A patient with a strong family history of breast cancer undergoes BRCA (Breast Cancer Gene) screening, what do I do as a provider when their associated person requests the results?

Refuse to Disclose BRCA Results to the Associated Person

As a provider, you must refuse to disclose the patient's BRCA test results to the associated person without the patient's explicit authorization, as genetic test results are confidential patient information protected by CLIA and HIPAA regulations. 1

Legal and Regulatory Framework

The correct answer is B. Refuse to disclose results to the associated person directly. Federal regulations are unambiguous on this matter:

• CLIA regulations (42 CFR §493.1231) mandate that laboratories and providers ensure confidentiality of patient information throughout all phases of genetic testing 1
• Test results may only be released to: (1) the authorized person who ordered the test, (2) persons responsible for using the test results as designated by the patient, and (3) the referring laboratory 1
• HIPAA Privacy Rule requires patient authorization before disclosing protected health information to third parties, even family members 1

Why the Other Options Are Incorrect

Option A (Ethics Committee Request by Patient) is Wrong

• There is no need for ethics committee involvement when standard confidentiality protocols apply 1
• This unnecessarily complicates a straightforward confidentiality matter governed by existing federal regulations 1

Option C (Conditional Disclosure if Positive) is Wrong

• Confidentiality protections apply regardless of whether results are positive, negative, or uncertain 1
• The nature of the result does not change the legal requirement for patient authorization before disclosure 1

Option D (Ethics Committee Contact by Associated Person) is Wrong

• The associated person has no standing to request an ethics review of another person's confidential medical information 1
• This would inappropriately shift the burden away from proper confidentiality protocols 1

Proper Protocol for Handling This Request

When an associated person requests a patient's BRCA results, follow this algorithm:

1. Immediately refuse the request without providing any information about whether testing occurred or results exist 1

2. Explain to the associated person that genetic test results are confidential patient information that cannot be disclosed without the patient's written authorization 1

3. Direct the associated person to speak directly with the patient about obtaining results 1

4. Document the request and your refusal in the medical record 1

5. Inform the patient privately that their associated person requested results, and discuss whether the patient wishes to authorize disclosure 1

When Family Member Disclosure May Be Appropriate

If the patient independently decides to authorize disclosure to the associated person, proper procedures must be followed:

• Obtain written authorization from the patient that specifically identifies what information can be shared and with whom 1
• The authorization should be documented in compliance with institutional policies and state requirements 1
• Pre-test consent forms should ideally address potential family disclosure scenarios, though this does not override the need for specific authorization at the time of results 1

Special Considerations for Family Members

While genetic test results have implications for biological relatives, this does not create an automatic right for family members to access results:

• The patient should be counseled during informed consent that genetic results may have implications for family members and encouraged to share information 1
• ASCO guidelines emphasize the importance of sharing genetic test results with at-risk relatives, but this remains the patient's decision 1
• The provider's role is to educate the patient about the importance of family communication, not to bypass the patient's confidentiality 1

Common Pitfalls to Avoid

• Never assume that family members have an automatic right to genetic information because it affects their own risk 1
• Do not disclose even "de-identified" or general information about the testing or results without authorization 1
• Avoid suggesting that positive results "should" be shared while negative results need not be—this implies information about the actual result 1
• Do not involve ethics committees for routine confidentiality matters that are clearly governed by existing regulations 1
• Never disclose results to a family member's healthcare provider without the patient's specific written authorization, even if that provider requests information to guide the family member's care 1

Supporting the Patient in Family Communication

After refusing the associated person's request and discussing with the patient:

• Provide the patient with resources about how to communicate genetic results to family members 1
• Offer genetic counseling support to help the patient navigate family disclosure decisions 1
• Explain that family members can pursue their own independent genetic testing or counseling 1
• Document the patient's decision regarding family disclosure in the medical record 1