Impact of HIPAA’s minimum necessary standard on genomic data sharing

• Published in: Genetics in medicine Vol. 20; no. 5; pp. 531 - 535
• Main Authors: Evans, Barbara J, Jarvik, Gail P
• Format: Journal Article
• Language: English
• Published: New York Nature Publishing Group US 01-05-2018; Elsevier Limited
• Subjects: 631/114/2402; 631/208/1516; 706/648/479/702/129/2043; 706/689/280; Biomedical and Life Sciences; Biomedicine; Genomics - methods; Guideline Adherence; Health Insurance Portability & Accountability Act 1996-US; Health Insurance Portability and Accountability Act - standards; Human Genetics; Humans; Information Dissemination; Information sharing; Laboratories; Laboratory Medicine; original-research-article; Privacy; United States; genomic data sharing; treatment uses; HIPAA Privacy Rule; minimum necessary standard; research
• ISSN: 1098-3600; 1530-0366
• DOI: 10.1038/gim.2017.141

This article provides a brief introduction to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule’s minimum necessary standard, which applies to sharing of genomic data, particularly clinical data, following 2013 Privacy Rule revisions. This research used the Thomson Reuters Westlaw database and law library resources in its legal analysis of the HIPAA privacy tiers and the impact of the minimum necessary standard on genomic data sharing. We considered relevant example cases of genomic data-sharing needs. In a climate of stepped-up HIPAA enforcement, this standard is of concern to laboratories that generate, use, and share genomic information. How data-sharing activities are characterized—whether for research, public health, or clinical interpretation and medical practice support—affects how the minimum necessary standard applies and its overall impact on data access and use. There is no clear regulatory guidance on how to apply HIPAA’s minimum necessary standard when considering the sharing of information in the data-rich environment of genomic testing. Laboratories that perform genomic testing should engage with policy makers to foster sound, well-informed policies and appropriate characterization of data-sharing activities to minimize adverse impacts on day-to-day workflows.