Audit of access to sensitive genomic records

Introduction

The audit of access to sensitive genomic records refers to the systematic examination of how genetic and genomic information is collected, accessed, stored, processed, shared and protected by healthcare institutions, biotechnology companies, research laboratories and government agencies. Genomic records contain highly personal biological information, including DNA sequences, genetic variations, inherited conditions and information concerning an individual's biological relationships.

Unlike ordinary medical records, genomic information may reveal sensitive details not only about an individual but also about biological relatives and future generations. Unauthorised access, disclosure or misuse of genomic information can create risks of genetic discrimination, privacy violations, identity-related misuse and commercial exploitation.

Therefore, auditing access to genomic records is an important component of data protection, healthcare governance and biotechnology regulation. It ensures that only authorised individuals access genetic information for legitimate purposes and that every access activity is properly documented and monitored.

Legal framework governing genomic records in India

1. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, establishes India's statutory framework for processing digital personal data.

Genomic information that identifies or relates to an identifiable individual falls within the scope of personal data under the Act.

Important regulatory principles include:

Processing personal data must have a lawful basis under the Act.

Data fiduciaries must comply with applicable obligations concerning personal data processing.

Appropriate technical and organisational security safeguards must be implemented.

Personal data breaches must be handled according to applicable statutory requirements.

Individuals are entitled to exercise rights provided under the legislation.

The Act is particularly relevant to genomic databases maintained by hospitals, diagnostic laboratories and biotechnology organisations.

Its application depends on the nature of the data, the processing activity and the applicable commencement and exemption provisions.

2. Information Technology Act, 2000

The Information Technology Act, 2000, provides additional legal protection against certain forms of unauthorised access and misuse of electronic information.

Important provisions include:

Section 43: Provides compensation-related liability for specified unauthorised acts involving computer systems and data.

Section 66: Addresses specified computer-related offences committed dishonestly or fraudulently.

Section 72: Addresses breach of confidentiality and privacy by persons who obtain access under powers conferred by the Act.

Section 72A: Provides punishment for disclosure of information in breach of a lawful contract, subject to its statutory requirements.

These provisions may become relevant where genomic databases are accessed, copied or disclosed without proper authority.

3. Bharatiya Sakshya Adhiniyam, 2023

The Bharatiya Sakshya Adhiniyam, 2023, provides the evidentiary framework for electronic and digital records.

Sections 61–63 address the admissibility and proof of electronic records.

This framework is important when genomic access audits identify unauthorised database access, altered laboratory records or suspicious electronic transactions that may subsequently become evidence in legal proceedings.

4. Indian Council of Medical Research guidelines

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017, provide ethical standards for biomedical research.

These guidelines are particularly important for genomic research because genetic information may reveal inherited conditions, family relationships and other sensitive information.

They emphasise:

Informed consent.

Confidentiality and privacy.

Ethical committee review.

Responsible storage and use of biological samples.

Appropriate handling of genetic information.

Protection of research participants against exploitation.

Meaning and objectives of genomic access auditing

A genomic access audit is a structured assessment of whether access to genetic information complies with applicable legal, ethical, institutional and cybersecurity requirements.

Its main objectives include:

1. Preventing unauthorised access

Audits identify individuals who access genomic records without legitimate professional or research requirements.

2. Ensuring accountability

Every access activity should be traceable to an authorised user, system or institutional process.

3. Protecting patient confidentiality

Audits help ensure that genomic information is not disclosed to unauthorised third parties, including employers, insurers or commercial organisations.

4. Monitoring regulatory compliance

Healthcare institutions and research organisations must demonstrate that their genomic data-handling practices comply with applicable legal requirements.

5. Detecting security incidents

Access audits help identify unusual database activity, excessive downloads, suspicious account behaviour and potential information breaches.

Major components of a genomic access audit

1. User authentication and authorisation

Institutions must establish procedures to verify the identity of individuals accessing genomic records.

Access should be granted according to professional responsibilities and legitimate operational requirements.

For example, a genetic counsellor may require access to particular genetic test results, while an administrative employee may only need limited patient-identification information.

2. Role-based access control

Role-based access control restricts access according to the responsibilities assigned to employees and researchers.

Different permission levels may be established for:

Medical practitioners.

Genetic counsellors.

Laboratory scientists.

Research investigators.

Database administrators.

Administrative personnel.

This approach reduces unnecessary exposure of sensitive genomic information.

3. Audit trails and access logs

Every access event should generate an appropriate electronic record.

Important information includes:

Identity of the accessing user.

Date and time of access.

Records viewed or modified.

Purpose of access, where required.

Data downloaded or transferred.

Changes made to genomic records.

Failed login attempts and suspicious activities.

Audit logs should be protected against unauthorised modification.

4. Consent verification

Before genomic information is used for research or secondary purposes, institutions should verify whether the relevant consent or other lawful basis exists.

Consent documentation should clearly identify the intended purpose, permitted data sharing and applicable limitations.

5. Third-party access monitoring

Genomic records may be shared with external laboratories, research institutions, cloud service providers and biotechnology companies.

Audits should examine contractual arrangements, access permissions, security safeguards and compliance with applicable data protection requirements.

6. Data retention and deletion

Institutions should establish appropriate retention policies for genomic information.

The audit should examine whether records are retained for legitimate purposes and whether deletion or anonymisation requirements are followed where applicable.

International legal framework

1. UNESCO International Declaration on Human Genetic Data, 2003

This declaration establishes principles concerning the collection, processing, use and storage of human genetic data.

It emphasises privacy, confidentiality, informed consent and protection against discrimination.

It is particularly relevant because genomic information can reveal sensitive characteristics concerning individuals and their biological relatives.

2. General Data Protection Regulation (GDPR), 2016

The GDPR provides strong protection for genetic data within its territorial scope.

Article 4(13) defines genetic data, while Article 9 treats genetic data as a special category of personal data.

Article 9 generally prohibits processing such information unless an applicable exception is satisfied.

Article 32 requires appropriate security measures, including safeguards against unauthorised access and disclosure.

These provisions establish an important international reference for genomic data governance.

3. Convention on Human Rights and Biomedicine, 1997

The Oviedo Convention establishes principles concerning human dignity, privacy and genetic testing.

Article 10 recognises the right to respect for private life in relation to information about health.

Its principles are relevant to protecting sensitive genomic information, subject to the Convention's application in the relevant jurisdiction.

Important judicial decisions

Although Indian courts have not yet developed a separate judicial framework specifically for genomic access audits, several decisions establish important principles concerning privacy, confidentiality, genetic information and electronic data protection.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 of the Constitution.

The judgment recognised informational privacy as an important component of individual autonomy and dignity.

Legal significance: Genomic records contain deeply personal information. The constitutional protection of informational privacy provides an important foundation for regulating access to genetic databases and preventing unauthorised disclosure.

2. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined the protection of privacy in relation to access to private documents and financial records.

The Court recognised that individuals have privacy interests in personal records and that state access must comply with constitutional requirements.

Legal significance: The principles are relevant by analogy to genomic records because sensitive personal information should not be accessed or disclosed without appropriate legal authority.

3. Sharda v. Dharmpal (2003)

The Supreme Court considered whether a court could direct a medical examination in matrimonial proceedings.

The judgment discussed the relationship between privacy, medical examination and the administration of justice.

Legal significance: The decision is relevant to genomic information because it demonstrates that medical privacy must be balanced against legitimate legal requirements. Access to sensitive medical or genetic information cannot be treated as unrestricted.

4. Selvi v. State of Karnataka (2010)

The Supreme Court examined the constitutional validity of involuntary narcoanalysis, polygraph examination and brain electrical activation profile tests.

The Court emphasised personal liberty, mental privacy and protection against compelled self-incrimination.

Legal significance: Although the judgment did not concern genomic databases, its reasoning reinforces the importance of individual autonomy and protection against involuntary intrusion into highly personal information.

5. R. Rajagopal v. State of Tamil Nadu (1994)

The Supreme Court recognised the right to privacy and examined restrictions on the publication of private information.

The judgment established important principles concerning unauthorised disclosure of personal information.

Legal significance: The decision is relevant to genomic data governance because genetic information should not be disclosed or published without appropriate legal justification.

Institutional responsibilities in genomic access auditing

Different institutions have responsibilities for maintaining genomic data security.

1. Hospitals and healthcare institutions

Hospitals must establish access-control policies, maintain appropriate records and protect genetic information from unauthorised disclosure.

2. Genomic research laboratories

Research laboratories must follow approved research protocols, consent requirements and ethical committee recommendations.

3. Biotechnology companies

Companies processing genomic information must implement appropriate cybersecurity safeguards and establish accountability for employees and third-party service providers.

4. Data protection and regulatory authorities

The Data Protection Board of India has functions under the DPDP Act, 2023, concerning enforcement of applicable provisions within its statutory jurisdiction.

CERT-In also plays an important role in cybersecurity incident response and compliance with applicable directions.

Major legal and ethical challenges

1. Genetic discrimination

Unauthorised access to genomic information may expose individuals to discriminatory treatment in employment, insurance or other areas.

2. Familial privacy

Genetic information about one individual may reveal information about biological relatives who have not independently consented to its disclosure.

3. Research confidentiality

Researchers may face difficulties balancing scientific collaboration with participant confidentiality and restrictions on secondary data use.

4. Commercial exploitation

Biotechnology companies may use genomic information for research, product development or commercial purposes, creating questions about consent, transparency and lawful processing.

5. Cross-border data transfers

International genomic research may involve transferring sensitive information between jurisdictions with different data protection requirements.

6. Cybersecurity vulnerabilities

Weak authentication, inadequate encryption, excessive user permissions and insufficient monitoring can expose genomic databases to cyber attacks.

Conclusion

The audit of access to sensitive genomic records is an essential element of modern healthcare governance and biotechnology regulation. It ensures that genetic information is accessed only for legitimate purposes and that institutions maintain accountability, confidentiality and appropriate security safeguards.

In India, the Digital Personal Data Protection Act, 2023, Information Technology Act, 2000, Bharatiya Sakshya Adhiniyam, 2023 and ICMR ethical guidelines provide important foundations for genomic data protection.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India, District Registrar v. Canara Bank and R. Rajagopal v. State of Tamil Nadu establish significant principles concerning informational privacy and protection of personal records.

Ultimately, effective genomic access auditing requires strong authentication systems, role-based permissions, reliable audit trails, informed consent, institutional accountability and regular security assessments. A comprehensive regulatory approach is necessary to protect genetic privacy, prevent discrimination and maintain public confidence in genomic research and personalised healthcare.