Health data and genomics: consent at the frontier

Health data governance begins with a person making a decision in circumstances that may be unfamiliar, stressful or deeply personal. In genomics, that decision can concern information whose significance changes as interpretation develops. I do not think a long consent form, on its own, is a sufficient answer to that complexity. The organisation needs to understand its purposes, explain meaningful choices and make sure its systems can honour the position it presents.

Separate the purposes before drafting

I begin by asking what the organisation intends to do with the information. Providing a requested service, supporting a research project, developing a product and training an AI system are distinct activities that need separate analysis. A broad description such as improving health outcomes does not tell a person enough about the proposed use. It also makes it difficult for the organisation to define its own limits.

The Canadian privacy commissioners’ meaningful consent guidance emphasises understandable information about collection, sharing, purposes and material risks or consequences. That guidance gives the team practical questions to answer before deciding how the interface should look. Which uses are necessary for the requested service? Which are optional? What can someone decline, and what follows from that decision? The answers should be visible where the decision is made.

Identify the law and the parties

Health information does not sit under a single, interchangeable rulebook. The applicable obligations depend on the jurisdiction, the organisation’s role, the information and the activity. In Alberta, the Health Information Act places particular duties on custodians and addresses their relationships with others handling health information. A commercial technology provider should establish its actual role rather than assume that every health-related dataset is governed in the same way.

Alberta’s privacy commissioner explains that a privacy impact assessment maps information flows and the authority for them. For custodians, the requirements relating to proposed systems and practices must be considered before implementation. The assessment is a useful discipline because it forces the legal account and the operational account to describe the same process. It is not a certificate that substitutes for maintaining that process after launch.

Treat genetic information with care

Genetic information can carry implications that extend beyond the immediate test result. The Office of the Privacy Commissioner of Canada’s guidance on consumer genetic testing discusses privacy questions involving future uses, sharing, storage and the information that services may reveal. An organisation should be able to answer those questions clearly before it invites participation. Uncertainty should be disclosed where it is relevant, rather than hidden behind expansive permission language.

I am cautious about claims that a dataset is anonymous merely because a name has been removed. The claim requires a technical and legal assessment of the information, its context and the realistic means of identification. Where the organisation relies on de-identification, it needs a documented method, restrictions appropriate to the risk and a process for reassessing the conclusion as circumstances change.

Make the permission operational

A meaningful choice has consequences for system behaviour. If research participation is optional, the collection and access process should reflect that choice. If an individual withdraws permission, staff need to understand what can be stopped, what information must be retained under applicable law and what limits may apply to material already used. The explanation given at the outset must be accurate about those consequences.

This is why I want to see the architecture alongside the form. Where are permissions stored? How do they travel with a sample, a report or a derived dataset? What happens when a downstream recipient receives an update? A single tick box may look simple in the interface while depending on several systems behind it. Those dependencies belong in the governance review.

Access deserves equal attention. Clinical need, laboratory work, customer support and product development should not be treated as the same permission category by default. The organisation needs a reason for access, a way to authorise it and an appropriate record of its use. Exceptions should be understood and reviewable.

Maintain an honest account

Consent communications need review when the service changes. A new partner, analytical method or proposed purpose may require fresh legal analysis and a different conversation with the individual. The team should have a route for escalating those changes before they become normal operating practice. Staff should also know where to take a question that the existing explanation does not answer.

My standard is that the promise made to a person should be traceable into the work of the organisation. The notice, the agreement, the information flow and the access controls should tell a consistent story. In precision health, trust depends on that consistency, particularly when a person cannot observe what happens to their information after they have shared it.

General information only, not legal advice. Ruchi Bindra is a member of the Alberta Bar (Barrister & Solicitor) and first qualified as an Advocate in India. Advice on the laws of other jurisdictions, including the UAE and the United States, is provided in coordination with locally licensed counsel where required.