Is such data covered by HIPAA?
Our interpretation is that there are no restrictions on the use or disclosure of such de-identified health information as long as it does not contain "Protected Health Information (PHI)." By definition, PHI is de-identified when it neither identifies nor provides a reasonable basis to identify an individual. Thus, this effort will not collect PHI such as names, addresses, zip codes, photographs, family identifiers, social security numbers, employers, or identification of the facility the patient was seen in.
Do we require IRB approval?
No. This project does not require IRB approval on two grounds: (1) this is not research, it's part of clinical care, and (2) even if it were research, the data are de-identified and therefore exempt.
or if the information is recorded by the Investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects (emphasis added)" is listed under Research Activities considered EXEMPT from review by IRBs
Do I have the right to release such de-identified data? Who owns test results?
Under California state law, where the project was initiated, medical records, such as laboratory results, are the property of the medical provider (or facility) that orders the test, not the laboratory and not the patient (although of course the patient has a right to see copies). Although there are differences on this issue in different states, our interpretation of a 50-state review of regulations at the state level indicates that there would be no regulatory problems with releasing this kind of de-identified, non-PHI information under these conditions.
Why are you collecting such limited phenotypic data?
We understand that there may be a lot of other clinical information that would be useful concerning age at onset, laterality, hormone receptor and oncogene status, response to therapy, etc. However, we believe this is a clear example of the "perfect being the enemy of the good." It is not realistic to burden participants with trying to collect all such information and we wish to keep the project simple and the data completely and incontrovertibly de-identified.
How useful do you think such data will be since it is collected in a clinic rather than at random in the population?
We acknowledge that the list of variants would be obtained from patients in whom there was sufficient clinical suspicion to justify the testing and not a random sample of the population. However, just obtaining a list of such variants, how they are currently being interpreted clinically, and making the information available would be a good start. Moreover, as large-scale sequencing data of unselected (or differently selected) populations becomes increasingly available, it will inform and help clarify the admittedly skewed data that will be derived from this effort.
Why are you focusing only upon BRCA1/2 in a period when sequences from entire genomes are currently being collected?
The ultimate need to expand this effort to include (all) other genes is readily apparent and there is a parallel effort underway to collect similar kinds of information for many medically-relevant genes directly from the clinical testing companies themselves for deposit into ClinVar. However, BRCA1 and BRCA2 arguably represent the most thoroughly sequenced genes in all of human genetics. Because of the clinical importance of BRCA1 and BRCA2, the restrictions on who can do clinical testing in the United States, and the loss of open access to the variant database maintained by Myriad Genetics, Inc. for the past 8+ years, BRCA1/2 represents a special case where we are seeking this information from you, the providers who ordered the test, in addition to the laboratories doing the testing
For more questions, please contact Dr. Robert Nussbaum at firstname.lastname@example.org.