Legal Q&A: Incidental findings & recontacting patients – Austrian legal view

BBMRI.at Legal Helpdesk answers

The BBMRI.at Legal Helpdesk Service – operated by legal experts from BBMRI.at partner UNIVIE – answers questions on legal and regulatory matters around biobanking and/or using biological samples and data. This service is offered to BBMRI.at partners to support them, as biobanking and research using biological samples and data (e.g. human, animal/veterinary, microbial, etc.) may raise legal questions. All answers are published in the BBMRI.at Knowledge Base.

QUESTION:

Inform or not? What is the legal view on incidental findings?

ANSWER:

1. Introduction – what are Incidental Findings? 

Viberg et al state the topic of return of incidental findings to participants is broadly discussed among biobanks.[1] This concerns, in particular, fields of genomic as well as imaging research. There is no universal legal definition of ‘incidental findings.’ Cippitani describes them as “‘findings’ (findings) that concern a specific research participant, but which are not directly related to the primary or secondary objectives of the project in question (incidental). This includes information which there was no plan to find during the research or diagnostic practices, such as information on on-going diseases or predispositions to diseases, or information concerning biological parentage and so on.”[2] Researchers may encounter such incidental findings when handling biobanked samples during their standards research activities within a specific research project.

It is important to properly react when such findings occur and to follow the legal, organizational and ethical principles applicable to such situations. The BBMRI-ERIC ELSI Knowledge Base reports on some of the key issues when dealing with incidental findings:[3]

• ‘The duty to disclose or not disclose,
• informed consent and participant preferences,
• privacy and confidentiality,
• resource allocation and costs,
• legal and regulatory implications.’[4]

2. The duty to disclose and the right not to know

In legal and ethical discussions around the topic of incidental findings, a popular discourse is often that of balancing, on one hand, the rights of the patients/research participants to be adequately informed about information potentially significant to their health and, on the other hand, the rights of natural persons to decide to not want to receive information on any incidental findings. In other words, there is a discrepancy between the right to information and the duty of researcher or physician to disclose information relevant to health and the right of the patient/research participant to not know about incidental findings.

The Oviedo Convention on Human Rights and Biomedicine states in Article 10 that: ‘Everyone is entitled to know any information collected about his or her health. However, the wishes of individuals not to be so informed shall be observed.’[5] Although Austria did not sign or ratify this Convention, meaning that it is not binding in Austria, this provision can be seen as indicative of international practice concerning this topic.

The central arguments for a right to not know appeal to the principles of harm and autonomy.[6] Concerning harm, the presumption is that medical news, especially a diagnosis can be distressing as well as can lead to social stigma and discrimination.[7] Regarding autonomy, the idea is that every person can lead an autonomous life and therefore cannot be forced to received unsolicited information on their health status.[8] Those, who argue against a right to not know put forward arguments that not knowing about a certain diagnosis could lead to harm to others and that patients might actually need all relevant information to make autonomous decisions.[9]

Moreover, a principle which is often discussed in connection to the duty to disclose or the right not to know concerning incidental findings is the principle of beneficence. According to this principle, ‘disclosure should be an option for participants because it will maximize their benefit and minimize harm if participants receive timely risk information.’[10]

3. Legal situation in Austria – example of the Gene Technology Act

The legal status of the right to not know as well as possible obligations for researchers to return incidental findings are not explicitly regulated at Austrian level.

The Gentechnikgesetz, the Gene Technology Act, also known as the GTG,[11] first published July 1994 (BGBl. Nr. 510/1994, came into force in 1995) and most recently altered in 2022 (through federal law BGBl. I Nr. 8/2022) regulates the subject of genetic testing in Austria. §71(4) GTG provides rules on how to share unexpected results with examined people which might be of clinical importance, or results which were specifically requested by the examined person. The GTG prescribes that the provision of such unexpected results must be worded so as to not cause concern to the examined person, particularly if the person has not requested to receive such information. It also prescribed that in borderline cases, this notification may be omitted altogether. Moreover, the GTG regulates who can have access to the data and pass on information to the examined person – the subject of the data. These data can only be passed to staff at the facility where the genetic data have been collected (providing they have had direct involvement with the collection, processing and evaluation of these data), the subject of the data, the legal representative of the subject of the data (according to §69(2) GTG), the physician who has initiated the genetic tests and the attending physician as well as any other person whom the data subject has explicitly given a written consent to do so (with written revocation of this consent possible at any time).[12]

Moreover, §70 GTG states that a doctor who carried out the test may recommend the examined person to further recommend genetic testing to affected relatives if the results point to a possible danger to the affected relative or when a test from a relative is necessary to interpret the results. Doctors are not obliged by law to provide such information to the relatives directly, but they are required to share a recommendation with the individual to do so themselves, based on the results of genetic testing of the individual. Finally, the GTG defines also the rules for genetic testing for scientific purposes, including research (§66 GTG). The main requirement defined therein imposes that “genetic analyses on humans for scientific and educational purposes may only be carried out on de-identified samples. Non-genetic medical data that is to be linked to genetic data of the same person must also be de-identified.” (§66(1) GTG – authors’ translation). The assignment of this data to the respective sample donor may only take place in institutions that have valid consent, required according to the General Data Protection Regulation (GDPR), from the data subject (i.e. patient/research participant) for this assignment (§66(1) GTG). Results from genetic analyses for scientific purposes may only be linked or published if suitable measures have been taken to ensure that, apart from the exception indicated above, the sample donor cannot be identified. (§66(2) GTG – authors’ translation). Therefore, genetic risk communication in such a setting is, by default not possible, unless the individual whose data and samples were analysed did opt in for receiving such information in the form of an informed consent.

For more information on genetic risk communication and GTG, please refer to the answer to Question 27.

In addition to that, the Austrian Bioethics Commission states the following about the return of individual results:[13]

“Individual results should only be shared in exceptional cases. The feedback of individual results collected as part of research projects is problematic, as these data are usually new and not yet validated in terms of their medical relevance, meaning that the sample donor cannot be adequately advised regarding the significance and significance of the results.” (translated from German).

The Commission recommends that there be no general duty of biobanks to disclose information on research results to participants unless they are vital/essential to the life of the participant. In any case, the right to not know should be respected.[14]

4. Consent forms and information obligations for researchers

Informed consent forms in biobanking might contain the preferences as to whether participants wish to be informed about any incidental findings relating to their health. Researchers should follow the participant’s wishes as indicated in the consent form, especially if the form provides for the choice to not be informed about any such significant findings. On top of that, research institutions may have internal policies on incidental findings. Researchers should read and comply with those policies and not re-contact any persons who requested not to be informed about incidental findings.

Information obligations for researchers might also stem from the GDPR which prescribes that the controller must provide the data subject with transparent and clear information on the processing of their personal data.[15] Since incidental findings might not be covered by the initial purpose and scope and data processing, e.g. scientific research, data subjects have the right to be informed about information that relates to them.

5. The European Health Data Space (EHDS) and incidental findings

Legal and regulatory landscapes dealing with incidental findings may vary per country. At the European level, the proposal for the EHDS regulation provides rules on how to inform natural persons about significant findings related to their health. The EHDS is an EU regulation proposal which aims to create a secure and interoperable framework for accessing, sharing, and using health data across the EU to improve healthcare, research, and policy making.[16]

Recital 44a EHDS clarifies that natural persons should have the right to request not to be informed of such findings. The conditions for such a right would have to be laid down in the national law of the Member States. This right is again mentioned in Article 35e(3) EHDS. Moreover, Member States should ‘be enabled, in accordance with Article 23(1)(i) of the GDPR, to restrict the scope information obligations where this is necessary for the protection patient safety and ethics. This means delaying the communication of information ‘until a health professional can communicate and explain to the natural persons information that potentially can have an impact on them.’[17]

The EHDS provides a sort of duty to disclose information on significant findings relevant to a natural persons’ health. Under the EHDS secondary use of data system, health data users must inform their health data access body of significant findings related to the health of a natural person whose data are included in the dataset.[18] Again, only if the person did not opt out from this right to information.

However, one needs to note here that this would be only possible where the dataset in question was pseudonymised, not anonymised. With anonymised data, it would be impossible to re-identify the natural person. In this context, Kogut-Czarkowska notes that the anonymisation of data, which should be irreversible under the GDPR, means that there is no possibility for the controller(s) to report any important incidental findings during research.[19]

6. Summary

To conclude and summarise the most important legal and ethical aspects of incidental findings discussed in this document:

• Incidental findings are findings which concern a specific research participant but where not part of the main objective of the respective research project.
• The duty of researchers to disclose information relevant to a person’s health is based, among others, on the principle of beneficence.
• The ‘right not to know’ where persons can decide that they do not wish to receive information on incidental findings is rooted on the principle of autonomy as well as the idea and it might cause harm to the person to receive information against their will.
• Incidental findings are not explicitly regulated by Austrian law but some provisions on obligations to disclose information can be found, for example in the GTG as well as the GDPR.
• The EHDS also lays down rules on the topic of informing persons about significant findings relating to their health. In particular, it puts an obligation on health data users to inform the health data access body of any such findings. Moreover, the EHDS states that natural persons should have the right to request to not receive such information.