The World Privacy Forum has released a new report authored by Robert Gellman and Pam Dixon, The Precision Medicine Initiative and Privacy: Will Any Legal Protections Apply? From their brief summary of the report:
This report reviews privacy law applicable to the Precision Medicine Initiative (PMI), and the large medical information and biospecimen database at its center. Precision medicine approaches to disease seek to incorporate individual variability in genes, environment, and lifestyle in research to eventually reach the goal of maximizing treatment effectiveness for individuals. The PMI will include a robust genetic research component. The HIPAA health privacy rule and its protections for individuals will not apply to PMI research activities. Other privacy laws may apply, such as the Privacy Act of 1974, but there is uncertainty regarding if or how this and other laws apply. The PMI offers a set of privacy guidelines, but the guidelines lack detail and fail to address underlying legal requirements and protections.
The key privacy concerns raised by the PMI are the lack of applicable law to govern its collection and use of individuals’ health data, the potential waiver of the patient-physician legal privilege that can shield data from disclosure through litigation, and the possibility of law enforcement access to patient records held in the PMI. Before it launches, the PMI needs to clarify the legal and administrative privacy protections that apply to its activities. People who volunteer their medical data and biospecimens must be told what specific legal protections apply and do not apply.
You can access the full report with their recommendations on World Privacy Forum.