Visit Website →
← Back to blog

Consent Management for PGx: A Laboratory Playbook

October 28, 2026
Consent Management for PGx: A Laboratory Playbook

Consent management for pharmacogenomics (PGx) is the set of decisions, records and workflows that show what a patient agreed to, what your laboratory may do with the genotype and medication data, how long you keep it, and what happens when the patient changes their mind. Consent to run a clinical test covers the test and the report. It does not automatically cover research use, commercial disclosure or indefinite storage, and your systems need to record those permissions separately.

This guide is written for laboratory directors, compliance leads and informatics teams who run or plan to run PGx reporting. It covers what patients should be told, how to structure consent records, how withdrawal and deletion interact with clinical-record duties, how retention works, and what to look for in reporting software.

SignalPGx
Build PGx Reporting Around Your Workflow
SignalPGx helps laboratories turn genetic and medication data into physician-reviewed reports, with configurable infrastructure for PGx reporting workflows.
Explore SignalPGx

TL;DR

  • Treat PGx consent as a clinical conversation with a durable record, not a one-time checkbox. DNA is permanent and shared with relatives, so the stakes differ from a routine lab order.
  • Separate permissions: testing and reporting, storage and retention, future reanalysis, and secondary or research use. Consent to the first does not imply the others.
  • Withdrawal has limits. Samples can usually be destroyed on request, but reports already used in care and records you are legally required to keep stay in the chart.
  • Retention is driven by CLIA, accreditation, state law and contract terms. Set a written schedule and enforce it in software, with an audit trail.
  • Your reporting platform should tie each report to the consent version, the evidence version and the reviewer who signed it.

Table of Contents

Pharmacogenomic results look routine. A CYP2C19 or CYP2D6 genotype is reported next to a drug, and a clinician adjusts a prescription. The underlying data, however, is a piece of the patient's genome. The Council on Pharmacy Standards frames PGx authorization as a foundational clinical intervention that builds safety and trust, rather than a transactional form, precisely because DNA is permanent and heritable.

There is also no single standard to copy. A 2024 assessment of real-world practices in Frontiers in Pharmacology reports that guidance exists for hereditary disease genetic testing, while consensus and standardized practice for pharmacogenomic informed consent are lacking. The same assessment found that institutions commonly include a description of the test, its purpose and the potential benefit in medication selection or avoidance.

For a laboratory this means your consent model is a design decision you own. Regulators and professional bodies tell you what to cover, but how you capture, store and enforce it is up to your team and your medical director.

What consent means for PGx data — overview diagram

What patients should be told

The British Columbia Ministry of Health's pharmacogenomics testing policy for providers (August 2025) is one of the more concrete public checklists. It is a Canadian document, so treat it as a reference model rather than a US requirement. It says patients should understand:

  • the purpose, use, impact, benefits and limitations of the test;
  • the possibility of incidental findings;
  • how their information is collected, accessed, used, disclosed and retained;
  • privacy risks that extend to genetically related people and people who share their ancestry;
  • that data may be used for research, product testing, development or market assessment.

The FDA-adopted ICH E18 guidance on genomic sampling (2018) adds items that matter when samples or data feed research: the type and quantity of biological material collected, the collection procedures, and the position on returning genomic data. It also encourages consent that allows broad analyses and, ideally, broad use, subject to local regulations and policies.

Translate this into plain language

A good PGx consent conversation is short and specific. Patients typically need four points in words they can repeat back:

  1. What the test does: it looks at genes that affect how you process certain medicines, and it informs prescribing. It does not diagnose a disease.
  2. What else it might reveal: depending on your assay and reporting scope, incidental findings are possible, and your lab should say whether they are reported.
  3. Who sees it: the ordering clinician, your lab, your software vendors acting under contract, and anyone else only with separate permission.
  4. How long it lasts: the result may be used again when guidelines change, and the record may be kept for years.

The fourth point is the one most often missing. If your platform reanalyzes results as guidelines evolve, patients and ordering providers should know that updated recommendations may follow the original report.

Not necessarily. The BC Ministry of Health recommends, at a minimum, specific consent for any secondary uses, disclosures and long-term retention beyond what the clinical test strictly requires. That is a sound operating rule for US laboratories too, even where the law is looser.

In the US, the HHS position is that genetic information is health information protected by the Privacy Rule when it is individually identifiable and held by a covered entity. HIPAA permits many uses for treatment, payment and operations without a separate authorization, but research, marketing and sale of data follow different rules, and state genetic privacy laws may be stricter. Your counsel should map which of your uses fall where, and your consent record should reflect the answer.

In practice, we recommend recording these as independent flags rather than one bundled agreement:

PermissionWhat it coversTypical default
Clinical testing and reportingRunning the assay, generating the report, delivering it to the ordering provider and patientRequired to proceed
Retention beyond the minimumKeeping genotype data and reports for longer than the legal minimumOpt-in, with stated period
Reanalysis and updatesRe-evaluating stored results as guidelines change and notifying the providerStated clearly; often part of the service
De-identified research or product developmentUsing data without direct identifiers for validation or improvementSeparate, opt-in
Disclosure to third partiesSharing identifiable data outside treatment, payment and operationsSeparate written permission

The exact defaults depend on your jurisdiction and your contracts. The point is that each row is its own field in the system, with its own timestamp and version of the consent language.

Patients can change their minds, and the question for your lab is what that actually reaches. The World Medical Association's Declaration of Taipei (2016) states that individuals may alter their consent, or request withdrawal of identifiable data from a health database and biological material from a biobank, at any time and without reprisal, for future use.

Two limits follow from that wording.

  • Withdrawal governs future use. A report already placed in the chart and used for a prescribing decision is part of the medical record. You cannot unwrite clinical history.
  • Analysis already done may stay. The FDA's E18 guidance notes that samples may be destroyed at a participant's request, but destroying genomic data once it has been analyzed and incorporated into study results can jeopardize the scientific integrity of clinical research.

For consumer-facing services, the Future of Privacy Forum's best practices for consumer genetic testing (2018) recommend clear, prominent methods to delete an account and genetic data and to destroy samples, unless legal or research obligations prevent it. A clinical laboratory is not a consumer service, but the principle carries over: offer a clear route, and explain the exceptions in the same breath.

A withdrawal workflow that holds up

  1. Log the request with date, requester identity and the scope: sample, data, future reanalysis, research use, or all of these.
  2. Check holds. Legal retention periods, accreditation requirements, pending disputes and active clinical use all limit deletion.
  3. Act on what is permitted: destroy the residual specimen, stop non-clinical uses, remove the record from research or development datasets, and suppress further notifications if the patient declined reanalysis.
  4. Tell the patient what was done and what was kept, with the reason for anything retained.
  5. Preserve the request itself in the audit trail. Proof that you honored a withdrawal is a compliance record.

The World Health Organization's personal data protection policy offers a useful template for the reasons deletion may proceed: the data is no longer necessary, consent was the only basis for processing and has been withdrawn, or deletion is needed to meet a legal obligation. It governs WHO, not US laboratories, but the logic maps cleanly onto a lab decision tree.

There is no single number. Several layers apply at once, and the longest applicable period usually wins.

The Future of Privacy Forum recommends reasonable retention practices that account for active accounts, contextual uses and regulatory requirements, and it stresses vendor oversight and data minimization. In short, keep what you must, keep what the patient has authorized, and have a defensible reason for anything else.

Decide what each record type gets

Build a retention schedule with a row per record type and a named owner. At minimum, include:

  • raw genotype files (VCF, array or sequencing outputs) and derived calls;
  • the signed report and each reanalysis version;
  • the medication list used at the time of interpretation;
  • the consent record, including the exact language version the patient saw;
  • withdrawal and deletion requests and your response;
  • access logs, reviewer sign-offs and audit trails.

Raw files are the costly ones to store, and the ones with the most privacy exposure. If you can regenerate a report from stored variant calls, decide explicitly whether raw files are still needed after the retention trigger. Our five-step genomic data retention guide for lab stewards goes through that decision in more detail.

Retention also touches your systems. Records that must survive for years need integrity controls and validated storage, so the question of LIMS validation and ALCOA+ data integrity belongs in the same planning conversation as the schedule itself.

Vendors, processors and who holds the data

Consent does not stop at your door. If a software vendor, cloud host or interpretation service touches identifiable genotype data, it does so on your authority, and your patients' expectations travel with the data. The Future of Privacy Forum notes that GDPR separates controller and processor responsibilities and that controllers should choose processors able to implement the necessary technical and organizational measures. In the US, the equivalent contractual tool is the business associate agreement, and we outline what your lab should require in a HIPAA BAA for genomics.

Ask every vendor four questions: where is the data stored, who can access it, what happens to it at contract end, and can deletion or restriction requests be executed and evidenced on demand.

We build reporting infrastructure for laboratories, and the pattern we see is consistent: consent gets handled well at the bedside and badly in the data. A signed form sits in a scanned folder while the report pipeline has no idea what the patient agreed to. Months later, a guideline changes, a reanalysis runs, and nobody can say whether the patient's permissions cover it.

Our view is that consent should be a first-class object in your reporting stack. Each report should reference the consent version it was issued under, the evidence version it relied on, and the medical director who approved it. That is the reasoning behind keeping clinicians in control of final sign-off, with an audit trail that records who reviewed what and when.

Consent-linked report approval and audit trail

We also think living reanalysis changes the consent conversation. If recommendations update as CPIC, DPWG or FDA labeling evolves, the patient and provider should be told so at the start, and the platform should respect a patient's decision not to receive updates. Automation should narrow the gap between policy and practice, not widen it.

Finally, we advise labs not to wait for a standard. Pharmacogenomic consent practice is still uneven, so a documented, reviewed, version-controlled approach is both your best protection and a real signal of quality to ordering providers.

— Tarek

If your laboratory is launching or scaling a PGx service, consent and retention rules are easiest to set before the first report ships. SignalPGx provides white-label pharmacogenomics reporting infrastructure for laboratories, with medical-director review, an audit trail, living reanalysis, HL7/FHIR integration and HIPAA and GDPR compliance built in.

SignalPGx

Our engagements start with Discovery & Strategy, from $7,000 one-off per project, where we map your consent, retention and review workflow. System Design starts from $9,000 and Deployment & Integration from $15,000, both one-off per project. Details are on our main site.

A practical checklist before you go live

  • Consent language reviewed by counsel and your medical director, with version numbers.
  • Separate fields for testing, retention, reanalysis, research and third-party disclosure.
  • A written retention schedule per record type, with owners.
  • A withdrawal workflow with a defined response time and an audit record.
  • Business associate or data processing agreements with every vendor that touches genotype data.
  • Reports that carry consent version, evidence version and reviewer identity.
  • Staff training so that ordering clinicians can explain the points in plain language.
  • A periodic review of the schedule against state law, accreditation changes and contract terms.

FAQ

Usually not by itself. A requisition authorizes the test, but patients should also understand storage, sharing, reanalysis and any research use, and secondary uses call for specific consent. Your state's requirements for genetic testing consent may add further steps, so confirm them with counsel.

How long must a lab keep PGx records?

CLIA sets a floor of at least 2 years for requisitions, authorizations and patient test records, and other record types have their own periods. Accreditation bodies, state law and contracts often require longer. Set one written schedule that applies the longest applicable period to each record type.

Can a patient have their genetic data deleted?

Often partly. Residual specimens can usually be destroyed on request, and non-clinical uses can be stopped. Reports already used in care and records that law or accreditation requires you to keep generally remain, and you should explain this to the patient in writing.

Does HIPAA cover genetic data from a PGx test?

Yes, when it is individually identifiable and held by a covered entity, HHS treats genetic information as protected health information. State laws and non-US rules such as GDPR can add obligations on top.

Sources