this page only  
Join BIO  
Member Directory  
Contact BIO  

Biotechnology Industry Organization
BIO Membership
BIO Membership Benefits


Wednesday, October 01, 2014

Recommendations for State Privacy Legislation

Click here for a printer-friendly page Printer Friendly

The Biotechnology Industry Organization (BIO) supports strong protections for the privacy of all personal medical information. Responsible use of personal medical information is essential for research into the genetic and other biological bases of disease. This research holds great promise for alleviating the suffering associated with many diseases. BIO believes that information resulting from medical research, including genetic research, must be respected, treated confidentially and safeguarded from discriminatory misuse. BIO also believes that medical information identifying a specific individual should not be disclosed without that individual's consent, unless the disclosure is authorized by law.

Legislation should be crafted to protect individual privacy yet not obstruct medical research. We are concerned that many of the legislative initiatives currently being considered contain provisions that would impede medical research.

Standards to protect the confidentiality of medical information should ensure that legitimate and vital medical research is encouraged and facilitated. Regulations already exist to protect the safety and privacy of individuals who participate in medical research studies. Under these regulations, the National Institutes of Health (NIH) and the Food and Drug Administration (FDA) require informed consent from participants and approval by a national or local review board for medical research.

Privacy legislation that is improperly drafted could significantly undermine medical research. For instance, it could increase the cost and complexity of locating projects in particular states with burdensome laws. More importantly, it could dash the hopes of patients whose lives depend on access to innovative treatments.

BIO's recommendations for drafting privacy legislation are as follows:

  • Privacy legislation should be carefully crafted to allow the continuation of legitimate and vital medical research.
  • BIO supports the enactment of comprehensive legislation to protect the privacy of personal medical information, including genetic information. Genetic information cannot and should not be separated from other medical information.
  • Medical information should be safeguarded from discriminatory misuse.
  • Medical research using information that identifies a particular individual should continue to be governed by existing FDA and NIH regulations to protect the safety and privacy of medical research participants.
  • Medical information that identifies a particular individual should not be disclosed without that individual's consent, unless the disclosure is authorized by law. Medical information that does not identify a particular individual should not be subject to the same consent requirements, as it does not raise privacy concerns.
  • Ownership of medical information and samples is not an appropriate mechanism for protecting privacy. Statutes that confer ownership of medical information and samples will hinder research and potentially deprive patients of the opportunity to participate in clinical trials.
  • Privacy legislation should protect the current practice of storing tissue samples and medical information which is critical to medical research.
  • Privacy legislation should not require the destruction of medical information and samples as this is detrimental to medical research.

Q. How should privacy legislation apply to medical research?

A. Privacy legislation should be carefully crafted to allow the continuation of legitimate and vital medical research. BIO recommends that medical research using patient identifiable information should continue to be governed by existing regulations to protect the safety and privacy of research subjects, specifically those cited in the Code of Federal Regulations at 21 CFR 50 and 45 CFR 46.


The regulatory system governing medical research in America today is both comprehensive and complex. Biotechnology and pharmaceutical research is closely regulated by the FDA. For both the public and private sectors, strict national and institutional guidelines prescribe how medical research shall be conducted. The entire research process is carefully monitored to ensure strict patient confidentiality. In addition to obtaining FDA or NIH review, research studies also must be approved by institutional review boards (IRBs), in compliance with NIH guidelines and FDA regulations, to assure patient safety and confidential treatment of data.

Q. Should privacy legislation treat genetic information separately from other medical information?

A. No. BIO is strongly opposed to legislation that separates genetic information from other medical information.


Most, if not all, diseases contain a genetic component. Genetic tests can be used to diagnose the presence of disease. They can provide information that can be used to reduce the risk of future disease and enable earlier and more effective treatment if and when disease occurs. Genetic information forms part of the continuum of medical information that is necessary for health care professionals to provide comprehensive care across the lifespan of an individual or a family.


At a fundamental level, there is no clear scientific distinction between "genetic" disease and "non-genetic" disease. Information which is typically not classified as "genetic" may, in fact, be genetically influenced (e.g., cholesterol) or even purely genetically determined (e.g., sex). Thus, it is impossible to draw a clear distinction between "genetic" medical information and "non-genetic" medical information.


Indeed, even if one were to arbitrarily separate "genetic" and "non-genetic" medical information, "non-genetic" medical information would deserve no less privacy protection than "genetic" medical information. For example, information about infectious ("non-genetic") conditions (such as HIV-positive status) may be even more sensitive than some "genetic" information. Therefore, it would be insufficient to legislate special safeguards that single out a portion of personal medical information.

Q. Should medical information be used to unfairly discriminate?

A. No. BIO believes that medical information must be treated responsibly, and safeguarded against discriminatory misuse, if new advances in medical knowledge are to achieve their full potential for improving human health.
BIO strongly supported the inclusion of genetic information in the new federal health insurance reform law which prohibits insurance companies from refusing health insurance coverage to individuals on the basis of their medical history. This new law demonstrates the inseparability of genetic information from other types of medical information. BIO supports further responsible anti-discrimination legislation and suggests the development of separate legislation to address discrimination and privacy protections.


BIO does not believe medical information should be used to discriminate unfairly, because people should have the option of using diagnostic tests that can help them recognize early warning signs of disease and seek proper treatment for disease.


For example, genetic tests that indicate a woman's predisposition to breast or ovarian cancer are important diagnostic tools for better health. They inform women about their health status in advance, and enable them to receive earlier and more aggressive surveillance and monitoring in hopes of detecting disease at an earlier and more treatable stage. BIO recognizes that many women at high risk for breast cancer do not avail themselves of this potential life-saving information because of fear and potential discrimination.


The development of genetic diagnostic tests is merely the first step in identifying new treatments for disease. Many biotechnology companies are using genetic information to develop new medicines to treat and cure diseases. Privacy legislation must ensure that companies can continue to identify and develop new diagnostic tests and treatments using valuable medical information, including genetic information.

Q. For which types of medical information disclosures must informed consent be obtained?

A. Medical information that identifies a particular individual should not be disclosed without that individual's consent, unless the disclosure is authorized by law. In many instances, the FDA requires the receipt of certain medical information, and routine disclosures are necessary in order to seek reimbursement from third party payors. BIO believes any changes to the requirements for obtaining informed consent for research purposes should be made to existing consent regulations and the IRB approval process in the context of federal oversight of research, rather than through new privacy legislation.


Medical information that does not identify a particular individual should not be subject to the same consent requirements, as it does not raise privacy issues. In fact, many research results are stripped of personal identifiers in an effort to protect confidentiality. It would be difficult, and sometimes impossible, to re-link genetic information to personal identifiers in order to request authorization for subsequent disclosures.

Q. Does ownership of medical information and samples afford greater privacy protection?

A. No. Ownership of samples and medical information is not an appropriate mechanism for protecting privacy. If ownership rights were created in samples and medical information, it would be highly detrimental to medical research, to the development of new health care products, to patients' privacy, and even to the operation of blood banks and organ transplant programs.


Ownership of medical information and samples would require record-keeping obligations that would not only be prohibitively expensive for hospitals and physicians but also would be in direct conflict with the goal of protecting privacy. For example, to protect an individual's ownership in a particular sample would mandate some form of record and potentially transferable "deed" identifying the donor that would require intrusion into the individual's privacy. Patients can best be protected and served if their identities are protected from disclosure, if samples and records are kept confidential, and if the use of information in medical research and development efforts continue to be governed by current regulations.


Furthermore, as property laws not intended for this kind of application are brought to bear on medical information and samples, there is likely to be an explosion of unnecessary litigation. For example, what rights would blood relatives have over medical information obtained from other family members? Could patients be held legally liable for the use of medical information or samples obtained from them?

Q. Why is it necessary to store tissue samples and medical information for research?

A. Tissue banks, which are collections of medical samples, are essential to research both in academia and in industry, as well as state and federal public health agencies. Samples from tissue banks may be used, for example, to study the mechanisms and stages of disease, to test new therapeutic compounds, and to understand patterns of disease in populations. Agencies such as the Centers for Disease Control and Prevention use archived samples to look for new forms of disease and to deal with potential immune resistance to drugs.


Tissue samples stored over generations by clinical labs can help families make health care decisions, help to create tumor registries and aid in the design of new diagnostic and treatment protocols. While some samples remain identifiable in order to be useful to the patient in the future, other portions of the samples may be saved in non-identifiable form for quality assurance purposes, such as developing and validating new testing techniques.

Q. Should privacy legislation require the destruction of medical information and samples?

A. No. Legislation should not require the destruction of medical information and samples. Destroying information may conflict with FDA requirements for information collected for clinical trials. Furthermore, requiring destruction of DNA samples could jeopardize the integrity of research projects. These projects are carefully constructed to include certain types and numbers of participants in order to ensure the scientific validity of the research findings. Allowing withdrawal of samples or information would delay research studies, or possibly even force the termination of some studies. Instead, individuals should be permitted to withdraw from research projects as provided under current FDA and NIH regulations.

In Summary
Privacy of medical information is not a new issue. But as our society acquires more information--and more ways to access it--privacy and confidentiality have become urgent issues. BIO believes that medical information, of which genetic information is an integral part, should be protected by uniform, national legislation. Privacy legislation needs to be constructed carefully and prudently to protect the privacy of individuals, while facilitating medical research that can benefit us all.

contact us | terms of use | privacy policy
© 2010 | Biotechnology Industry Organization | 1201 Maryland Ave., SW, Ste. 900 | Washington, D.C. 20024