Regulatory policy for genomic testing may be subject to biases that favor reliance on existing regulatory frameworks even when those frameworks carry unintended legal consequences or may be poorly tailored to the challenges genomic testing presents. This article explores three examples drawn from genetic privacy regulation, oversight of clinical uses of genomic information, and regulation of genomic software. Overreliance on expedient regulatory approaches has a potential to undercut complete and durable solutions.
W.Doniger, The Hindus: An Alternative History (New York: Penguin Press, 2009): 17.
3.
D. D.Newquistet al., “Beware of Data Gaps in Home Care Research: The Streetlight Effect and Its Implications for Policy Making on Long-Term Services and Support,”Medical Care Research and Review72, no. 5 (2015): 622-640.
M. J.Bregeret al., “Providing Economic Incentives in Environmental Regulation,”Yale Journal on Regulation8, no. 2 (1991): 463-495.
6.
V.Sutton, “Commentary on ‘Responsible Conduct by Life Scientists in an Age of Terrorism,’”Science and Engineering Ethics15, no. 3 (2009): 303-309.
7.
See B. J.Evans, “The First Amendment Right to Speak About the Human Genome,”University of Pennsylvania Journal of Constitutional Law16, no. 7 (2014): 549-636, at 618-623 (summarizing case law rejecting regulatory strategies that block information flows as a means of regulating activities that rely on those information flows); see also Central Hudson Gas & Electric Corp. v. Public Service Commission of New York, 447 U.S. 557, 566 (1980) (requiring restrictions on commercial speech to be narrowly tailored and no more extensive than is necessary to directly advance a substantial governmental interest).
8.
U.S. Department of Health and Human Services (DHHS), Secretary's Advisory Committee on Genetics, Health, & Society (SACGHS), U.S. System of Oversight of Genetic Testing (2008): at 17, available at <https://osp.od.nih.gov/wp-content/uploads/2013/11/SACGHS_oversight_report.pdf> (last visited October 20, 2019).
9.
Id.
10.
Id. at 17–20 (citing and reviewing some of this literature).
11.
Id. at 20.
12.
G. J.Annaset al., “Drafting the Genetic Privacy Act: Science, Policy, and Practical Considerations,”Journal of Law, Medicine & Ethics23, no. 4 (1995): 360-366, at 365.
13.
See J. D.Kearney and T. W.Merrill, “The Great Transformation of Regulated Industries Law,”Columbia Law Review98, no. 6 (1998): 1323-1409 (discussing the development of U.S. regulatory frameworks since formation of the Interstate Commerce Commission to regulate railroads in the late 19th century).
14.
See National Academies of Science, Engineering, and Medicine, Preparing for Future Products of Biotechnology (Washington, D.C., National Academies Press, 2017), at 70.
15.
Id.
16.
Office of Science and Technology Policy, Coordinated Framework for Regulation of Biotechnology, Federal Register51 (1986): 23, 302-50.
17.
Office of Science and Technology Policy, Exercise of Federal Oversight Within Scope of Statutory Authority: Planned Introductions of Biotechnology Products into the Environment, Federal Register57 (1992): 6753-62.
Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of 18, 26, 29 and 42 U.S.C.).
21.
45 C.F.R. pts. 160, 164.
22.
I. S.Kohaneet al., “Taxonomizing, Sizing, and Overcoming the Incidentalome,”Genetics in Medicine14, no. 4 (2012): 399-404, at 403; Department of Health & Human Services (DHHS), Food & Drug Administration (FDA), Optimizing FDA's Regulatory Oversight of Next Generation Sequencing Diagnostic Tests — Preliminary Discussion Paper (December29, 2014), available at <www.fda.gov/downloads/medicalde-vices/newsevents/workshopsconferences/ucm427869.pdf> (last visited October 20, 2019).
23.
F. E.Deweyet al., “Clinical Interpretation and Implications of Whole-Genome Sequencing,”JAMA311, no. 10 (2014): 1035-1045, at 1040.
24.
Genetic Information Nondiscrimination Act of 2008 (GINA), Pub. L. 110–233, 122 Stat. 881 (May 21, 2008).
25.
See GINA § 102 (amending the Public Health Service Act at 42 U.S.C. § 300gg-91b(d)(16) to define “genetic information” very broadly as including “with respect to any individual, information about — (i) such individual's genetic tests, (ii) the genetic tests of family members of such individual, and (iii) the manifestation of a disease or disorder in family members of such individual” and further including “genetic services and participation in genetic research”); id. at § 300gg-91(d)(17) (defining “genetic test” as referring to “an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, that detects genotypes, mutations, or chromosomal changes” and thus clearly including non-clinically-significant information, such as raw genomic data, within the scope of information included in GINA's definition of “genomic information”); id. at § 300gg-91(d)(18) (defining “genetic services” as including genetic tests and “genetic counseling (including obtaining, interpreting, or assessing genetic information)” and genetic information, such that information from testing, assessing, and counseling occurring during the course of genetic research is included in GINA's broad definition of “genetic information”).
26.
See GINA § 105.
27.
See, e.g., Congressional Record — House, at 2979 (remarks of Rep. Speier, characterizing the passage of GINA as a “strong step” toward protecting sensitive genetic information but stressing that “no journey is completed in just one step” and calling for further work to address “the underlying problems not fixed by this bill, so we can truly protect Americans' privacy…”).
28.
E. W.Claytonet al., “The Law of Genetic Privacy: Applications, Implications, and Limitations,”Journal of Law & the Biosciences6, no. 1 (2019): 1–36, available at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3384321> (visited October 19, 2019).
See National Academies of Science, Engineering, and Medicine, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research (Washington, DC, National Academies Press, 2009), at 16 (finding that the HIPAA Privacy Rule is criticized both for failing to protect privacy adequately while also impeding important health research).
34.
45 C.F.R. § 164.524.
35.
See Department of Health & Human Services, Standards for Privacy of Individually Identifiable Health Information, Federal Register65 (2000): 82,462-831 (codified at 45 C.F.R. pts. 160, 164) (promulgating the HIPAA Privacy Rule and including the access right at 45 C.F.R. § 164.524).
36.
Department of Health & Human Services, Centers for Medicare & Medicaid Services, Centers for Disease Control and Prevention, Office for Civil Rights, CLIA Program and HIPAA Privacy Rule; Patients' Access to Test Reports, Federal Register79 (2014): 7290-317 (to be codified at 42 C.F.R. pt. 493 and 45 C.F.R. pt. 164).
37.
See, e.g., Fair Credit Reporting Act of 1970, 15 U.S.C. § 1681 (authorizing the collection and storage of people's financial and credit data without their consent to facilitate a well-functioning credit market and, in return, granting individuals specific civil rights including a right of access to their data); see also U.S. Department of Health, Education, and Welfare, Report of the Secretary's Advisory Committee on Automated Personal Data Systems, Records, Computers, and the Rights of Citizens (DHEW Publication No. (OS) 73-94) (1973), available at <https://www.justice.gov/opcl/docs/rec-com-rights.pdf> (last visited October 20, 2019) (announcing an influential Code of Fair Information Practices (FIPs) based on five principles, one of which is that “[t]here must be a way for an individual to find out what information about him is in a record and how it is used,” id. at 41); F. H.Cate, “The Failure of Fair Information Practice Principles,” in Consumer Protection in the Age of the Information Economy (J. K.Winn, ed.) (New York: Routledge, 2006): 341-377 (tracing subsequent development of FIPs, including access rights, after the 1973 HEW Code of FIPs); Privacy Act of 1974, 5 U.S.C. § 552(a)(d) (providing an individual right of access to data held in governmental databases, including governmentally held Medicare data); Privacy Protection Study Commission, Personal Privacy in an Information Society (July 1977), available at <https://www.ncjrs.gov/pdffiles1/Digitization/49602NCJRS.pdf> (last visited October 20, 2019) (treating individual access rights as a core privacy protection in a report that heavily influenced subsequent development of the HIPAA Privacy Rule); Department of Health & Human Services, Confidentiality of Individually-Identifiable Health Information: Recommendation of the Secretary of HHS Pursuant to Sec. 264 of the Health Insurance Portability and Accountability Act of 1996, § I.G (Sept. 11, 1997), available at Healthcare Compliance Rep. (CCH) ¶ 100,001, 1997 WL 354007170 (hereinafter “DHHS, HIPAA Recommendations”) (citing the Privacy Protection Study Commission's 1977 recommendations and calling for individual access rights in the report to Congress that set the roadmap for the HIPAA Privacy Rule).
38.
See Press Release, U.S. Department of Health & Human Services, HHS Strengthens Patients' Right to Access Lab Test Reports, February 3, 2014), available at <https://perma.cc/AJ83-2Q59> (last visited October 20, 2019) (labeling HIPAA's individual access right as the “cornerstone of the Privacy Rule”).
39.
See B. J.Evans, “The Genetic Information Nondiscrimination Act at Age 10: GINA's Controversial Assertion that Data Transparency Protects Privacy and Civil Rights,”William & Mary Law Review60, no. 6 (2019): 2017-2109, at 2055-65 (reviewing statements by Congress, regulators, and congressional advisory bodies on the importance of access as a privacy protection).
40.
Department of Health & Human Services, Standards for Privacy of Individually Identifiable Health Information, Proposed Rules, Federal Register64 (1999): 59,918-60,067, at 59,980 (noting, in the preamble to the proposed Privacy Rule, that the right to inspect and copy one's data “is a fundamental aspect of protecting privacy”).
41.
See DHHS, HIPAA Recommendations, supra note 38, at § I.G (noting that the “decision whether to disclose a record may depend on what the record says, and so access to the record is integral to making an informed choice to disclose information”).
42.
See, e.g., California Consumer Privacy Act of 2018, § 2 (noting that “it is the intent of the Legislature to further Californians' right to privacy by giving consumers an effective way to control their personal information, by ensuring the following rights… [including] … The right of Californians to access their personal information….”); id. at § 3 (amending Part 4 of Division 3 of the Civil Code to add § 1798.100(d) (providing individuals with a right of access to their data); see also Minnesota Statutes § 13.04 (2018), Rights of subjects of data.
43.
See, e.g., European Union General Data Protection Regulation (Regulation (EU) 2016/679), Art. 15.
See B. J.Evans and S. M.Wolf, “A Faustian Bargain That Undermines Research Participants' Privacy Rights and Return of Results,”Florida Law Review71, no. 5 (2019): 1281-1345, available at <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3368555> (last visited October 20, 2019) (discussing HIPAA-related recommendations of the National Academies report, supra note 44, and how those recommendations would reduce existing privacy protections for genomic information).
National Institutes of Health-Department of Energy Working Group on Ethical, Legal & Social Implications of Human Genome Research, Task Force on Genetic Testing, N. A.Holtzman and M. S.Watsoneds., Promoting Safe and Effective Genetic Testing in the United States (1997): at ch. 2, available at <https://www.genome.gov/10001733/genetic-testing-report> (last visited June 6, 2019).
54.
National Institutes of Health, Secretary's Advisory Committee on Genetic Testing, Enhancing the Oversight of Genetic Tests: Recommendations of the SACGT (2000): at 10-11, available at <https://osp.od.nih.gov/wp-content/uploads/2013/11/oversight_report.pdf> (last visited June 4, 2019).
55.
B. J.Evanset al., “How Can Law and Policy Advance Quality in Genomic Analysis and Interpretation for Clinical Care,”Journal of Law, Medicine & Ethics48, no. 1 (2020): 44-68.
56.
See id. at 46.
57.
Clinical Laboratory Improvement Amendments of 1988, Pub. L. No. 100-578, 102 Stat. 2903, codified as amended at 42 U.S.C. § 263a.
58.
42 C.F.R. pt. 493.
59.
See DHHS, FDA, supra note 22, at 1.
60.
National Institutes of Health, Conference: Return of Genetic Results in the All of Us Research Program (March 7, 2017), available at <https://videocast.nih.gov/summary.asp?Live=21887&bhcp=1> (Day 2, 8 a.m. Session, at 1:16:55) (last visited October 20, 2019) (statement by Karen Dyer, Director, Center for Clinical Standards and Quality, CMS (ellipsis in the original)).
61.
Evans, supra note 39, at 2106-2107.
62.
See Evans et al., supra note 55, at 57; see also DHHS, FDA, Transcript of a Workshop, Optimizing FDA's Oversight of Next-Generation Sequencing Diagnostic Tests (February20, 2015), available at <http://wayback.archive-it.org/7993/20170113000324/http://www.fda.gov/downloads/MedicalDevices/NewsEvents/WorkshopsConferences/UCM439974.pdf> (last visited October 20, 2019), at 3, 20-21 (noting that genomic testing allows “broad and indication-blind testing” and explaining why this stymies FDA's traditional processes for ensuring tests are safe and effective in their intended uses).
63.
See, e.g., discussion infra this article, at 112-114.
64.
See Evans, supra note 39, at 2074-80 (discussing the application of HIPAA's individual access right to genomic information stored at HIPAA-covered laboratories); Evans and Wolf, supra note 45 (discussing ethical principles informing the return of genomic test results).
See 21st Century Cures Act, Pub. L. No. 114-255, § 3060(a), 130 Stat. 1033 (2016).
74.
See discussion infra this subsection.
75.
See Evans et al., supra note 55.
76.
See G.Marchantet al., “From Genetics to Genomics: Facing the Liability Implications in Clinical Care,”Journal of Law, Medicine & Ethics48, no. 4 (2020): 11-43.
See DHHS, FDA, Clinical and Patient Decision Support Software: Draft Guidance for Industry and Food and Drug Administration Staff, December8, 2017 (providing FDA's first draft guidance on clinical decision support software, which has been withdrawn).
See 21 U.S.C. § 321(h) (codifying § 201(h) of the Food, Drug, and Cosmetic Act, which defines the medical devices that Congress has authorized FDA to regulate).
91.
Id. at § 360j(o)(1)(E).
92.
See DHHS, FDA, supra notes 85 and 87.
93.
See 21 U.S.C. § 360j(o)(1)(E).
94.
Id. at 4.
95.
See 21 U.S.C. § 360j(o)(1)(E)(i)-(ii) (describing software for the purpose of “(i) displaying, analyzing, or printing medical information about a patient or other medical information (such as peer-reviewed clinical studies and clinical practice guidelines); (ii) supporting or providing recommendations to a health care professional about prevention, diagnosis, or treatment of a disease or condition”); see also Clinical Decision Support (CDS), HealthIT.gov (last updated January 15, 2013), available at <https://www.healthit.gov/policy-researchers-implementers/clinical-decision-support-cds> and <https://perma.cc/JWV8-YUGQ> (last visited February 26, 2018) (offering another helpful definition).
See generally W. N.Price, “Regulating Black-Box Medicine,”Michigan Law Review116, no. 3 (2017): 421-474 (discussing black-box software used in medical applications).
99.
21 U.S.C. § 360j(o)(1)(E)(iii).
100.
DHHS, FDA supra note 87, at 27.
101.
Id.
102.
21 U.S.C. § 360j(o)(1)(E)(iii).
103.
DHHS, FDA, supra note 87, at 27.
104.
DHHS, FDA, Genetic Database Recognition Decision Summary for ClinGen Expert Curated Human Variant Data, available at <https://www.fda.gov/media/119313/download> (last visited October 25, 2019).
105.
21 U.S.C. § 360j(o)(1)(E)(iii). See discussion supra notes 96-99 and accompanying text.
