Exploring access to genomic risk information and the contours of the HIPAA public health exception

Considerable resources have been invested in research to identify pathogenic and likely pathogenic variants that cause morbidity and mortality and also in returning these results to patients. The public health impact and cost-effectiveness of these efforts are maximized when probands' relatives are informed of their risk and offered testing. However, such 'Traceback' cascade testing programs face multiple obstacles, including perceived or actual legal and regulatory hurdles. Here, using genetic cancer syndromes as a test case, we explore the contours of the Public Health Exception to the HIPAA Privacy Rule to assess whether it is a viable pathway for implementing a Traceback program. After examining the Privacy Rule as well as state laws and regulations for reportable conditions and genetic privacy, we conclude that this is not currently a viable approach for Traceback programs. We conclude by reflecting on ethical considerations of leveraging HIPAA's public health exception to disclose PHI directly to at-risk relatives and offering insights for how legal hurdles to such a Traceback program could be overcome, if desired.