Topic 4.11 — Genomics & Precision-Medicine Data

Genomic data is the most personal, most durable and most familial data your organization will ever hold, so the way you store, interpret, consent for and return it is a lifelong clinical-safety, equity and public-trust decision — not a laboratory back-office concern.

Why this matters in health and care#

A genome is not a test result that expires. When you sequence a person's DNA you generate a record that stays clinically relevant for their whole life, is partly shared with their parents, children and siblings, and can be re-interpreted years later as knowledge advances. A variant that looks meaningless today may, a decade from now, explain a cancer, flag a drug that will harm them, or reveal a risk their untested relatives also carry. The data outlives the episode of care, the IT system that first held it, and often the clinician who ordered it.

That durability changes the stakes of every ordinary data decision. Storage is not a matter of holding a number until the next appointment; it is custody of a lifelong asset that must remain readable and re-analysable for decades. Consent is not a one-off tick on a request form; it must anticipate uses and findings that neither clinician nor patient can fully foresee. Access control is not just about this patient, because a genome implicates people who never walked into your clinic and never agreed to anything.

Genomic and precision-medicine data also carry a distinctive equity burden. Most of the world's reference and research genomes come from people of European ancestry, so a variant interpretation that is confident for one population can be uncertain or wrong for another — a bias baked into the data that no amount of good intent at the bedside corrects (see Topic 1.9 — Digital Inclusion & Accessibility). And because genomes are uniquely identifying, they are impossible to truly anonymize; the promise of "we removed your name" does not hold for a sequence that is your name. Get the ways of working wrong and you do not just leak a record — you erode the public trust that the whole enterprise of genomic medicine depends on (see Topic 1.8 — Data Ethics, Consent & Public Trust).

Core concepts#

Genomics is the study of an organism's complete set of DNA — its genome — including how genes function, vary and interact, as distinct from genetics, which classically studies single genes. Precision medicine (often called personalized medicine) is the practice of tailoring prevention, diagnosis and treatment to the individual characteristics of each patient — frequently their genomic profile — rather than applying a single average protocol to everyone. Genomics is one of the main engines of precision medicine, but the two are not synonymous: precision also draws on other molecular, imaging and lifestyle data.

Whole genome sequencing (WGS) reads effectively the entire three-billion-base-pair genome, in contrast to targeted panels (a handful of genes) or whole exome sequencing (the protein-coding fraction). WGS is the data-heaviest option: a single sequenced genome generates on the order of one hundred gigabytes of raw and processed data, so a national program measures its storage in petabytes and its compute in thousands of processor-hours. The scale is the first thing that makes genomic data a distinct engineering problem, not just another lab feed.

Turning raw sequence into clinical meaning is the work of bioinformatics — the computational pipelines that align reads, call variants, filter, annotate and prioritize them for a human scientist to interpret. Those pipelines depend on a reference genome, a standardized assembly against which an individual's sequence is compared; the choice and version of that reference, and the databases used to annotate variants, materially affect the answer. A genomic result is therefore not a raw fact but the output of a versioned, evidence-dependent process that must be reproducible and auditable years later.

Pharmacogenomics is the branch of precision medicine concerned with how a person's genome affects their response to medicines — which drugs will work, which will not, and which risk harm at standard doses. Delivered well, it puts a genotype-guided alert at the point of prescribing so a clinician avoids a drug the patient cannot metabolize safely (see Topic 4.8 — Electronic Prescribing & Medicines Management). Two further features define the data type: incidental medical findings — clinically significant discoveries unrelated to the reason the test was ordered, such as an unexpected cancer-predisposition gene — and data re-identification, the fact that a genome is so distinctive it can be matched back to an individual even when names are stripped, which is why ordinary anonymization fails.

In England this is delivered through the NHS Genomic Medicine Service, which commissions a national network of regional Genomic Laboratory Hubs, and through Genomics England, the government-owned company that ran the 100,000 Genomes Project and now curates the National Genomic Research Library — a controlled research resource built on participants' consent. Standards come from bodies including HL7 Fast Healthcare Interoperability Resources (FHIR), whose Genomics work lets results move between laboratory and record, and the Global Alliance for Genomics and Health (GA4GH), which sets international standards for sharing genomic data responsibly. Underpinning all of it is genetic privacy — the principle, and increasingly the law, that a person controls access to their own genetic information and its familial implications.

Best practices#

1. Treat consent as a durable, dynamic relationship, not a signature. Because genomic data will be re-analysed and may reveal findings no one anticipated, a one-off consent form cannot carry the weight. Adopt layered or dynamic consent that records, at a granular level, what the person agreed to — clinical use, research use, recontact for new findings, familial sharing — and lets them revisit those choices over time. Model the 100,000 Genomes precedent, where participants explicitly consented to their de-identified data joining a research library, and make consent status a first-class, queryable attribute of the record rather than a scanned PDF no system can act on (see Topic 1.8 — Data Ethics, Consent & Public Trust).

2. Engineer for lifelong custody and re-analysis, not one-time reporting. Design storage and metadata on the assumption that this genome will be re-interpreted in ten and twenty years by people and pipelines that do not yet exist. Retain not just the final report but the versioned inputs — reference genome build, pipeline version, annotation database releases — so a result can be reproduced and a re-analysis can tell what changed. Plan the storage economics honestly: petabyte-scale, tiered so that cold archival sequence is cheap to hold but retrievable, with formats and identifiers chosen for longevity over vendor convenience (see Topic 4.0 — Technical Architecture, Cloud & Legacy).

3. Make the bioinformatics pipeline reproducible, validated and version-controlled. A genomic result is the output of software, so the software is a clinical instrument and must be governed like one. Version-control the pipeline, validate it against reference standards and known-truth datasets, and record for every report exactly which pipeline and databases produced it. When you upgrade a reference build or an annotation source, treat it as a change with clinical-safety implications, because the same raw data can yield a different call under a different version (see Topic 1.6 — Clinical Safety & Risk Management).

4. Return results into the EPR as structured, actionable data — not a PDF. A genomic finding delivers value only when the right clinician sees it at the right moment, which means it must reach the electronic patient record in a computable, standards-based form. Use HL7 FHIR Genomics and recognized terminologies so a variant, its interpretation and its clinical recommendation are discrete data the record can act on, rather than a report locked in a document nobody can query (see Topic 4.6 — Electronic Patient Records & Clinical Systems, and Topic 4.3 — Interoperability & Data Standards). Design for the long tail too: a result filed today must remain findable and interpretable when it becomes relevant years later.

5. Deliver pharmacogenomics at the point of prescribing, not in a filed letter. A genotype that predicts a dangerous drug response is useless if it sits in a report while the prescriber writes the prescription unaware. Integrate pharmacogenomic results into the electronic prescribing system so a genotype-guided alert fires when a relevant drug is ordered, with clear, non-fatiguing guidance a prescriber can act on (see Topic 4.8 — Electronic Prescribing & Medicines Management, and Topic 4.7 — Clinical Decision Support & Clinical Informatics). Because the genotype is lifelong, design the alert to persist across settings and episodes, so a result generated in oncology protects the patient years later in primary care.

6. Plan for incidental and secondary findings before you sequence, not after. Whole genome sequencing will sometimes reveal something clinically important and entirely unrelated to the reason for the test, so decide in advance what you look for, what you report, and how the patient chose to be told. Align policy with the person's consent choices, provide the genetic-counseling pathway to deliver a serious unexpected finding humanely, and make sure the operational workflow — who contacts whom, and when — actually exists. Improvising this after a finding surfaces is how patients are harmed by good news badly handled.

7. Confront reference-data bias as a safety and equity issue. When the reference and variant databases underrepresent a population, interpretation for people of that ancestry is less certain and more error-prone — a variant of uncertain significance for one group may be confidently benign for another only because the data exists. Track the ancestry diversity of the datasets your interpretation relies on, be explicit with clinicians about where confidence is lower, and support efforts to build more representative reference data rather than treating a European-centered baseline as universal (see Topic 1.9 — Digital Inclusion & Accessibility). Equity here is not a soft aspiration; an unrepresentative reference produces measurably worse care.

8. Govern genomic data as familial, re-identifiable and uniquely sensitive. A genome cannot be truly anonymized and it implicates blood relatives who never consented, so ordinary information-governance defaults are not enough. Apply strong access controls, purpose limitation and full auditability; route research access through secure data environments where data is analysed in place rather than copied out (see Topic 4.10 — Secure Data Environments & Research Data Access); and work through the familial questions — when relatives can be informed of a shared risk, and how — with your Caldicott Guardian and clinical ethics support (see Topic 1.7 — Information Governance, Data Protection & Cyber Security). Adopt GA4GH standards for any data shared across organizational or national boundaries so responsible sharing is built in, not bolted on.

Questions to discuss with your team#

1. What does "consent" actually mean for data we will re-analyse for the rest of a patient's life — and can our systems act on the choices people made? This matters because the genomic consent a patient gives today has to govern uses and findings that neither of you can foresee, and a scanned form is not something a prescribing system or a research pipeline can enforce. Debate whether your consent model is genuinely dynamic — can a patient change their mind about recontact or research use, and does that change propagate to every system that relies on it? Surface the tension between broad consent, which enables research and future benefit, and specific consent, which respects autonomy but can freeze data out of uses that would help the patient and others. Consider the 100,000 Genomes and National Genomic Research Library precedent, where explicit, layered consent underpinned public trust in a research resource. A good, honest answer admits where consent today is an unqueryable document rather than a live attribute, and commits to making consent status something systems can read and honor, not just something a filing cabinet holds.

2. When whole genome sequencing reveals something we were not looking for, what will we do — and have we built the pathway before the finding arrives? Incidental and secondary findings are not edge cases; at genome scale they are a predictable category of result, and the harm comes from handling them without a plan. Discuss what your organization will actively look for and report, how that aligns with what each patient consented to hear, and who is accountable for delivering a serious unexpected finding — a cancer-predisposition gene, say — with the genetic counseling it demands. Probe the operational reality: does the workflow to contact a patient, offer counseling, and consider untested relatives actually exist and have capacity, or is it a policy paragraph with no team behind it? Consider the familial dimension, where the finding implicates relatives who are not your patients and never consented. A good answer names the reporting policy, ties it to consent, and confirms a resourced counseling and recontact pathway exists rather than assuming clinicians will improvise humanely under pressure.

3. Whose genomes underpin our interpretations — and where is that bias making our results less safe for some of our population? Genomic interpretation is only as good as the reference and variant databases behind it, and because those are dominated by people of European ancestry, confidence is systematically lower for other groups — an equity gap hidden inside what looks like objective science. Debate whether your teams even know the ancestry composition of the datasets their pipelines rely on, and whether clinicians are told when a result is less certain because the underlying data is thin for that patient's background. Surface the trade-off between acting on the best available evidence and being honest that "best available" is more reliable for some patients than others. Consider what your organization can do — from local data practices to supporting national efforts for more representative reference data — rather than treating a skewed baseline as an immutable fact of nature. A good answer refuses to treat reference bias as someone else's problem, makes the uncertainty visible at the point of care, and names concrete steps toward more representative data.

4. When we re-run a genome in ten years' time, will we be able to reproduce today's result and explain what changed — and can we still afford to hold the data? A genomic result is the output of versioned software running against versioned reference and annotation data, so re-analysis is not a bonus feature but the whole point of holding the sequence for a lifetime. Discuss whether your pipelines record, for every report, the reference build, pipeline version and annotation database releases that produced it, because without that provenance a re-analysis cannot tell a genuine change in knowledge from a silent change in software. Surface the storage reality behind the promise: petabyte-scale sequence that must stay readable and retrievable for decades, on formats and identifiers you do not want to be locked into, at a cost someone has to keep funding long after the original episode of care. Probe the tension between deleting to save money and retaining to serve the patient's future, and between vendor-convenient formats today and longevity tomorrow. A good answer treats the pipeline as a clinical instrument that is governed and version-controlled, plans tiered storage economics honestly rather than assuming this year's budget, and can point to a real case that was reproduced or re-analysed rather than a theoretical capability.

5. Does a genotype that predicts harm actually reach the prescriber's screen at the moment they prescribe — or does it sit in a filed report? A pharmacogenomic result only protects a patient if it fires as an alert when a relevant drug is ordered, potentially years later and in a different service from the one that sequenced them, so the integration between the laboratory result and the electronic prescribing system is where the clinical value is won or lost. Debate whether your genomic results return into the record as discrete, computable data using HL7 FHIR Genomics and recognized terminologies, or as documents that only a clinician who goes looking will ever see. Confront the alert-fatigue trade-off directly: an alert that fires too often or without clear, actionable guidance gets dismissed, so the design question is not just whether the alert exists but whether prescribers trust and act on it. Consider the lifelong, cross-setting requirement — a genotype found in oncology has to keep protecting the patient in primary care — which most result-return designs quietly ignore. A good answer can trace the path from a called variant to a prescriber's decision, names who owns that integration, and admits where results still arrive as unusable PDFs.

6. A genome implicates relatives who never walked into our clinic — how do we govern data that is familial and impossible to truly anonymize? Because a sequence is uniquely identifying and shared in part with a person's parents, children and siblings, ordinary information-governance defaults built for episodic, anonymizable records do not hold, and "we removed the name" is false reassurance for data that is itself an identifier. Discuss how your access controls, purpose limitation and audit actually work for genomic data, and whether research access analyses genomes in place through a secure data environment rather than copying them out where control is lost (see Topic 4.10 — Secure Data Environments & Research Data Access). Work through the genuinely hard familial question: when a finding reveals a serious, actionable risk that a patient's untested relatives also carry, who may be told, on what basis, and with whose ethical sign-off. Surface the tension between a relative's interest in knowing and the patient's control over their own information, and the reality that your Caldicott Guardian and clinical ethics support need to have settled this before a case forces it. A good answer governs genomic data as re-identifiable and familial by default, routes sharing through GA4GH standards and secure environments, and can describe the familial-disclosure pathway rather than hoping the situation never arises.

In practice: a health & care example#

Kingsbridge and Vale Genomic Laboratory Hub serves a regional integrated care system and processes whole genome and panel sequencing for rare-disease and cancer patients across several trusts. Historically its reports arrived as PDF letters filed into each trust's electronic patient record — readable by a clinician who went looking, invisible to any system that might act on them. When a patient was prescribed a common cardiac drug in primary care two years after a hospital sequencing test, nobody saw the filed report showing they were a poor metabolizer, and the patient suffered an avoidable adverse reaction. The board treated the near-miss as what it was: a data-flow failure, not a clinical one.

The hub, its ICS and the trusts convened a genomics informatics group with the laboratory director, a consultant clinical geneticist, the chief clinical information officer, a pharmacist, and the Caldicott Guardian. Their first decision was to stop shipping PDFs. Working with the trusts' EPR and electronic prescribing suppliers, they moved to returning results as structured data using HL7 FHIR Genomics, so a variant, its interpretation and its actionable pharmacogenomic recommendation became discrete, computable fields. The poor-metabolizer genotype now sits in the record as data, and an alert fires at prescribing wherever in the ICS that patient is later seen.

The group then tackled consent and storage. They replaced the scanned consent form with a structured consent record capturing, granularly, whether each patient agreed to research use via the National Genomic Research Library, to recontact if new findings emerged, and to familial sharing — and made that status queryable, so a re-analysis pipeline could check it before acting. Raw sequence was moved to tiered petabyte storage that retained the reference build and pipeline version for every case, so any result could be reproduced or re-analysed as knowledge advanced. Research access was routed through the ICS secure data environment, analysing genomes in place rather than exporting them.

Two things were deliberately hard. The geneticist insisted that incidental-findings policy be agreed and resourced before scaling WGS: a defined list of what would be reported, aligned to each patient's consent, with a genetic-counseling pathway that actually had capacity. And the group logged, honestly, that variant interpretation was less certain for the ICS's substantial South Asian and Black populations because reference data was thinner — so reports began flagging that lower confidence explicitly, and the ICS backed a regional effort to diversify reference data. A year on, the win was not a gadget but a discipline: genomic results that flow, persist, respect consent, and admit their own limits.

Sector lenses#

Startup#

A genomics or precision-medicine startup — a sequencing service, a variant-interpretation tool, or a pharmacogenomics decision-support product — lives or dies on trust and standards adoption. Build to HL7 FHIR Genomics and GA4GH from the first release, because an NHS Genomic Laboratory Hub or trust will not integrate a product that speaks only a proprietary format, and retrofitting standards later is costly. Be radically clear about consent, data residency and re-identification risk, since a single mishandling of uniquely sensitive genomic data can end a young company's credibility overnight. Your differentiator is not just algorithmic accuracy but a defensible, auditable, reproducible pipeline and an honest account of where your interpretation is less certain — including for underrepresented populations.

Small business#

An established small provider — a GP practice, a community pharmacy, a single-site clinic or a small diagnostics supplier — is a consumer of genomic results far more often than a generator of them, and its challenge is acting on data it did not produce with almost no dedicated informatics capability. The practical priority is that pharmacogenomic and other genomic findings arrive in the clinical system as structured, actionable data that fires a usable alert at prescribing, because a small team cannot manually watch for filed reports the way a hub can. Insist that suppliers deliver results via HL7 FHIR Genomics rather than PDFs you have no capacity to interpret or re-key, and lean on the regional Genomic Laboratory Hub and national counseling pathways for interpretation and incidental-findings support rather than trying to build that expertise in-house. The information-governance duties around familial, re-identifiable data still apply in full even with one part-time information-governance lead, so make consent status visible in your record and route any query you cannot resolve to your Caldicott Guardian arrangements rather than improvising.

Enterprise#

A large NHS trust, a Genomic Laboratory Hub or a pharmaceutical firm operates at the scale where storage, interpretation throughput and EPR integration become the binding constraints. The realistic priorities are structured return of results into clinical systems, a validated and version-controlled bioinformatics pipeline, tiered petabyte storage designed for decades of re-analysis, and pharmacogenomic alerts wired into electronic prescribing (see Topic 4.6 — Electronic Patient Records & Clinical Systems). Governance must span the laboratory, the clinical services that act on results, and the information-governance function that owns familial and consent questions. At this scale the biggest failures are integration failures — results that arrive as unusable documents — so invest in interoperability and consent-as-data before chasing sequencing volume.

Government#

A national body — NHS England's Genomic Medicine Service, Genomics England, or a devolved equivalent — shapes the whole system through commissioning, standards and shared infrastructure. Its leverage is to mandate interoperable result formats, fund the reference and research data infrastructure no single trust could build, run the consent and public-engagement model that sustains legitimacy, and steward a national research library on explicit participant consent (see Topic 9.2 — Global & International Digital Health). Government carries the equity duty most heavily: only national-scale action can meaningfully diversify reference datasets so genomic medicine works for the whole population, not just its best-represented parts. It also holds the public-trust settlement — a single high-profile breach or consent scandal can set the national program back years, so transparency and strong governance are strategic necessities, not overhead.

Common failure modes#

• The PDF result that no system can read. A genomic finding filed as a document is invisible to prescribing and decision-support systems, so lifesaving information sits unused until harm occurs. Return results as structured, standards-based data.
• Consent as a scanned form. If consent choices are trapped in an unqueryable image, no pipeline or clinician can honor them, and re-analysis and research either stall or overreach. Make consent a live, granular, queryable attribute.
• Sequencing without an incidental-findings pathway. Scaling WGS before deciding what to report and building a resourced counseling route turns predictable findings into crises handled by improvisation.
• A pipeline you cannot reproduce. If you do not record the reference build, pipeline version and annotation databases, you cannot reproduce a result or understand why re-analysis changed it — a clinical-safety gap disguised as a technical detail.
• Anonymization theater. Treating a genome as anonymizable ignores that it is uniquely identifying; "we removed the name" is false reassurance. Govern for re-identifiability and analyse in secure environments.
• A European-centered reference treated as universal. Interpreting everyone's genome against unrepresentative data produces quietly worse care for underrepresented groups. Track diversity, flag lower confidence, and support better data.
• Storage planned for a year, not a lifetime. Genomic data that becomes unreadable or unaffordable to retain fails the patient decades later when it finally matters. Plan tiered, durable, decades-long custody.

Maturity model#

Checklist#

• Genomic consent is captured granularly (clinical use, research, recontact, familial sharing) and stored as a queryable attribute that systems can act on.
• Results return into the EPR as structured, standards-based data (HL7 FHIR Genomics), not PDFs.
• Pharmacogenomic results trigger genotype-guided alerts at the point of prescribing, persisting across settings.
• The bioinformatics pipeline is version-controlled and validated, and every report records its reference build, pipeline version and annotation databases.
• Storage is tiered, durable and sized for decades of re-analysis, with provenance retained for reproducibility.
• An incidental- and secondary-findings policy is agreed, aligned to consent, and backed by a resourced genetic-counseling pathway.
• The ancestry diversity of interpretation datasets is tracked, and lower confidence is flagged to clinicians at the point of care.
• Genomic data is governed as re-identifiable and familial: strong access controls, full audit, and research access via secure data environments.
• Familial-disclosure questions are worked through with the Caldicott Guardian and clinical ethics support.
• Cross-boundary data sharing follows GA4GH standards.

Key sources#

• NHS England — NHS Genomic Medicine Service and the national network of Genomic Laboratory Hubs; commissioning and the National Genomic Test Directory.
• Genomics England — 100,000 Genomes Project and the National Genomic Research Library, including its consent and participant-engagement model.
• Global Alliance for Genomics and Health (GA4GH) — international standards and frameworks for responsible genomic data sharing.
• HL7 — FHIR Genomics implementation guidance for exchanging genomic results with clinical systems.
• Topol Review — Preparing the healthcare workforce to deliver the digital future (genomics as a driver of digital transformation).
• Caldicott principles — information-governance principles for the use of confidential health and care data.
• NICE — Evidence Standards Framework for Digital Health Technologies for evaluating genomics and precision-medicine tools.

References#

1. Genomics — Wikipedia — https://en.wikipedia.org/wiki/Genomics
2. Personalized medicine — Wikipedia — https://en.wikipedia.org/wiki/Personalized_medicine
3. Whole genome sequencing — Wikipedia — https://en.wikipedia.org/wiki/Whole_genome_sequencing
4. Bioinformatics — Wikipedia — https://en.wikipedia.org/wiki/Bioinformatics
5. Reference genome — Wikipedia — https://en.wikipedia.org/wiki/Reference_genome
6. Pharmacogenomics — Wikipedia — https://en.wikipedia.org/wiki/Pharmacogenomics
7. Incidental medical findings — Wikipedia — https://en.wikipedia.org/wiki/Incidental_medical_findings
8. Data re-identification — Wikipedia — https://en.wikipedia.org/wiki/Data_re-identification
9. Genomics England — Wikipedia — https://en.wikipedia.org/wiki/Genomics_England
10. 100,000 Genomes Project — Wikipedia — https://en.wikipedia.org/wiki/100,000_Genomes_Project
11. Fast Healthcare Interoperability Resources — Wikipedia — https://en.wikipedia.org/wiki/Fast_Healthcare_Interoperability_Resources
12. Global Alliance for Genomics and Health — Wikipedia — https://en.wikipedia.org/wiki/Global_Alliance_for_Genomics_and_Health
13. Genetic privacy — Wikipedia — https://en.wikipedia.org/wiki/Genetic_privacy
14. NHS England — NHS Genomic Medicine Service — NHS England — https://www.england.nhs.uk/genomics/
15. Genomics England — 100,000 Genomes Project and the National Genomic Research Library — Genomics England — https://www.genomicsengland.co.uk/
16. Global Alliance for Genomics and Health — Standards and frameworks for genomic data sharing — GA4GH — https://www.ga4gh.org/
17. HL7 International — FHIR Genomics implementation guidance — HL7 — https://www.hl7.org/fhir/genomics.html
18. Health Education England / NHS — The Topol Review: Preparing the healthcare workforce to deliver the digital future — NHS — https://topol.hee.nhs.uk/