AI on Health and Genomic Data: The Law and Ethics of Biomedical Research

ChatbotsChatbots in Healthcare covers what happens once an AI system is deployed to patients. This page covers the stage before that: training and validating a model on genomic, proteomic, electronic-health-record, or medical-imaging data in the first place, which runs on a different legal basis, a different approval process, and a different set of failure modes than deployment does. Building a predictive model from a research dataset and putting a diagnostic tool in front of a patient are two different regulatory events, not one continuous activity, and treating them as the same thing is where a research project's data-governance plan most often goes wrong.

Research Has a Different Legal Basis Than Care

LegalLegal Framework in Computing covers UK GDPR's general treatment of health data as "special category" data, requiring one of a short list of specific conditions before it can be processed at all. Scientific research has its own condition, separate from consent or direct care: UK GDPR Article 9(2)(j) permits processing special category data for research where it is proportionate, respects data protection rights, and provides suitable safeguards, and the Data Protection Act 2018's Schedule 1, paragraph 4 adds that the processing must not be likely to cause substantial damage or distress and must be documented in a formal "appropriate policy document" [1]. This is a materially different bar than "the patient consented to their data being used" — it is what lets a study use data from thousands of patients who were never individually asked, provided the safeguards are real and documented, not assumed.

A second, UK-specific route exists precisely because large-scale health research often can't get individual consent at the scale it needs: Section 251 of the NHS Act 2006 lets the common law duty of confidentiality be temporarily set aside for defined medical purposes, with approval granted and reviewed annually by the Confidentiality Advisory Group (CAG) within the Health Research Authority (HRA) [2]. A project that plans to link identifiable NHS records for training data — rather than working from an already-anonymised extract — needs this specific approval, not just a data-sharing agreement with whoever holds the records.

Genetic Material Has Its Own Law

DataData derived from a biological sample carries an additional layer that a spreadsheet of lab results doesn't: the Human Tissue Act 2004 makes it a specific criminal offence in England, Wales, and Northern Ireland to hold bodily material with intent to analyse its DNA and use the results — including for research — without "qualifying consent", and storing tissue for research generally requires a Human Tissue Authority licence unless a specific exemption applies [3] (Scotland's equivalent is the Human Tissue (Scotland) Act 2006, with its own detail; the two are not identical). This sits alongside, not instead of, the data-protection question above — a genomic sequencing project can satisfy UK GDPR's research condition for the resulting data and still be operating illegally if the sample itself was collected or stored without the consent the Act requires.

Ethical Approval Is a Gate, Not a Formality

ThisThis site's general Research Ethics page covers the generic Institutional Review Board model. Health and social care research in the UK runs through a more specific version of the same idea: a Research Ethics Committee (REC) recognised by the Health Research Authority, with CAG approval layered on top wherever the study needs identifiable data without consent, as above. A project plan that treats "we'll sort out ethics approval" as a line item to slot in once the model architecture is decided has the sequence backwards — approval scope determines what data the project is legally allowed to touch at all, which determines what's actually buildable, not the other way round.

"Anonymised" Genomic Data Often Isn't

AA genome is unusually hard to anonymise in the way a name-and-address field is, because the genome itself is the identifier. Gymrek and colleagues demonstrated this directly: starting from nothing but anonymised genetic data, they recovered the surnames of individuals in a research database by cross-referencing Y-chromosome markers against public genetic-genealogy databases, then narrowed the resulting family-name candidates using publicly available demographic metadata (age, state of residence) until they identified specific named individuals [4]. Stripping a genomic dataset of names and addresses does not make it anonymous in any durable sense — the data re-identifies itself given a large enough public reference database, and those databases only grow over time. The practical UK response has been to stop trying to fully de-identify-and-release sensitive health and genomic data at all: NHS Secure Data Environments now provide the default route for external researchers to run analysis against the data without the data itself ever leaving a controlled environment, built around the "Five Safes" framework (safe people, projects, settings, data, and outputs) [5]. If a project's data management plan involves downloading a de-identified genomic extract onto a laptop, that plan is already behind where UK policy has moved.

Whose Genome Is in the Reference Database Matters

AA model trained on biomedical data inherits whatever gaps exist in that data, and genomics has a specific, well-documented one: as of Popejoy and Fullerton's 2016 analysis, more than 78% of participants in published genome-wide association studies were of European descent, with most of the growth in the non-European share coming specifically from increased participation in a small number of Asian countries rather than broad-based improvement [6]. A diagnostic or risk-prediction tool trained predominantly on one ancestry's genetic variation carries a real risk of being measurably less accurate for patients outside it — the genomic-data equivalent of the training-data bias problem Chatbots in Healthcare documents for a non-genomic clinical algorithm, and evidence of the same underlying failure mode: a system's aggregate accuracy figure conceals how unevenly that accuracy is actually distributed across the population it's meant to serve.

Deployment Is a Separate Regulatory Event, Again

EverythingEverything above governs building and validating a model on research data. The moment that model is intended to inform an actual diagnosis or treatment decision, it potentially becomes a medical device in its own right, regulated by the MHRA's framework for software and AI as a medical device — a different regulator, a different approval process, and a different question ("is this safe and effective for this clinical use") than any research ethics approval already answers [7]. Approval for retrospective research on a historical dataset covers exactly that; a new approval process starts at the point research output becomes clinical input.

What This Means When You're the One Building It

• Identify the legal basis before writing any code — the research condition, Section 251 support, and explicit consent are different routes with different paperwork, and which one applies constrains what data you can actually touch.
• Treat a biological sample and the data derived from it as two separate compliance questions — satisfying UK GDPR for the data says nothing about whether the underlying sample was obtained and stored lawfully under the Human Tissue Act.
• Don't plan around downloading a de-identified extract if the data is genomic or otherwise highly identifying — plan around bringing the analysis to a secure environment instead.
• Report your training data's demographic composition, not just its size, and treat a skewed reference population as a limitation to disclose, not a detail to omit.
• Know which regulatory question you're currently answering — "is this approved for this research" and "is this approved for clinical use" are different questions with different answers, and passing the first is not evidence for the second.

Related Topics

• Chatbots in Healthcare — the deployment-side regulation and bias risks this page's research-side coverage leads into.
• Legal Framework in Computing — the general UK GDPR obligations this page's research-specific conditions sit on top of.
• Research Ethics — the general ethics-committee model this page's UK health-research-specific route extends.
• AI Governance — who actually evaluates and enforces standards for AI systems more broadly, once one leaves the research stage.
• Two Kinds of Ethics — why satisfying every procedure this page describes is a floor, not a guarantee that every remaining judgement call has been made well.

References

1. Information Commissioner's Office. What are the research provisions? and Data Protection Act 2018, Schedule 1, paragraph 4. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/the-research-provisions/what-are-the-research-provisions/
2. Health Research Authority. Confidential patient information and regulations (Confidentiality Advisory Group). https://www.hra.nhs.uk/about-us/committees-and-services/confidentiality-advisory-group/confidential-patient-information-and-regulations/
3. Human Tissue Act 2004. https://www.legislation.gov.uk/ukpga/2004/30/contents; Health Research Authority, Use of human tissue in research. https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/use-tissue-research/
4. Gymrek, M., McGuire, A. L., Golan, D., Halperin, E., & Erlich, Y. (2013). Identifying Personal Genomes by Surname Inference. Science, 339(6117), 321–324. https://doi.org/10.1126/science.1229566
5. NHS England. Secure Data Environments: accessing data for research and analysis. https://transform.england.nhs.uk/key-tools-and-info/data-saves-lives/secure-data-environments/accessing-data-for-research-and-analysis/
6. Popejoy, A. B., & Fullerton, S. M. (2016). Genomics is failing on diversity. Nature, 538(7624), 161–164. https://doi.org/10.1038/538161a
7. Medicines and Healthcare products Regulatory Agency. Software and AI as a Medical Device Change Programme. https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme