Advances in genetic and genomic testing technology have not only introduced the utilization of clinical genomic information into virtually every area of medical care, this testing has become an essential tool to achieve the goal of precision medicine. As genomic data become more complex, so too must the electronic health record (EHR) evolve to provide optimal care for patients, maximizing benefits while minimizing harm. Issues of patient autonomy, access, genetic literacy, privacy and protection, transferability of data, as well as the appropriate genomic data set are key in facilitating the incorporation of genomic information into patient care.

This points to consider document will discuss types of genomic information in the EHR, mechanisms of placement, data entry, usage, patient/provider access, results disclosure, portability, and privacy. It will highlight patient, family, and societal benefits; discuss areas of concern, identifying where further modifications are needed; and make recommendations for further optimization. It will also highlight unique characteristics of genomic information that require additional attention, as they relate to universal bioethical principles.


Defining the genomic data set: the scope of genetic data in the EHR

The definition of a genomic data set is a fluid one, as the nature and scope of genomic data analysis evolves. Diagnostic testing in the clinical setting may include a wide variety of methodologies, including but not limited to karyotyping, fluorescence in situ hybridization testing, chromosomal microarray, methylation polymerase chain reaction, targeted variant testing, sequencing and deletion/duplication testing of single genes, multigene panels, and exome or genome sequencing. As population-based variant screening for specific disorders emerges into clinical care, these should also be included in the patient’s data set.

Additional aspects of the genomic data set that merit consideration include not only the types of data, but also all relevant clinician reports, as well as their location in the subsections of the EHR. Genomic test results are frequently generated by reference laboratories and scanned to a portable document format (PDF), then uploaded to the EHR. The ease of access of these results may vary based on the EHR and the institutional or laboratory policies.

A vital component to the genomic data set that is not typically considered is the clinician’s interpretation of this data, entered as a clinical note or patient letter by the geneticist, genetic counselor, or other informed specialist. This provides crucial information that clarifies, and in some cases significantly alters, the interpretation of the raw genomic data in the laboratory report. The clinician’s interpretation may differ from that of the laboratory, given the clinician’s more detailed knowledge of the patient’s condition and other relevant information such as family history. The clinician’s report typically also includes genetic counseling, outlining the risk to family members. This information should be easily accessible by the patient and all clinicians, as often the test report alone is insufficient to guide medical care. Finally, the patient’s phenotype and the interpretation of their genomic test results may evolve over time, resulting in reclassification of variants, or providing diagnoses that were not identified on earlier data analyses. These new interpretations should also be included, available for review, and time stamped, stating clearly that they supersede prior reports. The new report should be linked to a clinician’s note. This note should contain the following information: confirmation that the clinician has reviewed the updated report; how the revised results change the patient’s diagnosis; any actions taken in regard to the medical treatment plan; and that patient/parent has been contacted with this new information.

As genomic data become an integral part of health care, they will be incorporated into multiple areas of the medical record. Genomic test results are often copied from one section of the EHR and pasted into other physician notes. Genetic diagnoses may be listed with International Classification of Diseases, Tenth Revision (ICD-10) codes on patients’ health problem lists. The ICD-10 coding system currently utilized in the United States is an inadequate tool to classify most genetic conditions and lacks the specificity for the majority of known genes identified today. Most genetic conditions diagnosed in the clinic when entered into ICD-10 revert to the generic code Q99.9—chromosome abnormality, unspecified. The imprecise nature of this code does not allow for medical reporting or clinical research, which can improve patient care and may even lead to incorrect medical information that results in patient harm.

Consumers are increasingly utilizing forms of consumer-initiated genetic/genomic testing outside of physician-directed medical care and may ask their physician to review these reports in their evaluation. FDA regulations require that all potentially medically actionable variants identified by these methods be confirmed in a CLIA-approved lab prior to application in medical care decisions. Caution should be applied in assessing the quality and medical actionability of consumer-initiated testing results and their incorporation in the medical record.1

Concern for individuals’ right of access

In a free society, individuals have a right to govern their own health care decisions, and as such, should have direct access to view and utilize their own test results, including genetic information. The recent publication by the Office of the National Coordinator (ONC) and the Centers for Medicare and Medicaid Services (CMS) of the final rule on patient access and interoperability describes this in its purpose statement as “…an important step in advancing interoperability, putting patients at the center of their health care, and ensuring they have access to their health information.”2 At present, the final rule does not explicitly discuss genetic or genomic information (other than in response to a comment, p. 121) where the authors note that additional work is needed in consultation with the ONC. Therefore, in the case of genetic tests, this autonomy is safeguarded by specific informed consent for testing over and above the standard consent to treatment.

Access to genomic test results is shared by not only the patient and the ordering provider, but with other authorized parties. The EHR has reduced barriers to sharing of data with all of the patient’s providers within that institution, facilitating coordinated medical care and improved outcomes. This data exchange is regulated by provisions of the Health Insurance Portability and Accountability Act (HIPAA).3 Right of access also includes regulatory agencies and insurance companies2 for defined business purposes. Genomic test results may be requested by outside non-health care agencies that provide services for patients, in particular rehabilitation, educational, and long-term care support, entities that may fall outside the HIPAA jurisdiction.

The exponential growth of genomic information and knowledge may result in the revision of the clinical interpretation of data that in turn affects the patient’s medical care and prognosis. This necessitates that the information in the EHR be modifiable through updated reports to reflect the most current information, and that individuals have the ability to continuously access their information as needed. Individuals should have the ability to receive and transport their genomic data, if they seek treatment outside the ordering facility for continuity of care. This is optimally achieved through an EHR network, in which systems share and communicate data from multiple institutions. This exists in some health care systems but has not been expanded across the country. The lack of implemented standards for the transfer of structured genomic information makes this impossible beyond sharing of scanned documents, even within EHR networks and health information exchanges.

The availability of patient portals linked to an EHR allows individuals to independently access their personal genomic test results, without contacting the physician’s office. Such direct access allows for more productive face-to-face dialogue during the provider visit, thus improving the patient experience of care. As one example, the OpenNotes project where patients were able to view providers’ notes about the visit demonstrated improved patient engagement and adherence to recommended care with only a modest increase in provider work.4 While OpenNotes has not been studied in genetics, related work to develop shared patient and provider genomic test reports that include both the laboratory result and the clinician-informed interpretation demonstrated the feasibility, acceptability, and utility of this approach.5,6

Issues related to adolescent confidentiality and right of access are covered under the HIPAA Privacy Rule,8 which also defers to state and other applicable laws. These laws primarily apply to the adolescent’s right to access a variety of services related to sexual health, substance abuse, and mental health without parental consent.8,9 Genetic information contained within the EHR of a minor patient may be sensitive and could include genetic diagnoses, carrier status, genetic predisposition to adult-onset conditions, and even biologic relationships that may not reflect the perceived family structure. Inadvertent disclosure is a potential risk if this information is available to all providers who may not be aware of the sensitive nature of the information. Right of access to this information by the adolescent and/or their parent may or may not be covered under existing laws and institutional guidelines.

Points to consider

  • Genetic data in the medical record should be readily and continuously accessible to the patient, including test results, secondary findings, AND the clinician’s interpretation.

  • To optimize medical care and the patient experience, the test report should be linked to the clinician’s note electronically, which should be visible to the patient and his/her providers. It should also be included when tests results are requested by outside providers. This report should interpret the genomic information in a clear format that clarifies if a clinical diagnosis has been made based on the test results.

  • ICD-10 codes should be updated to include input from the genetics community that includes individual codes for specific syndromes, genetic conditions, and genomic variants. Alternative coding systems may be required to perform this accurately. Standardized definitions of phenotypes capturing clinical signs and symptoms that inform but do not constitute a diagnosis would facilitate data sharing and test interpretation.10

  • Access to genetic data may be obtained through a secure patient portal, which should contain the results in a form that the reasonable patient could understand and utilize.11,12

  • For patients who desire a more detailed data set, this information could be made available to them upon request. Optimization of the EHR may include additional mechanisms for data access although requests for all the data associated with exome or genome sequencing would by necessity have to occur outside of the EHR ecosystem given the large size of the data.

  • Reference laboratory results should be incorporated into the patient’s record preferably as structured data, or, at a minimum, as a scanned PDF file or image.

  • Updated laboratory reports should be linked to the original report, clearly identifying the most recent results, and the evidence and rationale for the change in interpretation. They should be date and time stamped to unambiguously identify the most recent report.

  • Caution should be exercised in assessing the quality and medical actionability of outside results from other institutions and laboratories uploaded to the EHR by the patient, particularly consumer-initiated testing companies. These results would be best stored in a separate section of the EHR or flagged in such a way as to clarify the origin of the report.

  • Further optimization of the interoperability of EHR networks is encouraged to allow separate institutions who provide care to the same patient to be able to view the patient’s genetic data, facilitating coordinated care and minimizing the risk of duplicate testing, with the attendant waste of resources. The use of standards such as the Health Level 7 (HL7) genomics model, and Fast Healthcare Interoperability Resources (FHIR) including the emerging FHIR genomics standards13 by EHR vendors is encouraged.

  • In the future development/revision of EHRs, the ability to easily retrieve genomic information will be vital to enable targeted testing for family members, facilitating cost reduction, earlier diagnosis, and treatment.

  • Access to genetic data by minors and adolescents should be treated as is regulated for other medical information, but consideration should be given to the unique aspects of genetic data as further outlined in the discussion of genetic exceptionalism. Secondary findings such as carrier status for autosomal recessive disorders and pathogenic variants for adult-onset disorders should not be disclosed to minors other than in exceptional circumstances, consistent with current professional society guidelines.14

  • Continued optimization of the EHR may soon allow genomic data to be directly linked to clinical decision and management support tools, furthering the goal of precision medicine. The potential of this is only beginning to be realized and will grow substantially over time as more genomic information is available. EHR vendors may not be the best positioned to curate these tools, given the complexity and dynamic nature of genomic information.12 This necessitates the development of new models of clinical decision support maintained by trusted third parties and accessible in the EHR through application program interfaces (API). While not yet fully computerized, the American College of Medical Genetics (ACMG) ACT (Action) sheets are examples of such a resource that could be used for clinical decision support.

Genetic exceptionalism

Genetic exceptionalism is the supposition that genetic/genomic information is qualitatively different from other types of health information, and thus requires enhanced privacy and security protection when included in the EHR.15 However, it is well recognized that the incorporation of a variety of genomic data into an individual’s EHR will ultimately be necessary for the delivery of precision medicine.13 Although some types of sensitive medical information currently require enhanced privacy/security requirements (e.g., mental health, substance abuse, sexual assault), it could be argued that other potentially sensitive information, e.g., family and social history, is routinely documented. Features of genomic information requiring further consideration include but are not limited to, identifiability, the predictive nature of results for both later onset medical conditions as well as reproductive risks, immutability of genetic data, impact on family members, changing societal perspectives, and the dynamic nature of knowledge and data that allows for reinterpretation of previously reported genomic variants.16 Complex family dynamics and relationships also have the potential to complicate interpretation of data and genetic counseling.17

Federal laws such as HIPAA3 and the Genetic Information Nondiscrimination Act (GINA)18 protect the rights and privacy of individuals with regard to the permissible use of sensitive personal health information, including genetic/genomic information. Subsequently regulations such as the Privacy Rule7 and the Security Rule19 address issues surrounding shared health information. Nevertheless, genetic discrimination remains an ongoing concern for individuals due to the variability of state regulations, as well as the ability of insurers to indirectly limit health care coverage by raising insurance rates for individuals affected by genetic disorders. Passage of the Affordable Care Act (ACA),20 while not specifically addressing genetics, has provided additional protection for health insurance availability and affordability for those with a pre-existing condition. Given these protections and out of concern for patient care, all clinically validated presymptomatic genetic testing results are strongly encouraged to be available in some form in the EHR.21

Balancing the privacy of individuals with the needs of relatives who require their family member’s genetic test results to assess their own disease risks must also be considered. This is of some relevance because it remains ambiguous as to whether disease manifestations in a family member constitutes “genetic information” protected by GINA with its attendant protections.22 Some institutions now have the ability to link individual electronic medical records among family members within their system. This has the potential for disclosure of genomic results without explicit informed consent, thus changing background assumptions for privacy of genomic information.

The now standard use of publicly funded genomic databases has increased general genomic knowledge and diagnostic capabilities, but has simultaneously increased the potential to re-identify individuals whose health information has been de-identified. The capability of identifying a person unequivocally based on a few genetic variants has now been shown in multiple studies,23,24,25 raising concerns for breach of privacy and potential harm to patients. The protections afforded by federal and state legislation are unclear as to whether they apply in the setting of re-identification from publicly available data. To date, no examples of this have emerged in the setting of health insurance or employment, so the potential for harm remains hypothetical.

Finally, genetic and other medical providers have a duty to not only provide genomic information to patients, but also protect them from harm. The direct and immediate access to genomic test results via an EHR portal by patients and parents supports autonomy but may result in emotional distress due to the discovery of a life-altering genomic condition, misinterpretation of complex or equivocal results, unexpected secondary findings, misattributed parentage, or consanguinity. Unintentional disclosure of genomic test results or diagnoses may also occur through access to other providers’ notes, or simply the patient’s health problem list, as coded in the EHR. The potential for inadvertent disclosure of childhood results, including diagnosis of adult-onset disorders, carrier testing, and secondary findings to minors, through their ability to access their own test results, may cause additional harm. This creates a basis for questioning state laws/regulations that limit access to adolescents’ test results by their parents without consent of the minor.

Points to consider

  • The ability of patients to access genomic test results through the EHR in a timely manner must be balanced against the need for clinical interpretation and counseling related to the results and potential for patient harm.

  • The provider’s note (linked to the test result) should ideally include a statement about the unique nature of genomic information, thus clarifying the need for extra privacy protection.

  • Additional privacy protection mechanisms for types of genomic information such as consanguinity and misattributed parentage could include the designation of these test results under a separate document category in the EHR (“sensitive” or “confidential” notes), either under a broader genomics section or as a standalone section.

  • Presymptomatic test results from a clinical laboratory should not be excluded from the EHR, as they will later impact appropriate medical care; however, they could be placed under a separate document category in the EHR with additional privacy protection mechanisms. Further study is required to determine the most appropriate placement of such results, to balance the privacy of individuals seeking presymptomatic genetic testing with the requirements of the EHR.

  • Health care providers, vendors of EHR systems, and health information exchanges should develop mechanisms to protect sensitive genomic information in the EHR (such as consanguinity, misattributed parentage, and presymptomatic test results) from inadvertent disclosure, without the explicit written consent of the patient.

  • Mechanisms to minimize patient harm from direct access to their genomic information include release of results following provider review and communication with the patient, or delayed release after a set time period. Increased genetic literacy of the public through education, in conjunction with increasing the genetic provider workforce, is needed to allow for appropriate changes in policies over time.

  • Given that genomic testing of minors may yield results not immediately relevant (carrier status, presymptomatic high risk variants) it is important that the documentation of the parental consent be linked to these results. Care must to taken to avoid unintentional disclosure, yet results should be readily accessible at the appropriate time.

  • Health care providers, vendors of EHR systems and health information exchanges should develop mechanisms to protect sensitive genomic information in the EHR of a minor/adolescent from inadvertent disclosure, while allowing access without parental consent to the minor seeking services under applicable laws. These mechanisms should also preserve parental access to results on their minor children when appropriate.

  • Informed consent should be adapted to reflect these points to consider, explicit on right of access, mechanism of access, delayed release of certain results, and potential usage of personal genomic information by the ordering institution as well as outside agencies such as public health programs and genomic databases.

Social justice concerns

Genomic medicine has the potential to reduce health care disparities by developing health care interventions tailored to the individual’s genomic information. The benefits of genomic medicine can only be fully realized when all have equal access to genomic testing and the medical information from these tests is made available in the EHR. In addition to well-known problems of access for those uninsured or underinsured, barriers to access of genomic information via the EHR include lack of access to the Internet, genetic illiteracy, and language and cultural barriers.

  • When developing EHR policies, their impact on fair, just allocation of genomic medicine resources should be considered.

Improving health of populations

At present, most genomic testing is being done for specific indications. However, large-scale application of genomics for population screening is being explored in clinical research settings in the United States funded by the National Institutes of Health (NIH) (All of Us26), the Department of Veterans Affairs (VA) (Million Veteran program27), and private health-care systems (Geisinger MyCode28). Participation in these studies is high and participants are interested in receiving results.29 These programs are in the early stages of implementation and, as such, outcomes demonstrating the potential for improving the health of the population are preliminary,30 with more expected in the near future. Each of the programs listed above as examples have dedicated resources to the study of the availability of information to individuals both directly and through the EHR.31

  • Many of the issues discussed in this paper are also of relevance for the genomic information generated by population screening programs, even though these are not occurring outside of research settings at present. There may be unique issues that arise that should be anticipated and made the subject of study.


Further research is needed to determine the optimal approaches for patient access to and use of genomic information in the EHR, as well as protecting patient privacy and avoiding harm. While direct patient access to the EHR is appropriate and will facilitate patients’ involvement in their own health care, it is not a substitute for face-to-face interaction, which remains the ideal method of communication of potentially life-altering personal health information. These points to consider should be viewed as guidance for the ordering provider, clinical geneticist, laboratory geneticist and genetic counselor, and institutions and vendors. They are intended to assist providers, institutions, and vendors to develop policies and procedures that optimize the use of the EHR in the delivery of medical care to maximum patient benefit, minimize harm, improve population health, and decrease health care costs.