	Introduction

Advances in genomics technology and information technology infrastructure, together with policies regarding the sharing of research data, support expanded genomic research efforts but also raise new issues with respect to privacy, and specifically the effort to balance "the potential of scientific progress with privacy and respect for persons." The development of new genomic sequencing technologies has allowed for the generation of big data, and recent changes in information technology infrastructure—including, for example, cloud data storage—have facilitated big data storage and analytics. These developments are expected to support significant changes in health research and, eventually, in health care delivery. Genetic and genomic research have generated large amounts of genetic data. If these "large-scale genomic data" are generated as a part of research funded by the National Institutes of Health (NIH), then they are subject to specific data sharing policies and are often held in publicly available databases. Among other things, advances in sequencing technology have enabled this research, and have made available large amounts of data at a rate that has generally outpaced the ability to both store and analyze that data (see "What is DNA Sequencing?" NIH has established a comprehensive policy for the sharing of genomic data that "applies to all NIH-funded research that generates large-scale human or non-human genomic data as well as the use of these data for subsequent research." This policy requires investigators to outline their data sharing plans as part of their funding applications; if investigators fail to submit the required data, NIH may withhold funding. Investigators are required to de-identify the data prior to submitting it to NIH-designated data repositories. Data should be de-identified—stripped of identifiers such as an individual's name—according to the requirements of both the (1) HHS Common Rule and (2) the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Recent studies suggest that different types of genomic data may be more likely to raise privacy issues than had been previously understood. Researchers were able to reidentify these individuals using their publicly available de-identified personal genome data and other publicly available data. Relevant law includes (1) the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules; (2) the HHS Regulations for the Protection of Human Research Subjects, or the Common Rule; (3) GINA; and (4) the Freedom of Information Act (FOIA). FOIA is relevant, not in the sense that it protects information from a potential privacy breach, but in that it allows public access to much of the information held by the federal government. The remaining sections of this report provide an overview of each of these relevant laws and regulations. The Genetic Information Nondiscrimination Act (GINA, P.L.
Advances in genomics technology and information technology infrastructure, together with policies regarding the sharing of research data, support new approaches to genomic research but also raise new issues with respect to privacy. The development of new genomic sequencing technologies has allowed for the generation of big data, and recent changes in information technology infrastructure have facilitated big data storage and analytics. These developments are expected to support significant changes in health research and, eventually, in health care delivery.
Genetic and genomic research—and other "omics" research—have generated large amounts of genetic data. If these "large-scale genomic data" are generated as a part of research funded by the National Institutes of Health (NIH), then they are subject to specific data sharing policies and are often held in publicly available databases. Among other things, advances in sequencing technology have enabled this research, making large amounts of data available at a rate that has generally outpaced the ability to both store and analyze that data.
NIH has established a comprehensive policy for the sharing of genomic data that "applies to all NIH-funded research that generates large-scale human or non-human genomic data as well as the use of these data for subsequent research." This policy requires investigators to outline their data sharing plans as part of their funding applications; if investigators fail to submit the required data, NIH may withhold funding. Investigators are required to de-identify the data prior to submitting it to NIH-designated data repositories, according to the requirements of both the HHS Common Rule and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule.
Some recent studies have begun to suggest that different types of molecular data may be more likely to cause privacy issues than had been previously understood, and specifically, that de-identified large-scale genomic sequence data may in fact be able to be reidentified. In a recent study, researchers were able to reidentify research participants using the publicly available de-identified personal genome data and other publicly available metadata.
This demonstration of reidentified individuals in a research study using de-identified genome data raises the question of whether—and if so, how—relevant current law should be modified in response to this new capability. Relevant law governs informed consent, access to research data, and the use of this data, and includes (1) the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules; (2) the HHS Regulations for the Protection of Human Research Subjects, or the Common Rule; and (3) the Genetic Information Nondiscrimination Act of 2008 (GINA). In addition, the Freedom of Information Act (FOIA) is relevant, not in the sense that it protects information from a potential privacy breach, but in that it allows public access to much of the information held by the federal government. This report discusses these considerations in the context of each of the relevant laws and regulations.