8.1 Regulatory Framework in the United States
8.1.1 Genetic Privacy and Nondiscrimination
At the basis of personalized medicine lie genome tools, which enable more precise
predictions and treatment of illness and include “entire” genomes. This requires
development, standardization, and integration of many important tools in the health
system and clinical studies and dictates significant changes of the regulatory
system. Federal and state laws are not harmonized and do not provide adequate
protection for abuse of genetic information. The states adopt their own laws, which
results in unequal protection to the detriment of personalized medicine.
Basic federal laws aiming to protect medical and genetic information include the
following:
- The Privacy Act of 1974 ;^67
- The Electronic Communication Privacy Act of 1986 ;^68
- The Americans with Disabilities Act of 1990;^69
- The Health Insurance Portability and Accountability Act (HIPAA) of 1996;^70
and - The American Recovery and Reinvestment Act (ARRA) of 2009.^71
Let us briefly touch upon some of the most relevant regulatory solutions. The
HIPAA regulates the exchange of medical documentation between health care
providers and representatives of the health care system. Its objective is to secure
the privacy of personal health information. For example, it protects workers from
unauthorized disclosure of health information to their employers, but insurers may
still request genetic information or genetic testing.^72 The 2009 Report of the
Institute of Medicine, however, critically evaluates protections offered under the
HIPAA Privacy Rule, claiming that they often fail to protect patient privacy and
impede important medical research.^73
The ARRA is the federal act enacted in 2009, which regulates, among others,
privacy and security of information in connection with the Electronic Health
Record (EHR), as well as the Personal Health Record (PHR). It was accompanied
by a USD 19 billion allocation as a financial stimulus to hospitals and doctors for
the use of EHR and health information technology. The scope of its application was
extended to cover all entities offering the so-called Personal Health Record (PHR),
such as Google or Microsoft.
(^67) The Privacy Act of 1974 , 5 U.S.C.§552a.
(^68) The Electronic Communication Privacy Act of 1986 , 18 U.S.C.§2510-2521, 2701–2710.
(^69) The Americans with Disabilities Act, Pub.L. 101–336, 104 Stat. 327.
(^70) The Health Insurance Portability and Accountability Act, Pub.L. 104–191; 110 Stat. 1936.
(^71) The American Recovery and Reinvestment Act of 2009 , Pub.L. 111–5; 123 Stat. 115.
(^72) Vogenberg et al. (2010a), p. 629.
(^73) Institute of Medicine of the National Academies ( 2009 ), p. 3.
Challenges of Personalized Medicine: Socio-Legal Disputes and Possible Solutions 45