Biotech Company and Patients Face Off to Gain Access to Their Genetic Tests

— -- A Utah-based biotech company that had refused to let four patients access their full genetic information has reversed course, a day before the American Civil Liberties Union filed a complaint with the federal government on behalf of patients in general.

Myriad Genetics provided the patients late Wednesday with genetic information they requested in February. The company described the move as "voluntary" and maintained that it was still within its rights to withhold other patients’ complete results in the future, according to the ACLU.

The ACLU filed a complaint on Thursday with the U.S. Department of Health and Human Services, calling on Myriad to release complete gene information to all patients whenever requested. The ACLU had originally intended to file a complaint on Thursday pertaining specifically to the four patients, but amended its complaint after Myriad's about-face, ACLU officials said.

“The position Myriad took is akin to a hospital saying that patients can only have a portion of their MRI or a portion of their physical exam records,” said Sandra Park, senior attorney with the ACLU Women’s Rights Project, adding that the company's prior withholding of the patients’ information “clearly violates the law.”

Richard Marsh, general counsel for Myriad, said in a statement on Thursday that company officials believe that Myriad "has acted appropriately, responsibly and in compliance with the laws and regulations governing patients' rights to access their genetic data."

“We believe the complaint lacks merit and should not be accepted,” Myriad added in its statement.

The four patients represented by the ACLU include two women who had been previously diagnosed with breast cancer, a man with metastatic bladder cancer, and his cousin. They all had changes in their DNA, known as gene variants, which were located in the BRCA genes. The BRCA genes, when mutated, are known to be linked to breast, ovarian and prostate cancers, among others.

Myriad classified some of these variants as “benign,” Park said, and as such did not include them in test reports.

In the case of one of the breast cancer patients, Myriad had told AnneMarie Ciccarella in March that the company had already included all unknown variants and those associated with cancer risk in its initial gene report to her, but that they were not required by law to provide the full data. The company, which keeps its data in a private database, also told Ciccarella that it “does not maintain much, if any, of the [additional] items” she had requested.

“Their response infuriated me,” Ciccarella said during a news conference Thursday.

However, the email Ciccarella received Wednesday from Myriad showed that there were in fact ten variants on BRCA1 and five on BRCA2 that had been classified as benign and omitted from the original report.

Ciccarella said she plans to share her test results with doctors and researchers to monitor whether the changes in her DNA could be tied to potential health consequences in the future. Making complete genetic information available to patients and researchers, she said, is necessary to advance scientists' and families' understanding of what these DNA variants mean.

ACLU officials said they are checking to see if the information she received matches the complete set she is entitled to under the Health Insurance Portability and Accountability Act (HIPAA).

HIPAA ensures that patients have access to their health and genetic information -- not only the lab report, but also the “the full gene variant information generated by the test, as well as any other information in the designated record set concerning the test,” according to the HHS guidance on genetic testing.

This is likely the first complaint seeking to enforce a patient’s right to access their own genetic information under HIPAA, Park said.

An HHS spokesperson was unable to confirm this, responding that their “complaint intake system currently does not collect data at this level of granularity.”

The HHS Office of Civil Rights will review the complaint and decide whether to open an investigation, according to Park, who also noted that it is not possible to sue under HIPAA.

HHS records show that it has not previously enforced its guidance against a company denying patients access to their own genetic information.

Myriad was also the focus of a 2013 landmark Supreme Court case, in which the judges unanimously ruled that human genes could not be patented. The company previously held a monopoly on genetic testing for the two BRCA genes. After the ruling, more labs began to offer the genetic tests at much lower prices.

Myriad also announced on Wednesday that it plans to open a web portal to provide patients access to their test results and health information.

A Myriad spokesman told ABC News Thursday in an email that “the first phase of the portal will be available by the end of the quarter,” though he did not directly confirm whether patients would be able to access full results through this portal.

“Myriad has a long track record of providing patients with free access to their test reports directly or through their healthcare providers,” the spokesman said in the email.

He did not comment on whether or how Myriad plans to provide complete genetic information in the future.

However, in a letter sent Wednesday to one of the patients represented by the ACLU, Myriad wrote that it had been in talks and “anticipates further discussions” with the HHS Office of Civil Rights.

Ciccarella said she strongly believes her genetic information belongs to her.

“My body, my blood, my data, my choice,” she said.

ABC News’ Dr. Stephanie Markle and Dr. Atish Chopra contributed to this report.