Advances in genomics technology and information technology infrastructure, together with policies regarding the sharing of research data, support expanded genomic research efforts but also raise new issues with respect to privacy, and specifically the effort to balance "the potential of scientific progress with privacy and respect for persons." The development of new genomic sequencing technologies has allowed for the generation of big data, and recent changes in information technology infrastructure—including, for example, cloud data storage—have facilitated big data storage and analytics. These developments are expected to support significant changes in health research and, eventually, in health care delivery. Specifically, researchers hope to leverage big data by combining genetic, environmental, clinical, behavioral, and other data to facilitate precision medicine. Precision medicine is the idea of providing health care to individuals based on specific patient and disease characteristics, and is a priority of the National Institutes of Health (NIH). Genetic and genomic research have generated large amounts of genetic data. If these "large-scale genomic data" are generated as a part of research funded by the National Institutes of Health (NIH), then they are subject to specific data sharing policies and are often held in publicly available databases. "Large-scale genomic data," as defined for the purposes of NIH's data sharing policy, include genome-wide association studies (GWAS), as well as genome sequence, gene expression, and other data. Among other things, advances in sequencing technology have enabled this research, and have made available large amounts of data at a rate that has generally outpaced the ability to both store and analyze that data (see "What is DNA Sequencing?" text box, above). Sequencing output has been increasing at approximately a fivefold rate per year in recent years, and the sequence data from a single individual's genome uses about 100 gigabytes of storage space. As a result, "[g]enomic databases increasingly surpass the storage abilities of individual researchers—and even of large institutions—and consequently are stored increasingly frequently in the 'cloud.'" , For example, the National Cancer Institute (NCI) at NIH has launched and funded its Cancer Genomics Cloud Pilots, an initiative to develop up to three public cancer genomics cloud pilots, where large data repositories will be colocated with computing resources. Storage of sequence data in "clouds" facilitates faster, more widespread, and increased access to this information. Advances in genomics research—for example, studying the genetic underpinnings of common diseases such as diabetes—have been facilitated by the data-banking of large quantities of data that are in turn available as a result of policies that encourage or require data sharing. NIH has established a comprehensive policy for the sharing of genomic data that "applies to all NIH-funded research that generates large-scale human or non-human genomic data as well as the use of these data for subsequent research." This policy requires investigators to outline their data sharing plans as part of their funding applications; if investigators fail to submit the required data, NIH may withhold funding. Investigators are required to de-identify the data prior to submitting it to NIH-designated data repositories. Data should be de-identified—stripped of identifiers such as an individual's name—according to the requirements of both the (1) HHS Common Rule and (2) the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. In addition, NIH requires the assignment of random and unique codes to the data, with the key linking the codes with individual identifiers to be held by the submitting institution. The data are submitted to relevant NIH-designated databases (e.g., NIH database of Genotypes and Phenotypes, or dbGaP ) by the investigator, and the institution's Institutional Review Board (IRB) determines whether the data may be held in unrestricted-access repositories or should be available only through controlled-access. This determination is made based on the informed consent under which the research was conducted and specifically language in the informed consent about the use of the data for future research purposes, as well as for broad data sharing purposes. Investigators wishing to use controlled-access data for the purposes of secondary research must first get NIH approval to use the data for their specific research project. This requirement is in contrast to unrestricted-access data, which are publicly available to anyone, without requiring prior approval for use in secondary research. Some databases provide differing levels of access to data, depending on the type of data involved. For example, the dbGaP has both open- and controlled-access levels. This flexibility allows for the "broad release of non-sensitive data, while providing oversight and investigator accountability for sensitive data sets involving personal health information." Collecting the large quantities of data needed to answer questions about the genetic underpinning of common diseases, and to support precision medicine, requires individuals who are willing to participate in research studies. "The willingness of individuals and communities to assume some risk to participate in biomedical research depends on the scientific community's ability to maintain the public's trust." This trust is developed in many ways, including honest and complete disclosure of risks upfront (through informed consent) and safeguards to protect privacy. With respect to research studies, privacy may be considered in terms of three components, or decision points: (1) the individual's decision to disclose personal data, (2) decisions about controls on access to the data, and (3) decisions about appropriate uses (and what constitutes "misuse") of the data. Relevant law and regulation—including the HIPAA Privacy Rule, the Genetic Information Nondiscrimination Act (GINA), and the Common Rule—govern aspects of these components, including the informed consent process for human research subjects, prohibited uses of the data, and access to the data (and in what form). To date, the privacy of data has been largely considered in the context of identifiability; that is, whether data or information may be readily linked with an individual. NIH defines de-identified data as that data where information that could be used to associate the data with an individual has been removed. Where data is considered to be "de-identified," relevant laws and regulations generally treat it as not posing the potential for a breach of individual privacy. This issue is illustrated by large-scale genomic sequence data, which are generated in large quantities, often entered into the public domain, and generally agreed to be de-identified in the absence of other data sources. In other words, such data were not able to be linked back to a specific individual, or to be "reidentified." Experts have noted that "[r]ecent work reveals the need to re-examine the current paradigms for managing the potential identifiability of genomic data." Recent studies suggest that different types of genomic data may be more likely to raise privacy issues than had been previously understood. One study, in particular, has challenged the traditional paradigm that de-identified personal genome data could not be reidentified. In January 2013, a study by Gymrek et al. was published wherein researchers were able to reidentify nearly 50 participants in the International HapMap Project. Researchers were able to reidentify these individuals using their publicly available de-identified personal genome data and other publicly available data. Essentially, to reidentify de-identified personal genome data, a researcher needs to be able to match the de-identified data to a second source of genetic data that is, in turn, linked to some (or multiple) pieces of identifying data. The January 2013 study by Gymrek et al. accomplished this by using a public genealogy database containing genetic information linked to surnames as its second source of genetic data. The study matched the de-identified personal genome data with the genetic information contained in the genealogy database, allowing the researchers to link the de-identified genome data with a surname and other identifying pieces of data (e.g., geographical location). The researchers then used public databases to combine surname, year of birth, and state of residence to identify specific individuals. As noted, the 2013 Gymrek study relied on genealogy data. For this reason, the study's findings cannot be assumed to be broadly generalizable to the whole population; that is, the risk of reidentification using this particular second source of genetic data may not be uniform throughout the general population. In addition, this study relied on the 1000 Genomes database, which is open access; conversely, most NIH data repositories maintain some or all data in a controlled-access manner, which makes accessing data more time-consuming and makes it more difficult to access multiple databases at one time. However, genetic genealogy and other genomic databases are growing, and "the more genomic data collected, and the more refined the connections between genetic variations, disease states, and other personal characteristics, the easier it becomes to reidentify an individual and discover private information." Given the technical feasibility of reidentification demonstrated by the 2013 Gymrek study, along with the increasing amount of genetic data and analytics available, it is reasonable to expect that, over time, the risk of reidentification will expand to encompass more of the general population. The NIH and others see value in genomic research and prioritize funding it and widely sharing the resulting data. However, the generation, handling, and release of these data require privacy and security protections. The recent reidentification of research participants demonstrates that privacy and security concerns are not merely theoretical. Given this, policymakers may decide to monitor both NIH's evolving genomic data sharing policies and relevant federal law. Relevant law includes (1) the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules; (2) the HHS Regulations for the Protection of Human Research Subjects, or the Common Rule; (3) GINA; and (4) the Freedom of Information Act (FOIA).