Note that we have previously adopted a 2014 Edition health certification “family history” criterion that referenced the HL7 standard for representing genomic information and are proposing a 2015 Edition health history certification criterion that references “family – pedigree” that same standard as well as a related IG. In addition to their relevance for the tested patient, genomic test results are unique in that they have the potential to inform the health care of blood relatives of the tested individual, similar to a shared family history. We note that any application of genomic information across family members must be done in accordance with the HIPAA Privacy Rule and other privacy and patient rights laws regarding genetic information at the federal and state levels. We acknowledge that individually identifiable genetic information may be subject to federal and state privacy laws and regulations that are more privacy restrictive than the HIPAA Privacy Rule. As such, these privacy issues will impact any certification criteria or policy we might propose to adopt in future rulemaking. We therefore welcome input on factors to consider for health IT that allows the user to use or disclose genetic information in a manner compliant with federal and state privacy laws. Note that we are proposing two new 2015 Edition certification criteria for segmentation for privacy and segmentation for “data – send” “data privacy that would focus on the capability to separately track individually – receive” (“segment”) identifiable health information that is protected by rules that are more restrictive than the HIPAA Privacy Rule (please refer to Section III.A.3 for more information). We believe that the capabilities offered by the proposed segmentation for criteria could be leveraged “data privacy” for the segmentation of individually identifiable genetic information that are protected by federal and state privacy laws and regulations.
Note that we have previously adopted a 2014 Edition “family health history” certification criterion that referenced the HL7 standard for representing genomic information and are proposing a 2015 Edition “family health history – pedigree” certification criterion that references that same standard as well as a related IG. In addition to their relevance for the tested patient, genomic test results are unique in that they have the potential to inform the health care of blood relatives of the tested individual, similar to a shared family history. We note that any application of genomic information across family members must be done in accordance with the HIPAA Privacy Rule and other privacy and patient rights laws regarding genetic information at the federal and state levels. We acknowledge that individually identifiable genetic information may be subject to federal and state privacy laws and regulations that are more privacy restrictive than the HIPAA Privacy Rule. As such, these privacy issues will impact any certification criteria or policy we might propose to adopt in future rulemaking. We therefore welcome input on factors to consider for health IT that allows the user to use or disclose genetic information in a manner compliant with federal and state privacy laws. Note that we are proposing two new 2015 Edition certification criteria for “data segmentation for privacy – send” and “data segmentation for privacy – receive” that would focus on the capability to separately track (“segment”) individually identifiable health information that is protected by rules that are more restrictive than the HIPAA Privacy Rule (please refer to Section III.A.3 for more information). We believe that the capabilities offered by the proposed “data segmentation for privacy” criteria could be leveraged for the segmentation of individually identifiable genetic information that are protected by federal and state privacy laws and regulations.
2015_editionnprm_ofr_disclaimer_3-20-15.docx