BMC Genomics 2006, 7:93 http://www.biomedcentral.com/1471-2164/7/93 FGiegnuerPeIN3G single genotype lab view GenePING single genotype lab view. A patient's view of one of his genotype datasets. Note the interface that allows datapoints to be downloaded in batches, or individually when queried. Since the element is already stored at a given location indicated by HMACarraykey, a secure index requires an addi- tional level of indirection. HMACindexkey(snp123) will yield the name of a block which will itself point to the real location of snp123's location. This technique for secure granular storage allows for effi- cient browsing of genotype data. While a single record may contain megabytes of data, individual SNP data points can be browsed in batches of ten. The decryption and network transfer is thus also done in batches, either via a browsing interface or a search interface for specific SNPs (Figure 3). Privacy profiles & filtered documents An additional complication in the personal management of genomic health records is patient education. While the average patient will likely understand how to share a blood test result, sharing genomic data becomes compli- cated: which SNPs should an individual share with his doctor? Is it realistic to expect patients to individually per- mission their SNPs? With hundreds of thousands of datapoints in a single test, a patient without guidance is likely to simply give any health care provider complete access to their genome, a choice that could seriously affect the user's privacy. To address this issue, we introduced Privacy Profiles, each a list of SNPs, rare mutations, and gene names. Each privacy profile fulfills a given clinical purpose, e.g. "Breast Cancer Markers" would include all SNPs relevant to genetic breast cancer predisposition. Privacy profiles are represented using XML with a public schema. The definition of these Page 5 of 10 (page number not for citation purposes)