Returning Individual Results

In 2015, President Obama announced the Precision Medicine Initiative, a coordinated public- and private-sector effort to increase research into precision medicine, a tailored approach for disease treatment and prevention that takes into account an individual’s molecular and genetic information.[1] A large part of this endeavor involves facilitating patient access to their personal health information and building an infrastructure that allows institutions to efficiently and securely share health data provided for research. The heightened visibility and support for precision medicine reflects a growing consumer interest in obtaining individual health information, including research results. In fact, one study found that 90 percent of participants wanted to receive their research tests results, regardless of the test’s accuracy or reliability.[2] Consequently, investigators and Institutional Review Boards (IRBs) are often presented with the question of whether a protocol should include a plan for returning individual test results. Consideration of this matter requires an understanding and appreciation of its ethical and legal framework.

Ethical Issues

Investigators and IRBs often struggle with the question of whether an individual research result should be returned to a participant. This difficulty typically arises from the way the issue navigates the clinical-research dichotomy. Unlike clinical care, which is intended to benefit the patient, the goal of research is to contribute to generalizable knowledge. A study may therefore present no direct benefit to the participant and individual test results are often not released. Ethical justifications for non-disclosure include the duty to avoid the harm of providing results of uncertain value (e.g. lacking in analytic validity, clinical validity, or clinical significance) and of propagating a “therapeutic misconception” that the researcher is routinely screening participants for certain disorders or conditions.

While these are valid concerns, there are instances where ethical principles might require or favor the return of individual research results. For example, the principle of beneficence obligates an investigator to inform participants of medical findings incidentally discovered during the course of the study that require action to avoid harm. Ethical arguments can also be made for providing planned research test results (as opposed to unexpected, “incidental” findings). One such justification—the principle of reciprocity—originates from the duty to respect persons. Reciprocity acknowledges participants as partners in the research enterprise who are entitled to the option of receiving test results that might contain clinical or informational value.[3]

Much has been written about the above considerations and there is general consensus that investigators and IRBs should consider several questions when assessing whether it is appropriate to return individual research test results:[4]

  • Has the test’s analytic and clinical validity been established?
  • Is the test result clinically actionable?
  • Do the test results have clinical or reproductive significance?
  • What is the magnitude of potential harm if the results are not disclosed?
  • Did the informed consent process discuss the possibility of disclosing test results?
  • Does disclosing the test results comply with applicable law?

When assessing whether participants should have the option to receive their individual research test results, a major consideration is whether the test’s analytic validity (specificity and sensitivity) and clinical validity (causal association between finding and condition) has been established. If the accuracy of the test is unknown, there may be limited benefit and potential harm in releasing the results. Other factors include whether the test result is clinically actionable and whether the test reveals a risk of harm. In other words, there may be an ethical obligation to provide individual test results if there is an available and effective intervention for the discovered condition and if serious harm could be avoided by taking clinical action. Additionally, regardless of whether the test result is clinically actionable, the results might still reveal a risk of developing a serious medical condition and the participant might value having this knowledge. For example, tests revealing inheritable conditions may be relevant to the participant’s reproductive decision-making.

Ideally, researchers and IRBs will prospectively establish plans for returning results and that information will be documented in the protocol and consent form. But if, after study implementation, there is still a question of whether a specific result should be returned, the following aspects should be considered:

  • Was the participant told about the potential for incidental findings or given the option of receiving test results?
  • If given an option, did the participant choose to receive results?
  • Was the consent form silent on the issue of returning results?
  • Did the consent state that no results would be disclosed?

Finally, IRBs and investigators should consider whether disclosing the research results complies with applicable law. The regulatory issues related to providing individual research test results are discussed below.

Regulatory Issues

The federal human subject protection regulations are silent regarding the return of individual results.[5] These rules do, however, indirectly affect the issue. Regulatory requirements related to informed consent state that the consent process must provide adequate information to a potential subject about the reasonably foreseeable risks and benefits of the research.[6] Participants must also be told of any significant new findings developed during the course of the research that might relate to their willingness to continue participation.[7] Some research test results, both planned test results and incidental findings, could be viewed as a benefit or risk of the study and thus the possibility of such findings and any policy for their return needs to be disclosed in the consent discussion and in the consent form.

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule also impacts the regulatory question of when test results should be returned to research participants. The Privacy Rule establishes standards for protecting the privacy of individually identifiable health information and confers specific rights on individuals, including the right to access and amend certain health information.[8] This right of access extends to all of the protected health information in a designated record set held or maintained by a covered entity (health plans and most health care providers).[9] The designated record set includes a broad array of health information about individuals including medical and billing records, laboratory test results, clinical case notes, and other information used to make decisions about individuals.[10] Generally, if research test results are included in a participant’s medical record or otherwise used to make decisions about them, those results become part of the designated record set and subject to an individual’s right of access. In other words, if a participant requested access to those test results, a covered entity would be obligated to provide them. While the Privacy Rule does not involve IRBs in the process of reviewing and honoring an individual’s request to access research test results, IRBs and investigators should understand this right and ensure that the protocol and informed consent documents do not contain information contrary to the rule.

The Centers for Medicare & Medicaid Services (CMS) regulates laboratory testing through the Clinical Laboratory Improvement Amendments of 1988 (CLIA). The purpose of the CLIA program is to ensure that clinical labs meet certain quality standards for accuracy and reliability. Therefore, all facilities that meet the CLIA definition of a “laboratory” must obtain CLIA certification prior to conducting patient testing.[11] Research laboratories, however, are “excepted” from CLIA certification requirements as long as the laboratory does not report patient-specific results “for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients.”[12] In other words, a non-CLIA certified research laboratory is prohibited from returning laboratory test results to a participant for treatment or health assessment purposes. Although determining CLIA applicability falls outside its purview, an IRB is obligated to consider the ethical aspects of a researcher’s plan to return individual laboratory test results, including the risks associated with providing test results of unknown accuracy and reliability.[13]

It is important to note here that there is currently regulatory uncertainty regarding the interaction between the Privacy Rule access provisions and the CLIA laboratory requirements.[14] This uncertainty is a result of recent amendments to both rules that support the personalized and precision medicine movements by broadening an individual’s ability to access laboratory test reports directly.[15] Some commentators interpret these revisions as conflicting with each other.[16] Specifically, if a research laboratory is a HIPAA covered entity and research test results are considered part of the designated record set, then participants have a legal right to receive these results. But if this same research laboratory is excused from CLIA requirements, it cannot comply with the Privacy Rule’s access provisions without violating CLIA’s prohibition against returning individual results from a non-CLIA certified laboratory.

There are several factors influencing the discussion of whether the HIPAA and CLIA regulations are actually in conflict. For example, there is ambiguity regarding the scope of research laboratory test results that would be considered part of a designated record set.[17] It is also unclear whether CMS interprets providing test results per an individual’s request under the Privacy Rule access provisions as providing results “for the diagnosis, prevention or treatment of any disease or impairment of, or the assessment of the health of individual patients.”[18]

Finally, in October 2014, the Food and Drug Administration (FDA) issued draft guidance describing how the agency intends to enforce regulatory oversight of laboratory developed tests (LDTs).[19] Historically, the FDA has exercised enforcement discretion such that the agency has not imposed applicable provisions of the Federal Food, Drug, and Cosmetic Act (FD&C Act) and FDA regulations with respect to LDTs. Under the agency’s proposed regulatory framework, however, many LDTs will be subject to medical device requirements. Additionally, there has been FDA communication indicating that clinical investigations of LDTs may require an Investigational Device Exemption (IDE) if results are returned to participants without confirmation in a CLIA-certified laboratory.[20] At this time, since the FDA has only published draft guidance of its intent to enforce regulatory oversight, the potential impact on non-CLIA certified laboratories remains unclear.


As patient access to individual health information increases, more participants will desire their research test results, including exploratory tests that may have unestablished accuracy and reliability. Because of this, the traditional stance prohibiting the return of individual research results is arguably evolving into a “translational research” model where researchers have a limited duty to provide some results to their participants. Investigators should therefore proactively draft their protocol and consent documents to include a plan for handling individual test results. IRBs should have written policies for reviewing these plans that take into consideration the ethical and legal consequences of sharing such results. Finally, both investigator and IRB should work together to ensure that any decision regarding disclosing results minimizes risks and maximizes benefits to the participant.




[1] The White House, Precision Medicine Initiative, (last visited May 3, 2016).

[2] E.g., Matthew P. Kirschen, Agnieszka Jaworska, and Judy Illes, Subjects’ Expectations in Neuroimaging Research, 23 Magnetic Resonance Imaging 205 (January 2006).

[3] See, e.g., Susan M. Wolf et al., Managing Incidental Findings and Research Results in Genomic Research Involving Biobanks & Archived Datasets, 14 Genetics in Med. 361 (April 2012); Judy Illes et al., Incidental Findings in Brain Imaging Research, 311 Science 783 (February 2006).

[4] See, e.g., Presidential Commission for the Study of Bioethical Issues, Anticipate and Communicate: Ethical Management of Inci­dental and Secondary Findings in the Clinical, Research, and Direct-to-Consumer Contexts (December 2013),; Susan M. Wolf et al., Managing Incidental Findings and Research Results in Genomic Research Involving Biobanks & Archived Datasets, 14 Genetics in Med. 361 (April 2012); Richard R. Fabsitz et al., Ethical and Practical Guidelines for Reporting Genetic Research Results to Study Participants: Updated Guidelines from a National Heart, Lung and Blood Institute Working Group, 3 Circulation: Cardiovascular Genet­ics 574 (December 2010); Susan M. Wolf et al., Managing Incidental Findings in Human Subjects Research: Analysis and Recommendations, 36 J.L. Med. & Ethics 219 (October 2008).

[5] 45 CFR Part 46 and 21 CFR parts 50 and 56.

[6] 45 CFR § 46.116(a)(2); 21 CFR § 50.25(a)(2).

[7] 45 CFR § 46.116(b)(5); 21 CFR § 50.25(b)(5).

[8] 45 CFR § 164.524.

[9] 45 CFR § 160.103.

[10] See 45 CFR § 164.501; OCR Guidance, Individuals’ Right under HIPAA to Access their Health Information 45 CFR § 164.524 (January 7, 2016),

[11] See 42 CFR § 493.

[12] 42 CFR § 493.3(b)(2).

[13] CMS Regulations and Guidance, Research Testing and Clinical Laboratory Improvement Amendments of 1988 (CLIA) Regulations (v. 12/10.2014)

[14] See, e.g., Secretary’s Advisory Committee on Human Research Protections (SACHRP) Letter to the HHS Secretary , Attachment C: Return of Individual Results and Special Consideration of Issues Arising from Amendments of HIPAA and CLIA (September 28, 2015),; Mark Barnes et al., The CLIA/HIPAA Conundrum of Returning Test Results to Research Participants, 14 Bloomberg BNA Med. Res. L. & Pol. Rep. 491 (July 2015); Barbara J. Evans et al., Regulatory changes raise troubling questions for genomic testing, 16 Am. C. Med. Genetics & Genomics 799 (November 2014); Barbara J. Evans et al., Regulatory changes raise troubling questions for genomic testing, 16 Am. C. Med. Genetics & Genomics 799 (November 2014).

[15] CLIA Program and HIPAA Privacy Rule; Patients’ Access to Test Reports, 79 Fed. Reg. 7290 (Feb. 6, 2014) (amending 42 C.F.R. § 493.1291; 45 C.F.R. § 164.524).

[16] Id. at 10.

[17] Id.

[18] Id.; Barbara J. Evans, The First Amendment Right to Speak About the Human Genome, 16 J. Const. L. 549 (Feb. 2014).

[19] FDA Draft Guidance, Framework for Regulatory Oversight of Laboratory Developed Tests (LDTs) (October 2014),

[20] Secretary’s Advisory Committee on Human Research Protections (SACHRP) Letter to the HHS Secretary, Attachment C: Return of Individual Results and Special Consideration of Issues Arising from Amendments of HIPAA and CLIA (September 28, 2015),

Tags: , , ,