There is no question that the resources required to process, analyze, and manage petabytes of genomic information represent a huge burden for even the largest academic research facility or healthcare institution. That burden becomes even greater when one factors in the need to handle these data in compliance with an alphabet soup of regulatory regimes: HIPAA, CLIA, GCP, GLP, 21 CFR Part 11, and their counterparts outside the United States, including data privacy laws in jurisdictions such as the European community.

In this context, the use of cloud-based solutions to manage, analyze, store, and share data can provide some relief. Computer and storage resources are instantly available on demand. There is no need to lease brick-and-mortar facilities, purchase equipment, or hire staff to maintain them.

Despite the advantages of cloud computing, organizations are often hesitant to use it because of concerns about security and compliance. Specifically, they fear potential unauthorized access to patient data and the accompanying liability and reputation damage resulting from the need to report HIPAA breaches. While these concerns are understandable, a review of data on HIPAA breaches published by the US Department of Health and Human Services (HHS) shows that these concerns are misplaced.  In fact, by using a cloud-based service with an appropriate security and compliance infrastructure, an organization can significantly reduce its compliance risk.

A HIPAA Primer

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act of 2009 (“HITECH”), protects “individually identifiable health information,” which the rule calls “protected health information,” or “PHI.”  

Opinions differ as to whether a human genome, stripped of identifiers such as name or social security number, constitutes PHI. Whether these data constitute PHI depends on whether there are sufficient publicly available reference data sets to create a “reasonable basis to believe” that a genome can be associated with an identified individual. Recent publications suggest that if these data are not currently classified as PHI, they will be soon [1].  As a consequence, organizations that handle genomic data are well advised to implement systems that treat a whole genome as PHI, even if public reference data sets are not yet common enough to make it PHI today.

Entities that are obligated to comply with HIPAA are often particularly concerned with the obligation to report HIPAA breaches and the associated potential harm to their reputations. These reporting obligations create powerful incentives for organizations to implement systems and processes to reduce risk.