Examining gaps in institutional policies for clinical genomic data sharing: A cross-jurisdictional study.

Abstract

The sharing of data generated by clinical genetic and genomic testing without explicit consent is important for timely diagnosis and treatment. While many jurisdictions permit the sharing of identifiable data for direct clinical care, institutional policies vary in how clearly they specify key elements, including when sharing is permitted, what data are covered, and what safeguards apply. Greater clarity around these elements may support responsible data sharing while balancing timely care with transparency and appropriate protections. We conducted a mixed-methods content analysis of data-sharing and privacy policies from 33 clinical genomic institutions across 17 countries and regions. Using a predefined analytical framework, we assessed how policies document key governance elements relevant to sharing without explicit consent. Two independent reviewers extracted information about clinical contexts, data types, justifications, and protections. Although 70% of institutions described circumstances permitting data sharing without explicit consent, most policies did not clearly define the scope or governance of such sharing. Policies also rarely distinguished clinical from research or secondary use and inconsistently specified privacy and security safeguards. While sharing was commonly justified for clinical care (78.3%) or testing services (43.5%), data recipient roles and onward-sharing expectations were often left undefined. This uneven documentation could make it difficult for clinical teams and institutional decision-makers to identify and justify decisions about what is permitted and under what conditions. A guidance framework specifying core governance elements and corresponding protections could help institutions communicate their governance choices more clearly and support comparable baseline practices for responsible data sharing.