TL;DR:
- Individuals have the legal right to access their raw genomic data files from CLIA-certified labs within 30 days under HIPAA.
- Most EHR systems cannot effectively ingest raw variant call files unless they are converted into standardized FHIR formats using tools like vcf2fhir.
Yes, you can obtain clinical-grade raw genomic files from a CLIA-certified lab under HIPAA and you can direct those files to a named clinician, EHR endpoint, or health system. The key is submitting a written request that specifies the exact file format and recipient, not just asking for "records."
- Usable clinical file formats: VCF (variant call format), FASTQ (raw sequencing reads), BAM (aligned reads), and CLIA-annotated variant reports. VCF is the most commonly requested for downstream clinical use.
- Timeline: HIPAA grants 30 days to fulfill an access request, with one 30-day extension if the lab notifies you in writing.
- Patients: Submit a written HIPAA access request to the lab's privacy officer specifying VCF or FASTQ format and a named electronic recipient.
- Clinicians and health systems: Request directly from the lab's provider services team, naming your FHIR endpoint, SFTP server, or secure portal as the delivery destination.
Table of Contents
- Which file types and standards actually matter for clinical portability?
- What are your HIPAA rights when requesting CLIA genomic files?
- How to request and transfer your genomic files, step by step
- What does a secure lab-to-EHR transfer actually look like?
- How should receiving clinicians validate transferred genomic files?
- Common barriers and how to fix them
- Genematrix supports CLIA-grade genomic data intake for health systems
- Key Takeaways
- The gap between legal access and clinical usability is still real
- Useful sources and technical references
Which file types and standards actually matter for clinical portability?
Not all genomic files are equal in a clinical context. The format determines whether a receiving system can act on the data or just store it.
| File Type | What It Contains | Primary Clinical Use |
|---|---|---|
| FASTQ | Raw sequencing reads, base quality scores | Re-analysis, secondary confirmation |
| BAM | Reads aligned to a reference genome | Variant re-calling, coverage review |
| VCF | Called variants with quality annotations | Clinical interpretation, EHR ingestion |
| CLIA-annotated report | Curated variants with clinical classifications | Direct clinical decision-making |
The ACMG's Genetics in Medicine commentary confirms that FASTQ, BAM, and VCF files all fall within the designated record set (DRS) when they were used to make clinical decisions, meaning labs must document what they hold and disclose it on request.
For most clinical workflows, VCF is the practical target. EHRs increasingly expect FHIR Genomics Reporting representations rather than raw VCF, which is where the open-source vcf2fhir converter fits: it translates a VCF into HL7 FHIR format so the data can be ingested by modern EHR systems. HL7v2 LRI (Laboratory Result Interface) remains common in older lab-to-EHR pipelines. For health systems building new infrastructure, FHIR Genomics Operations provide a standardized API layer that abstracts the heterogeneity of underlying genomic repositories.
What are your HIPAA rights when requesting CLIA genomic files?
HHS confirms that individuals have a right to access genomic information in a lab's designated record set, including the completed test report, full gene variant data, and the underlying raw files generated during next-generation sequencing. Labs that are HIPAA covered entities cannot simply hand over a PDF and call it done.
| Request Element | What to Specify |
|---|---|
| Requester identity | Patient, personal representative, or authorized clinician |
| File format | VCF, FASTQ, BAM, or annotated variant report |
| Delivery method | FHIR endpoint URL, SFTP server address, encrypted portal, or secure email |
| Required metadata | Sample ID, test accession number, CLIA test identifier, specimen date |
| Recipient designation | Named clinician, health system, or EHR system |
| Timeline expectation | 30 days under HIPAA (one 30-day extension permitted with written notice) |
If the lab holds the data electronically and it is readily producible in the requested format, HHS requires delivery in that format. When a format is not readily producible, the lab and requester must agree on a readable electronic alternative. Labs may charge reasonable cost-based fees, including for encrypted physical media when no other delivery method works.
Directing the request to a named clinician or health system endpoint is often faster than routing files through the patient, because labs are already configured for provider-facing workflows.
How to request and transfer your genomic files, step by step
Step 1: Gather your identifiers. Collect the patient's full name, date of birth, sample collection date, test accession number, and the lab's CLIA identifier. Missing any of these slows the process.
Step 2: Choose your recipient and delivery method. Decide whether files go to an EHR FHIR endpoint, a secure SFTP server, an encrypted portal, or directly to a named clinician. Name it explicitly in the request.
Step 3: Submit a written HIPAA access request. Use this template:
Step 4: Confirm secure transfer method. Verify the lab will use encrypted delivery (TLS in transit, AES-256 at rest) and will provide a signed checksum (MD5 or SHA-256) with the files.
Step 5: Confirm fees upfront. Ask whether the lab charges for electronic delivery or encrypted media before the transfer occurs.
Step 6: Acknowledge receipt and verify integrity. Once files arrive, compare checksums and confirm accession numbers match the clinical report before ingesting into any system.
If the lab does not respond within 30 days, send a follow-up citing 45 CFR § 164.524 and request written confirmation of the extension. If access is improperly denied, you may file a complaint with HHS Office for Civil Rights (OCR) at hhs.gov/ocr.
What does a secure lab-to-EHR transfer actually look like?
Three delivery patterns cover most real-world scenarios.
FHIR push: The lab generates a FHIR Genomics Reporting bundle and pushes it directly to the health system's FHIR R4 endpoint. ONC's Sync for Genes Phase 3 demonstrated this model across multiple sites, with labs as the primary producers of FHIR-formatted genomic data. This is the cleanest path when both sides support the HL7 Genomics Implementation Guide.
Secure file transfer: The lab deposits VCF/FASTQ/BAM files to a mutually authenticated SFTP or HTTPS portal. The receiving system pulls files, verifies checksums, and routes them to a genomic archiving and communication system (GACS) or directly to the EHR.
Encrypted physical media: Used when file sizes are large and no high-bandwidth secure channel exists. The lab ships an encrypted USB or drive at cost; the receiving team verifies the checksum on arrival.
| Transfer Method | When to Use | Security Requirement |
|---|---|---|
| FHIR push (FHIR Genomics Reporting) | Both sides support HL7 FHIR R4 | Mutual TLS, OAuth2 |
| SFTP / HTTPS portal | Standard lab-to-provider file drop | SFTP with key auth, TLS |
| Encrypted physical media | Large files, no secure channel | AES-256, signed checksum |
When the receiving EHR cannot ingest raw VCF directly, run the file through vcf2fhir to produce a FHIR Genomics bundle. For health systems managing multiple genomic data sources, a GACS paired with FHIR Genomics Operations provides a uniform API layer so clinical apps query one interface regardless of the underlying repository.
How should receiving clinicians validate transferred genomic files?
Getting the file is step one. Using it safely in a clinical decision is a different requirement.
- Verify provenance first. Confirm the accession number in the file metadata matches the lab's signed clinical report. A mismatch means you may have the wrong patient's data.
- Compare checksums. The MD5 or SHA-256 hash the lab provides must match what you compute on the received file. Any difference signals corruption or tampering.
- Confirm CLIA test identifiers. The VCF header or accompanying manifest should carry the CLIA lab ID and test identifier. Cross-reference against the original requisition.
- Do not interpret raw VCF in isolation. Variant calls in a VCF are only clinically meaningful when read against the lab's CLIA-validated interpretation. Confirm each variant against the annotated report before acting on it.
- Log every transformation. If you convert VCF to FHIR using vcf2fhir, document the tool version, conversion date, and any filtering applied. This preserves chain-of-custody and keeps downstream decisions auditable.
Pro Tip: Create a standard intake checklist in your EHR or LIMS that fires automatically when a genomic file arrives. Fields: accession number confirmed, checksum verified, CLIA ID matched, clinical report attached, conversion logged. A five-minute intake step prevents a costly re-request weeks later.
Common barriers and how to fix them
- EHR rejects the VCF file — Convert using vcf2fhir to produce a FHIR Genomics Reporting bundle, or ask the lab to deliver a FHIR-formatted report directly if they support the HL7 Genomics IG.
- Lab claims files are "not readily producible." — Cite HHS guidance: if the data exists electronically, the lab must provide a readable electronic alternative. Ask specifically for the annotated variant report in CSV or structured text if VCF is unavailable.
- Lab denies access outright. Send written escalation to the lab's privacy officer citing 45 CFR § 164.524. If unresolved within 30 days, file a complaint with HHS OCR. For rare disease or complex cases, a patient advocate or legal counsel familiar with HIPAA access rights can accelerate resolution.
Genematrix supports CLIA-grade genomic data intake for health systems
Clinical teams need more than a file. They need a validated, report-ready result that fits their workflow without a six-week integration project.
Genematrix is a Chicago-based, CLIA-certified lab built for exactly this handoff. Health systems and clinicians can send or receive VCF and FASTQ files through HIPAA-compliant secure transfer, with FHIR conversion and mapping handled on Genematrix's side. Clinician-ready reports come back within 72 hours, covering hereditary cancer risk (BRCA1/2, Lynch syndrome), pharmacogenomics, and specialty panels. Onboarding for health systems involves a technical validation call, secure endpoint setup, and a test transfer before any live patient data moves.
To start the intake process or verify CLIA credentials, visit Genematrix's science and lab certification page or go directly to the clinical intake form to submit a provider request.
Key Takeaways
Clinical-grade raw genomic data portability requires a written HIPAA access request naming the exact file format, delivery method, and recipient, followed by checksum verification and chain-of-custody documentation before any clinical use.
| Point | Details |
|---|---|
| HIPAA right of access | Patients and authorized clinicians can request VCF, FASTQ, and BAM files from CLIA labs under 45 CFR § 164.524. |
| 30-day timeline | Labs must fulfill requests within 30 days; one 30-day extension is permitted with written notice. |
| Specify format and recipient | Name the exact file type and delivery endpoint in the written request to avoid receiving a PDF-only response. |
| Validate before clinical use | Verify checksums, match accession numbers, and log any VCF-to-FHIR conversions before acting on transferred data. |
| Genematrix intake | Genematrix accepts VCF/FASTQ via HIPAA-compliant secure transfer and returns clinician-ready reports in a timely manner. |
The gap between legal access and clinical usability is still real
The legal right to access raw genomic files is now well-established. The practical reality is messier. Having a VCF file does not mean a clinical system can use it. Most EHRs were not designed to ingest raw variant call files, and the ACMG's designated record set guidance01026-7/fulltext) makes clear that the bottleneck is not legal, it is technical and organizational.
What actually closes the gap is lab participation in standards. ONC's Sync for Genes showed that when labs generate FHIR-formatted genomic reports directly, the patient burden for portability drops sharply. The file arrives in a format the EHR can already read. That is the model worth scaling.
Health systems that want to get ahead of this should prioritize two investments: a GACS to store and serve genomic data outside the EHR core, and FHIR Genomics Operations APIs to expose that data to clinical apps uniformly. The JAMIA analysis of FHIR Genomics Operations makes a persuasive case that this architecture will become the standard interface for querying genomic repositories, replacing ad-hoc file handoffs. The organizations building toward that now will spend far less time troubleshooting failed transfers in three years.
Useful sources and technical references
- HHS FAQ: HIPAA right of access to lab genomic information — primary legal authority for patient access rights to CLIA lab data
- HHS: Individuals' Right under HIPAA to Access Health Information (45 CFR § 164.524) — full access rule guidance including format, timeline, and fee rules
- ONC Sync for Genes Phase 3: Engaging Laboratories Final Report — implementation evidence for FHIR-based lab-to-EHR genomic data exchange
- HL7 Version 2 Implementation Guide: Clinical Genomics (LRI) — standards reference for HL7v2 LRI, the structured genomic result reporting guide for EHR integration