BIO's Recommendations for National Privacy Legislation

BIO's Recommendations for National Privacy Legislation

The Biotechnology Industry Organization (BIO) supports national legislation to protect the confidentiality of all individually identifiable medical information. BIO believes that this medical information must be respected, treated confidentially and safeguarded from discriminatory misuse.
Medical research holds great promise for alleviating the suffering associated with many diseases. Standards to protect the confidentiality of individually identifiable medical information, therefore, should be implemented to ensure that vital medical research is encouraged and facilitated. Laws that inappropriately restrict the use of individually identifiable medical information could slow the development of new drugs and biologics and dash the hopes of patients whose lives depend on access to innovative treatments.
Regulations already exist to protect the safety of individuals and the confidentiality of information generated about them during the course of most medical research studies. Under these regulations, the National Institutes of Health (NIH) and the Food and Drug Administration (FDA) require informed consent from participants and approval by a national or local review board for medical research. BIO believes any changes to the requirements for obtaining informed consent for research purposes should be made to existing regulations in the context of federal oversight of research, rather than through privacy legislation.
BIO believes that privacy legislation should be national in scope to avoid impeding medical research with a patchwork of inconsistent state laws. Efforts to protect the confidentiality of individually identifiable medical information and to promote research are best served by a uniform standard. States that impose greater restrictions on research over and above a national standard could drive research out of a state, negatively impacting research at universities and companies as well as denying patients in those states access to clinical research.
BIO's recommendations for drafting privacy legislation are focused on individually identifiable medical information used in the research and development of new diagnostics and treatments. We recognize there are other important and necessary uses of medical information, such as for patient care and reimbursement, that are not encompassed in these recommendations.

BIO supports the enactment of comprehensive legislation to protect the confidentiality of medical information that identifies a specific individual.

Privacy legislation should be carefully crafted to allow the continuation of vital medical research.

Genetic information cannot be scientifically or practically separated from other medical information and therefore should not be addressed separately.

Medical research using information that identifies a specific individual should continue to be governed by existing FDA and NIH regulations to protect the safety of medical research participants and the confidentiality of information generated about them.

Medical information that identifies a specific individual should not be disclosed without that individual's consent, unless the disclosure is authorized by law. Medical information that does not identify a specific individual should not be subject to consent requirements, as it does not raise privacy concerns.

Establishing ownership rights in medical information and samples is not an appropriate mechanism for protecting confidentiality. Statutes that would confer ownership of medical information and samples will hinder research.

Privacy legislation should protect the current practice of storing tissue samples and medical information which is critical to medical research.

Privacy legislation should not require the destruction of medical information and samples as this is detrimental to medical research.

Medical information should be safeguarded from discriminatory misuse.

Privacy legislation should provide effective remedies for violations.

Privacy legislation should be national in scope to avoid impeding medical research with a patchwork of inconsistent state laws. Efforts to protect medical information identifying a specific individual and to promote research are best served by a uniform standard. Federal law should preempt all state health information law with certain exceptions, such as doctor-patient privilege and licensing.

Q. How should privacy legislation apply to medical research?
A. Privacy legislation should be carefully crafted to allow the continuation of vital medical research. BIO recommends that the use of patient identifiable information in medical research should continue to be governed by existing regulations to protect the safety and privacy of research subjects, specifically those cited in the Code of Federal Regulations at 21 CFR 50 and 45 CFR 46.
The regulatory system governing medical research in America today is both comprehensive and complex. Biotechnology and pharmaceutical research is closely regulated by the FDA. For both the public and private sectors, strict national and institutional guidelines prescribe how medical research shall be conducted. The research process is carefully monitored to ensure strict patient confidentiality. In addition to obtaining FDA or NIH review, clinical trials also must be approved by institutional review boards (IRBs), in compliance with NIH guidelines and FDA regulations, to assure patient safety and confidential treatment of data.
Q. Should privacy legislation address genetic information separately from other medical information?
A. No. BIO is strongly opposed to legislation that separates genetic information from other medical information.
At a fundamental level, there is no clear scientific distinction between "genetic" disease and "non-genetic" disease. Information which is typically not classified as "genetic" may, in fact, be genetically influenced (e.g., cholesterol) or even purely genetically determined (e.g., gender). Thus, it is impossible to draw a clear distinction between "genetic" medical information and "non-genetic" medical information.
Most, if not all, diseases contain a genetic component. Some genetic tests can be used to diagnose the presence of disease. Other tests can provide information that can be used to reduce the risk of future disease and enable earlier and more effective treatment if and when disease occurs. Genetic information forms part of the continuum of medical information that is necessary for health care professionals to provide comprehensive care across the lifespan of an individual or a family.
Indeed, even if one were to arbitrarily separate "genetic" and "non-genetic" medical information, "non-genetic" medical information would deserve no less privacy protection than "genetic" medical information. For example, information about infectious ("non-genetic") conditions (such as HIV-positive status) may be even more sensitive than some "genetic" information. Therefore, it would be insufficient to legislate special safeguards that single out a portion of personal medical information.
Q. Should discriminatory misuse of medical information be addressed in legislation?
A. Yes. BIO believes that medical information must be treated responsibly, and safeguarded against discriminatory misuse, if new advances in medical knowledge are to achieve their full potential for improving human health.
BIO strongly supported the inclusion of genetic information in the new federal health insurance reform law, the Health Insurance Portability and Accountability Act of 1996, which prohibits insurance companies from refusing health insurance coverage to individuals on the basis of their medical history. This new law demonstrates the inseparability of genetic information from other types of medical information. BIO supports further responsible anti-discrimination legislation and suggests the development of separate legislation to address discrimination and privacy protections.
The development of genetic diagnostic tests is merely the first step in identifying new treatments for disease. Many biotechnology and pharmaceutical companies are using genetic information to develop new medicines to treat and cure diseases. Any such legislation must ensure that companies can continue to identify and develop new diagnostic tests and treatments using valuable medical information, including genetic information.
BIO believes that people should have the option of using diagnostic tests that can help them recognize early warning signs of disease and seek proper treatment for disease. This option would be jeopardized if medical information were used to discriminate unfairly.
For example, genetic tests that indicate a person's predisposition to breast or colon cancer are important diagnostic tools for better health. They inform people about their health status in advance, and enable them to receive earlier and more aggressive surveillance and monitoring in hopes of detecting disease at an earlier and more treatable stage. BIO recognizes that many people at high risk for cancer do not avail themselves of this potential life-saving information because of fear of potential discrimination.
Q. Should informed consent be obtained before disclosing medical information?
A. Yes. Informed consent should be obtained before disclosing medical information that identifies a particular individual, unless the disclosure is authorized by law or the individual has previously consented to disclosure of the information for medical research or patient care. In many instances, the FDA requires the receipt of certain medical information, and routine disclosures are necessary in order to seek reimbursement from third party payors. BIO believes any changes to the requirements for obtaining informed consent for research purposes should be made to existing consent regulations and the IRB approval process in the context of federal oversight of research, rather than through new privacy legislation.
Medical information that does not identify a particular individual should not be subject to the same consent requirements, as it does not raise privacy issues. In fact, many research results are stripped of personal identifiers or replaced with a protected alphanumeric code in an effort to preserve confidentiality. In many instances, it would be difficult, and sometimes impossible, to re-link medical information to personal identifiers in order to request authorization for subsequent disclosures.
Q. Does establishing ownership rights in medical information and samples afford greater privacy protection?
A. No. Establishing ownership rights in samples and medical information is not an appropriate mechanism for protecting confidentiality. If ownership rights were created in samples and medical information, it would be highly detrimental to medical research, to the development of new health care products, to the confidentiality of patient information, and even to the operation of blood banks and organ transplant programs.
Establishing ownership rights in medical information and samples would require record-keeping obligations that would not only be prohibitively expensive for hospitals and physicians but also would be in direct conflict with the goal of protecting confidentiality. Patients can best be protected and served if their identities are protected from inappropriate disclosure by implementing strong remedies, by keeping samples and records confidential, and by continuing to govern the use of information in medical research and development efforts through current regulations.
Furthermore, as property laws not intended for this kind of application are brought to bear on medical information and samples, there is likely to be an explosion of unnecessary litigation.
Q. Why is it necessary to store tissue samples and medical information for research?
A. Collections of tissue samples are essential to research both in academia and in industry, as well as state and federal public health agencies. Samples from tissue banks may be used, for example, to study the mechanisms and stages of disease, to test new therapeutic compounds, and to understand patterns of disease in populations. Agencies such as the Centers for Disease Control and Prevention use archived samples to look for new forms of disease and to deal with potential immune resistance to drugs.
Tissue samples stored over generations by clinical labs can help families make health care decisions, help to create tumor registries and aid in the design of new diagnostic and treatment protocols. While some samples remain identifiable in order to be useful to the patient in the future, other portions of the samples may be saved in non-identifiable form for quality assurance purposes, such as developing and validating new testing techniques.
Q. Should privacy legislation require the destruction of medical information and samples?
A. No. Legislation should not require the destruction of medical information and samples. Destroying information may conflict with FDA requirements for information collected for clinical trials. Furthermore, requiring destruction of DNA samples could jeopardize the integrity of research projects. These projects are carefully constructed to include certain types and numbers of participants in order to ensure the scientific validity of the research findings. Allowing withdrawal of samples or information would delay research studies, or possibly even force the termination of some studies. Instead, individuals should be permitted to withdraw from research projects as provided under current FDA and NIH regulations.
Q. What type of remedies should be applied to violations?
A. Privacy legislation should provide strong, effective remedies for violations where a pattern and practice of material violations of the legislation are demonstrated. Any consideration of damages should be limited to actual harm proven.
Q. Should states enact different laws to protect privacy?
A. No. Privacy legislation should be national in scope to avoid impeding medical research with a patchwork of inconsistent state laws. Efforts to protect personal health information and research are best served by a uniform standard. Federal law should preempt all state health information law with certain exceptions, such as doctor-patient privilege and licensing.
Research endeavors often cross state lines. Disease crosses borders as well. States that impose greater restrictions on research than a strong national standard could drive research out of a state, denying patients in those states access to clinical research.
In Summary
Privacy of medical information is not a new issue. But as our society acquires more information--and more ways to access it--privacy and confidentiality have become urgent issues. BIO believes that medical information, of which genetic information is an integral part, should be protected by uniform, national legislation. Privacy legislation needs to be constructed carefully and prudently to protect the confidentiality of individuals' medical information, while facilitating medical research that can benefit us all.