Abstract

Background The sharing of data generated through the course of clinical genetic and genomic testing without explicit patient consent is increasingly important for timely diagnosis and treatment. While many jurisdictions permit the sharing of identifiable data for direct patient care, institutional policies vary in how clearly they specify key elements. When do policies permit sharing of data without explicit consent? What data types may be shared, with whom, and under what safeguards? Greater clarity around these elements may support responsible data sharing while balancing timely care with transparency and appropriate protections.

Methods We conducted a qualitative content analysis of data-sharing and privacy policies from 33 clinical genomic institutions across 17 jurisdictions. Using a predefined analytical framework, we assessed how policies document key governance elements relevant to sharing without explicit consent. Two independent reviewers extracted information about clinical contexts, data types, justifications, and protections, documenting areas of inconsistency across institutions.

Results Although 70% of institutions described circumstances permitting data sharing without explicit consent, most policies did not clearly define the scope or governance of such sharing. Policies also rarely distinguished clinical from research or secondary use and inconsistently specified privacy and security safeguards. While sharing was commonly justified for clinical care (78.3%) or testing services (43.5%), recipient roles, access conditions, and onward-sharing expectations were often left undefined.

Conclusion This uneven documentation could make it difficult for clinical teams, laboratories, and institutional decision-makers to identify and justify key decisions about what is permitted and under what conditions. A guidance framework specifying core policy elements and corresponding protections could help institutions communicate their governance choices more clearly while supporting more comparable baseline practices for responsible data sharing across settings.

Competing Interest Statement

The authors have declared no competing interest.

Funding Statement

Juliann M. Savatt and Heidi L. Rehm. were supported by the National Human Genome Research Institute of the National Institutes of Health under grant U24HG006834.

Author Declarations

I confirm all relevant ethical guidelines have been followed, and any necessary IRB and/or ethics committee approvals have been obtained.

Yes

I confirm that all necessary patient/participant consent has been obtained and the appropriate institutional forms have been archived, and that any patient/participant/sample identifiers included were not known to anyone (e.g., hospital staff, patients or participants themselves) outside the research group so cannot be used to identify individuals.

Yes

I understand that all clinical trials and any other prospective interventional studies must be registered with an ICMJE-approved registry, such as ClinicalTrials.gov. I confirm that any such study reported in the manuscript has been registered and the trial registration ID is provided (note: if posting a prospective study registered retrospectively, please provide a statement in the trial ID field explaining why the study was not registered in advance).

Yes

I have followed all appropriate research reporting guidelines, such as any relevant EQUATOR Network research reporting checklist(s) and other pertinent material, if applicable.

Yes

Data Availability

All data produced in the present study are available upon reasonable request to the authors

List of AbbreviationsDNADeoxyribonucleic acidEUEuropean UnionGDPRGeneral Data Protection RegulationHCPHealthcare providerHIPAAHealth Insurance Portability and Accountability ActHPOHuman Phenotype OntologyMMEMatchmaker ExchangeU.S.United States