Beginning in the mid-1990s, three widely discussed state appellate court decisions in medical malpractice cases held that physicians had a duty to warn the genetically at-risk relatives of their patients. Two of these cases clearly stated that any duty owed to relatives would be satisfied by informing the patient of the genetic risk to family members and the need for the patient to warn relatives of the familial risk. One of the cases stated that, under certain circumstances, a physician might have a duty to inform at-risk relatives directly. From this single judicial pronouncement, some observers have concluded that physicians have a duty to warn genetically at-risk relatives, and the failure to do so would expose them to liability. This duty is assumed to apply equally to other health-care providers, including genetic counselors and nonphysician clinical geneticists.

The theory that physicians are legally required to warn their patients’ relatives when the patients fail to do so, even over the objection of their patients, raises serious concerns about professional responsibility and possible conflicts with federal health privacy law.1 In the intervening years since these three judicial decisions the issue has not been put to rest. If anything, whether there is a duty to warn relatives of patients is an even greater source of confusion today. The introduction of whole-genome and whole-exome sequencing has increased the number and variety of identifiable genetic risks for patients and their relatives. Consequently, providers who frequently order genetic tests are likely to encounter this challenge quite often. They are also more likely to deal with genetic test results that are especially difficult for providers to explain and more difficult for patients and family members to understand.

This article reconsiders the legal and ethical issues raised by a health-care provider’s duty to warn genetically at-risk relatives, and it addresses the following questions: (i) Do providers have a legal duty to undertake reasonable efforts to ensure that their patients warn genetically at-risk relatives of important risks? (ii) If a patient fails to warn an at-risk relative or refuses to do so, does a provider have a duty to warn at-risk relatives directly? (iii) What criteria should be used to determine whether to warn a patient’s genetically at-risk relatives? and (iv) Is the duty to warn genetically at-risk relatives likely to change in the future?

Legal issues

Three key cases

Pate v. Threlkel

In 1987, Marianne New received treatment for an autosomal dominant form of medullary thyroid carcinoma. In 1990, her adult daughter, Heidi Pate, also was diagnosed with this disorder. Pate then sued New’s physicians asserting that the physicians had a duty to warn New’s children of their risk and, if they had done so, Pate would have been tested and received prompt treatment. The Florida Supreme Court held that under Florida’s medical malpractice act a duty to warn exists if a reasonably prudent physician would warn the patient of the genetic nature of the condition. Although a physician’s professional and legal duty extends to a patient’s children, “in any circumstances in which the physician has a duty to warn of a genetically transferable disease, that duty will be satisfied by warning the patient.”2

Safer v. Estate of Pack

In 1956, Robert Batkin was treated by George Pack, a surgeon, for retroperitoneal cancer, and his care included a total colectomy and an ileosigmoidectomy for “multiple polyposis” of the colon. After a series of operations and other treatments, Batkin died in 1964 at the age of 45. At the time of his death, his daughter Donna was 10 years old. In 1990, Donna Safer, then 36, was diagnosed with metastatic colon cancer resulting from multiple polyposis. In 1992, she filed a lawsuit against the estate of Dr Pack, who had died in 1969, alleging that the failure of Dr Pack to inform her father of the genetic nature of his condition failed to meet the standard of care prevailing at the time and prevented her from obtaining early treatment for her condition.

The New Jersey appellate court declared that a physician has a duty to warn those known to be at risk of a genetic disorder, and significantly stated that the duty may not always be satisfied by warning the patient. “It may be necessary, at some stage, to resolve a conflict between the physician’s broader duty to warn and his fidelity to an expressed preference of the patient that nothing be said to family members about the details of the disease.”3

The implications of a direct duty to warn are troubling. What the court casually termed the patient’s “expressed preference” for the physician not to warn relatives has been a fundamental tenet of medical ethics since the time of Hippocrates, and a physician’s duty of confidentiality is widely recognized by the common law and numerous statutes. Undermining trust in the physician–patient relationship would have profound implications for the health of individual patients as well as public health.

In 2001, the New Jersey Legislature effectively overturned the decision in Safer by enacting a broad genetic privacy statute.4 The law prohibits any disclosure of individually identifiable genetic information without the consent of the individual or the individual’s legal representative. There are several exceptions, including forensic identification, paternity determinations in compliance with New Jersey law, and pursuant to a court order. A physician’s nonconsensual disclosure of genetic information to a patient’s at-risk family member without the consent of the patient clearly violates the New Jersey statute.

Molloy v. Meier

In 2001, Kimberly Molloy brought medical malpractice actions against three physicians who treated her young daughter in which she claimed that the physicians were negligent in failing to diagnose her daughter’s fragile X syndrome. She alleged that she was specifically told that her daughter’s health problems were not genetic in origin and that the risk of having another child with a similar affliction was “extremely remote.” Molloy subsequently had a son who was diagnosed with fragile X and her daughter also later tested positive for fragile X. The Minnesota Supreme Court held that a physician may owe a duty to a third party who is not a patient of the physician and that a legal action could be based on the failure to warn the mother of the risk to a future child.5

The Molloy case has more in common with prior medical malpractice cases for “wrongful conception” than it does with the Pate and Safer cases. For example, prior wrongful conception cases found liability where a negligent failure to diagnose an affected child resulted in the parents having another child with cystic fibrosis6 and congenital optic nerve hypoplasia.7 Nevertheless, Molloy is often referenced along with Pate and Safer for the proposition that a duty to provide genetic information extends beyond the patient to those who foreseeably may be affected.


The most significant legal development on this topic since the Pate and Safer decisions was the promulgation of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which became operational in 2003.8 Other than a definitional provision,9 a provision dealing with de-identification,10 and two provisions dealing with health plans,11 the Privacy Rule does not contain any special provisions for genetic information. Genetic information is subsumed within health information. According to the Privacy Rule, uses and disclosures of protected health information beyond treatment, payment, and health-care operations generally require a HIPAA-compliant, written authorization signed by the individual.12 The Privacy Rule preempts or supersedes contrary state laws that are less protective of privacy rights.13

The HIPAA Privacy Rule contains numerous exceptions, including 12 “public purpose” exceptions,14 which permit covered entities to disclose protected health information without authorization for law enforcement, public health, national security, and similar uses. The only exception involving warnings to at-risk individuals is a provision for “Uses and disclosures to avert a serious threat to health or safety,”15 which permits disclosure of protected health information when the person to be warned is the subject of a serious and imminent threat of physical harm. This exception is concerned with serious threats, such as in the famous Tarasoff case, where an individual disclosed to his psychotherapist that he intended to, and later did, brutally murder a female acquaintance who had spurned his affections.16, 17

Another of the public purpose exceptions in the HIPAA Privacy Rule is for “Uses and disclosures required by law.”18 The exception is not expressly limited to statutory or regulatory requirements, and it includes the common law, the body of judicially developed legal doctrines developed over time.19 The regulatory language that outlines this “required by law” exception, however, refers to three other exceptions for applicability: disclosures about victims of abuse, neglect, or domestic violence; disclosures for judicial and administrative proceedings; and disclosures for law enforcement purposes. These examples make it clear that this exception involves laws dealing with criminal justice and it was not meant to apply to disclosures of patient health information to genetically at-risk relatives.

Under the Privacy Rule, uses and disclosures of protected health information for treatment purposes are permitted without consent or authorization.20 Although recognizing that an overly broad interpretation of treatment could compromise the privacy of patients, the drafters of the Privacy Rule took the position that the treatment exception includes treatment of individuals other than the patient whose information is being used or disclosed.21, 22

In 2013, the Office for Civil Rights of the Department of Health and Human Services, which enforces the HIPAA Privacy Rule, published a questionable interpretation that “health care providers may share genetic information about an individual with providers treating family members of the individual who are seeking to identify their own genetic risks, provided that the individual has not agreed to a restriction on such disclosure.”23 Under the Privacy Rule, individuals may request a restriction on the disclosure of their health information, but covered entities, including health-care providers, are not required to grant the request.24 Therefore, the 2013 interpretation would apply if there has been no agreement; either the patient was not informed of the disclosure or the patient requested a restriction, but it was not granted by the provider. The potentially harmful effects of this interpretation are lessened by the fact that health-care providers are not required to make these disclosures and they may make them only to another health-care provider. The exception does not extend to a provider directly warning at-risk relatives.25 In my view, the Office for Civil Rights’ broad definition of treatment coupled with nonconsensual disclosures of individually identifiable genetic information seriously undermines health privacy and conflicts with established principles of professional ethics discussed below.

Ethical considerations

A logical starting point is the ethical codes of the two main health professions involved in clinical genetics and genetic counseling. The AMA Code of Medical Ethics does not authorize physicians to disclose individually identifiable genetic information without consent or over the objection of their patients. It simply provides that physicians “have a professional duty to protect the confidentiality of their patients’ medical information, including genetic information.”26 Similarly, the National Society of Genetic Counselors Code of Ethics provides that genetic counselors should work to “maintain the privacy and security of their client’s confidential information, unless released by the client or disclosure is required by law.”27 Both codes declare that it is impermissible to disclose confidential information without consent.

The duty to warn also has been the subject of considerable scholarship and professional guidelines. Both the President’s Commission for the Study of Ethical Problems in Medicine and Biomedical and Behavioral Research in 1983 (ref. 28) and the Institute of Medicine in 1994 (ref. 29) supported professional disclosure to at-risk family members if the patient refused to do so only in a narrow set of circumstances, such as when there is a high probability of serious harm. The most influential of the guidelines is the statement of the American Society of Human Genetics (ASHG), which was published in 1998, not long after the Pate and Safer cases were decided. According to the ASHG, as a general rule, confidentiality ought to be respected and no disclosures of genetic information ought to be made by a health-care provider without the consent or authorization of the patient. Nevertheless, exceptional circumstances may justify otherwise impermissible disclosures.

Disclosure should be permissible where attempts to encourage disclosure on the part of the patient have failed; where the harm is highly likely to occur and is serious and foreseeable; where the at-risk relative(s) is identifiable; and where either the disease is preventable/treatable or medically accepted standards indicate that early monitoring will reduce the genetic risk.30

The circumstances for breaching the general rule of nondisclosure are quite limited, and even if they are met, direct disclosure to at-risk relatives is permissive rather than mandatory.

The narrow exception created by the ASHG was not intended to establish a broad duty on the part of health-care providers to warn genetically at-risk relatives of their patients. Following the adoption of the HIPAA Privacy Rule it is reasonable to conclude that the ASHG’s exception to the general rule of confidentiality and nondisclosure has been superseded as a matter of law. Therefore, if a provider warns a patient’s relatives without the consent or authorization of the patient it would violate the HIPAA Privacy Rule.

An ethics framework

Beyond legal doctrines, regulations, and professional statements it is valuable to consider how various disclosure arrangements actually affect the key parties. Table 1 presents the options for issuing warnings and their effects on providers, patients, and at-risk relatives. “Warning” means offering to share relevant genetic information about the patient and its implications for family members.

Table 1 Options for and effects of warning a patient’s genetically at-risk relatives

The first row of the table considers the option of not giving any warnings. This may be viewed as positive by providers because if there is no duty owed to at-risk relatives, then there can be no legal liability for failing to warn them. In addition, it may be extremely burdensome for providers to determine all of a patient’s at-risk relatives and to obtain their contact information, especially if the patient is unwilling to assist in the process. For the patient, doing nothing would be considered positive if he or she objects to warning at-risk relatives. There are many reasons why a patient might object temporarily or permanently to warning relatives, including embarrassment about the medical consequences of the disorder, unease in sharing the information, and severely strained personal relationships. The lack of a warning must be considered negative for the relatives, because they do not have an opportunity to receive potentially life-saving information.

Commentators who support providers giving warnings to at-risk family members over the objection of their patients justify the disclosures because of the potential life-saving benefit to the relatives and the assumedly unjustified refusal of the patient to provide or authorize a provider to give a warning.31, 32 In these rare cases, perhaps the patient is not irrational or motivated by intrafamilial discord. For example, suppose the patient, a middle-aged widower with an autosomal dominant cancer syndrome, refuses to share the information with his adult daughter. The patient might know that his daughter is the product of his late wife’s infidelity and he does not want to share this family secret with anyone, including his oncologist, or have his daughter subjected to needless anxiety and an unnecessary genetic test. Health-care providers have a duty of loyalty and should respect the informed decisions of their patients.

The second row of the table considers the effects of warnings given by a provider over the objection of the patient. This must be viewed as negative for the provider because of the burden, the potential legal liability, and because warning relatives over the objection of the patient will severely undermine the provider–patient relationship and, quite possibly, end the relationship. Direct warnings by the provider will be viewed as a negative by the patient, because the provider will be acting directly contrary to the patient’s expressed wishes. Because at-risk relatives will receive an opportunity to obtain important health information it will be viewed positively by many of them. It would be viewed negatively by relatives who do not want to know their risks, but who are nevertheless contacted by a relative’s physician who is offering to share very important family medical information.

The third row considers the effects of voluntary warnings given by the patient. This would be positive for the provider because it relieves a burden and does not strain the provider–patient relationship. The provider is still likely to have a role in the process, as discussed in the following section. For the patient, giving warnings to at-risk relatives may be uncomfortable because of the subject matter or strained family relationships. With appropriate counseling, however, a substantial percentage of patients can be expected to appreciate the importance of providing a warning. If the patient does not want to give the warning personally, the patient can ask the provider to do so or to provide assistance. Because at-risk relatives will be afforded an opportunity to receive important health information, it is likely to be viewed positively by them.

To summarize Table 1, having the patient give warnings is the only approach that provides positive outcomes for all three interested parties. Although the table answers the question of who should give the warnings, the following two questions still need to be answered: (i) What genetic criteria should be used to determine whether a warning should be given? and (ii) What steps by a provider are required to ensure that the patient provides an accurate and appropriate warning?

Elements of the warning

A great deal has been written about the duty to inform, notify, or warn patients, research participants, and family members about genetic information. Disclosure of incidental findings in clinical settings33, 34 and return of results in research35, 36 are areas of particular scholarly and practical interest. It is beyond the scope of this article to explore those issues other than to observe the criteria often discussed for deciding whether to inform individuals about genetic risks: severity of the condition, mode of inheritance, penetrance, patterns of expression, age of onset, reproductive significance, availability of medical interventions, social value of the genetic information, and expressed views of the individual about receiving genetic information.

Regardless of whether the warning is provided by a patient or health-care provider, any warning should be given in a reasonable, comprehensible manner to enable informed decision-making. Thus, the message, whether oral or written, should be clear and without medical jargon or euphemisms. It should include an appropriate sense of urgency, especially for conditions potentially requiring immediate medical assessment and possible intervention, such as medullary thyroid carcinoma, familial adenomatous polyposis, and hereditary diffuse gastric cancer. Those tasked with providing the warning should be persistent in efforts to reach at-risk relatives and deliver the essential information. Health-care providers should encourage but not coerce the sharing of information.37

One common way of facilitating the warning of at-risk relatives is through a family sharing letter. These documents are crafted by physicians or genetic counselors to include relevant information that can be delivered by the patient or the patient’s designee to at-risk family members. The letters for sharing with family members are similar to letters routinely given to patients and placed in a patient’s medical record after genetic counseling.38 The letter also generally contains an offer of assistance for more information, consultation, or recommendations of health-care providers in the family member’s geographic area. The use of such a letter is confirmation that in clinical genetics and genetic counseling the unit of treatment is often the family.39 Providing a letter and making sure the patient understands the information will generally discharge the provider’s duty to warn, but for serious conditions needing immediate medical evaluation the provider may need to follow up and determine whether the warnings were given.

Emerging issues

Although the principal cases involving the duty to warn at-risk relatives were decided in the mid-1990s, it would be a mistake to view the issue as an old one or that the enactment of the HIPAA Privacy Rule resolved all possible legal issues. The ethical and legal dimensions of the duty to warn at-risk relatives are emerging in more settings and the following three factors are likely to gain in prominence: (i) more genetic information is available, (ii) genetic information is being linked to a wide range of other data, and (iii) new clinical implications of genetic information are being discovered constantly.

First, the reduced cost and more widespread availability of whole-genome and whole-exome sequencing means that substantial predictive genetic information could be discovered. Unlike the Pate, Safer, and Molloy cases, where a patient’s symptoms led to a diagnosis of a genetic condition, if genetic information is based on sequencing data there may be multiple risks to consider for warnings. Direct-to-consumer genomic sequencing removes health-care providers from the initial part of the process, but they may still need to play a role in counseling their patients, which could include the implications for at-risk relatives.

A related issue is who qualifies as a genetically at-risk relative or, in other words, how far should a legal duty to warn extend? According to the Genetic Information Nondiscrimination Act, a “family member” includes a fourth-degree relative.40 Such a broad civil rights definition is unlikely to be adopted under the tort law doctrine of foreseeability or codes of professional conduct. Thus, as a practical matter, the main issue is how detailed pedigrees should be when familial risks are explained to the patient. Under any definition of “family member” or “at-risk relative” providers ought to be able to satisfy their legal duty by explaining the genetic risk involved and the need to notify relatives.

Second, in the future, genetic information is less likely to be freestanding. Assuming the growth of precision medicine, health risk assessments will consider genetic information along with epigenetic information, microbiome information, exposure data, medical history, data from mobile health apps, and numerous other data sources.41 It is unknown whether the algorithms used for predicting risk will be accurate, especially in the short term, but because of the sensitive information involved significant privacy concerns will be raised that can complicate the process of warning at-risk relatives.

Genetic information is widely viewed as sensitive information, and this often plays a part in an individual’s reluctance to warn at-risk relatives. When the risk is based on genotype plus other factors, such as environmental exposures, it might become even more sensitive if the exposures involve unlawful (e.g., illicit substances) or embarrassing activities (e.g., sexual practices). In such an event, counseling may be needed to prepare the patient to provide a warning in a way that is accurate but not needlessly embarrassing.

Third, medical intervention in light of predictive genetic risk information is dynamic. What today is a variant of unknown significance may be better understood months or years in the future. What today is a largely unpreventable or untreatable condition may soon be controllable. This raises the issue of whether health-care providers have a duty to recontact patients (and through the patient their at-risk relatives) to provide additional information or warnings and, if such a duty exists, for how long does it continue?

The issue of recontacting patients to provide updated information is emerging in various contexts, such as informing patients about drug or medical device recalls, new studies on lifestyle and health risks, and changes in prevention guidelines and treatment options.42 Electronic health records and technology that enables the simultaneous contacting of all patients with certain medical conditions make such warnings feasible. It is valuable to anticipate the possibility of future developments and routinely to query patients about their interests in being contacted in the event of new developments and, if so, their preferred method of contact. It is not clear for how long such a duty persists, but it should not be open-ended, especially when the individual is no longer a regular patient. Furthermore, recontacting should be reserved for truly exceptional, crucial updates or patients will ignore the communication as spam, advertising, or routine health promotion.


Physicians and other health-care providers have legal and ethical duties to make reasonable efforts to ensure that the genetically at-risk relatives of their patients are offered appropriate warnings. These duties can be satisfied by warning their patients and encouraging and assisting their patients in providing warnings to their relatives. Health-care providers are neither required nor permitted to warn their patients’ relatives without the consent of their patients. The legal cases that helped develop this doctrine involved warnings initially based on diagnoses of affected individuals, but the future applications of the duty to warn genetically at-risk individuals increasingly will be based on data derived from whole-genome sequencing and other predictive technologies.