INNOVATIONS IN MEDICAL GENOMICS: HOW TO ENABLE … · 2 ADVANCES IN GENOME SEQUENCING TECHNOLOGY...

INNOVATIONSINMEDICALGENOMICS:HOWTOENABLEADVANCES

WHILEMANAGINGPRIVACYANDSECURITYRISKS?

ForrestBriscoe(fbriscoe@psu.edu)andBarbaraGray(b9g@psu.edu)*

withassistancefromCelesteDiazFerraro

PennStateUniversity

SEPTEMBER2017

“Howdowesupporttheverynoblecancermoonshotandahealthiersocietyandenvironment,withouterodingwhataretrulyourfundamentalvaluesofindividualismandprivacy?”(GenomicscompanyCEO)

ASGENOMICSISINTEGRATEDINTOHEALTHCAREDELIVERY,NEWPRIVACYANDDATA-SECURITYRISKSNEEDTOBECONSIDERED

Humangenomesequencingistransforminghealthcare.Sequencingistheinnovationatthe

heartoftheshifttoprecisionmedicine,reflectedinthe21

CenturyCuresAct(2016)andother

recentinitiatives.Assequencingbecomesincorporatedintoroutinemedicalcare,millionsof

Americanswillhavetheirgenomicdatageneratedinordertodiagnose,treat,orprevent

disease.Atthesametime,thatdatawillbeaddedtogenomedatabasesthatareproliferating

acrossthecountry.Thesedatabasesarenecessarytorealizeprogressinmedicalcare–butthey

alsocarryparticularprivacyandsecurityrisksthatarenotwidelyappreciated.Inparticular,

genomicdatarevealdetailedphysicalandmentalcharacteristicsforeachpersonsequenced,as

wellasforhisorherfamilymembersandoffspringforgenerations.Thesedatabasesare

inevitablyvulnerabletobreaches,andtheircontentscannotbeanonymizedeffectively.

Inthiswhitepaper,wesummarizeprivacyandsecurityrisksassociatedwithmedicalgenomics,

andindicatesomeoftheoptionsforriskmitigationthatarebeingdeveloped.

Someoptions

couldimpactonthepaceofinnovationandprogressinscienceandmedicine.Hence,leadersin

thegenomicsfieldaredebatingtheserisksandbenefits.Yetthebroaderpublicalsoneedsto

beengagedinthisdebate,sincetheirgenomesareenteringthegenomedatabases.Citizens

andpolicymakersneedtograpplewithimportanttrade-offsinherentinhowwetreatgenomic

data.Henceweconcludewiththreequestionsaboutgenomicsthatneedtobedebatedby

informedAmericancitizensandpolicymakers:Whoshouldhavetherighttomakedecisions

aboutyourgenome?Howcloselyshouldyouholdontoyourgenome?Whatstandardsare

desirableforsecuringgenomicdatabases?Addressingthesequestionswillhelpinsurethatwe

striketherightbalanceofbenefitsandrisksinthisrapidlydevelopingfield.

Privacy&SecurityinMedicalGenomics:APrimerandCallforPublicEngagement

ADVANCESINGENOMESEQUENCINGTECHNOLOGYARETRANSFORMINGHEALTHCAREANDTHELIFESCIENCES

Thegenomeisthatuniquesequenceofdeoxyribonucleicacid(DNA)moleculeswhich

representseachindividual’sbiochemicalcode.

Thefirsthumangenomewassequencedover

15yearsago,andnowthepromiseofgenomicsisbeingrealized.Inthattime,advancesinthe

technologiesusedtogenerateanddigitallystorethatsequencehavemadeitfeasibleto

incorporategenomicdataintoawiderangeofmedical,scientificandcommercialactivities.In

medicine,genomicsismovingtocenterstageinthesearchforeffectivetherapiesanddrugs;it

isalsobeingincorporatedintotheclinicaldiagnosis,treatment,andpreventionofdisease.

Genomicsisalsotransformingmanyscientificfields,frombiologyandanthropologytopublic

healthandthesocialsciences,sheddingnewlightonresearchtopicsfromhumanevolutionto

societalinequality.Andarangeofcommercialfirms,suchasGoogle,Apple,IBM,Amazonand

Alibaba,aimtousegenomicsinordertotailorconsumerproductsandservicesaccordingto

users’geneticprofiles,allowingthesecompaniestomorepreciselymanagerelationswithusers

andanticipatethoseusers’needsandactivities.

Thefieldofgenomicsislarge,complex,andrapidlyexpanding.Adiverseecosystemof

organizationsisinvolved,includinghospitalsandhealthcareorganizations,academic

departmentsandresearchteams,pharmaceuticalandbiotechnologyfirms,consumer

technologycompanies,genomicsdevicemanufacturersandsequencinglabs,grantfunding

organizations,venturecapitalists,regulatoryagencies,citizenscienceandpatientadvocacy

organizations,andmore.Majorgenomicsentitiesareorganizedasfor-profitcompanies,non-

profitorganizations,andgovernmentagencies,reflectingarangeofdifferinginterestsand

governancestructures.Awebofinter-organizationalpartnershipsandalliancescrisscrossesthe

field.A2013studyestimatedthegenomicsector’scontributiontotheeconomyat$25billionin

directoutputand$40billioninindirectoutput;observersanticipatethefootprintofthesector

willgrowrapidlyinthecomingdecade.

Inthiswhitepaper,wefocusonmedicalgenomics,whichisthelargestcomponentofthe

overallgenomicsfield.Changesnowoccurringinthehealthcaresystemsuggestthatinthe

nextfewyearsasignificantportionofAmericanswillbeaskedtohavetheirgenomesequenced

aspartofroutinemedicalcare.

Thisdevelopmenthasfarreachingconsequencesthatareonly

dimlyappreciatedatpresent.Ouraiminthispaperistoprovideaninitialriskassessment

focusedontheprivacyandsecurityconsequencesofthisdevelopment.Inparticular,wefocus

onprivacyrisks.Medicalgenomicshasgreatpotentialtoimprovethehumancondition,andour

aimisnottoquestionthatpotential.Rather,wehopethatinsensitizingthepublictomoreof

theimplicationsofmedicalgenomics,wecanstimulatepublicdiscussionanddeliberationon

thebestwaystobalanceprivacyconcernswithotherinterestsdrivingthisfield.

CLINICALHEALTHCAREISTHEGATEWAYTHROUGHWHICHAMAJORITYOFAMERICANSARELIKELYTOBEINTRODUCEDTOSEQUENCING

Withrapidadvancesinthefeasibilityofgenomesequencing,leadersinhealthcarearenow

forgingakeyroleformedicalgenomicsinthedeliveryofclinicalpatientcare.Indeed,inmajor

hospitalsandhealthcareorganizations,medicalgenomicsisalreadybeingintegratedwith

patientdataandotherpersonalhealthinformation,sotheycanbeusedtogetherindiagnosing

andtreatingpatients.

Atarecentconference,apanelofleadingexpertsconcludedthatwithin

adecade,over1billionhumansworldwidewillbesequenced,andthatsequencingwillhave

becomepartofroutinepatientcareintheU.S.

Forexample,apatientpresentingsymptomsof

diabeteswillhavehergenomeanalyzedformutationsknowntomakecommondiabetesdrugs

ineffective;iffound,thepatient’sphysicianwouldbeinformedandadifferentdrugprescribed.

ApatientarrivingintheE.R.withchestpainswillbeanalyzedforgeneticheart-rhythm

mutationswhich,iffound,wouldaltercriticalcaredeliveryinlife-savingways.

Thisincorporationofgenomicdataintoclinicalcaretakesustowardanindividualizedapproach

tohealthcarethatisbeingcalledprecisionmedicine.Proponentsarguethatasthefieldadvances,thepracticeofmedicinewillberevolutionizedthroughtargetedtherapiesand

customdrugsbasedonknowledgeofaspecificpatient’sgenome.Already,priortobeing

prescribedwithadrugsuchaswarfarinandPlavix,apatientcanhavehisorhergenome

checkedformutationsthatareknowntoreducetheefficacyofthosedrugs.

Inaddition,

genomictestingforprostatecancercannowidentifypatientsatriskofthemoreaggressive

formofthedisease,leadingtomoretargetedscreeningandtreatmentofthosepatients.

Routine“cell-freeDNA”sequencingonhealthypatientsisaimedatearlydetectionofavariety

ofcancers.Powerfulnewgeneeditingcapabilitiesarealsonowmakingitpossibletocurtail,

andevencure,certaindiseasesbyidentifyingtheoffendingmutationsinanindividualandthen

usinggenetherapytofixthem.In2016,suchapproacheswerefoundsuccessfulagainst

diseasesincludinghemophiliaandnon-Hodgkinslymphoma.

Astheseexamplesillustrate,

precisionmedicineinvolvestheintensiveuseofgenomicsinbiomedicalresearch,aswellasthe

routineuseofgenomicsinclinicaldiagnosisandtreatment.

GENOMICSDATABASESPLAYACRUCIAL–ANDCONTROVERSIAL–ROLEThelinchpinofthisrevolutionisthegenomicsdatabase.Thereuse,combination,andsharingof

humangenomicdatainordertocreatethesedatabasesisanessentialrequirementfor

realizingthemedicaladvanceschronicledabove.

Toseewhythisisthecase,considerhowascientistdiscoversthegeneticmutations(called

variants)thatcauseaspecificdisease.Ataminimum,sheneedstocomparegenomesfrom

manypeoplewiththedisease,againstgenomesfrommanypeoplewithoutthedisease.Bothgroupsneedtobepresentinsufficientnumbersinordertobestatisticallyconfidentaboutthe

associationbetweenthevariantsandthedisease.Ifthediseaseisrare,thedatabaseneedsto

belargerinordertoincludeenoughdisease-carryingindividuals.Ifthediseasehasmany

variantsassociatedwithit,andtheyoccurincomplexcombinations–asituationthatis

common–thenanevenlargerdatabaseisneededtoensureallthosecombinationsare

included.Thisstatisticalcomparisonprocessismademorechallengingbecauseofthesheer

sizeofthehumangenome.Althoughmostofthe6billionbasepairsineachgenomeare

identicalacrossindividuals,therearestillafewmillionbasepairsthatvarybetweenpeoplethatmayneedtobeanalyzedforpotentialdisease-causingvariants.

Thenetresultofthissituationisthatresearchersrequireaccesstolargedatabasescomprised

ofDNAdatafromthousands-andinsomecasesmillions-ofindividuals.What’smore,those

databasesaremostusefultoresearcherswhentheyarelinkedtoadditionalinformationabout

theindividualswithinthem.Forexample,toidentifythegenomesofdisease-carrying

individualsanddisease-freeindividuals,genomicdatamayneedtobelinkedtomedicalrecords

thatreportthediseasestatusofeachpersoninthedatabase.Henceeffortsareunderwayto

compileandconnectmultipledatabasestogether,tocreateever-largerpoolsofgenomicdata

coupledwithothermedicalandpersonalinformationontheindividualscontainedinthem.

Manypeoplehave-wittinglyorunwittingly-contributedtheirDNAsequencestothese

databasessimplybyparticipatinginmedicaltestingorbyusingdirect-to-consumergenomics

testingservices,oftenwithoutrealizingtheirdatahasnowbecomeavailableforacademicand

medicalresearch,andinsomecasesalsoforadditionalcommercialresearch.Although

contributorssignconsentformsmentioningtheirdatawillbereused,fewseemawareofthe

implications,aswedescribebelow.Ontheotherhand,actorsinthegenomicsfieldarewell

awareofthevalueofgenomicsdatabases.Asaresult,healthcareorganizations,

pharmaceuticalcompanies,scientificteams,governmentagencies,andentrepreneursareall

engagedinagenomicsdatabasegold-rush,tryingtoassemble,secure,monetizeandmine

thesedatabasesforthesecretstheyhold.Suchdatabasesarequietlyregardedasstrategic

assetsbyforward-thinkingmedicalorganizationssuchasKaiserPermanente,GeisingerHealth

System,andtheVeteransHealthAdministration,bypharmaceuticalfirmssuchasRocheand

AstraZeneca,andbyconsumertechnologyfirmssuchasGoogleand23andMe.

DISCLOSEDGENOMICDATAREVEALFUTUREHEALTH,BEHAVIORALTENDENCIES,ANDOTHERTRAITS,PLUSDETAILSOFFAMILYMEMBERS

Despitetheincreaseinandpopularizationofgenomics,therisksassociatedwiththisfieldin

general,andgenomicdatabasesinparticular,maybelargelyunderappreciatedbypatients.The

latentvalue(andlatentharm)ofdisclosingone’sgenomicinformationisalreadysignificant.

Consider,forexample,thatgenomicinformationnowrevealsanindividual’ssusceptibilityto

substanceabuse,oddsofdevelopingdepressionandearlyAlzheimer’sdisease,abaselinefor

innatemathematicalability,tendencytowardaggression,andprobabilitiesfordevelopinga

widerangeofbothcommonandraregeneticdiseases.

Further,advancesinstatisticalanalysis

meanthatevenwhenonepartofaperson’sgenomeisdisclosed,datafromotherpartsofthat

person’sgenomecanbeinferredwithrelativecertainty.Inonefamousexample,whenJames

Watson(theco-discovererofthestructureofDNA)madehisgenomepubliclyavailable,he

withhelddataforthevariantthatpredictsearlyAlzheimer’sdisease.Butscientistsshowedhow

toinferthatvariantusingotherpartsofhissequence.

Further,disclosurethatoccurstodaywillalsoincreaseone’svulnerabilitytofuturerisksthat

areas-yetunknown.Asthegenomicrevolutionadvances,boththevalue–andthepotential

harm–ofanindividual’sgenomicdatawillcontinuetoincrease,longafterthemomentwhen

heorshewasinitiallysequenced.Within5years,expandedsequencingofaperson’s

metagenome,whichincludeshisorherpersonalmicrobiome,willrevealfurtherdetailsofa“geneticfingerprint,”encompassingfine-grainedinformationaboutethnicity/nationalorigin,

placesanindividualhasvisited,andevenrecentcontactwithotherpeople.Clinicalcollectionof

expandedmetagenomicdatawillincreaseinthenearfuture,asscientistsuncovertheroleof

themicrobiomeintriggeringandregulatingdisease,andinservingasindicatorsofthe

environmentalexposuresaffectingdisease.

Metagenomicdatawillalsoimproveonexisting

abilitiestopredictanindividual’ssocioeconomiccircumstancesfromhisorhergenome.

Importantly,genomicdisclosurerisksalsoextendtofamilymembers.Becausesomuchofone

person’sDNAisidenticaltothatofhisorherrelatives,includingcurrentandfuture

descendants,thesedisclosuresaffectnotonlyanindividualbutalsotheirfamilymembers.

Knowledgeofoneindividual’sgenome,orevenjustsomeoftheirvariantdata,canreveal

usefulinformationonthediseaseprobabilitiesandpersonalcharacteristicsofthatperson’s

parents,siblings,children,andevenextendedkinupto5degreesofseparation.

Giventheinherentvalueinpersonalgenomicdata,

manyentitiesmayhaveaninterestinacquiringit-

includingemployers,educationalinstitutions,

insuranceandfinancialfirms,andevenromantic

partners.Althoughthe2008GeneticInformation

NondiscriminationAct(GINA)currentlyprotects

againstabusebysomeoftheseparties(specifically,

employersandhealthinsurersareprohibitedfrom

discriminatingagainstindividualsbasedongenomic

data),itdoesnotcoverlife,disabilityorlong-term

careinsurance.Educationalorfinancial

discriminationisalsopossible,ifeducatorsor

lenders-whicharenotsubjecttoGINA’snon-

discriminationprovisions-begintoscreen

applicantsaccordingtodesirablegenomicfeatures.

Genomicsdataisalreadybeingusedtodetermine

theeligibilityofsomestudentstoparticipatein

collegiateathletics.

Stateandnon-stateactorsalso

haveastronginterestinobtaininggenomicdata

(seetextbox).

StateandNon-StateActorsAlsoSeekGenomicDataBeyondthesemarketactors,whoelse

isinterestedingenomicdata?State

andnon-stateactorsalsohavean

interestingainingaccesstogenomic

dataforacountry’scitizens.Foreign

entitieshaveconductedlarge-scale

hackingofU.S.healthcaredatabases.

Suchdatacanprovidevaluablemedical

andbehavioralinsightsonatarget

country’sfuturebusinessleadersand

governmentalofficials.Assuch,these

datawillhaveincreasingvalueonthe

blackmarket,tobothcriminalsand

states.Ifgenomicsignaturesbecome

incorporatedintocryptographicand

informationsecuritytools,thevalueof

obtainingsuchgenomicdatawill

increasefurther.

Apotentialparalleltothecurrentmomentingenomicdatadisclosuremightexistintheearly

yearsofonlinesocialmedia.Earlysocialmediausersfailedtoanticipatehowdisclosureoftheir

embarrassingordubiouspicturesontheirFacebookpagemightjeopardizetheirfuture

employmentoptions.Aspeoplebecamemoreawareofhowonlinedatacouldbeusedagainst

them,socialmediausersappeartohavebecomemorecareful,andsocialmediacompanies

haverespondedwithmoreoptionsforindividualstocontroltheirdataandlimitdisclosure

risks.ForDNAdata,althoughGINAcurrentlyofferssomeprotectionsagainsttheuseof

disclosedgeneticinformation,thoseprotectionsareincomplete,andunlikelytokeeppacewith

futureattributesyettoberevealedfrompreviously-releasedDNA.

Inshort,genomicdataappearstobeuniquelyinformativeofanindividual’sfuturelife

expectations,challengesandopportunities-andominously-thoseoftheirprogenyaswell.

Thissuggeststhatanindividual’sdatashouldbetreatedwithuniquecare.Butaswedescribein

moredetailbelow,therearemanyscenariosinclinicaluseandbeyondinwhichidentifiable

genomicdatacanpotentiallybereleased-intentionallyornot-andcauseharmtoan

individualandtheirfamilymembers.

THELEGALANDREGULATORYFRAMEWORKTOPROTECTGENOMICDATAISLIMITED

Asthevalueandriskassociatedwithgenomic

datadisclosurecomesintofocus,theU.S.legal-

regulatoryframeworkprotectingithasnotkept

up.Evenwhengenomicdataisgeneratedinthe

healthcaresetting,itisnotprotectedinthe

samemannerasapatient’spersonalhealth

information.Personalhealthinformationis

protectedunderHealthInsurancePortabilityandAccountabilityAct(HIPAA),whichcircumscribeshowthatinformationcanbe

stored,used,andshared.Noclearregulatory

frameworkforprotectinggenomicdataexists.

Initsabsence,organizationsappeartobetaking

anapproachwiththreebasicpillars–consent,

de-identification,andcybersecurity–eachof

whichsuffersfromsignificantlimitations.

Consentisthelegalprocessthroughwhichindividualsprovideapprovalfortheirgenomic

datatobegeneratedandused.Inpartto

facilitategenomicsresearch,anewmodelof

“broadconsent”hasbeendeveloped,underwhichpatientsandothersagreeingtoDNA

sequencingaretoldsomethinglike,“Yourgenomicdataandhealthinformationwillbestudied

HowdoestheU.S.Government’sInvolvementinGenomicsComparewithOtherCountries?Governmentalinvolvementingenomics

variesgreatlyacrosscountries.Relativeto

theU.S.,thereisgreaterinvolvementin

theUnitedKingdom,China,Iceland,

France,andothercountrieswherethe

governmentiscollectinggenomicdataon

amanyorallofitscitizens.Whythe

differencesacrosscountries?Inpart,

differencesmayreflectsocietalvaluation

ofpersonalprivacy.However,differences

alsoreflectthestate’spre-existingrolein

thefinancingandprovisionofhealthcare;

wherethatroleislarge(suchastheUK),

thereareisamandateforthegovernment

toinvestinthecollectionanduseof

genomicsdatabasestocontrolthenation’s

healthcarecosts.

alongwithinformationfromotherparticipantsinthisresearch,anditwillbestoredforfuture

studiesbythisandotherresearchteams.”

Thisapproachislegallyadequate,becauseunder

currentU.S.law,genomicdataitselfisregardedasaformofproperty,subjecttocontractlaw,

ratherthangovernedbyanyuniversalprivacyrightoftheindividualwhothedatadescribes.

Underthisapproach,patientsarerarelyinformedofspecificwaystheirdatawillbe

subsequentlyusedortheconsequencesofsuchuse.

De-identificationisintendedtoensurethatpeoplewhoaccessagenomicsdatabasecannottell

whotheindividualsarewithinit.HIPAAregulationsdetailasetofstepsneededtode-identify

data,involvingremoving18specifiedindividually-identifyingdataitems,suchasname,

telephonenumber,andfingerprintdetails,whichmakeitpossibletouniquelyidentifyaperson.

Ifagenomicsdatabaseisfree-standing,orlinkedtoitemsotherthanthose18specifiedones,itfallsoutsideofthejurisdictionofHIPAA,andinthatstateitcanbereusedandsharedrelatively

easily.Infact,strictlyspeaking,inthatnon-HIPAAformat,genomicdatacanbereusedand

sharedforresearchpurposeswithoutpatientconsent.

Unfortunately,genomicdataitselfappearstoallowforre-identification,whetherornotitis

linkedtoanyotheritems.Indeed,genomicdataappearstobeoneofthebestwaystouniquely

identifyanindividualthathaseverbeendiscovered.Researchershavedemonstratedanumber

ofwaysthatapersoncanbere-identifiedbyanyonewithaccesstoa(de-identified)genomic

database.Forexample,ifyouknowjustafractionofaperson’sDNAsequencefromanother

source,youcanusethatinformationtore-identifytheminthegenomicdatabase.Or,ifyou

knowfragmentsofaperson’sphenotypeinformation,suchaseyeandskincolor,height,anda

fewotheritems,youcanalsousethattore-identifythatpersoninagenomicdatabase.

Whileaprimaryconcernwithre-identificationisdisclosureofprivateinformationmanifestin

theperson’sgenome,asdescribedabove,thereisalsoaprivacyriskinjustlearningthata

personisincludedwithinagivendatabase.Becausemanydatabasesfocusonspecificdiseases,

suchasautismspectrumdisorderor

mitochondrialdiseases,knowingthataperson

isinsuchadatabaserevealsthatthis

individualisacarrierforthatdisease,andtheir

familymembersarelikelycarriersaswell.

Thethirdpillariscybersecurity.However,theframeworkforensuringcybersecurityin

genomicsisflexible,anddependsinlargepart

onthevaryingpoliciesofeachorganization

involved.Inhealthcare,HIPAAshapes

cybersecurity,butgenomicsdatacanbekept

outsideofHIPAAjurisdiction.Further,even

HIPAA-protecteddataisoftenbreached(see

textbox).

Forresearchprojectsand

organizationsreceivingfederalfunding

HowOftenDoDataBreachesOccurintheU.S.HealthCareSystem?AccordingtotheInstituteforCritical

InfrastructureTechnology,nearlyhalfofthe

U.S.populationhadpersonalhealthcare

datacompromisedinjustoneyear.

Anthem’sdatabreach,disclosedin2015,

involved78millionrecordswithpersonally

identifiableinformation.Thissuggeststhat

personaldataprotectionsmandatedby

HIPAAarenotprovidingadequate

protection,evenofnon-genomicdata.These

sensitivepersonalhealthdataarebeing

successfullytargetedbynationstateactors,

cybercriminals,andhacktivists.

(includingmanymedicalorganizations,academicinstitutions,andpharmaceuticalcompanies),

aninternalInstitutionalReviewBoard(IRB)approvesgenomicscybersecuritypractices,along

withotheraspectsofclinicaloracademicgenomicsresearch.IRBs,inturn,trytoensurethat

bestpracticeguidelinesfordatasecurityarefollowed,andtheycanenforceinternalpenalties

fornon-complianceastheydeemappropriate.

UNCOVERINGTHEFULLLIFECYCLEOFDNADATA

Tofurtherexplainhowgenomicdataarebeingused,wedevelopedaportraitofthe“lifecycle

ofDNAdata,”tracinganarcfromitscreationduringclinicaldiagnosisandtreatmenttoits

subsequentreuseforclinicalandresearchpurposesinothersettings.Whiletheprocessisby

nomeansstandardized,thisgenerallifecyclemodelnonethelesscapturesthebroadsetof

stepsthatarecommonacrossmanysettings.Thelifecyclemodel(seeTable1)offersausefulmeansforidentifyingwhereprivacyandsecurityvulnerabilitiesassociatedwiththeuseof

clinicalDNAdatacanoriginate,andwhatstepsneedtobeinplacetoensuretheprivacyand

securityofthedataasitistransferredfromanindividualtoalargedatabaseandbeyond.

ThetoprowofTable1showsfourbasicstepsinhowDNAdataishandled:(1)thegenerationof

thesequenceddata,(2)theanalysisofvariantsinthedata,(3)clinicalinterpretationofdata,

and(4)subsequentdatasharingandreuse.Thenexttworowsinthetablesummarizethekey

activitiesinvolvedineachstep,andspecifywhohandlesthedata.Thebottomtworows

summarizetheimplicationsofeachstepfortheprivacyandsecurityofDNAdata.Inthe

sectionsbelow,wefirstmoveleft-to-rightacrossthetophalfofthetabletoexplaineachstep

inthelifecycle.Thenwegoleft-to-rightthroughthebottomhalfofthetable,discussingthe

privacyandsecurityissues,andmeasurestoaddressthem,ateachstep.

Step1.GenerationofDNAdata

ThefirststepisthedecisiontocreateDNAdataforthepatient.Thisdecisionoriginatesina

clinicalsettinginconsultationwithanindividual’shealthcareproviderbecausethepatienthas

symptomstheclinicianbelievesmaybebetterunderstoodthroughgenomicanalysis.Thisstep

involvesobtainingabiosampleandgettingitsequenced.Forgenomicsresearch,thebiosample

isusuallyobtainedviaabloodsampleora“spitkit”–asmallcontainerinwhichtheindividual

depositssaliva–whichisthensenttothelabforsequencing.

Priortosubmittingtheirbiosample,patientsareaskedtosignaconsentformthatindicates

theyunderstandhowtheirdatawillbeusedandtherisksinvolved.Inaddition,inmanycases,

patientsareaskedtomeetwithageneticcounselor,andtoreadadditionalmaterials,inorder

toincreasetheirunderstandingoftheimplicationsofhavingtheirgenomesequenced,the

informationitmayreveal,andthedecisionstheymayfaceasaresult.Thepeople“touchingthe

data”inthisstepincludenurses,labtechniciansandbioinformaticianswhoareeitheremployeesofthemedicalorganizationthatisrequestingtheDNAdatacreation,oremployees

ofasequencinglabcontractedtocollectandsequencethedata.

StepsinthelifecycleofDNAData,andattendantprivacyandsecurityrisks

1.GeneratingDNAdata

2.AnalysisofVariants 3.Clinicalinterpretation 4.Furtherdatasharingandreuse

Summary Individualmakesdecision

tocollectDNAdataandraw

sequencedataisgenerated

Individual’sDNAdata

processed&analyzedto

identifyvariants

DNAdatabaselinkedtoindividual’sother

healthdata,andanalyzedbycliniciansfor

insightintomedicalcondition

Findingsfromanalysismaybeshared,

anddataaresharedforsubsequent

reanalysis

Keyactivities

Patientseeksmedicalcare,

orjoinshealthcaresystem

Patientsignsconsentform

Biosamplecollectedatclinic

andsenttosequencinglab

-Biosampleispreparedand

runthroughsequencing

machine

-ResultingrawDNAdatais

storedtemporarily

Datamovesto

bioinformaticians

Patient’srawDNAdata

processedandannotated

usingvariantdatabase

DNAdataanalysismovestoclinicians

DNAdataanalysislinkedtootherdatain

patient’shealthrecord,andtolarger

genomics&medicaldatabases.Mayinclude:

-visualizationofspecificpatient’sDNA

-scrutinyofspecificpatient’sgenotype-

phenotypeassociations

-Sharinganddiscussionofdata,withinlocal

clinicalteamandpossiblyotherexternal

clinicalorresearchconsultants

Diagnosisandtreatmentoptionsgivento

patient

Patient’sDNAdatamergedwithothers’

DNAdatainlargerdatabase

Findingsfromanalysissharedwith

otherresearchersandclinicians

workinginsimilarareas

Datamaybesharedforreusewith:

-clinicianstreatingotherpatients;

-NIH,whichrequiresfundedprojectsto

depositdataforacademicreuse

-pharmafirmsfordrugdiscovery

-commercialfirmsandothertypesof

organizations

Whohandlesdata?

Sequencinglabemployees Employeesofsequencing

lab,medicalorganization,

and/orthird-party

bioinformaticscompany

Employeesofsequencinglab,medical

organization,and/orthird-party

bioinformaticscompany

-Alsootherclinicians,researchersandgenetic

counselorsconsultedfordiagnosis/treatment

Otherclinicians,academicresearchers,

pharmaceuticalemployees,and

governmentalentitiesthatacquire

accesstodatabases

Dataprivacy&security

Consentformdoesnot

allowindividualtoeasily

appreciateimplicationsfor

selfandfamily

Sampleordatacrossing

state/legaljurisdictions

Behavioroflabemployeesandclinicians-carelessnessortheftofdata

-clinician’surgetodiagnosepatientincreasesincentiveforrapiddata

sharing,carelessuseofcommunicationtechnology

Technology-Storageandtransitofdataviainternet,localcomputersorcloud

Individualshandlingdataarenot

subjecttoprivacy&securitypoliciesof

originalorganization;maynotbeas

carefulwithdata;goalsmayalsodiffer

Re-identificationofdatamaybe

possibledespiteeffortstoanonymizeit

Waystoaddress

dataprivacy&security

Requireexpandedgenetic

counseling

Increaseindividualcontrol

overdata

Updateconsentprocess

with“opt-in”todatareuse

Behavioroflabemployeesandclinicians-screening,compliancetrainingandsanctions

-monitoringandauditing

Technology-databaseaccess:encryption,authentication,authorization

-secureplatformforcommunicationofgenomics&healthinformation

Makesharingcontingentonrecipient

organizationreplicatingprivacyand

securitystandardsofsharing

organization

Maintainindividual’sopt-in/opt-out

rights,enabledbytechnologyand

organizationalprocesses

Mostoften,thesequencinglabisseparatefromtheclinicalorganization,althoughsome

hospitalsorclinicshaveanin-housesequencinglab.Theregulatoryoversightofsequencing

labsisnotclearlydefinedcurrently.SomesequencingoccursinlabsthathaveobtainedCLIAcertificationbytheCentersforMedicareandMedicaidServices(CMS),butthisisnota

requirementtoconductsequencing.Theinitialresultofsequencinganindividualisthecreation

ofrawdatafiles,whichthenmovetostep2foranalysis.

Step2.Individual’sDNAdataisprocessedandanalyzedtoidentifyvariants

Inthisstep,theindividual’sdataislargelyinthehandsofbioinformaticianswhoworkforthe

in-houseorcontractedsequencinglab,orforanexternalconsultingorganizationspecializingin

DNAanalysis.Initsentirelyrawform,DNAdataisnotveryuseful.Andalthoughsequencing

technologyhasadvancedgreatlyinthelastdecade,theprocessingofrawdataintousableform

requiresaconsiderableamountofskill,experience,andtimeonthepartofbioinformaticians.

Dependingonthetypeofsequencingdone(e.g.,genotyping,wholegenomeorwholeexomesequencing),therawdatafileswillhavedifferentformats,andtheirprocessingandanalysis

willrequiredifferentnumbersofsteps.Forexample,forwholegenomeandexomesequencing,

therawdataproducedbythesequencingofasingleindividualconsistsofalargenumberof

smalldatafiles,eachofwhichcontainsatinysectionofthegenome,andwhichtogetherforma

sequencinglibrary.Thatlibraryisthensubjectedtoa3-stepprocessof“assembly”and

“alignment”(inwhichtheoriginalDNAsequenceisreconstructedinitsproperorder)and

finally“annotation”(comparisonwithawell-knownreferencegenomeorvariantdatabase)toidentifyandcataloguevariantsfoundalongthereconstructedsequence.Althoughthisprocess

isautomated,bioinformaticiansoftenvisuallyinspecttheresultsusingagenebrowsertohelpincreaseaccuracy.

ExamplesofGenomicSequencingDevices

IlluminaMiSeq OxfordNanoporeTechnologiesMinion

https://www.illumina.com/systems/sequencing-platforms.htmlhttps://nanoporetech.com/products/minion

Step3.DNAdataisusedforclinicalinterpretation

Inthethirdstep,theanalyticresultsareprovidedbacktoclinicianswhointerpretitforthe

patient.Thelabresultsincludekeyfindingsaboutvariationsfromclinicalcasesofsimilar

patientsinothergenomicdatabases.Itisworthnotingthateventhoughtheyarebasedon

digitaldata,thesefindingsarenotfreefrompotentialerrors,andinfacttheyalwaysinvolvea

degreeofsubjectiveinterpretation.Thevariantinformationhelpscliniciansinterpretthedata

ofthecurrentpatientbeingtreated.Inthisstep,variantinformationisalsolinkedtohealth

records,sothatclinicianscangaininsightintothepatient’sconditionandrecommend

treatmentoptions.

Atthispointintheprocess,ifhealthcareprovidersaredealingwithadifficultdiagnosisor

treatmentsituation,theyarelikelytoconsultwithin-houseand/orexternalcliniciansinorder

togatheradditionalinformationtoassisttheminmakingadiagnosis.Forthispurpose,they

mayseekgenomicdataonpatientswithsimilarsymptoms,ormedicalrecorddataonpatients

withsimilargenevariants.Thissteprequiressharinganddiscussionofthepatientgenomicdata

andphenotypicdata(i.e.medicalrecords)frommultipleindividuals.Whoisinvolvedatthis

stepdependsonthespecificdiagnosticsituation,butitwouldusuallyincludethepatient’s

primaryclinicalteam,cliniciansatothermedicalfacilities,andeveninternalorexternal

bioinformaticiansifsubsequentscrutinyofthegenomicdataisdeemednecessarytoreacha

diagnosis.

Step4.Furtherdatasharingandreuse

Inthefinalstep,thepatient’sDNAdataisnearlyalwaysreusedandsharedbeyondtheoriginal

purposeforwhichitwascreated.Initiallythefocusofattentioninthepatient’sdatawaslikely

onvariantstiedtohisorherspecificsymptomsordisease.However,thepatient’slarger

genomeisvaluableformyriadotherpurposesandthisdataishighlysoughtafterbyother

cliniciansandresearchers.Henceitiscommonpracticeforanindividual’sDNAdata(andits

associatedphenotypicdata)tobede-identifiedandthenaddedtoalargerDNAdatabasefor

furtherresearchandclinicaluses.Althoughinmanycasesthepatienthassignedaconsent

formthatauthorizesadditionalusesingeneral,theyrarelyareinformedaboutthespecific

waystheirdatawillbereused.Inaddition,genomicdatathatisconsideredde-identifiedcanbe

sharedwithoutconsent,asnotedabove.

DatabasesthatcontainmergedDNAandclinicaldatafrommanyindividualsarecriticalfor

researchersaimingtodiscovernewvariantsandteaseouttheirclinicalimplications.Variant

discoveriesfromnewdatacanthenbecomparedwithpriorknowledgefrompre-existing

variantdatabases,graduallygrowingandrefiningtheoverallpoolofgenomicknowledge.

Astheinitialpatient’sdataismergedintoalargerde-identifieddatabase,thatdatabasemayin

turnbesharedfurtherafield.Clinicalorganizationssuchashealthsystemscreatingthese

databasesmayenterintopartnershiporlicensingagreementswithotherorganizations(suchas

otherclinics,academicresearch

institutesordrugcompanies

searchingfornew

pharmacogenomicdrugs)toenablere-useoftheirdata.Such

partnershipsfacilitatethe

transferDNAdatafromclinical

tocommercialsettings.Indoing

so,thesepartnershipsalsoblur

thelinebetweenclinical,

research,andcommercial

genomics(seetextbox).25Ifthe

patient’ssequencingwasdone

aspartofafederally-funded

researchstudy,theirdatawill

alsobecomepartofadatabase

depositedwiththeNational

InstitutesofHealth(NIH)and

madeavailableforother

researchers.26Atthispointinthe

lifecycle,individualpatientsno

longerhavecontroloftheir

individualDNAdataandmost

likelywillneverlearntheresults

ofsubsequentanalysesthat

utilizeit.

Insum,thelifecycleofDNAdatashowshowgenomessequencedforindividualpatientcare

becomecriticaltonewresearchdiscoveries,aswellasprofit-makingendeavorsby

entrepreneurialorganizations,throughdatabasecreation,sharing,andreuse.

DataSharingBlurstheLinesBetweenClinicalCare,Research,andConsumerFirmsBecausegenomicsdatabasesareseenasvaluablefora

rangeofpurposes,includingclinicalcare,biomedical

research,andcommercialpurposes,partnershipsare

forgedthatallowdatasharingandreuseacross

organizationsinallthreeofthesesectors.Forexample,

FoundationMedicine–apubliclytradedcorporation–

offersaservicetopatientsandtheirdoctorsinvolving

sequencingcoupledwithtailoredtreatment

recommendationsbasedonthatsequencing.Usingclient

data,Foundationisassemblingagrowingdatabaseof

cancerpatientandtumorDNA,fromwhichithopesto

derivenewinsightsfortailoredtreatments.InNovember

2015,Roche,oneoftheworld’slargestpharmaceutical

firms,acquiredamajorityshareinFoundation,givingit

accesstotheirdatafordrugresearch.Atthesametime,

anotherpartnershiplinksFoundation’sgenomicsdataon

20,000cancerpatientstoFlatironHealth’sclinicaldataon

thedrugs,treatments,andhealthoutcomesofthose

patientsfrommedicalrecords.Theypromiseeventual

publicdisclosureofthesede-identifieddata.Andthrough

ongoingownershipandgovernancecontrolinFoundation,

theconsumertechnologygiantGoogleisalsoaccessing

Foundation’sdatafortheircommercialresearchand

developmentpurposes.

PRIVACYANDSECURITYRISKSATEACHSTEPINTHEDNADATALIFECYCLEGiventhenatureofgeneticdata,andspecificallyhowmuchitcanrevealaboutanindividual

andhisorherfamily,manypeoplemaywanttomaintaintheirprivacyregardingthiskindof

information.However,acrossthisDNAdatalifecycle,manyprivacyandsecurityriskscanbe

identified.Inthissection,weconsidertherisksateachstep,alongwithpotentialremediesthat

mayhelptoamelioratethem.Beforetakingstockofthespecificrisks,itisworthpausingto

considerthemeaningofprivacy,bothingeneralandinthespecificcontextofDNAdata.Inbroadstrokes,privacyinvolvesbeingabletochoosewhatpartsofoneselftodiscloseto

differentaudiences.27AlthoughtheUnitedStateslacksabroadlegalrighttoprivacy,many

Americans,aswellastheUnitedNations,regardadegreeofprivacytobeafundamental

humanright.28

Inthecontextofpersonalinformation,suchasDNAdata,privacymeanshavingcontrolover

thatinformation,suchthatapersoncanconfidentlychoosetodiscloseittoonetrustedparty

foronespecificpurposewithoutconcernthatitwillbepassedtootherpartiesorusedfor

otherpurposes.Maintainingprivacythereforealsologicallyrequiresmechanismstoensurethe

securityofthatinformationwhileitisbeingusedbytheotherparty,preventingunauthorized

disclosureandfurtheruses.Ofcourse,whenanindividual’sinformationbecomespartofa

largerdatabasethatencompassesdataonmanyotherpeople,themaintenanceofprivacyand

securitynolongerdependjustonhowtheirspecificinformationistreated;instead,much

dependsonthepoliciesandpracticesrelatedtothelargerdatabase.29Hence,muchoftherisk

–andpotentialremedy–concerningDNAdatainvolvesthedatabasesandhowtheyare

managed.

Instep1oftheDNAlifecycle,whengenomicdataarecollectedforsequencing,patientsmust

givetheirconsentfortheprocesstobegin.However,theyareunlikelytobefullyawareofthe

pathwaystheirdataaregoingto

travel.Patientsoftenconsentto

sequencingbecausetheirdoctor

hopesitcanhelpintheir

diagnosisandtreatment;that

usageisnaturallytheirpriority.

Butinmostsituations,theirdata

willalsobeaddedtoaDNA

database,andreusedforother

researchandclinicalpurposes.

Patientstypicallysignconsent

formsthatsaytheirdatawillbe

reusedinunspecifiedways(see

textbox).30Givenaninabilityto

trulyanonymizeDNAdata

UpdateonFederalConsentRulesforResearchAJanuary2017updatetotheU.S.CommonRule-which

appliestoresearchprojectsandorganizationsreceiving

federalfunding-hasimplicationsforthetreatmentof

genomicsdata.Theupdateallowsresearcherstobein

complianceiftheyobtain‘broadconsent’from

individualswhosebiosamplesarecollected(asdescribed

above).Analternativeapproach,requiringresearchersto

informindividualsabouteachspecificwaytheirdataare

beingreused,wasrejectedduetotheburdenitwould

haveplacedonresearchers.1Manyclinicaland

commercialgenomicsorganizationsareadoptingthis

broadconsentapproachaswell.

throughde-identification,thatonwardjourneycarriesdisclosurerisksthatriseasmore

individualshandlethedata.Allthoseindividualscouldaccidentallydisclosethedata,or

themselvesengageinitstheft,makingthedataavailabletopartieswhowoulduseitagainst

them.Althoughthoserisksmaybereduced,aswediscussbelow,theycanneverbeeliminated.

TheconsentformsusedbycommercialgenomicscompaniesandotherDNAdataservicestend

tobesimilarlynon-specificindetailingthereusesofanindividual’sdata(seetextbox).31

Whatcanbedonetoenhance

privacyandsecurityofDNA

dataatthisinitialstep?Ata

minimum,duringtheconsent

process,patientsneedtobe

educatedaboutthebenefits

andrisks.Beforeproviding

consentandbeingsequenced,

thepatientcanberequiredto

meetwithageneticcounselor,tolearnaboutthepotentialbenefitsandrisks

associatedwithDNAdata

generationandanalysis–as

wellasaboutthepotential

benefitsandrisksoffurther

sharingandreuseofdata.

Patientscanalsobegiventhe

choicetoopt-outofdatareuselaterinthelifecycle.

Theconsentprocessitselfcan

bemodifiedsothatpatients

areabletochoosethedegree

ofdatabaseinclusionand

furtherusestheywant.For

example,theycouldoptfor

inclusioninthehealthcare

organization’sinternal

database,butnotforfurther

sharingwithexternalpartners.Theycouldalsochoosetoopt-intoreuseininstancesthatthey

personallysupport(forexample,certainmedicalorscientificstudiestheycareabout),butstay

outofreuseininstancestheydonotsupport(forexample,certaincommercialuses).

Withoutsuchgenomiccounselingandopt-outprovisions,consentintheclinicalsetting

representsanindividuallossofcontrolandcreatespotentialprivacyrisks.Atthesametime,it

isimportanttorecognizethattheseprovisionswouldcomeatanon-trivialcost.Inparticular,

ExcerptsfromacommercialgenomicsconsentformThecompany23andMe,whichsharesgenomicdatainsome

formwithmorethanadozenotherentities,providesits

customerswithaconsentform,privacystatement,and

terms-of-service.Theirconsent“keypoints”500-word

summarydescribessomeaspectsoftheirgenomicdata

sharingandassociatedrisks:

“23andMeresearcherswhoconductanalyseswillhaveaccesstoyourgeneticandotherpersonalinformation,butnottoyourname,contact,orcreditcardinformation.”“23andMemaysharesomedatawithexternalresearchpartnersandinscientificpublications.Thesedatawillbesummarizedacrossenoughcustomerstominimizethechancethatyourpersonalinformationwillbeexposed.”The23andMeprivacyformelaboratesondatasharing:

“Wemayshareanonymizedandaggregateinformationwiththird-parties;anonymizedandaggregateinformationisanyinformationthathasbeenstrippedofyournameandcontactinformationandaggregatedwithinformationofothersoranonymizedsothatyoucannotreasonablybeidentifiedasanindividual.”Thelongerterms-of-serviceformalsostates:

“GeneticInformationthatyousharewithfamily,friendsoremployersmaybeusedagainstyourinterests.EvenifyoushareGeneticInformationthathasnoorlimitedmeaningtoday,thatinformationcouldhavegreatermeaninginthefutureasnewdiscoveriesaremade.”

researcherswouldlosethefreedomtoeasilyre-analyzethedatathatcamefromindividuals

whoopted-out.Afurtherissueisthetreatmentofinfantsandchildreningenomicsdatabases.

Theseminorscannotprovideinformedconsent,butaftersequencingintheclinicalsetting,

theirdataisbeingreusedinthesamewaysthatadultgenomicdataisbeingreused.

Insteps2and3,datasecurityriskscometothefore,asactivitiesrelatedtothestorageand

handlingofDNAdatapresentmanypointsofvulnerability.Althoughhealthcareorganizations

arerelativelysophisticatedwhenitcomestoprotectingpersonalhealthdata,becauseofHIPAA

laws,nonethelesstheyarefrequenttargetsofattack,andsufferfrequentdataspills.Indeed,

90%ofhealthcareorganizationsandassociatedfirmsrespondingtoa2016Ponemonsurvey

reportedtheyhadexperiencedadatabreach,and64%reportedabreachthatinvolvedleaking

patientmedicalrecords,injustthelasttwoyears.32Itistooearlytoknowabouttheoccurrence

ofgenomicspills,buttheyarelikelytobeoccurringnowandinthenearfutureaswell.Inone

recentincident,QuestDiagnostics,whichhandlesgenomicsdataforalargeIBMWatson

initiative,reportedamajorspillofpatientlabdata(seeinset).33

Forgenomicdatamanagement,therearemanyhardwareandsoftwareoptionsforthestorage

andtransitofDNAdata.Datacanbestoredonanorganization’slocalserversorinacloud

servicesuchasAmazonWebServicesorGoogleCloud.Datacanbemovedviadedicated

internalcableswithinanorganization,orovertheInternet,orphysicallyviaportablehard

drives.ForDNAdatathatisstoredonly(orlargely)inthecloud,datatransitcanbelimited

throughcloudcomputingpractices,essentiallyrequiringanyanalysissoftwaretobe“brought

tothedata”inthecloudratherthanthedatabeinganalyzedbysoftwareonalocalmachine.

Eachofthesealternativedatamanagementoptionscanbemaderelativelymoresecureusinga

numberoforganizationalbest-practices:

• Encryption:Ensuringthatdataisencryptedintransitandatrest• Authentication:Verifyingtheidentityofindividualsaccessingthedata.Two-factor

authentication,involvingatokensenttoamobiledeviceorkeyfob,providesadditional

validation.Forsensitivedata,in-personauthenticationcouldberequired.

• Authorization:Narrowingthenumberofpeoplewithaccesstodatabasedonthe

projectortask,andlimitingthedurationofthataccess.

• Monitoringandauditing:Assessingandimprovingsystemsecurity,andtrackingdetails

ofuse,unauthorizeduseandcompliance.Routinevulnerabilityassessmentsand

penetrationtests.Usingablockchainlegersystemmaybeonewaytoverifyhistoryof

dataaccessthroughoutlifecycle.

• De-identification:Strippinganindividual’sidentityfromtheDNAdataisuseful,butit

doesnotachievetrueanonymizationinmanycircumstances(aswediscussedabove).

“QuestDiagnostics,aNewJersey-basedmedicallaboratorycompany,disclosedadatabreachaffectingabout34,000peopleonMonday.Digitalintrudersstolepersonalandmedicalinformationofcustomers—includingnames,datesofbirth,labresults….AttackersgainedaccesstothedataonNovember26throughanimproperlysecuredmobileappthatletspatientsshareandstoreelectronichealthrecords.”

Beyondthesecurrentbest-practices,therearealsoeffortstoallowuserstoquerydatabasesas

totheircontents,andtoaggregateandanalyzedataacrossmultipledatabases,allwithout

exposingtheusertotheactualunderlyingdata.However,theseeffortshaveproventobe

challenging.Forexample,in2015a“beacon”systemwasdevelopedbyGlobalAlliancefor

GenomicHealth(GA4GH)toallowpeopletoquicklyquerymanydatabases(viatheirbeacons)

aboutwhethertheycontainindividualswithcertainspecificvariants.However,thissystemwas

quicklyshowntobevulnerabletore-identificationattacks.34Inanotherexample,“Datashield”

softwarewasdevelopedtoallowpooledstatisticalanalysesacrossmanygenomicdatabases,

returningpooledresultswithoutrevealinginformationaboutanyspecificdatasetthatwent

intothepooling.35

Atthesametime,despitethesetechnologicalprotections,alltheseoptionsarevulnerableto

risksthatarisethroughhumancompliancebehavior.Ingeneral,manydataspillsresultfrom

(non-)compliancebehavioramongindividualswhoareauthorizedtousesensitivedata.36

Carelessnessandtheftbyemployeesposeseriesriskstodatamanagement.Minimizingsuch

behavioralthreatstodataprivacyandsecurityarebesthandledthroughrobuststaffscreening

andtraining,coupledwithsanctionsforemployeesandsubcontractorswhoviolatepoliciesand

procedures,andphysicalworkplacesecurity.Indesigningtrainingandsanctions,itiscriticalto

recognizethatastheintrinsicvalueofagenomicsdatabaseincreases,sodoesthefinancial

temptationforinsiderstobecomeinvolvedinadataspill.

Instep3,datasecurityrisksalsoariseasphysiciansandothercliniciansshareindividualpatientgenomicdataandinterpretationswithcolleaguesinthecourseoftheirwork.Outofadesireto

helptheirpatients,physiciansandotherprovidersoftensearchforotherpatientswhoseDNA

variantsandclinicalsymptomsappearsimilartothepatienttheyaretreating.Inthisprocess,

theywillsharedataaboutapatientwithotherclinicians,andrequestthatthesecliniciansshare

dataonotherpatientswiththem.Intheeraofgenomicsequencing,thissharingcaninvolve

genomicdata–variantlists,interpretations,genomesnippetsorsectionsofinterest,oreven

wholeexomeorgenomedata.Inthisprocess,cliniciansareoftenmotivatedtoactquicklyand

efficiently,givenboththeirprofessionaldesiretohelpasufferingpatient,andtheirownbusy

schedules.

Theseforcesincreasetheincentivetoshareapatient’sgenomicdata,alongwithother

personalhealthinformation,inamannerthatisnotsecure.Inparticular,theelectronic

communicationplatformsusedforthispurposeareanimportantconsideration.Inrecent

years,ithasbecomeincreasinglycommonforphysicianstoshareinformationfromtheir

mobiledevices,usingemail,text,orappsthatdonotcomplywithHIPAArequirementsfordata

security,andthishasbeenamajorcauseofhealthdatabreaches,asintheQuestdatabreach

reportedabove.37Mobilecommunicationstransmittedoverwirelessnetworkscanbe

particularlyvulnerabilitytointerception.Whengenomicdataislinkedwithotherpatient

information,itisclearlysensitive;eveninisolation,aswehaveshown,genomicdatamustbe

treatedwithcare.

Henceallcommunicationofpatientdataneedstotakeplaceusingasecureplatform–onethat

complieswithHIPAArequirements,maintainingencryptionintransitandatrest.Ofcourse,this

posesacomplicationforsharingamongclinicianswhodonotusethesamesecureplatform.

Andthesecurityofthesecommunicationsisstilllimitedbytheextenttowhichcliniciansare

compliantinmaintainingthesecurityoftheirownmobiledevices.

Step4involvestheDNAdata’sonwardjourneybeyondtheoriginalsettingandpurposeforwhichitwasgenerated.Inmanyways,thissteprepresentsthegreatestrisk.Thedatais

changinghandsandmovingacrossorganizationalboundaries,beingentrustedtomore

individuals,exposedtomultipleorganizationalpoliciesandroutines,allofwhichincreasethe

chancesofloss,accidentaldisclosureortheft.OrganizationsreceivingDNAdatamayhave

differentgoals,andtheiremployeesmaybesubjecttodifferentprivacyandsecuritypractices,

andthesedifferencesmaygrowwiththepassageoftime,asillustratedinarecentcourtcase

involvingDNAcollectedformedicalresearch(seetextbox).38

Whengenomicsdatabasesareshared

acrossorganizationalboundaries–i.e.

whendataisbeingtransferredtoreside

inanotherorganization,ordataaccess

isbeingprovidedtomembersof

anotherorganization–thereneedsto

beanaccountabilitystructurethat

ensuresdataprivacyandsecurityinthe

receivingorganization.Anobvious

templateforthisaccountability

structureisprovidedbyHIPAA.Under

HIPAA,afteritwasupdatedwiththe

2010HITECHAct,whenahospitalor

healthcompanysharesdatathat

containspersonalhealthinformation,

thereceivingorganizationhastosigna

HIPAABusinessAssociate(BA)contract,inwhichtheyagreetoasetofdata

privacyandsecuritypracticesthat

largelymirrorthoserequiredwithinthehospitalorhealthcompanyitself.TheBAentity

becomesliableforrespondingtodatabreachesaswell.SuchBAcontractsaresignedbythird-

partyorganizationsforinsuranceclaimsprocessing,hospitalconsultants,andeven

transcriptionistshandlingpersonalhealthinformation.Suchanapproachdoesnotapplyto

genomicsdata,butitcould.

Asintheprimaryorganization,datasecuritypracticesintheorganizationsthatreceiveaccess

toshareddatashouldalsobesettoahighstandard.Ifdataaretransferredtoapartner

organization,themanagementofgenomicsdataatthatpartnerorganizationnaturallypose

risksthataresimilartothoseweinventoriedaboveinsteps2and3.Inparticular,thereare

AcourtcaseinvolvingdisputedDNAdatareuseIn1993,DNAsamplesfrommembersofasmall

AmericanIndiantribe,theHavasupai,were

obtainedformedicalresearchpurposes,using

broadconsent.Theinitialstudyapprovedbythe

tribeinvolveddiabetes,butsubsequentlythe

DNAdatawereusedbyotherresearchersin

otherstudies,ontopicsrelatedtomentalhealth,

migration,andinbreeding.In2003,atribal

memberlearnedaboutotherresearchwhile

attendingauniversitylecture,leadingtoa

lawsuitthatwasultimatelysettledoutofcourtin

2010.Issuesinthelawsuit,ArizonaBoardofRegentsv.HavasupaiTribe,includedlackofinformedconsent,violationofcivilrights,

unapproveduseofdata,andviolationofmedical

confidentiality/re-identification.

databreachrisksarisinginthestorageanduseofthedata,regardlessofwhetheritisphysically

locatedonlocalserversorinthecloud,andwhetherornotitismovedbetweenlocationsover

theinternet.Thesameorganizationalbest-practicescanhelpmitigatethoserisks.Ifdataisnot

transferred,butaccessisprovidedtomembersofapartnerorganization,thenthesamehuman

compliancebehaviorconcernsariseforthosepartnerorganizationemployeeswhoaregiven

access.

Theseverityofconcernswithgenomicdatabasesharingwasunderscoredintheconclusionsof

arecentassessmentbytheAmericanAssociationofArtsandSciences(AAAS)andtheFederal

BureauofInvestigationonthistopic(seeinset).39

“Beyondaccesscontrols,encryption,andothercommondataandcybersecuritytechnologies,nosolutionsexistthatpreventormitigateattacksondatabasesorthecyberinfrastructurethatsupportBigDatainthelifesciences,whichcouldresultinconsequencestothelifescience,commercial,andhealthsectors.”

Whatfactorsarelikelytobeassociatedwithanincreasedriskofprivacyandsecurity

compromiseinpartnerorganizations?Researchontheincidenceofwrongdoingandaccident

eventsinorganizationalandscientificfieldsprovidesausefulguide.40Inparticular,theresearch

suggestsheightenedriskwhendatasharingincludes:

• Emerginginnovators.Smallandrecently-foundedorganizationstendtolackthe

resources,experienceandscaletohavedevelopedandfundedinternalcompliance

systems.Andthecultureofinnovationinemergingventuresoftenencouragesbreaking

withindustryrules.Examplesofemerginginnovatorsincludenewspecialized

sequencinglabsandbioinformaticsfirms,consumer-facingstartups,andcitizen-science

organizationsthatlackfundingandexperience.(Ofcourse,largerorganizationsmaybe

morevisible,tohackersaswellaseveryoneelse,butsmallerorganizationstendtobe

morevulnerable.)

• Organizationsbasedinweakerregulatoryjurisdictions.Examplesincludecommunity

hospitalsandmedicalofficesthathavenotpreviouslyengagedinclinicalresearch,

whichcouldfalloutsidefederalCommonRulejurisdictionandlackIRBexperience.

Otherexamplesincludecommercialgenomicscompaniesandpatientadvocacy

organizationsthatdonothandlepatientmedicalrecords,implyingtheyfalloutside

HIPAAjurisdictionandlackexperiencehandlingsensitivepatientdata.Partner

organizationsmayalsobebasedinstatejurisdictionswithlooserregulations.41An

extreme(butcommon)exampleispartnerorganizationsbasedoutsidethelegal

jurisdictionoftheUnitedStatesaltogether.Forexample,amajorU.S.genomics

company,HumanLongevityInc.,recentlyformedpartnershipswiththeBritish-Swiss

pharmaceuticalfirmAstraZenecaandtheSouthAfrica-basedhealthandlifeinsurance

companyDiscoveryLtd.42

• Useofpartnersandoutsidecontractors.Asthenumberofpartnerorganizationsincreases,

accountabilitystructuresbecomedecentralized

andmorediffuse,andthereisagreaterchance

thatcompliancestandardswillconflictbetween

organizations.Morepartnersalsoadd

complexity,whichincreasesthechancefor

errorsorgapsinprocedurethatcreate

vulnerabilities.Forexample,aclinical

organizationmayhavecrisscrossing

partnershipswithpharmaceuticalcompanies,

genomicsstartups,academicresearchers,and

patientadvocacygroups–allofwhichare

commoninthegenomicsfield.Databrokersare

alsousedtosharegenomicdata,addinganother

layeroforganizationalcomplexity(seetextbox).43

• Linksbetweenfor-profitandnon-profitentities.Thesepartnershiparrangementswill

mixconflictinglegaljurisdictions,andtheyarealsolikelytomixconflictingfinancialand

societalobjectives.Thosefactorsincreasethechancesthatcompliancestandardswill

differ,andcomplicatecomplianceoversight.

• Organizationsexperiencingrapidchange.Organizationsthatarerestructuring,mergingorbeing

acquired,rapidlyexpandingor

contracting,experiencingfinancial

hardshiporgoingthrough

bankruptcyareallmorelikelyto

experiencebreakdownsandgapsin

compliance,asstandardoperating

proceduresaresuspended(seetext

box).44Theyarealsolikelytohave

increasedstaffturnover,bringingan

elevatedriskfornewlyhired

employeeswholacktraining,and

outgoingemployeeswhomaybe

morewillingtoretaliateagainst

theirformeremployer.

Professionaltraining.Acrosstheentirelifecycle,thereisabroadneedforclinicians,bioinformaticians,andotherswhohandlegenomicdatatobetrainedintheprivacyand

securityrisksassociatedwiththesedata.Currently,theprimaryvehicleforthisisemployee

training–ahighlydecentralizedandthereforeunevenvehicle.Educationalinstitutionscanalso

GenomicDataBrokersInresponsetogrowingdemandfor

humangenomicdata,anewcropof

start-upcompaniesisservingasdata

brokers,offeringtopayindividualsfor

accesstotheirgenomicdata,whichthe

brokerthensellstoresearchstudies.

Oneexampleofthisbrokerfunction,a

startupventurecalledDNASimple,

offerstogiveconsumerscontrolover

whichresearchstudiestheirdataare

givento,andtolaterdestroya

customer’sdataupontheirrequest.

Whathappenstoagenomicsdatabaseinbankruptcy?Asgenomicsdatabasesproliferateintheprivate

sector,thequestionarisesconcerninghowthey

wouldbetreatedinabankruptcyproceedings.

Althoughpersonaldataispartlyprotectedunder

FederalTradeCommissionrules,andenforcedby

stateconsumerprotectionauthorities,thisdoesnot

stopthesaleofgenomicdatatoanotherentity

duringbankruptcy.Theruleofthumbisthat

whateverprivacypoliciesthebankruptcompany

hasinplacewillhavetobereplicatedintheentity

thatthatbuysthedata.HIPAAcanalsoconstrain

thesaleofpersonalhealthdata,butde-identified

genomicdatawouldprobablybeexemptfromthis

constraint.

playanimportantrole,byincorporatingprivacyandsecuritytopicsintothecurriculumof

degreeprogramsinmedicine,bioinformatics,andrelatedfields.Thereisalsolikelytobeaneed

forcommercialtrainingprograms,andadvisoryservicestohelpdisseminateandestablishbest-

practicesinorganizationaltrainingprogramsacrosshealthcareorganizations.Manypracticing

physicians,forexample,willneedcontinuingmedicaleducation(CME)relatedtogenomicsin

comingyears,representinganopportunitytoensuretheyareexposedtoprivacyandsecurity

concerns.

Self-regulationintheprivatesector.Marketforcesandself-regulationcanplayanimportant

roleinreducingtheserisks.Yetintheabsenceofanexternalaccountabilitymechanism,self-

regulatingmarketactorsonlybearpartofthecostofagenomedatabreachthatoccurs.

Instead,furthercostsareshoulderedbyindividualswhosedataaredisclosed(andtheirfamily

members,whosedataareindirectlydisclosed),whoincurharmifthosedataareusedagainst

themsubsequently.Throughthislens,genomicdata-spillrisksareanegativeexternalitythat

maymeritregulation.45Whilethethreatofcompetitionortheftfromrivalsshouldincentivize

genomicdatabasesecurity,atthesametimecompetitivepressureincreasestheincentiveto

enterpartnershipstoacceleratediscoveryaheadofcompetitors-increasingthedatasharing

risksposedbythosepartnerships.

Publicdatasharinginitiatives.Inthepublicsector,commitmentstoopenscienceareaimedat

acceleratingscientificadvances.Theseinitiatives,whilelaudable,alsoposeriskstotheextent

thatpublicsharingofgenomicdatasetsincreasetheirexposure.Forexample,agenomic

databaseofcancerpatients,linkedtotheirmedicalrecorddata,wasrecentlyreleasedbythe

AmericanAssociationforCancerResearch,incollaborationwithSageBionetworks,forpublic

researchaccess.Whiledataprivacyprovisionswereincludedinthedesignofthepublicdata

release,itremainstobeseenwhetherthesedataarevulnerabletodisclosureand

reidentificationattacks.46Onalargerscale,theNationalInstitutesofHealthcollectsgenomics

dataintoseveral

centralizedarchives

designedforsharing

andreusebyother

researchers,increasing

thebenefitsaswellas

therisksofdatareuse

(seetextbox).47

CentralizedCollectionandSharingofU.S.HumanGenomicsDataThecentralcollectionandintegrationofmanydatabasesoccurs

withinasinglepublicsectorentity,theU.S.NationalCenterfor

BiotechnologyInformation's(NCBI)databaseofGenotypesand

Phenotypes(dbGaP).Suchcentralcollectionsmaybringadditional

exposurerisksassociatedwiththescaleofthedatabaseandthe

numberofsharingeventstobemanaged(20,178approveddata

requestsasofJuly1,2015).ThedbGaPdatabasehasalready

experiencedseveralknowndatasecurityincidents,andislikelyto

beatargetforfuturehacking.Thereareotherrisksassociatedwith

unintendedfutureusesofsuchdatacollections,includingfuture

governmentalreuse,includingreuseforforensicinvestigation,to

identifyvictimsinthewakeofmasscasualtyevents,forcitizenship

verification.

THEBIGPICTURE:WENEEDGREATERSOCIETALATTENTIONTOPRIVACYANDSECURITYOFGENOMICDATA

Genomicsoffersboldpromisesforrevolutionizingmedicineasweknowit—andsomeofthose

promisesarealreadybeingrealized.Therearetremendouspotentialbenefitsfromgenomics,

revealingnewlife-savingandlife-enhancingdiscoveriesforprecisionmedicalcare.Genomics

databaseswillplayanimportantroleinachievingthosebreakthroughs.Atthesametime,we

alsoneedtobeappreciatetheseriousrisksthatthedisclosureofsequencedDNAresultspose

forindividuals.

Ifindeedthegenomicsfieldisatacriticalinflectionpoint,asmanybelieve,thenthisisacrucial

pointforustowrestlewiththetensionsinherentinpromotingfutureresearchwhileatthe

sametimesafeguardingindividualprivacy.Thelifecycleviewweofferedinthispaper–showing

howDNAdataisgeneratedandprocessedforuseinprecisionmedicine–identifiespotential

riskstoprivacyandsecurityateachstep.Ourintentioninsettingoutthislifecycleperspectiveis

toprovideacautionarytale,indicatingwheredatabreachescouldoccurinclinicalpractice,

despitebreachpreventioneffortscurrentlyemployed.

ShouldwebehavingbroaderpublicdeliberationabouthowDNAprivacyandsecurityissues

canbestbeaddressed?Whatisthepublic’sroleinrealizingthetwingoalsofaccelerating

discoveryandtreatment–whileensuringthatprivacyandsecurityarerespected?This

discussionshouldincludeallrelevantstakeholders–notjustthosewhoarealreadyinvolved

andinvestedinthecurrentgenomicsfield,butalsorepresentativesofthoseordinarycitizens

whoaresoontobeaffectedbythegenomicsrevolution(whethertheylikeitornot).

Ouranalysisrevealedthreefundamentalquestionsthatwebelievewarrantbroadsocietal

reflectionanddeliberationifwearetoreachforthepromiseofmedicalgenomicswhile

simultaneouslymitigatingrisksofdisclosure.Explorationofthesequestionsshouldbeatthe

coreofpublicdeliberationsabouttheprivacyandsecurityofgenomicdata.Thereareofcourse

manyotherpressingquestions–involvinglegal-regulatoryframeworks,economicimpacts,and

nationalinterests,amongotherthings.Butwebelievethesethreequestionsshouldtake

prioritybecausetheystartfromarecognitionofthefundamentalnatureofthegenome.

ThreeFundamentalQuestions

Question#1:“Whoshouldhavetherighttomakedecisionsaboutyourgenome?”Thetensionunderliningthisquestionpitsindividualvs.societalrights.Basically,thequestionis

towhatextentcanIcontrolwhathappenstomysequencedDNAresults?Althoughnoone

“owns”theirDNAdata,anindividual-centricapproachtoDNAdatameansthatindividuals

retaincontroloverwhentheirDNAdataisextractedandtowhatusesitisput.Presumablythis

wouldentailindividualsmakinginformeddecisionsaboutwhentheychoosetobesequenced,

whattheirsequenceddatacanbeusedfor,andunderwhatcircumstancestheirdatacanbe

usedbyothers.Whilethisisthepurposeofinformedconsent,atthetimethatconsentisgiven,

individualsareaskedtoagreeto-butcannotpossiblyfullyappreciate-thepotential,unnamed

usestowhichtheirdatamaybeputinthefuture.Indeed,thecurrentcommonpracticeof

obtaining“broadconsent”limitsindividualcontrolfurtherbyrequiringpeoplebeingsequenced

toagreetoabroadrangeofunspecifiedfuturereuseandsharingscenarios.

Themostobviousanswertothisquestionfromaprivacyandsecurityperspectiveisthat

individualsoughttoretaincontrolovertheirDNAanditsuse.However,aswenotedabove,

therearemanyresearchandcommercialorganizationsthatdependonlargedatabasesofDNA

datatodotheirwork.“Nearlythree-quartersofallgenomicscompaniesprovidetools(both

physicalandinthecloud)topharmaceuticalcompaniesandacademicresearchinstitutions.”48

Inaddition,medicalorganizationsarescramblingtobuildbigger(andbetter)DNAdatabasesto

enablenewresearchandimprovedclinicalpractice,andtheNationalInstitutesofHealth

activelypromotethesharingofDNAdatabaseswhenfundinginnovativemedicalresearch.

JustastheHeLacelllinethatoriginatedfromHenriettaLackswasinstrumentalinadvancing

biomedicalresearch,49thesesequencedatabases–inthiscaseoriginatingfrommanypeople

ratherthanjustone–arelikelytobeinstrumentalforprogressinmedicineandhealthcare.

Indeed,creatingandsharingthesedatabasesisbelievedtobecriticalforsuccessintheWhite

HousePrecisionMedicineInitiative,theCancerMoonshot,andthe21stCenturyCuresAct.

acompellingcounterargumenttoindividualcontrolisthatimplementingfullindividualcontrol

couldgrindgenomicresearchtoahalt,andgreatlyslowprogressinmedicineandscience.In

thisview,thescientificcommunityshouldbeempoweredandtrustedtodecidehowindividual

genomicdatashouldbeused,becausetheyarebestpositionedwiththerelevantexpertiseto

weighthepotentialbenefitsandcostsofitsuseoverall.

Everydaycitizensshouldhavecontroloftheusesoftheirowngenomicdata

ThescientificcommunityshoulddecidehowDNAdatabasesarehandled vs

Question#2:“Howcloselyshouldyouholdontoyourgenome?”HowproprietaryindividualsfeelabouttheirsequencedDNAdatarunsthegamutfromthose

whowanttozealouslyguardittothosewhoarewilling,andeveneager,tocirculateitfreely,

eitherunawareoforindifferenttopotentialfutureriskstothemselvesandtheirfamilies.Still

othersciteasenseofinevitabilityofwidely-sharedDNAdataandeventhepotentiallikelihood

ofpeerpressuretoshareitthatcouldemanatefromsuspicionthatthosewhodonotmustbe

hidingdamagingevidenceabout

themselves.Indeed,withinaculture

ofwidespreaddisclosureofpersonal

datathroughsocialmedia,arguingin

favorofprivacymaybealosing

battle.Thereareevenpersuasive

argumentsthatundersome

conditionstheremaybeaobligation

torevealyourgenomicinformation

(seetextbox).51

Still,ifthesocietalresponseto

question#1isthatindividualsshould

havetherighttoprotecttheirown

DNAfromusebyothersand,instead,

retainitasatreasuredprivate

possessionthatshouldbekept

secureinadigitalsafetydepositbox,

thenattentiontohowwearegoing

toenablethatisneeded.Ata

minimum,thisdeservesaninformed

publicdiscussion,whichbringsustothethirdquestion.

DNAdataisjustanotherbitofpersonaldatatosharewith

relativeopennessduringawiderangeofsocialtransactions

DNAisatreasuredpossessionthatneedstobekeptsecureinadigitalsafetydepositboxvs

ADutytoRevealYourGenome?Genomicdataoftenprovideinformationofrelevance

torelatives,includinginformationaboutincreased

diseaserisk,andbiologicalparent/child/siblingstatus.

Thisisgivingrisetoarangeofunsettledethicaland

legalquestions.Underwhatconditionsdoesthis

informationcreateadutyforanindividualtoactually

revealinformationfromhisorhergenomicdatato

relativeswhoareimpacted?Andbeyondthat

individual,couldaphysicianorothercliniciantreating

boththepersonsequencedandhisorherrelatives

haveadutytoinformtherelatives?What

responsibilityisbornbythesequencinglabs,research

organizations,ormedicalorganizationsthatacquire

andstorethisinformation?Beyondethical

considerations,couldtheseactorsbeexposedto

claimsofnegligence,malpractice,orotherlegal

liabilities?

Question#3:“Whatstandardsaredesirableforsecuringgenomicdatabases?”Theprivacyconsiderationsnotwithstanding,aswehaveshownabove,therisksofdata

breachesofsequencedDNAdataremainasrealpossibilitieseitherbecauseofhuman

ignoranceorcarelessnessinthehandlingofDNAresultsornefariousactivitiessuchastheft

throughhacking.WithsequenceddataonlyfallingunderHIPAAprotectionsonceitislinkedto

apatient’smedicalrecord,thepotentialforunsecuretransmissionofthesedataaccidentallyor

intentionallyisgreaterthanzero,andthepotentialforre-identificationofanonymizeddata

certainlyexistsandbecomesevenhigherwhenthedataislinkedtohealthrecords.

Asourlifecyclemodelshows,DNApassesthroughalotofhandsinitstrajectoryfrom

collectiontoreuse.TheresponsibilityforsecuringDNAcurrentlyfallstothoseindividual

organizationsdoingthesequencing,interpretingtheresults,presentingthemtopatientsor

reanalyzingbigDNAdatabases.Whiletechnicalprotocolsforensuringdatasecuritysecureare

available,theyonlyworkasdeterrentsiforganizations(andtheiremployees)areassiduousin

theiruseandenforcement.Anunansweredquestionthatremainsiswhetherspecificstandards

(similartoHIPAA)forthehandlingof

genomicdataareneededatasocietallevel

toensurethatindividualorganizations

takethisresponsibilityseriously.Those

whoopposesuchregulations(suchas

researchagencies)makethereasonable

claimthatstrictregulationswillslowthe

progressinrealizingthepromiseof

genomics.

Couldamodelforbestpracticesinthe

privacyandsecurityofsensitivedataexist

inanotherindustry?Someobservers

believethefinancialservicesindustrymay

provideaninstructiveexample(seetext

box).52

Tightmonitoringoftheuseofgenomicdatabaseswillhelpprotectindividualandfamily

privacy

Unrestricteddatabaseswillhelpournationbeatthe

forefrontofgenomicscienceandinnovation

LearningfromtheFinancialServicesIndustry?Theexperiencesoftheinvestmentbankingsector

couldprovideadegreeofroadmappingfordata

policiesandpracticesinthefieldofmedical

genomics.Financialservicefirmshandlelarge

volumesofsensitivecustomerdata,andshare

dataacrossinstitutionsonaregularbasis.A

combinationofgovernmentregulationand

voluntaryinitiativeshaveledtorelativelyuniform

andrigorousdatasecuritypracticeswhich,thus

far,appeartohavelimitedthescopeandsuccess

ofdatabreaches.Asinvestmentbanksadapt

practicesfornewtechnologicalplatforms,

includingcloudcomputingandmobileaccess,

theremaybevaluablelessonsformedical

genomics.

WhatActionisNeededNow?

Answeringthesequestionswillrequirecareful,well-informedsocietaldeliberationatthe

broadestlevelpossible.Thebestwaytoincludemanystakeholderswithalegitimateinterestin

genomicdataisthroughapublic,collaborativeexplorationofthesequestionsandhowbestto

resolvethem.Asasociety,weneedtoconsiderhowbesttostructuresuchadialogueto

ensurethatallinterestedstakeholders(patients,familymembers,clinicians,researchers,

insurers,advocacygroups,businesses,regulatorsetc.)canthoroughlyexploreanddebate

alternativescenariosforhowtosafeguardtheprivacyandsecurityofDNAdata.

*Abouttheauthors:Wearesocialscientistswhostudythedevelopmentandtransformationof

industriesandscientificfields.Weteachandconductresearchontheemergenceofnew

standardsandpracticesinthesefields.Ourresearchhasaddressedquestionssuchas:Howdoa

diversesetoforganizationsinafieldcometoagreeoncollectivestandardsandgovernance

procedures?Howdotherisksandbenefitsofnewtechnologiesandpracticescometobe

perceivedandcommunicatedamongtheseorganizations?Howdovoluntaryindustry

associations,formalstateregulations,andsocialmovementsinfluencethisprocess?What

facilitatescollaborationwithinscientificcommunities?Andwithinorganizations,whatarethe

structuralandleadershipcharacteristicsthataffectadoptionofnewstandardsandpractices?

Webothhaveundergraduatedegreesinscience,anddoctoratesinsocialscience–specifically

thefieldofManagement&Organization.

Wewrotethiswhitepaperbecause,fromourvantageassocialscientistswhostudyfield

transformation,webelievethefieldofmedicalgenomicsisinawatershedmoment.Manyof

theissuesthefieldfacesinvolveethicaldecisionswithuncertainoutcomesformany.Given

thesestakes,wealsobelieveitisimportanttoincreasepublicunderstandingandinvolvement

indecisionsaboutthestandardsforthisrapidlydevelopingfield.Eventhoughtheissuesare

complexandtechnical,weneedtheinvolvementofbothinsidersandoutsiders.Wehopeto

stimulatewidespreaddiscussionoftheissuesraisedhere.

Wecanbereachedatfbriscoe@psu.eduandb9g@psu.edu.

APPENDICES:Examplesofgenomebrowsers

USCSGenomeBrowser

http://genome.ucsc.edu

OmicsoftGenomeBrowser

http://www.omicsoft.com/genome-browser/

APPENDIX:ExamplesofIndividualGenomicsReports

MedicalGenomics(GenomicsAdvisor)

http://projects.iq.harvard.edu/smartgenomics

MetagenomicProfile(BiomeOrganisms)

https://www.onecodex.com

ICBBreederTool(CanineGenomics)

http://www.instituteofcaninebiology.org/blog/the-icb-breeder-tool-available-now

ENDNOTES1Thispaperisbasedonin-depthinterviewswithmorethan25leadersinthegenomicsfield,

andreviewofover200archivaldocuments,conductedduringthefallof2016.Ourinformants

includedleadersingenomicsbiomedicalresearch,clinicalhealthcaredelivery,healthcare

regulation,commercialgenomics,venturecapital,datasecurity,researchoversight.2Theshiftinmedicalterminologyfrom“genetics”to“genomics”reflectsashiftfromtheuseof

tailoredgenetictestsforspecificmutationstowardtheuseofsequencingtechnologyto

generatedataonaperson’swholegenome(orsignificantsectionsofit).3Battelle2013report:“TheImpactofGenomicsontheUSEconomy.”

http://web.ornl.gov/sci/techresources/Human_Genome/publicat/2013BattelleReportImpact-

of-Genomics-on-the-US-Economy.pdf4Topol,E.2015.Thepatientwillseeyounow:Thefutureofmedicine.Philadelphia:PerseusBooks.5ExamplesofspecificinitiativesintegratinggenomicsintoclinicalcareincludeKaiser

Permanente’slungcancerinitiative(https://share.kaiserpermanente.org/article/new-clinical-

trials-use-genetic-testing-to-personalize-lung-cancer-treatment/),GeisingerHealthSystem’s

autisminitiative(http://www.geisinger.org/for-researchers/initiatives-and-

projects/pages/simons-vip.html),InterMountainHealthcare’sPrecisionGenomicsCancer

Initiative(https://intermountainhealthcare.org/services/cancer-care/precision-

genomics/research/),PartnersHealthCare’sserviceforpatientswithsuspectedbut

undiagnosedraregeneticdiseases(http://personalizedmedicine.partners.org/laboratory-for-

molecular-medicine/tests/genome.aspx),andtheTexasMedicalCenter’sClinicalCancer

GeneticsProgramwhichcoordinatesgenetictestingandhigh-riskcancersurveillancefor

familieswithhereditarycancersyndromes(https://www.mdanderson.org/prevention-

screening/family-history/hereditary-cancer-syndromes.html).Severalhospitalsandmedical

centersareparticipatingintheNIH-fundedElectronicMedicalRecordsandGenomics(eMERGE)

Networkinitiativetointegrategenomicsandpatientmedicalrecordsintoclinicalcare

(https://www.genome.gov/27540473/electronic-medical-records-and-genomics-emerge-

network/).6PrecisionMedicineWorldConference,ClosingPanel,January24,2017,MountainView,CA.

7Schwartz,P.J.,Crotti,L.,&Insolia,R.(2012).Long-QTsyndromefromgeneticsto

management.Circulation:ArrhythmiaandElectrophysiology,5(4),868-877.8FDADrugSafetyCommunication:ReducedeffectivenessofPlavix(clopidogrel)inpatientswho

arepoormetabolizersofthedrug.http://www.fda.gov/Drugs/DrugSafety/PostmarketDrugSafetyInformationforPatientsandProvid

ers/ucm203888.htm;DeanL.WarfarinTherapyandtheGenotypesCYP2C9andVKORC1.2012

Mar8[Updated2016Jun8].In:MedicalGeneticsSummaries[Internet].Bethesda(MD):

NationalCenterforBiotechnologyInformation(US);2012-.Availablefrom:

https://www.ncbi.nlm.nih.gov/books/NBK84174/9Cooperberg,M.R.,Davicioni,E.,Crisan,A.,Jenkins,R.B.,Ghadessi,M.,&Karnes,R.J.(2015).

Combinedvalueofvalidatedclinicalandgenomicriskstratificationtoolsforpredictingprostate

cancermortalityinahigh-riskprostatectomycohort.Europeanurology,67(2),326-333.

10Grupp,S.A.,etal.(2014).Tcellsengineeredwithachimericantigenreceptor(CAR)targeting

CD19(CTL019)havelongtermpersistenceandinducedurableremissionsinchildrenwith

relapsed,refractoryALL.Blood,124(21),380-380.11Stranger,B.E.,Stahl,E.A.,&Raj,T.(2011).Progressandpromiseofgenome-wide

associationstudiesforhumancomplextraitgenetics.Genetics,187(2),367-383.Robinson,M.

R.,Wray,N.R.,&Visscher,P.M.(2014).Explainingadditionalgeneticvariationincomplex

traits.TrendsinGenetics,30(4),124-132.12D.Nyholt,C.Yu,andP.Visscher.OnJimWatson’sAPOEstatus:Geneticinformationishardto

hide.EuropeanJournalofHumanGenetics,17:147–149,2009.13Hooper,L.V.,Littman,D.R.,&Macpherson,A.J.(2012).Interactionsbetweenthemicrobiota

andtheimmunesystem.Science,336(6086),1268-1273.Honda,K.,&Littman,D.R.(2016).The

microbiotainadaptiveimmunehomeostasisanddisease.Nature,535(7610),75-84.14Rietveld,C.A.,Medland,S.E.,Derringer,J.,Yang,J.,Esko,T.,Martin,N.W.,...&Albrecht,E.

(2013).GWASof126,559individualsidentifiesgeneticvariantsassociatedwitheducational

attainment.science,340(6139),1467-1471.Krapohl,E.,&Plomin,R.(2016).Geneticlink

betweenfamilysocioeconomicstatusandchildren’seducationalachievementestimatedfrom

genome-wideSNPs.Molecularpsychiatry,21(3),437-443.15Humbert,M.,Ayday,E.,Hubaux,J.P.,&Telenti,A.(2013,November).Addressingthe

concernsofthelacksfamily:quantificationofkingenomicprivacy.InProceedingsofthe2013ACMSIGSACconferenceonComputer&communicationssecurity(pp.1141-1152).ACM.16Wagner,J.K.(2013).Playingwithheartandsoul…andgenomes:sportsimplicationsand

applicationsofpersonalgenomics.PeerJ,1,e120.17https://www.bloomberg.com/news/articles/2015-06-05/u-s-government-data-breach-tied-

to-theft-of-health-care-records18Otherregulatoryactorscouldalsobecomemoreinvolvedingenomicsinthefuture.TheFDA

hasbeenworkingtodevelopa“flexible,adaptiveregulatoryapproach”toensuringthe

accuracyandsafetyofgenomicsequencing.However,aftersignificantstakeholderinputon

proposedregulationsoverseveralyears,asofJanuary2017,theyhavenotissuednew

regulations,noristhereatimelineforissuingthem.TheFederalCommunicationsCommission

(FCC)alsohasaparticularinterestinprivacyinthedigitalage,whichcouldapplytogenomics.

InOctober2016,theFCCpassednewregulationsthatensureconsumerprivacybylimitinghow

internetprovidercompaniesuseandsellcustomerdata.TheFCChasalsoexpressedaninterest

inconsumerhealthdata,butsincetheFCCdoesnothavejurisdictionovernon-profit

organizations,andmanygenomicsentitiesinhealthcareandacademiaarenon-profit,their

jurisdictionalreachislimited.19NHGRIIRBGuidetoWritingConsentForms-Version2.0(November25,2015).Availableat

https://www.genome.gov/27528182/irb-forms-templates-and-guides/20Incontrast,Europeanprivacylawsprovideindividualswithgreaterrightstotheirpersonal

data,butthoselawsarebeingupdated,andtheirapplicationtogenomicsisnotyetclear.See

Townend,D.(2016).EULawsonPrivacyinGenomicDatabasesandBiobanking.TheJournalofLaw,Medicine&Ethics,44(1),128-142.21U.S.DepartmentofHealthandHumanServices.2016.GuidanceRegardingMethodsforDe-

identificationofProtectedHealthInformationinAccordancewiththeHealthInsurance

PortabilityandAccountabilityAct(HIPAA)PrivacyRule.https://www.hhs.gov/hipaa/for-

professionals/privacy/special-topics/de-identification/index.html#coveredentities;Presidential

CommissionfortheStudyofBioethicalIssues.2012.PrivacyandProgressinWholeGenomeSequencing.http://bioethics.gov/sites/default/files/PrivacyProgress508_1.pdf22Nyholt,D.R.2012.UsingGenomicDatatoMakeIndirect(andUnauthorized)Estimatesof

DiseaseRisk.PublicHealthGenomics15:303–311;Zaaijer,S.,Gordon,A.,Piccone,R.,Speyer,D.,&Erlich,Y.(2016).DemocratizingDNAFingerprinting.bioRxiv,061556.23InstituteforCriticalInfrastructureTechnology(ICIT)(2016).HackingHealthcareITin2016:

LessonstheHealthcareIndustryCanLearnfromtheOPMBreach.http://icitech.org/wp-

content/uploads/2016/01/ICIT-Brief-Hacking-Healthcare-IT-in-2016.pdf24GlobalAllianceforGenomicsandHealth.SecurityTechnologyInfrastructure:Standardsand

ImplementationPracticesforProtectingthePrivacyandSecurityofSharedGenomicand

ClinicalData.Version2.0,August9,2016.https://genomicsandhealth.org/category/search-

topics/security25FlatironHealthandFoundationMedicineUnveilPowerfulOncologyInformationResourceto

AdvancePrecisionMedicine.November3,2016PressRelease.

http://investors.foundationmedicine.com/releasedetail.cfm?releaseid=99738526NIH’sGenomicDataSharingPolicy,documentavailableat

https://gds.nih.gov/03policy2.html.27TheRighttoPrivacyintheDigitalAge,UnitedNationsOfficeoftheHighCommissioner,

http://www.ohchr.org/EN/Issues/DigitalAge/Pages/DigitalAgeIndex.aspx.28Acquisti,A.,Brandimarte,L.,&Loewenstein,G.(2015).Privacyandhumanbehaviorinthe

ageofinformation.Science,347(6221),509-514.Forattitudesaboutprivacyofhealthinformation,seeDimitropoulos,L.,Patel,V.,Scheffler,S.A.,&Posnack,S.(2011).Public

attitudestowardhealthinformationexchange:perceivedbenefitsandconcerns.AmericanJournalofManagedCare,17(12SpecNo.),SP111-6.29Mayer-Schönberger,V.,&Cukier,K.(2013).Bigdata:Arevolutionthatwilltransformhowwe

live,work,andthink.HoughtonMifflinHarcourt.30Jaschik,S.U.S.IssuesFinalVersionof‘CommonRule’onResearchInvolvingHumans.Inside

HigherEd,January19,2017.Availableathttp://insidehighered.com.NationalAcademyof

Sciences.OptimizingtheNation'sInvestmentinAcademicResearch:ANewRegulatory

Frameworkforthe21stCentury.Availableathttp://www.nap.edu/download/2182431https://www.23andme.com/about/consent/

32PonemonInstitute/IBM,SixthAnnualBenchmarkStudyonPrivacy&SecurityofHealthcare

Data.May2016.http://www2.idexpertscorp.com/ponemon2016.33http://fortune.com/2016/12/13/quest-diagnostics-data-breach-health/

34Shringarpure,S.S.,&Bustamante,C.D.(2015).Privacyrisksfromgenomicdata-sharing

beacons.TheAmericanJournalofHumanGenetics,97(5),631-646.35Heatherly,R.(2016).PrivacyandSecuritywithinBiobanking:TheRoleofInformation

Technology.TheJournalofLaw,Medicine&Ethics,44(1),156-160.36PonemonInstitute,SixthAnnualBenchmarkStudyonPrivacy&SecurityofHealthcareData.

May2016.http://www2.idexpertscorp.com/ponemon2016.

37Thomson,L.2015.HealthCareDataBreachesandInformationSecurity:AddressingThreats

andRiskstoPatientData.Chapter15inPeabody,A.(Ed.).(2013).HealthCareIT:Theessentiallawyer'sguidetohealthcareinformationtechnologyandthelaw.AmericanBarAssociation.

Availableat

http://www.americanbar.org/content/dam/aba/publications/books/healthcare_data_breaches

.authcheckdam.pdf38Eveleth,R.2015.GeneticTestingandTribalIdentity.TheAtlantic,January26.Alsosee

HavasupaiTribeandtheLawsuitSettlementAftermath.http://genetics.ncai.org/case-

study/havasupai-Tribe.cfm39Berger,K.M.,&Roderick,J.(2014).NationalandtransnationalsecurityimplicationsofBig

Datainthelifesciences.Washington,DC:AmericanAssociationfortheAdvancementofScience.http://www.aaas.org/sites/default/files/AAAS-FBI-UNICRI_Big_Data_Report_111014.pdf40Trevino,L.K.,&Nelson,K.A.(2010).Managingbusinessethics.JohnWiley&Sons.D.Palmer,

K.Smith-CroweandR.Greenwood(2016),OrganizationalWrongdoing:KeyPerspectivesandNewDirections(Cambridge,UK:CambridgeUniversityPress),includingchapters5("BadApples,

BadBarrelsandBadCellars:A‘Boundaries’PerspectiveonProfessionalMisconduct.")and7

(“SheblindedmewithScience:TheSociologyofScientificMisconduct.”Leveson,N.,Dulac,N.,

Marais,N.,Carroll,J.2009.MovingBeyondNormalAccidentsandHighReliability

Organizations:ASystemsApproachtoSafetyinComplexSystems.OrganizationStudiesVol30,Issue2-3,pp.227–249.Roberts,K.H.,Bea,R.,&Bartles,D.L.(2001).Mustaccidentshappen?

Lessonsfromhigh-reliabilityorganizations.TheAcademyofManagementExecutive,15(3),70-78.Kochan,T.A.,Smith,M.,Wells,J.C.,&Rebitzer,J.B.(1994).Humanresourcestrategiesand

contingentworkers:Thecaseofsafetyandhealthinthepetrochemicalindustry.HumanResourceManagement,33(1),55-77.41Thereisincreasingvariationacrossstatesintheextenttowhichgenomicsisregulatedin

research,clinical,andcommercialsettings.See

https://www.genome.gov/policyethics/legdatabase42http://www.humanlongevity.com/human-longevity-inc-and-discovery-ltd-to-offer-whole-

exome-whole-genome-and-cancer-genome-sequencing-to-discovery-insurance-clients-in-

south-africa-and-the-united-kingdom/43https://www.dnasimple.org

44Thomson,L.L.(2015).PersonalDataforSaleinBankruptcy.AmericanBankruptcyInstitute

Journal,34(6),32.45Acquisti,A.,C.TaylorandL.Wagman.2016.TheEconomicsofPrivacy.JournalofEconomic

Literature,Vol.52,No.2.https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2580411##46AmericanAssociationforCancerResearch.

http://www.aacr.org/RESEARCH/RESEARCH/PAGES/AACR-PROJECT-GENIE-DATA.ASPX47ComplianceStatisticsforPoliciesthatGovernDataSubmission,AccessandUseofGenomic

Data.NIHGenomicDataSharing(GDS).Availableat

https://gds.nih.gov/20ComplianceStatistics_dbGap.html

48Devos,L.,T.WangandS.Iyer.2016.TheGenomicInectionPoint:ImplicationforHealthcare.

RockHealthSpecialTopicsReport.https://rockhealth.com/reports/the-genomics-inflection-

point-implications-for-healthcare/49Skloot,Rebecca(2010).TheImmortalLifeofHenriettaLacks,NewYorkCity:RandomHouse.

50Seehttps://ghr.nlm.nih.gov/primer/precisionmedicine/initiativeand

https://www.cancer.gov/research/key-initiatives/moonshot-cancer-initiative51Conley,J.2017.WilliamsandBeyond:LegalandPolicyIssuesintheRegulationofGenetic

Testing.UNCCenterforGenomicsandSociety.Presentation,February9,2017.

http://www.genomicslawreport.com.52CyberSecurity:ConfrontingtheThreat.2015.AccentureConsulting.

https://www.accenture.com/_acnmedia/Accenture/next-gen/top-ten-

challenges/challenge9/pdfs/Accenture-2016-Top-10-Challenges-09-Cyber-Security.pdf

INNOVATIONS IN MEDICAL GENOMICS: HOW TO ENABLE … · 2 ADVANCES IN GENOME SEQUENCING TECHNOLOGY...

Documents

Transcript of INNOVATIONS IN MEDICAL GENOMICS: HOW TO ENABLE … · 2 ADVANCES IN GENOME SEQUENCING TECHNOLOGY...

admera health Biopharma Servicesas environmental genomics, ecogenomics or community genomics. While traditional microbiology and microbial genome sequencing and genomics rely upon

Genome mapping Genome sequencing Next Gen sequencing.

BGGN213 F17 lecture15 - GitHub Pages · ‣What is a Genome? • Genome sequencing and the Human genome project ‣ What can we do with a Genome? • Comparative genomics ‣ Modern

Gene expression and the transcriptome I. Genomics and transcriptome After genome sequencing and annotation, the second major branch of genomics is analysis.

Primer on Genome Wide Association and Sequencing on Genome Wide Association and Sequencing Multi-IC NIH Symposium On Population Genomics Francis S. Collins, M.D., Ph.D. June 5, 2006

Maryam Nazir. Personal Genomics: Branch of genomics concerned with the sequencing and analysis of the genome of an individual Once sequenced, it can.

Comparative Genomics of Coccidioides and Other Pathogenic ... · Comparative Genomics of Coccidioides and Other Pathogenic Dimorphic Fungi A whitepaper for Microbial Genome Sequencing

Genomics, Transcriptomics, and Proteomics in the Clinical ... · Genomics, Transcriptomics, and Proteomics in the Clinical Setting: Integrating Whole Genome and RNA Sequencing With

GENOME SEQUENCING AND FUNCTIONAL GENOMICS NATIONAL PROGRAM IN LATVIA

Title of SMI goes here · Web viewYersinia pestis 97. Whole Genome Sequencing (WGS) This is also known as “full genome sequencing, complete genome sequencing, or entire genome sequencing”.

Functional Genomics (EST) and Genome Sequencing … am/icsr05-robledo-et... · Genome Sequencing of the Protistan Parasite Perkinsus marinus José A. F. Robledo1, Eric J. Schott1,

Genome&Assembly:&Novel&Applica3ons& …sergek/presentations/ThesisTalk_final.pdf · Sequencing!Output Tsunami ash Genomics?" ennisi (2011) . ear ear! 4 Will Computes Crash Genomics.

WHOLE GENOME SEQUENCING: Transforming …...WHOLE GENOME SEQUENCING: Transforming health research What is the purpose of whole genome sequencing? Whole genome sequencing turns blood

Towards your own genome. Designing your Sequencing Run Sequencing strategy Genome size and genome.

Genomics-sequencing of microbial genomes · Genomics: 37 Post Genome Sequence •Comparative genomics –comparing genome organisation and content –genome size –genome repeats/Tn/phages

Genomics & Proteomics I.What is genomics? A. GOALS of Genomics B. How are genomes mapped? C. Methods for sequencing genomes D. The Human Genome Project.

Whole Genome Sequencing, Comparative Genomics, & Systems Biology Gene Myers University of California Berkeley.

CSCI6904 Genomics and Biological Computing Seminar 1 – Sequencing a genome in one step. Projects and paper presentations.

Sequencing the Maize (B73) Genome Genome Sequencing Center Maize Genome Sequencing Consortium.

Genomics and other omics - University Of Illinois · 1 Genomics and other “omics” • Genome sequencing - individual organism (genomics), community of organisms (metagenomics)