Presymptomatic Testing and Confidentiality in the Age of the Electronic Medical Record

For more than 20 years, we have performed presymptomatic testing for Huntington’s disease (HD) according to generally accepted guidelines (1, 2). In part, strong concerns about the confidentiality of medical records steer these guidelines. These concerns include the harm of disclosing gene-positive results when a person is still apparently healthy. Discrimination in health insurance and employment on the basis of genetic test results is illegal in the United States, but that protection is imperfect (3). These already limited protections do not extend to other types of insurance coverage, such as life insurance and long-term care insurance. Another concern may be inadvertent disclosure by a family doctor to family members, some of whom may be obligate gene carriers. Finally, there has historically been a strong concern that disclosure of gene-positive status could lead to suicide (4). Suicide does occur, though generally data suggest that carrying the gene or having manifest symptoms confers an immensely stronger risk for death by suicide than the revelation of a gene-positive result per se (5–8).

As a result of these concerns, current professional guidelines strongly recommend in-person delivery and interpretation of test results to the patient (1, 9). Guidelines also encourage assessment of psychological status before testing, before revealing results, or both (1). The success of following these guidelines may be suggested by the observation that death by suicide after presymptomatic testing following these guidelines is rare (10, 11), even though suicidal thoughts and suicide are common in HD (12, 13).

By contrast, many electronic medical record (EMR) systems allow patients to access their test results online, meaning patients may obtain their results on their own when they may be alone, without the presence of professional support or possibly even social support (14). Furthermore, EMR systems facilitate sharing medical records, including test results, with other physicians, who may or may not know the patient. Such sharing, however, can also lead to inadvertent disclosure.

Recently, our institution converted to a commercial EMR system. This change raised questions about the confidentiality of the record for our presymptomatic-testing patients. For instance, many patients do not wish genetic test results to be available to anyone else, including their insurer or even their primary care physician. Yet, patients who visit an emergency department at another institution that uses the same EMR may not realize that giving permission for the emergency team to see their medication list may also enable sharing of their entire record with all caregivers at the other institution. Furthermore, patients may not realize that a properly signed release request may lead the centralized medical records departments at most large institutions to release their entire medical record, including genetic testing results. The solution to these confidentiality concerns is not obvious or simple.

We therefore reached out to several national leader institutions to ask how they had addressed these concerns. Our goal was not to choose a nationally representative sample but rather to identify possible solutions from peer institutions from which we could identify best practices. Here, we present the results, believing that the information will likely be useful to other institutions, as our concerns are unlikely to be unique.

Methods

Thirteen institutions were selected from well-known medical centers with long-standing HD clinics, designated as the Huntington’s Disease Society of America (HDSA) Centers of Excellence and engaged in presymptomatic HD testing. The clinic social worker at each center was the initial point of contact. In some cases, the social worker obtained the answers from other staff members at his or her institution or referred us to another appropriate staff member. We chose questions relevant to our concerns. All the predetermined questions are presented in Table 1.

Results

We received responses from 10 of the 13 institutions selected. Of these, seven are affiliated with hospitals in the U.S. News Best Hospitals Rankings for neurology. Several institutions requested not to be identified, and thus we do not name the responding institutions except to state that our own institution is included in these responses. Responses are summarized in Table 1.

Respondents provided a number of additional comments that demonstrate the wide variety of approaches to record the presymptomatic testing process in the EMR. These comments are available online (DOI 10.6084/m9.figshare.12055194). Briefly, these approaches included the following:

• Delaying the appearance of test results in the EMR in a variety of ways,

• Recording presymptomatic testing results only on paper,

• Restricting documentation of clinical information (omitting the specific reason for the visit, not documenting the test results visit, or not documenting social work visits),

• Obfuscating data (e.g., by not specifying the genetic test ordered or by scanning results as a digital image),

• Recording all information under a pseudonym generated either by site staff or by the patient, or

• Using a laboratory outside the institution and not connecting results to the EMR.

Several respondents noted that these practices produced discomfort or difficulties. For instance, with pseudonyms, patients could not later document having had a normal test without retesting. Respondents also noted the potential for human error with these workarounds. Another concern was that many providers with access to the EMR may not distinguish gene-positive status from a clinical diagnosis of manifest HD. Differences in philosophy and in practice were obvious. For example, staff at one institution were uncomfortable with allowing pseudonyms, whereas another respondent expressed confusion as to why institutions would have such a concern.

Discussion

There is no consensus among nationally respected institutions as to how to resolve the collision between the virtues of a shared EMR and the goal of patient control of confidential medical information. Furthermore, confidentiality remains compromised in several of the practices disclosed. These results demonstrate that important issues remain unresolved.

The HDSA originated a testing protocol in 1989 that included an effort to protect patients against premature or uninformed release of genetic information. The consortium revised the testing guidelines several times—in 1994, in 2003, and, most recently, in 2016—and each revision upheld the standard of in-person disclosure of test results (1). Most participants in presymptomatic testing programs agree with this standard (2). This choice, however, conflicts with the final Clinical Laboratory Improvement Amendments (CLIA) program and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which states that covered entities must disclose results despite their possible “sensitive nature or potential for causing distress to the individual” (15, 16). The rule provides an exception for cases in which the information “is reasonably likely to endanger the life or physical safety of the individual or another person,” so long as the patient has the right of review by an unaffiliated health care professional. That exception is the core of the concern behind the HDSA protocol, but the CLIA-HIPAA Final Rule applies it on an individual basis rather than a group basis.

HIPAA, established in 1996, allows sharing information with insurers without patient consent, but we note the potential conflict of a widely shared EMR with at least the spirit of HIPAA’s mandate that generally patients control the information in their medical records and should determine when it is shared more broadly. Furthermore, HIPAA does not grant permission to open a patient’s information to those not directly involved in the patient’s care.

Some have argued that the virtues of a shared medical record outweigh the loss of confidentiality (17). They ask how a clinician can provide optimal care for a patient without full knowledge of his or her medical status and risks. We believe this is a valid point, but the balance of this potential gain with the loss of confidentiality is a decision that should at a minimum involve the patients, if not be controlled entirely by them. Additionally, our experience is that lack of control over the confidentiality of their medical record is among the most common reasons patients give for avoiding or delaying genetic testing for HD in advance of symptoms. Others have shared similar views (18).

Pseudonymous testing is used by some sites as a solution to patient confidentiality concerns. It can be done in two ways: one in which someone at the testing center maintains a list of the patient’s actual identities and another in which the patient merely invents a name to be used in the medical record. In our view, either type of pseudonym provides only a partial solution to the conflict of values. The pseudonym may protect the patient’s identity but not the durability of the medical record, the continuity of care, or a unified medical record. Pseudonymous testing is at best a bureaucratic solution to a conflict of values that deserves genuine resolution.

Klitzman (19) extensively investigated ethical dilemmas in genetic testing, including the exclusion of genetic testing from the medical record. He noted that these concerns pose “critical challenges” and create tension between potential medical benefits versus potential for discrimination. Klitzman also noted that often patients do not trust that laws will protect them, frequently leading patients to withhold genetic results from physicians, assuming the information will be entered into their EMR. He acknowledged that this may impede continuity of care.

Arias and Karlawish (20) discussed similar issues related to preclinical studies of Alzheimer’s disease (AD). They concluded the following:

Unfortunately, the field does not seem to have moved forward substantially since this conclusion.

Recommendations

The least controversial ethical consideration is patient autonomy, specifically respect for the patient’s choices about the confidentiality of the information in the medical record. This respect may reasonably extend to other sensitive patient care issues, such as HIV status, cognitive testing, and a history of psychosis. These cases may differ as a result of competing concerns, including possible medication interactions or current need for treatment. Furthermore, impaired cognition or limited insight color the decisions in some of these other settings. On the other hand, even for asymptomatic gene carriers, optimal diagnosis of future symptoms may require access to this sensitive information. Here, beneficence and the duty to provide optimal care compete with autonomy.

The second ethical concern arises from the clinical consensus that the potentially life-changing HD test result should be provided to patients in a supportive setting with expert clinical interpretation. The value here is nonmaleficence. This clinical consensus, of course, may be seen as paternalistic, at odds with the autonomy of those patients who wish to receive their results without returning to the office.

We do not claim to have solved the conflicts of values, and we encourage further dialogue, including with patients. But we believe that the medical record must subserve ethical values, not the other way around. As a consequence, we believe that generally medical record systems must adapt to and respect the patient’s desires for confidentiality. Favoring confidentiality is especially compelling in the case of presymptomatic testing, where there are no competing present concerns about patient capacity or the need for treatment. The medical record must allow these patients to restrict access to this sensitive information.