Information for Clinicians

Is such data covered by HIPAA?

Our interpretation is that there are no restrictions on the use or disclosure of such de-identified health information as long as it does not contain "Protected Health Information (PHI)." By definition, PHI is de-identified when it neither identifies nor provides a reasonable basis to identify an individual. Thus, this effort will not collect PHI such as names, addresses, zip codes, photographs, family identifiers, social security numbers, employers, or identification of the facility the patient was seen in.

Do we require IRB approval?

No. This project does not require IRB approval on two grounds: (1) this is not research, it's part of clinical care, and (2) even if it were research, the data are de-identified and therefore exempt.  

  1.  The collection of this data is not research. It is no different than what is done routinely now as part of clinical care. Please consider the following: When a variant of any kind is found in a gene of interest, current clinical practice of laboratory testing involves reviewing all the data in a lab from patients tested previously for a similar phenotype and possibly found to have the same variants. The lab never gets IRB consent to do this because it is not research. Furthermore, lab directors call their colleagues in other labs and ask them if they have seen a similar variant and how they classified it, all de-identified of course. This is an important component of quality control for routine clinical care and there is once again NO IRB review. Myriad itself has a database of patient results that they use to interpret new results as they come in. They do not have IRB approval or patient consent to do that, nor should they, since it is just routine clinical practice and not research. Of course, an IRB at any institution can weigh in on anything at any time and impose requirements.
  2. According to NIH guidelines governing Human Subjects Research, de-identified data are exempt from IRB review.  "Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens if these sources are publicly available 

    or if the information is recorded by the Investigator in such a manner that subjects cannot be identified, directly or through identifiers linked to the subjects (emphasis added)" is listed under Research Activities considered EXEMPT from review by IRBs

Do I have the right to release such de-identified data? Who owns test results?

Under California state law, where the project was initiated, medical records, such as laboratory results, are the property of the medical provider (or facility) that orders the test, not the laboratory and not the patient (although of course the patient has a right to see copies). Although there are differences on this issue in different states, our interpretation of a 50-state review of regulations at the state level indicates that there would be no regulatory problems with releasing this kind of de-identified, non-PHI information under these conditions.

Why are you collecting such limited phenotypic data?

We understand that there may be a lot of other clinical information that would be useful concerning age at onset, laterality, hormone receptor and oncogene status, response to therapy, etc. However, we believe this is a clear example of the "perfect being the enemy of the good." It is not realistic to burden participants with trying to collect all such information and we wish to keep the project simple and the data completely and incontrovertibly de-identified. 

How useful do you think such data will be since it is collected in a clinic rather than at random in the population?

We acknowledge that the list of variants would be obtained from patients in whom there was sufficient clinical suspicion to justify the testing and not a random sample of the population. However, just obtaining a list of such variants, how they are currently being interpreted clinically, and making the information available would be a good start. Moreover, as large-scale sequencing data of unselected (or differently selected) populations becomes increasingly available, it will inform and help clarify the admittedly skewed data that will be derived from this effort.

Why are you focusing only upon BRCA1/2 in a period when sequences from entire genomes are currently being collected?

The ultimate need to expand this effort to include (all) other genes is readily apparent and there is a parallel effort underway to collect similar kinds of information for many medically-relevant genes directly from the clinical testing companies themselves for deposit into ClinVar. However, BRCA1 and BRCA2 arguably represent the most thoroughly sequenced genes in all of human genetics. Because of the clinical importance of BRCA1 and BRCA2, the restrictions on who can do clinical testing in the United States, and the loss of open access to the variant database maintained by Myriad Genetics, Inc. for the past 8+ years, BRCA1/2 represents a special case where we are seeking this information from you, the providers who ordered the test, in addition to the laboratories doing the testing

For more questions, please contact Dr. Robert Nussbaum at