The 154 page report concludes that
to realize the enormous promise that whole genome sequencing holds for advancing clinical care and the greater public good, individual interests in privacy must be respected and secured. As the scientific community works to bring the cost of whole genome sequencing down from millions per test to less than the cost of many standard diagnostic tests today, the Commission recognizes that whole genome sequencing and its increased use in research and the clinic could yield major advances in health care. However it could also raise ethical dilemmas. The Commission offers a dozen timely proactive recommendations that will help craft policies that are flexible enough to ensure progress and responsive enough to protect privacy.The Commission has aimed to
find the most feasible ways of reconciling the enormous medical potential of whole genome sequencing with the pressing privacy and data access issues raised by the rapid emergence of low-cost whole genome sequencing. The life-saving potential of genome sequencing depends on gathering genetic information from many thousands (perhaps millions) of individuals, most of whom will not directly benefit from the research. Those who are willing to share some of the most intimate information about themselves for the sake of medical progress should be assured appropriate confidentiality, for example, about any discovered genetic variations that link to increased likelihood of certain diseases, such as Alzheimer’s, diabetes, heart disease and schizophrenia. Without such assurance in place, individuals are less likely to voluntarily supply the data that have the potential to benefit us all with life-saving treatments for genetic diseases. Everyone stands to gain immensely from our society taking the necessary steps to protect privacy in order to facilitate progress in this era of whole genome sequencing.The Commission reports that
Realizing the promise of whole genome sequencing requires widespread public participation and individual willingness to share genomic data and relevant medical information. In other words, scientists and clinicians must have access to data from large numbers of people who are willing to share their private information. This in turn requires public trust that any whole genome sequence data shared by individuals with clinicians and researchers will be adequately protectedIt indicates that
Large-scale collections of genomic data raise serious concerns for the individuals participating. One of the greatest of these concerns centers around privacy: whether and how personal, sensitive, or intimate knowledge and use of that knowledge about an individual can be limited or restricted (by means that include guarantees of confidentiality, anonymity, or secure data protection). Because whole genome sequence data provide important insights into the medical and related life prospects of individuals as well as their relatives— who most likely did not consent to the sequencing procedure—these privacy concerns extend beyond those of the individual participating in whole genome sequencing. These concerns are compounded by the fact that whole genome sequence data gathered now may well reveal important information, entirely unanticipated and unplanned for, only after years of scientific progress.
Another privacy concern associated with whole genome sequencing is the potential for unauthorized access to and misuse of information. For example, in many states someone could legally pick up a discarded coffee cup and send a saliva sample to a commercial sequencing entity in an attempt to discover an individual’s predisposition to neurodegenerative disease. The information might then be misused, for example, by a contentious spouse as evidence of unfitness to parent in a custody case. Or, the information might be publicized by a malicious stranger or acquaintance without the individual’s knowledge or consent in a social networking space, which could adversely affect that individual’s chance of finding a spouse, achieving standing in a community, or pursuing a desired career path.
Realizing the promise of whole genome sequencing requires widespread public participation and individual willingness to share genomic data and relevant medical information. This, in turn, requires public trust that any whole genome sequence data shared by individuals with clinicians and researchers will be adequately protected. Current U.S. governance and oversight of genetic and genomic data, however, do not fully protect individuals from the risks associated with sharing their whole genome sequence data and information. In particular, a great degree of variation exists in what protections states afford to their citizens regarding the collection and use of genetic data. Only about half of the states, for example, offer protections against surreptitious commercial genetic testing. Currently, the majority of the benefits anticipated from whole genome sequencing research will accrue to society, while associated risks fall to the individuals sharing their data. This report focuses on reconciling the enormous public benefits anticipated from whole genome sequencing research with the potential risks to privacy of individuals, and the protections that must be foremost in our minds as we focus our policies to facilitate such privacy and progress.
Basic Ethical Principles for Assessing Whole Genome Sequencing
Laws and regulations cannot do all of the work necessary to provide sufficient privacy protections for whole genome sequence data. The Commission has been mindful of how the five ethical principles set out in its first report, New Directions: The Ethics of Synthetic Biology and Emerging Technologies, apply to the ethics of whole genome sequencing. These principles—which flow from the ideal of respect for persons—are public beneficence, responsible stewardship, intellectual freedom and responsibility, democratic deliberation, and justice and fairness. This report ... enlists these principles along with those set forth in the Belmont Report (a landmark statement of ethics for research involving human participants). Privacy and Progress focuses on recommendations aimed at pursuing and securing the public benefits anticipated from whole genome sequencing while minimizing the potential privacy risks to individuals.
These principles suggest ethically important and practically useful guidelines for whole genome sequencing. Chief among these is the principle of respect for persons, which requires strong baseline protections for privacy and security of data, while public beneficence requires facilitating ample opportunities for data sharing and access to data by clinicians, researchers, and other authorized users. Respect for persons further requires that any collection and sharing of individual data be based on a robust process of informed consent. Responsible stewardship calls for oversight and management of whole genome sequence information by funders, managers, professional organizations, and others. The principle of intellectual freedom and responsibility provides further support for pursuing whole genome sequencing and seeking models for broad data sharing by promoting regulatory parsimony. Democratic deliberation urges all parties to consider changes to policies and practices in light of the evolving science and its implications for enduring ethical values. Finally, justice and fairness requires that we seek to channel the benefits of whole genome sequencing to all who can potentially benefit, and to ensure that the risks are not disproportionately borne by any subset of the population, including vulnerable or marginalized groups.The report offers several recommendations as follows
Currently we are in a period of intense transition with respect to integrating whole genome sequencing into clinical care, as well as facilitating access to and use of whole genome sequence data for research purposes. Moreover, the challenges we face today are not precisely the same challenges we will face in one, five, or ten years, as genomic technologies continue to develop and mature. Due to the rapid development of technology, we need to craft policies that are flexible and agile enough to ensure that we do not constrain our ability to adapt to evolving technology and social norms related to privacy and access.
Recognizing that ethical obligations reach beyond what is legally enforceable, the Commission examines both the relevant ethical principles and the relevant legal requirements to offer guidance as to what (ethically) ought to be done and what (legally) must be done. This is the foundation on which the Commission builds its Privacy and Progress recommendations.Strong Baseline Protections While Promoting Data Access and Sharing
Presently, many national and state policies are in place to guard personally identifiable health information and records of participation in research. These policies should apply to all handlers of the data, from those who collect the data, to researchers who use them, to third-party storage and analysis providers (e.g., hosts of cloud computing services). Privacy protections should guard against unauthorized access to, and illegitimate uses of, whole genome sequence data and information while allowing for authorized users of these data to advance individual and public health.
Recommendation 1.1
Funders of whole genome sequencing research; managers of research, clinical, and commercial databases; and policy makers should maintain or establish clear policies defining acceptable access to and permissible uses of whole genome sequence data. These policies should promote opportunities for models of data sharing by individuals who want to share their whole genome sequence data with clinicians, researchers, or others.
Strong baseline privacy protections require a spectrum of policies starting with data handling through the protection of persons from future disadvantage and discrimination arising from misuse of their whole genome sequence data. It is critical, however, to ensure that privacy regulations allow individuals to share their own whole genome sequence data with clinicians, researchers, and others in ways that they choose.
Recommendation 1.2
The Commission urges federal and state governments to ensure a consistent floor of privacy protections covering whole genome sequence data regardless of how they were obtained. These policies should protect individual privacy by prohibiting unauthorized whole genome sequencing without the consent of the individual from whom the sample came.
Treating like data alike is crucial to ensuring consistent protections for whole genome sequence information across the United States. Although states should enact genomic policies that are most relevant and important to their constituents, bringing such protections to a minimum standard that addresses privacy—while still allowing individuals to share their own data—would provide just and fair protections regardless of where one happens to reside.Data Security and Access to Databases
Data privacy requires data security. Data security requires ethical responsibility and accountability from all those who handle whole genome sequence data. It must further be supported by policies and infrastructure to protect safe sharing of data.
Recommendation 2.1
Funders of whole genome sequencing research; managers of research, clinical, and commercial databases; and policy makers should ensure the security of whole genome sequence data. All persons who work with whole genome sequence data, whether in clinical or research settings, public or private, must be: 1) guided by professional ethical standards related to the privacy and confidentiality of whole genome sequence data and not intentionally, recklessly, or negligently access or misuse these data; and 2) held accountable to state and federal laws and regulations that require specific remedial or penal measures in the case of lapses in whole genome sequence data security, such as breaches due to the loss of portable data storage devices or hacking. Many observe that absolute privacy is not possible in this, or many other realms. The greater potential for harm is not by virtue of authorized others knowing about one’s whole genome make-up, but rather through the misuse of data that have been legally accessed.
Recommendation 2.2
Funders of whole genome sequencing research; managers of research, clinical, and commercial databases; and policy makers must outline to donors or suppliers of specimens acceptable access to and permissible use of identifiable whole genome sequence data. Accessible whole genome sequence data should be stripped of traditional identifiers whenever possible to inhibit recognition or re-identification. Only in exceptional circumstances should entities such as law enforcement or defense and security have access to biospecimens or whole genome sequence data for non health-related purposes without consent.
The consent process should communicate limits on access to and use of genomic data to those having their whole genome sequenced in clinical care, research, and consumer-initiated contexts. These policies should apply to the original recipient of the data as well as to all parties who work with the data, from those who collect the sample or data through third-party storage and analysis service providers. Those who work with whole genome sequence data should remain current on regulations regarding data privacy and security.
Recommendation 2.3
Relevant federal agencies should continue to invest in initiatives to ensure that third-party entrustment of whole genome sequence data, particularly when these data are interpreted to generate health-related information, complies with relevant regulatory schemes such as the Health Insurance Portability and Accountability Act and other data privacy and security requirements. Best practices for keeping data secure should be shared across the industry to create a solid foundation of knowledge upon which to maximize public trust. Whole genome sequence data not stripped of traditional identifiers are considered “protected health information” and are covered under the Health Insurance Portability and Accountability Act’s Privacy, Security, and Enforcement Rules and the federal Common Rule for protecting human research participants. The same regulations, policies, and ethical guidelines that protect such health information should also be in place to govern the sharing of whole genome sequence data with third-party storage and analysis service providers. Public and the private sector parties should share their lessons learned to promote efficiency and avoid duplicating efforts.Consent
Not unique to whole genome sequencing, a well-developed, understandable, informed consent process is essential to ethical clinical care and research. To educate patients and participants thoroughly about the potential risks associated with whole genome sequencing, the consent process must include information about what whole genome sequencing is; how data will be analyzed, stored, and shared; the types of results the patient and participant can expect to receive, if relevant; and the likelihood that the implications of some of these results might currently be unknown, but could be discovered in the future. Respect for persons requires obtaining fully informed consent at the outset of diagnostic testing or research.
Recommendation 3.1
Researchers and clinicians should evaluate and adopt robust and workable consent processes that allow research participants, patients, and others to understand who has access to their whole genome sequences and other data generated in the course of research, clinical, or commercial sequencing, and to know how these data might be used in the future. Consent processes should ascertain participant or patient preferences at the time the samples are obtained.
Recommendation 3.2
The federal Office for Human Research Protections or a designated central organizing federal agency should establish clear and consistent guidelines for informed consent forms for research conducted by those under the purview of the Common Rule that involves whole genome sequencing. Informed consent forms should: 1) briefly describe whole genome sequencing and analysis; 2) state how the data will be used in the present study, and state, to the extent feasible, how the data might be used in the future; 3) explain the extent to which the individual will have control over future data use; 4) define benefits, potential risks, and state that there might be unknown future risks; and 5) state what data and information, if any, might be returned to the individual. Each Common Rule agency has its own enforcement authorities to protect research participants. All agencies should work together as they develop clear and consistent guidelines for their informed consent forms. Clinical consent documents for whole genome sequencing will have to address a number of issues specific to whole genome sequencing: an explanation of the science, whether whole genome sequence data collected for clinical applications will be made available for research purposes, and what types of results will be produced through whole genome sequencing. For example, an important unsettled issue is the ethics of reporting incidental findings to individuals— that is, information gleaned from whole genome sequencing research or clinical practice that was not its intended or expected object.
Recommendation 3.3
Researchers, clinicians, and commercial whole genome sequencing entities must make individuals aware that incidental findings are likely to be discovered in the course of whole genome sequencing. The consent process should convey whether these findings will be communicated, the scope of communicated findings, and to whom the findings will be communicated.
Recommendation 3.4
Funders of whole genome sequencing research should support studies to evaluate proposed frameworks for offering return of incidental findings and other research results derived from whole genome sequencing. Funders should also investigate the related preferences and expectations of the individuals contributing samples and data to genomic research and undergoing whole genome sequencing in clinical care, research, or commercial contexts. Individuals undergoing whole genome sequencing in research, clinical, and commercial contexts must be provided with sufficient information in informed consent documents to understand what incidental findings are, and to know if they will or will not be notified of incidental findings discovered as a result of whole genome sequencing.Facilitating Progress in Whole Genome Sequencing
Currently, large amounts of patient data are being collected in the health care setting, stripped of traditional identifiers, analyzed, and fed into research that might one day improve clinical care. This “learning health system” model both translates advances in health services research into clinical applications and collects data during clinical care to facilitate further advances in research. Learning health system advocates and others support standardized electronic health record systems and infrastructure to facilitate health information exchange so that data can be easily aggregated and studied. Integrating whole genome sequence data into health records in the learning health system model can provide researchers with more data to perform genome-wide analyses, which in turn can advance clinical care.
Recommendation 4.1
Funders of whole genome sequencing research, relevant clinical entities, and the commercial sector should facilitate explicit exchange of information between genomic researchers and clinicians, while maintaining robust data protection safeguards, so that whole genome sequence and health data can be shared to advance genomic medicine.
Current sequencing technologies and those in development are diverse and evolving, and standardization is a substantial challenge. Ongoing efforts are critical to achieving standards for ensuring the reliability of whole genome sequencing results, and facilitating the exchange and use of these data.
Recommendation 4.2
Policy makers should promote opportunities for the public to benefit from whole genome sequencing research. Further, policy makers and the research community should promote opportunities for the exploration of alternative models of the relationship between researchers and research participants, including participatory models that promote collaborative relationships. Respect for persons implies not only respecting individual privacy, but also respecting research participants as autonomous persons who might choose to share their own data. Public beneficence is advanced by giving researchers access to plentiful data from which they can work to advance health care. Regulatory parsimony recommends only as much oversight as is truly necessary and effective in ensuring an adequate degree of privacy, justice and fairness, and security and safety while pursuing the public benefits of whole genome sequencing. Therefore, existing privacy protections and those being contemplated should be parsimonious and not impose high barriers to data sharing. While the Commission supports the intellectual freedom this access will encourage, clinicians and researchers must also act responsibly to earn public trust for the research enterprise.Public Benefit
Thousands of citizens have participated in whole genome sequencing research personally, and all citizens help to support government investment in whole genome sequencing through their general participation in and support of our political system. Therefore, all citizens should have the opportunity to benefit from medical advances that result from whole genome sequencing.
Special caution should be taken on the part of researchers to ensure that their participants accurately reflect as much as possible the rich diversity of our population. Different groups have genomic variants at different frequencies within their populations, and sufficiently diverse data must be collected so that advances arising from whole genome sequencing can be used for the benefit of all groups.
Recommendation 5
The Commission encourages the federal government to facilitate access to the numerous scientific advances generated through its investments in whole genome sequencing to the broadest group of persons possible to ensure that all persons who could benefit from these developments have the opportunity to do so.
Government investment in genomic research has resulted in public benefit through improved health care and in economic return on investment. The principle of justice and fairness requires that the benefits and risks of whole genome sequencing be distributed equitably across society. Research funded with taxpayer contributions should benefit all members of society. To these ends, researchers should be vigilant about including individuals from all sectors of society in their studies, so that research findings can be translated widely into improved clinical care. The federal government should follow through on its investment in research and assure that the discoveries of whole genome sequencing are integrated with clinical care to benefit the health of all.
