The rapid development of knowledge in genetics has propelled the issue of the privacy of genetic information into the public awareness. Legislators at both the national and state levels are considering the conflicting concerns of consumers, researchers, health care providers, and business. More than 35 states have enacted some form of genetic-related legislation, most of which is concerned with discrimination in health insurance based on genetic information. Genetic information legislation is being drafted and introduced at both the federal and the state levels.1
These genetic privacy concerns have an impact on the university health care system at many levels. The handling of genetic information affects the interests of patients, health care providers, researchers, educators, and the business of health care and education. Key areas of concern for genetic privacy are informed consent, ownership of genetic information, and security of medical information; they affect both patient care and the needs of research. Successful solutions must maintain a balance of meeting the needs of individuals and the needs of organizations and research in the larger context of societal needs.
In 1994, the Multnomah County Medical Society of Portland, Oregon, established a study group including geneticists and attorneys to study the need for genetic privacy legislation.2 Legislation was drafted based on their work, and the Oregon Genetic Privacy Act was passed in 1995. In this article, we examine the effect of the Oregon Genetic Privacy Act on a university health system, Oregon Health Sciences University (OHSU).
THE OREGON GENETIC PRIVACY ACT OF 1995
The Oregon Genetic Privacy Act (GPA) of 1995, SB 276, was written to protect genetic privacy by providing legal protection for medical information, tissue samples, and DNA samples, and the individual's right to genetic privacy. In the rest of this section, we summarize the content of the Act.
The defining principle of the Act holds that the DNA molecule is a code containing the individual's probable medical future. This genetic information is not only about the individual, but also about the individual's relatives, thus affecting family privacy, including reproductive decisions. The Act states that this information has the potential to lead to significant harm to the individual through psychosocial interactions (e.g., family disruption) and discrimination in either employment or access to health insurance. Legal constraints are needed both to protect individual privacy and to permit legitimate genetic research.
The definition of the term “genetic test” in the Oregon GPA is broad, including not only tests of nucleic acids such as DNA, RNA, mitochondrial DNA, and chromosomes, but also proteins used to diagnose a genetic characteristic. “Genetic information” is defined as the information about an individual or family obtained from a genetic test or an individual's DNA sample.
The Act stipulates that genetic information or a DNA sample may be obtained only after informed consent except under a few well-defined exceptions: for identification of persons in criminal court proceedings or law enforcement investigation, for an inquest, for identification of deceased individuals, for establishing paternity, and for anonymous research. The Oregon State Health Division may establish rules to obtain samples for screening procedures for newborns, but not for the purpose of obtaining complete genetic information about all newborns.
The Act establishes the individual's genetic information as the property of the individual. It states that a person may not retain another individual's genetic information without first obtaining specific authorization from the individual except under circumstances comparable to those that are exempt from the informed consent requirement. Retention of genetic information is also permitted to benefit blood relatives of a deceased individual. DNA samples must be destroyed promptly on request of the individual, or, in the case of DNA testing for insurance purposes, on completion of the testing. A DNA sample used in a research project must be destroyed promptly upon completion of the project or upon request of the individual, whichever occurs first. The individual may, on request, inspect or obtain or ask for corrections in his or her genetic information. The law also specifically states that this law does not apply to any rights to compensation relating to substances or information derived from an individual's DNA.
Genetic information and the identity of a person on whom genetic testing has been done are protected from disclosure under all circumstances, including subpoena, with exceptions similar to obtaining genetic information. This information is protected from any redisclosure.
An employer is not prohibited from obtaining and using genetic information to determine a bona fide occupational qualification if given specific authorization (i.e., informed consent) by an employee. However, an employer may not subject any employee to a genetic test for any other reason or use genetic information to discriminate against an employee.
Last, the Act states that an insurance provider may obtain specific authorization to do a genetic test on an applicant, but must reveal to the applicant the use of the test. The insurance provider may not use the results to deny insurance or to affect the terms of the coverage for any policy for hospital or medical expense or use favorable genetic test results to induce purchase of insurance.
IMPACT ON OHSU
The Oregon Genetic Privacy Act has affected OHSU in three areas of genetic privacy concerns: (1) informed consent, (2) ownership of genetic information, and (3) security of medical information. It affects two areas of the university's mission, patient care and research.
The provisions for informed consent affect any consent that involves taking or using specimens that may be used for genetic testing either for patient care or for research. This provision necessitated a search by one of the authors (LAC) for all consent forms used throughout the OHSU Medical Center health care system that might cover such a circumstance. The definitions in the Act of genetic testing and genetic information are broad enough that testing other than strictly DNA or RNA testing had to be considered in deciding which forms might require revision.
The consent forms in use in the health system were then each reviewed to ascertain which forms were in potential conflict with the Act regarding genetic consent. In the health care context, the forms that required changes were the general “terms and conditions” form for admission to the hospital, the specific consents for procedures and tests, and the release of information forms. The other type of consent affected was consent for research.
In both clinical and research contexts, the genetic privacy components of both the general consent forms and the specific procedural consent forms have to do with obtaining, storing, and testing samples. The Oregon Genetic Privacy Act requires specific consent for DNA, RNA, and mitochondrial DNA testing, but also speaks of proteins tested to diagnose a genetic characteristic. At the time this article was written, the intent of the law appears to be concerned primarily with nucleic acid coding and the consents are written accordingly. However, the intent of the wording specifically regarding the term “proteins” mentioned in the legislation is not clear. As the definitions are refined, the wording in the consents will be modified accordingly.
In the clinical setting, the general consent by the patient for treatment also includes a section for the release of information to health insurers and other payers. Patients must be aware that if genetic tests are done and they want the insurance to pay for them, information must be released that the tests were done. Otherwise, the patient is responsible to pay all fees related to the genetic testing. The insurance may ask for copies of patient chart notes to establish justification for the testing to be done and, conceivably, the results may be in the chart notes as a part of the clinical record. Although the legislation stipulates that insurance providers are not to use genetic information to affect the ability to obtain insurance or the terms of the health insurance, informed consent requires the patient be informed that information gained as a result of genetic testing or the fact that genetic testing was requested or done may affect his or her ability to obtain insurance.
In the research setting, the Oregon Genetic Privacy Act significantly affects informed consent by research subjects and the concept of ownership of genetic material and information. The OHSU researchers develop a consent process for each project, and this process is reviewed and approved by the OHSU's Investigational Review Board (IRB). The OHSU IRB has written OHSU Guidelines for Obtaining Informed Consent in Protocols Involving Genetic Research & DNA Banking.3 This document outlines very specifically for researchers the information that they are required to provide for research subjects. Among other things, the subjects must be informed of (1) the length of time the tissue sample will be stored; (2) who will have access to samples and medical records; (3) how results of genetic tests will be handled, i.e., whether or not counseling will be offered; and (4) the risks associated with a breach of confidentiality. The IRB has developed suggested wording for the genetic research consent forms.
The potential impact of the Act on OHSU's tissue banks is a major concern. OHSU, like many academic centers, has accumulated a large tissue bank over many years. This repository has been an invaluable resource for research. Traditionally, the samples in tissue banks have been the property of the institution. Confidentiality has been maintained concerning the identities of the tissue donors and the information gained from these samples over the many years of their existence. Under the recent genetic privacy legislation, any tissue samples that are now taken for genetic testing must be destroyed when the testing is completed or be completely stripped of patient identifiers before being kept or used for other studies.
Some of the most valuable medical research is done on these banked tissue samples, especially for rare or new diseases. As cases of various diseases are found and diagnosed, the researcher can go back to tissue samples of similar cases, re-examine them with new tools such as genetic testing, and compare the results. Often information is needed from the patient records of these cases as to the course of the disease and the effect of treatment to increase the understanding of the disease and its treatment. And identifiable information gained from these tissue samples is under the same restraints of confidentiality as any patient medical information. The information learned through research does not go into the patient medical record unless it is part of the patient's care.
Under the Oregon Genetic Privacy Act, anonymous genetic research with a complete removal of all identifying information is permitted. There can be no access to the patient record and therefore no correlation with clinical information. To do genetic research that includes clinical information, a specific informed consent is required for that specific research study. If the opportunity came up later to study a sample again involving genetic testing, the law requires that the tissue donor or his or her heirs be found and specific informed consent be again obtained for the new research study on that sample. If the person cannot be found, that sample cannot be used. This may affect the outcome of the research because, for example, the omission of samples from a study may introduce a sampling bias.
OHSU is assessing the impact of the requirements of the Oregon Genetic Privacy Act on its research programs. The Act has the potential to affect the IRB approval of research projects, the participation of research subjects, and the funding for research.4
The patient record at OHSU is currently undergoing transformation to an electronic lifetime clinical record (LCR). The requirements for security of the medical record, including genetic information, are one of the important issues in that transformation. The maintenance of the privacy of the clinical record is fundamental to genetic privacy. As genetic testing becomes increasingly a part of routine medical investigation and treatment planning, the results of the testing will be, of necessity, a part of the medical record.
In 1999, the Oregon State Legislature established the Genetic Research Advisory Committee with broad representation from OHSU, researchers, health care provider organizations, policymakers, the pharmaceutical industry, consumers, and the state government. The committee was mandated to study the issues surrounding genetic privacy and research and to make recommendations for changes to the GPA to meet the needs of legitimate medical research and protect the individual's genetic privacy.5
At OHSU, possible solutions to the dilemma of tissue banks are being discussed. One of the options being discussed is that of “secure coding.” This arrangement entails coding of tissue samples. If information is needed from the clinical record, the information can be obtained through a process where all identifiers are removed before going to the researcher.
The security of medical information is essential to meeting the needs of patients and to carrying out legitimate medical research. The transformation of medical records to electronic form provides both an opportunity to develop new protective barriers to unauthorized access and also a challenge of potential vulnerability in an environment of telecommunication networks.
In addition to the current impact of the Oregon Genetic Privacy Act at OHSU, there are related issues developing that will be of increasing importance to academic medicine and other areas in the future.
DNA-based testing and genetic information are expected to become a much greater part of patient care and treatment planning. For example, genetic tests that are related to coronary heart disease (CHD) may be useful in early detection and intervention in asymptomatic individuals to prevent or modify the course of CHD. Like CHD, many diseases have multiple genetic factors that interact with environmental factors. If genetic testing identifies a predisposition to CHD in an individual, it may become possible to develop a preventive plan specifically for that person by modifying environmental factors or using pharmacologic agents. Genetic tests may also be helpful in drug selection for individuals, determining how an individual might metabolize a given drug, and therefore aid in selecting drugs that will be effective in the individual and lower the probability of adverse effects from drug therapy.
However, a gene identified in a person as a risk factor in one disease may also be an indicator for increased risk of another disease; for example, the ε4 gene is associated with increased risks of both CHD and Alzheimer's disease. The use of genetic tests may have implications beyond the immediate clinical indication, both for the patient and for his or her relatives. Therefore, genetic privacy with careful informed consent and the security of medical records will continue to have high priorities. The rapid changes in medical genetics will necessitate education of medical students, residents, and physicians regarding the issues around genetic privacy and informed consent for genetic testing, and in the legal requirements of legislation such as the Oregon Genetic Privacy Act. However, such education is not keeping pace with the growth in knowledge of genetics and surrounding issues.
Francis S. Collins, MD, PhD, of the National Human Genome Research Institute, defines the lag in the dissemination of knowledge in these words: “Doctors and other health professionals are not yet prepared to inform patients about the appropriate application of genetic tests, or to provide basic genetic counseling.”6 He delineates the central role that medical schools must play in educating future and practicing physicians. As an academic medical center, OHSU has a mandate to develop medical school curriculum and continuing medical education. As a center for clinical genetic research, OHSU has the resources to address this need.
The experience of OHSU with the Oregon Genetic Privacy Act brings several issues surrounding genetic privacy to the fore: the importance of effective informed consent procedures; the question of ownership of genetic information; the necessity to balance the needs of medical research and the protection of the individual's genetic privacy; the maintenance of security of medical records; and the public's confidence in that security. As the Human Genome Project advances and the knowledge of medical genetics develops, these issues will continue to be of immediate importance to OHSU and to all other academic medical centers and those whom they serve.
Note added in proof. This article was prepared prior to the 2001 Legislative Sessions. As of July 2001, 26 states had introduced bills on genetic privacy, and seven had enacted them.7
On June 11, 2001, the Oregon Legislature passed Senate Bill 114, incorporating the recommendations of the Genetic Research Advisory Committee. This included the establishment of the Advisory Committee on Genetic Privacy and Research with a mandate to monitor and study the evolving issues around genetic privacy and genetic research. This broadly representative committee is mandated to create opportunities for public education regarding genetic privacy issues and to elicit and consider public input. The committee is to report to the Oregon legislature biennially on its activities and make recommendations to the legislature. The Oregon Health Division (the state health department) is mandated to oversee the IRBs that review genetic research and to make rules establishing minimum standards for genetic research that conform to the federal policy for the protection of human subjects. Bill 114 defines and sets parameters regarding anonymous research and mandates encryption or coding to protect the identities of individuals in other genetic research. The provision of the GPA regarding ownership of genetic information and samples was changed to a right to genetic privacy rather than that of property. Informed consents regarding genetic information and samples made prior to the effect date of the legislation would remain valid, but informed consents and samples made after that date must comply with the current rules. This would, in part, address the issue of tissue banks. The definition of “genetic characteristic” was refined so as to include only those determined through a genetic test and not family history or other means. The bill also addresses issues relating to family members, and to the release of genetic information, and includes provisions for legal recourse for violations of genetic privacy law and penalties for violations.
While OHSU and the state of Oregon are actively addressing the issues around genetic knowledge, there is wide variation in genetic legislation from state to state, with no legislation in many states. There are also ongoing efforts at the federal level to develop genetic privacy legislation. The issues surrounding genetic privacy are relevant locally, nationally, and internationally, and will continue to be relevant as genetic research progresses and the implications for the genetic privacy of the individual are understood.