5.5 Privacy, Confidentiality, Documentation & Genomic Data Security
Key Takeaways
HIPAA Privacy and Security Rules treat genetic information as protected health information (PHI) when held by covered entities/business associates—governing use, disclosure, and safeguards.
Genetic counseling documentation must be accurate, timely, and sufficient to support clinical care, medical necessity, and continuity—without speculative or judgmental language.
Confidentiality can tension with duties to warn or protect identifiable third parties; genetics cases are taught as counseling/legal-awareness frameworks (Tarasoff-adjacent), not as license to give legal advice.
Genomic data security includes access controls, minimum necessary use, secure transmission/storage, vendor/BA agreements, and caution with email, portals, and research repositories.
Board items reward the best next privacy/documentation/security action—not absolute secrecy promises or casual oversharing with relatives or employers.
Privacy and security as everyday genetic counseling practice
After GINA’s non-discrimination frame (5.4), Domain 5C turns to how genetic information is handled: who may see it, how it is recorded, when confidentiality yields to competing duties, and how genomic data are secured. The Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules are the federal backbone for covered entities (health plans, most providers, clearinghouses) and their business associates.
On the CGC exam, privacy stems rarely ask you to recite regulatory subsection numbers. They ask whether you recognize PHI, apply minimum necessary thinking, document appropriately, avoid improper disclosures, and respond wisely when a client refuses to tell at-risk relatives.
HIPAA applied to genetic information
Protected health information (PHI) includes individually identifiable health information held or transmitted by a covered entity/business associate. Genetic test results, pedigrees with identifiers, counseling notes, and billing details tied to an individual are classic PHI.
| HIPAA concept | Practical meaning in genetics | Exam cue |
|---|---|---|
| Privacy Rule | Limits uses/disclosures of PHI; grants patient rights (access, amendments, accounting in defined ways) | Can we release results to a relative without authorization? |
| Security Rule | Administrative, physical, and technical safeguards for electronic PHI (ePHI) | Portal access, encryption, workstation policies |
| Minimum necessary | Use/disclose only what is needed for the purpose | Sending an entire chart when a result summary suffices |
| Authorization | Patient permission for many non-treatment/payment/operations disclosures | Employer, life insurer, or curious relative requests |
| Business associate | Vendors handling PHI (labs’ portals, cloud EHR, billing firms) need appropriate agreements/safeguards | Who hosts the genomic data? |
Genetic information is not “extra-secret HIPAA” by default—but it is sensitive
HIPAA does not create a separate “genetic-only” statute that replaces the Privacy Rule; genetic information is generally handled as PHI with heightened clinical sensitivity. Additional state genetic-privacy laws may impose stricter consent or disclosure rules—acknowledge without inventing statutes (same discipline as GINA state-law teaching).
Treatment, payment, and health-care operations (TPO) disclosures among involved clinicians often proceed under HIPAA without a separate authorization, but “involved” is not unlimited: do not email identifiable results to a relative who is not the patient, post pedigrees to social media, or discuss cases in public spaces.
Documentation standards for genetic counseling
Medical documentation in genetics supports clinical care, continuity, billing/medical necessity, risk management, and patient access rights. High-yield documentation content:
- Indication and history — phenotype, family history summary, prior testing.
- Counseling provided — risks/benefits/limitations discussed; psychosocial issues; decision aids used.
- Informed consent elements for testing (what was ordered, alternatives, residual risk, result types including VUS).
- Results disclosure — what was communicated, patient understanding, follow-up plan, cascade recommendations.
- Resources and referrals offered.
- Privacy/GINA discussion when material to the decision (protections and gaps).
| Documentation practice | Preferred | Risky / exam distractor |
|---|---|---|
| Tone | Objective, specific, respectful | Pejorative labels (“noncompliant,” “difficult”) without clinical facts |
| Uncertainty | Document residual risk and VUS counseling | Implying certainty the science does not support |
| Family history | Record what was reported and limitations | Fabricating relatives to meet testing criteria |
| Disclosures | Note authorizations and what was released | “Told sister everything” without patient direction/authority |
| Amendments | Follow institutional process for corrections | Quietly altering notes to hide an error |
Documentation is discoverable in legal and regulatory processes. Write as if a future clinician—and a future reviewer—must understand the care.
Confidentiality vs duty to warn: genetics awareness (not legal advice)
Genetics uniquely implicates blood relatives. A client may refuse to share a pathogenic variant that would change a sibling’s screening. Classic teaching draws on Tarasoff-adjacent duty-to-warn/protect ideas from mental-health case law and later genetics literature (e.g., discussions around warning identifiable at-risk relatives). For OpenExamPrep/CGC purposes:
- Frame this as counseling and legal-awareness, not as authorizing you to practice law or to declare a universal mandatory warning rule in every jurisdiction.
- Typical clinical pathway: explore barriers, offer support for disclosure, provide letters relatives can use, involve supervising clinicians/ethics/legal resources per institution when refusal creates serious preventable harm to identifiable third parties.
- Jurisdictions and institutional policies vary. Boards reward process: protect privacy by default, escalate appropriately, document efforts, avoid unilateral gossip to relatives as the first move.
| Approach | When it fits | Why |
|---|---|---|
| Supportive disclosure counseling | Most refusal cases | Preserves autonomy and often succeeds |
| Written tools for relatives | Patient agrees to indirect sharing | Maintains accuracy of medical facts |
| Ethics/legal consult | High-stakes preventable harm + persistent refusal | Policy and law are local |
| Immediate unauthorized call to a relative | Almost never the first board answer | Bypasses privacy process and role limits |
Emphasize: you are not giving the examinee legal advice to break confidentiality casually. You are teaching recognition of the tension and professional escalation.
Genomic data security basics
Genomic datasets are identifiable or re-identifiable, large, and often shared across labs, EHRs, research repositories, and patient portals. Security literacy for counselors:
- Access controls — unique logins, role-based access, no shared passwords.
- Secure channels — prefer approved portals/EHR messaging over consumer email for results; if email is used, follow institutional encryption/policy.
- Device hygiene — lock screens, avoid PHI on personal devices unless approved.
- Minimum necessary downloads — do not export full VCFs to USB “for convenience.”
- Vendor awareness — laboratories and software vendors are often business associates; breaches can affect thousands of examinees.
- Secondary use caution — research repositories and data-sharing require consent/IRB pathways (see 5.6), not silent clinical reuse.
- Breach response — know to report suspected incidents immediately through institutional channels.
| Risk | Example | Mitigation |
|---|---|---|
| Misdirected disclosure | Results faxed to wrong clinic | Verify identifiers; confirm fax/portal destination |
| Oversharing in family sessions | Discussing one relative’s result with another present without permission | Separate encounters; explicit permission |
| Portal account sharing | Spouse uses patient’s login indefinitely | Counsel on account control; document authorized representatives properly |
| Unsecured slides | Pedigree with names left on conference laptop | De-identify teaching cases |
Integrated scenarios
Scenario A — relative request: A patient’s sister calls asking for the patient’s BRCA result “because we’re family.” Best action: explain you cannot disclose the patient’s PHI without appropriate authorization; offer to help the patient share or provide a release process—not read the result over the phone.
Scenario B — employer letter: Employer requests “all genetic records” after a workplace wellness dispute. Best action: do not release without valid authorization and institutional review; GINA/employment issues may also apply (5.4)—privacy release and non-discrimination are related but distinct.
Scenario C — refusal to inform: Client with a highly penetrant pathogenic variant refuses to tell an identical twin. Best process: explore barriers, offer assistance, document, and involve supervising clinician/ethics/legal resources per policy when serious identifiable harm is at stake—not an immediate unauthorized disclosure as the default first step.
Scenario D — security: Counselor downloads identifiable exome files to a personal laptop to finish a letter at a café on public Wi-Fi. This fails Security Rule/practical security expectations; use approved systems and secure environments.
Common traps
- Disclosing PHI to relatives or employers without authorization because “they deserve to know.”
- Promising absolute secrecy that conflicts with mandatory reporting or institutional safety policies.
- Charting speculative blame or altering notes improperly.
- Treating genomic files as ordinary attachments without safeguards.
- Confusing HIPAA privacy with GINA non-discrimination (both may apply; they answer different questions).
- Giving definitive legal instructions about Tarasoff duties as if one nationwide genetics rule exists.
Quick exam checklist
- Is the requestor the patient or a third party? Authorization needed?
- Does documentation support care, consent, and follow-up without harmful language?
- If relatives are at risk and the patient refuses, did I counsel, document, and escalate—not freelance disclose?
- Are genomic data handled with minimum necessary access and secure systems?
- Am I separating privacy (HIPAA), non-discrimination (GINA), and research rules (Common Rule)?
A patient’s adult sibling calls the genetics clinic requesting the patient’s multigene panel result to guide their own screening. The patient has not signed an authorization. What is the most appropriate immediate action?
Read the pathogenic variant aloud because first-degree relatives always have a HIPAA right to another person’s results
Decline to disclose the patient’s protected health information without appropriate authorization and explain how the patient can share results or complete a release
Email the full clinic chart to the sibling’s employer wellness office
Post a de-identified summary to a public social media page so the sibling can find it
Which documentation practice best meets genetic counseling standards after disclosing a pathogenic variant?
Write only “results given” with no mention of residual risk, cascade recommendations, or understanding
Use pejorative labels for the patient instead of describing observed behaviors and clinical facts
Delete the pretest note so the chart shows only the positive result
Record what was disclosed, the patient’s questions/understanding, recommended medical and cascade follow-up, and resources offered, using objective language
A client refuses to inform an identifiable sibling who would clearly benefit from knowing a familial pathogenic variant. What is the best Domain 5C framing of the counselor’s role?
Explore barriers, support disclosure, document efforts, and involve institutional ethics/legal resources per policy when serious preventable harm to an identifiable third party remains—without treating Tarasoff-adjacent ideas as a license to give unilateral legal advice or to make unauthorized disclosure the automatic first step
Immediately call the sibling with the result because federal law always mandates warning in every genetics case
Promise the client that confidentiality can never yield under any institutional policy
Ignore the issue because family communication is never part of genetic counseling
Which action best reflects genomic data security expectations for electronic protected health information?
Share one clinic login among all genetic counselors for speed
Export identifiable exome files to a personal USB drive for café work on open Wi-Fi
Use role-based unique access, approved secure systems, and minimum necessary handling of genomic files, reporting suspected breaches through institutional channels
Email unencrypted spreadsheets of named patient genotypes to a personal Gmail account for “backup”
Sections you finish are checked off in the contents.