Oregon Genetic Privacy Law

The law generally requires informed consent to obtain genetic information, subject to certain exceptions. One of the exceptions is for anonymous genetic research, which requires notification to or consent from the research subject.

Subsequent statutes direct the Department of Human Services to adopt rules to implement a notification requirement for anonymous research subjects. Anonymous research must be determined by an Institutional Review Board to be exempt from review requirements.

Under the Administrative Rules, the researcher must demonstrate that the research subject was notified that anonymous research might take place in the future and, at the time of notification, did not request that the sample be withheld from the anonymous research. Multiple notifications are permitted, but at least one notification is required. Any notification must include a general description of the type of sample intended to be used, a general explanation of the meaning of anonymous research, and an opportunity for the subject to withhold the sample from the anonymous research (OAR 333-025-0120(3 & 4)).

The statute requires researchers conducting non-exempt research to obtain informed consent of the individual research subject or his or her representative. The consent must comply with statutory requirements and the Department of Human Services must adopt rules conforming to the Federal Policy for the Protection of Human Subjects, 45 CFR 46, particularly addressing the operation and appointment of Institutional Review Boards, which Boards must register with DHS pursuant to DHS rule.

If the research anticipates DNA samples or genetic information that is coded, identified, identifiable, or linked to identifiers, the statute imposes additional requirements.

If the genetic research is coded, the research subject must grant informed consent for the specific research project or genetic research generally. The research must be approved by an IRB after disclosure to the board by the researcher of the risks of coding. Approval of the IRB does not need to take any particular form, so long as the IRB is fully informed in the course of the researcher’s presentation and approves the protocol with the clear understanding that coding is an element of the research. The code must not be derived from individual identifiers, must be kept securely and separately from the DNA samples and genetic information, and must not be accessible to the investigator unless specifically approved by the IRB. The data must be stored securely in electronic files or by other means with access limited to necessary personnel. The data must also be limited to elements required for analysis and meet the criteria for a “limited data set” (45 CFR 164.514 (e)). Finally, the investigator must be a party to the data use agreement. An agreement into which a “covered entity” enters with the recipient (e.g., researcher) of a limited data set that establishes the ways in which the limited data set may be used and how it will be protected (45 C.F.R. 164.514 (e)).

The statute and rules also addresses recontact of research subjects. The statute prohibits recontact of a subject based on coded information. The rule requires the subject be notified of the specific circumstances under which recontact can occur in the original consent process. Any recontact option, whether part of the original protocol or a later application, must be approved by the IRB. However, if recontact was not contemplated during the original consent process, the researcher must seek separate IRB approval for recontact. The threshold for permissible recontact is extremely high. Such approval must assure three conditions: that the findings are scientifically valid and confirmed (e.g., the DNA was analyzed by a CLIA approved facility); that they have significant implications for the subject’s or public’s health, AND that a course of action to ameliorate or treat the subject’s or the public’s health concerns be readily available. Additionally, the researcher is required to determine and adhere to the expressed wishes and desires of the research subject in relation to disclosure of genetic information to that individual. Finally, if research results are disclosed to a subject, appropriate medical advice and referral must be provided (OAR 333-025-0130).

Retention of genetic information obtained for research is addressed in the statute. Genetic information obtained for anonymous research conducted after notification or with consent may be retained. Genetic information obtained for non-exempt research may be retained with the authorization of the individual research subject. Genetic information obtained for non-exempt research should be destroyed promptly upon the completion of a non-exempt research project or withdrawal of the individual from the project, unless the research subject has directed otherwise by informed consent. An individual may inspect, request correction of and obtain genetic information from his or her records, if that information is coded, identified, or identifiable (ORS 192.537).

The general rule is that disclosure of genetic information is not allowed and cannot be compelled, unless specifically authorized by the tested individual in a consent form prescribed by DHS rules (ORS 192.539(1)(d)). This would suggest that, for research purposes where a repository was being developed or genetic information was going to be stored, an informed consent form approved by an IRB would need to be supplemented with the DHS consent form in order to disclose the genetic information to the repository.

The statute grants a private right of action for violation of the statutes on genetic privacy. Violation of an individual’s rights in genetic information, retention, or destruction of that information or failure to follow DHS procedures for IRBs can result in penalties ranging from $100 for inadvertent violation to $25,000 for a knowing violation. Violation of the informed consent or disclosure requirements can result in penalties ranging from $1000 for an inadvertent violation to $250,000 for a knowing violation. Affirmative defenses to such claims include prompt corrective action (ORS 192.541).