specifically authorized. Those who maintain medical records that include private genetic information as defined by the Act, must develop record keeping policies and procedures that adequately guard against wrongful disclosures of such information under general releases of medical information.
A rule that would require complete segregation of private genetic information from medical records would facilitate compliance with these provisions. Nonetheless, we believe such a statutory requirement is neither practical nor advisable. At least some private genetic information may be necessary for the provision of adequate and appropriate medical treatment. Inclusion of such information in medical records is, therefore, left to the discretion of providers and the developing standards of care. Disclosure of such information, on the other hand, is not discretionary and can only be made when the individual specifically authorizes it, and when the purpose of the disclosure has been explicitly documented. Nothing in these provisions, however, would require that providers disclose private genetic information, if to do so would conflict with any other law or professional ethics.
Accommodating the provisions of these sections should not be burdensome on those who maintain such information whether or not it is incorporated in medical records. Developing authorization forms that meet these requirements should not be any more difficult than development of forms and procedures so as to comply with federal regulations governing the confidentiality of alcohol and substance abuse treatment, as well as other laws governing medical records.[23] Since most medical records in the future are likely to be maintained in electronic format, it should be feasible to program record keeping so that private genetic information can be deleted from records prior to release under a general authorization.
Sec. 113. INSPECTION AND COPYING OF RECORDS CONTAINING PRIVATE GENETIC INFORMATION
(a)INSPECTION OF RECORDS. -- Except as otherwise provided in section 131(c)(2) and 131(f), a person who maintains private genetic information shall upon written request permit the sample source or the sample source's representative to inspect records containing private genetic information and shall provide a copy of any such records upon request by the sample source or the sample source's representative.
(b)RESPONSE TO REQUEST EXAMINATION AND COPYING OF INFORMATION. -- Upon receipt of a written request from a sample source or the sample source's representative to inspect or copy all or part of records containing private genetic information, a person as promptly as required under the circumstances but no later than 30 business days after receiving the request, shall make the information available to the sample source or the sample source's representative for inspection during regular business hours or provide a copy, if requested, to the individual.
(c)EXPLANATION OF TERMS AND CODES. -- A person shall provide an explanation of terms and any code or abbreviations used in records containing the private genetic information upon request of the sample source or the sample source's representative.
(d)FEE. -- A person may charge a reasonable fee, not to exceed the person's actual duplication cost, for copies of records which are provided.
This section requires that anyone maintaining records that include private genetic information permit a sample source or that individual's representative to inspect and obtain copies of such records. These information practices echo the provisions of state laws governing access to medical records and proposed federal legislation.[24] However, the Act differs from such models in one significant respect. Several laws grant health care providers discretion to deny inspection of medical information in particular circumstances. For instance, under some statutes, it is within the discretion of a provider to withhold inspection of records that include mental health or psychiatric information, and to provide a summary to the patient instead, or to allow inspection by a representative of the patient.[25] The presumption behind such discretion is that the provider is able to determine if, and when, access to such information would be harmful to the patient.
In contrast, the Act's general obligation on the holder of private genetic information to permit a sample source or that individual's legal representative to inspect records containing such information, is modified by two narrow exceptions that apply only to research activities. These sections, 131(f) and 131(c)(2) are discussed below.
Sec. 114. AMENDMENT OF RECORDS
(c)STANDARDS FOR CORRECTION OR AMENDMENT. -- A person maintaining records containing private genetic information shall correct or amend information in accordance with a request made under subsection (a) if the information is not accurate or complete for the purposes for which the information may be used or disclosed by the person.
(d)STATEMENT OF DISAGREEMENT. -- After a sample source or a sample source's representative has filed a statement of disagreement under subsection (b)(3), the person, in any subsequent disclosure of the disputed portion of the information, shall include a copy of the individual's statement and may include a statement of the reasons for not making the requested correction or amendment.
This section includes provisions for processing requests for correction or amendment of information in records that contain private genetic information. The specific details in this section have been adapted from similar provisions in the Fair Health Information Practices Act of 1994.[26] They require the holder of records to make corrections or inform the individual of any reason for refusal to do so. Records should be corrected if the information is not accurate or complete for the purposes for which it may be used or disclosed. When the holder refuses to amend or correct records, the sample source must be informed of further procedures that are available for review of the refusal, and in the event that the dispute is not resolved subsequent disclosures of the information must be accompanied by a statement of the sample source's disagreement with the accuracy of the information.
Most people will not know enough about genetics or DNA analysis to be able to question the correctness of private genetic information. Awareness of an inaccuracy may occur when the sample source has had more than one genetic analysis done and the results of both are incompatible or contradictory, placing the accuracy of at least one test in question. Because others may make decisions regarding the sample source based on this information, and records containing private genetic information may not be governed by any other rules that require correction of information, it is important that mechanisms be in place to ensure the accuracy of such information and prevent hardships due to disclosure of inaccurate records.
Sec. 115. DISCLOSURES PURSUANT TO COMPULSORY PROCESS
(3)The genetic information is for use in a law enforcement proceeding or investigation in which the person maintaining the information is the subject or party.
(b)NOTICE. -- If genetic information is sought under subparagraph (2) of subsection (a), or in a proceeding or investigation pursuant to subparagraph (3) of subsection (a), the person requesting compulsory disclosure shall serve upon the person maintaining the genetic information, and upon the sample source, the sample source's representative, or on the sample source's attorney, the original or a copy of the compulsory disclosure request at least thirty (30) days in advance of the date on which compulsory disclosure is requested, and a statement of the right of the sample source or sample source's representative, and of the person maintaining the genetic information, to have any objections to such compulsory disclosure heard by such court or governmental agency prior to the issuance of an order for such compulsory disclosure, and the procedure to be followed to have any such objections heard. Such service shall be made by certified mail, return receipt requested, or by hand delivery, in addition to any form of service required by applicable state or federal law.
(c)CERTIFICATION. -- Service of compulsory process or discovery requests upon a person maintaining private genetic information must be accompanied by a written certification, signed by the person seeking to obtain the private genetic information or his or her authorized representative, identifying at least one subparagraph of subsection (a) under which compulsory process or discovery is being sought. The certification must also state, in the case of information sought under subparagraphs (2) or (3) of subsection (a), that the requirements under subsection (b) for notice have been met. A person may sign the certification only if the person reasonably believes that the subparagraph of subsection (a) identified in the certification provides an appropriate basis for the use of discovery or compulsory process. A copy of the written certification shall be maintained as a permanent part of the records of private genetic information.
Despite the fact that an individual discloses personal information to others with the expectation and intention that the recipient of the information will keep it confidential, the law may not recognize the information as privileged and therefore beyond compelled discovery in legal proceedings. Even communications to a physician, psychotherapist or other health care professionals which often fall under the protection of a state statutory privilege, are not absolutely protected from compelled disclosure. In some circumstances courts have determined that a litigant's need for medical information outweighs the patient's privacy interest, and that claims of privilege, even when they can be invoked, do not always protect records containing such information from discovery.[27]
Just as discovery of medical records has been sought in the past, there will be situations in which an individual or entity will seek to obtain records containing private genetic information through compulsory process. Under the Act, disclosure of private genetic information contained in any records, however, can be compelled only in limited circumstances. First, if the sample source has authorized release of the information in response to a request for the compulsory disclosure, the holder of the information can be compelled to comply with the request. [section 115(a)(1)] Additionally, when the sample source is a party to a proceeding and the private genetic information is at issue, the disclosure can be compelled.[section 115(a)(2)] For instance, in an action for medical malpractice or negligent DNA analysis, this information may be necessary to prove or disprove the validity of the claim.
Finally, the disclosure may be compelled if the person who holds the information is under investigation for committing a crime. [section 115(a)(3)] Fraud is the most likely crime in which the holder of private genetic information would be under investigation and prosecution. The standards applied by particular courts in Medicare and Medicaid fraud cases are helpful in developing an appropriate standard for compelled discovery of private genetic information and balancing the state's interest against the privacy interests of the individual subjects of the information.
Assertion of a statutory physician-patient privilege, or psychotherapist-patient privilege, so as to bar compelled production in fraud cases has had various degrees of success in protecting private patient information. A few courts that have determined that the state interest in preventing fraud warrants compelled disclosures of otherwise privileged information have also sought to protect patient privacy by limiting the specific information that must be disclosed, and rejected requests for entire records. Even in cases involving psychotherapy records, however, which are sometimes afforded special protection out of deference to the extremely personal nature of the communication, courts have not applied consistent and explicit standards to protect patient privacy.
In resolving the conflict between federal Medicaid law and the psychotherapist-patient privilege, a Massachusetts court held that production of psychotherapy records can be compelled in a prosecution for fraud, but only to the extent that they are "necessary fully to disclose the extent of the services provided."[28] Records that meet this criteria were further determined to include documentation of the time and lengths of appointments, fees, diagnoses, treatment plans, recommendations and somatic therapies. In contrast, records reflecting the patient's thoughts and feelings could not be compelled since they were of no concern to the legitimate investigation. Other courts have viewed the disclosure of patient records as an all or nothing matter, and not bothered to distinguish between kinds of information contained in the records sought.[29]
To avoid similar inconsistency and overly broad compulsory disclosure in cases where private genetic information is sought, the Act sets forth specific requirements for those seeking such disclosure, and the standard for courts to apply in considering objections to such disclosures. The provisions of section 115(b)-(e) establish notice procedures for those who seek disclosure of private genetic information through compulsory process for use in criminal investigations and for proceedings in which the genetic condition of a party is at issue. They are intended to ensure that the individual who is the subject of the information has the opportunity to object to the disclosure and protect his or her individual interests. To avoid abrogation of the privacy interests of the sample source, the Act further requires that prior to compelled disclosure, the court must find that there is no other available and effective way to get the information that is sought, and that there is a compelling need for the information. [section 115(d)]
Additionally, even when such findings have been made, the subsequent order must direct that all individual identifiers be deleted from documents which will be available to the public and any other measures that the court determines are necessary to protect the privacy of the sample source. [section 115(e)]
File posted May 1995.