How a genomic referral flows from indication to cascade, how genetic data is classified and gated, how the panel, the pedigree and the result fit together, and how the whole thing is shaped to the NHS Genomic Medicine Service — with what is not built stated as plainly as what is.
commvita is not a sequencing platform and not a variant-interpretation engine. It is the clinical layer around the laboratory: the place a clinician decides a test is indicated, records the consent that makes it lawful, chooses the right national panel, routes it to the right laboratory, draws the family, receives the classified result back onto the person’s record, and offers testing to the relatives that result implicates. The genome is sequenced by a Genomic Laboratory Hub. Everything on either side of that is what this module does.
Six states, one gate and two returns. The states are the platform’s own vocabulary, not a diagram drawn for this document.
Genetic data is special category data under UK GDPR Article 9(1). In commvita that is not a banner: it is an RBAC domain that every genomics route is gated on.
Every access decision is written to the audit log whether it was granted or refused. A successful-access log tells an IG reviewer who read a genome; a refusal log tells them who tried, which is the question an access review is actually asking.
On the person’s record the Genomics tab is appended only where the reader holds the domain. A tab that appears and then 403s has already disclosed that this person has a genomic record — and would write a denial every time any clinician opened any patient, until the log stopped meaning anything.
GET /genomics/access is deliberately not behind the gate: your own
permission level is not special-category data. The record asks once and either offers the tab or
does not, rather than provoking a 403 to find out.
One test, six separable consents. Bundling them into a single signature is how a person ends up in a biobank they never agreed to.
The only element that is required for the test to proceed. Recorded with who obtained it, who witnessed it, the date, the method and the consent form version.
Whether the person wishes to be told about a finding unrelated to the reason for testing. Answered before sequencing, because afterwards is too late to ask honestly.
Whether relatives may be approached on the strength of this result. Held separately because consenting to a test is not consenting to a family conversation.
Separate from care. A person can be tested and decline research entirely, and the register records that as a first-class answer rather than an omission.
Storing the sample is a different question from analysing it, and is asked as one.
How long the sequence itself is retained — the element most likely to matter decades after the consultation everyone has forgotten.
Referrals are placed against R-coded panels, the units the National Genomic Test Directory is written in, each carrying its genes, its eligibility criteria, its sample requirement and its turnaround target. A clinician chooses a panel, not a gene list.
| Code | Panel | Genes | Test type | Target |
|---|---|---|---|---|
| R208 | Hereditary breast and ovarian cancer | BRCA1 · BRCA2 · PALB2 · CHEK2 · ATM | Targeted panel | 42 days |
| R30 | Hereditary colorectal cancer (Lynch) | MLH1 · MSH2 · MSH6 · PMS2 · EPCAM | Targeted panel | 42 days |
| R27 | Heritable thoracic aortic aneurysm | FBN1 · TGFBR1/2 · SMAD3 · ACTA2 · COL3A1 | Targeted panel | 56 days |
| R67 | Inherited cardiac conditions — arrhythmia | SCN5A · KCNQ1 · KCNH2 · RYR2 · CALM1–3 | Targeted panel | 42 days |
| R116 | Familial hypercholesterolaemia | LDLR · APOB · PCSK9 · LDLRAP1 | Targeted panel | 21 days |
| R304 | Pharmacogenomics | CYP2D6 · CYP2C19 · CYP2C9 · HLA-B · DPYD · TPMT · NUDT15 | Pharmacogenomics | 28 days |
| R59 | Rare and undiagnosed disease | Whole genome — trio | WGS trio | 180 days |
| R240 | Solid tumour | Whole genome — tumour vs germline | WGS somatic | 28 days |
england.nhs.uk is not reachable from
the build environment these documents are produced in, so the R-codes, gene lists and turnaround
targets could not be checked against the live National Genomic Test Directory. The directory
is versioned and changes; confirm against the current publication before relying on any specific
code, and treat the shipped set as a configuration to be updated, not a national reference.A family history written as prose cannot be reasoned about. Drawn, it answers in one glance the question the whole referral turns on: is this pattern inherited, and who else is at risk?
Results come back classified on the ACMG/AMP five-tier scale. The classification is the laboratory’s; commvita’s job is to carry it faithfully and make the class 3 problem visible rather than tidy it away.
It surfaces on the person’s record without being hunted for, it makes cascade testing a live offer to first-degree relatives. In the pharmacogenomic panels it ought to reach the prescriber — a CYP2D6 poor metaboliser is a reason not to prescribe codeine, and that is a fact about a prescription rather than a fact filed in a genetics letter. It does not today: see section 9.
It does not call variants, classify them, or re-classify them when evidence moves. Those are the laboratory’s accountable acts under its own accreditation. A platform that quietly re-scored a variant would be practising genomics without a licence.
Three lanes, and the third is the one worth reading carefully.
Diagnostic genomics asks why is this person ill? Pharmacogenomics asks something the whole population has a stake in: how will this person handle the drug I am about to prescribe? The panel is a buccal swab, taken once, and the genotype does not change — so a single test speaks to every future prescription of an affected medicine.
That changes the economics of testing. A diagnostic panel answers one question for one family. A pharmacogenomic panel answers a question that recurs at every prescribing decision for the rest of somebody’s life — which is why it is ordered as R304 through exactly the same referral, consent and routing machinery as every other panel, rather than as a separate service.
A pharmacogenomic panel is genetic data and carries the same six separable consents, the same access control and the same withdrawal rules as any other genomic test. It is tempting to treat it as routine because the result is a dosing note; the data is not routine, and a CYP2D6 diplotype identifies a family exactly as any other variant does.
One of the two has arrived. A persisted phenotype and a governed library now live at /population-genomics, where every interaction carries the evidence source and version the deploying organisation configured it from. What is still missing is the rule that fires where the prescription is written. Until that exists, a pharmacogenomic result is a document somebody has to remember to open.
The service is centralised by design: seven Genomic Laboratory Hubs serve the whole of England, ordering is against one national test directory, and the clinical decisions sit with the referring service. commvita is shaped to that model rather than around it.
Referrals carry an R-code, its eligibility criterion and its turnaround target — the same unit the directory is published in. A local catalogue would have to be re-mapped at every boundary; a national code does not.
Every referral records the GLH it went to, and the default is resolved from the jurisdiction rather than hardcoded — a Crown Dependency referring into the service under a memorandum of understanding routes differently from an English trust, and neither is a code change.
Clinical features are recorded as Human Phenotype Ontology terms, which is what makes a referral interpretable by the laboratory and re-analysable later when a gene panel is updated.
The consent record names the form and version used, and holds the national elements separately — including data sharing with the national programme, which is its own answer rather than an implication of being tested.
A jurisdiction with its own national genomic programme configures its own regulator, panels and routing through the Jurisdiction Profile. ACMG/AMP classification and HPO are international and do not vary; the programme around them does.
There is no message exchange with a GLH or with the national service. No test order leaves the platform, no report arrives electronically, and commvita is not on any national genomics interface. A referral is recorded and progressed by people.
| Capability | Where | How | Status |
|---|---|---|---|
| Referral register — create, route, progress | /genomics | GET/POST/PUT /genomics/referrals | Live |
| Panel directory — R-codes, genes, eligibility, turnaround | /genomics | GET /genomics/panels | Live |
| Consent register — six separable elements, withdrawal | /genomics | GET/POST/PUT /genomics/consents | Live |
| Pedigree — members, affection, testing, inheritance | /genomics | GET/POST/PUT /genomics/pedigree | Live |
| Result & ACMG classification | /genomics | on the referral record | Live |
| Analytics — by status, by panel, consent rate, pathogenic count | /genomics | GET /genomics/analytics | Live |
| The Article 9 gate — default deny, refusals audited | every route above | require_genomics() | Live |
| Genomics tab on the person’s record | /patients/:id/whole-person | GET /genomics/access + /genomics/patient/{id} | Live |
| Pharmacogenomics — diplotype and phenotype, illustrative only | /genomics | seeded client-side, calls no API | Demonstrated |
| NHS GMS / GLH message exchange | — | not built | Demonstrated |
| Patient-signed genomic consent in the portal | — | not built | Demonstrated |
| FHIR R4 / openEHR projection of a genomic report | — | mapping defined, no endpoint | Demonstrated |
The register was held in memory. It is now a database, and that is worth saying out loud. Until recently the genomic referrals, consents and pedigrees were module-level Python lists rather than tables, so a record created through the interface was lost when the service restarted and, with the platform’s default of two API replicas, invisible to the other one. A consent withdrawal that evaporates on a deploy is a consent nobody can evidence. The three registers are now real tables keyed to the person, the demo set is folded in once and no longer changes, and a record a clinician actually created is never re-pointed at somebody else to tidy a demonstration. A reference that matches nobody is stored unlinked and reported rather than attached to a convenient patient.
A write could be made by a role that may not read. Three endpoints were gated on seniority rather than on the genomics permission itself, which let the executive role — deliberately denied every genomic read — edit a genomic record. That is closed, and it is named here for the same reason as the three claims below: the fix is only half the work if nobody is told what was wrong.
Nothing is written to an openEHR clinical data repository. The
intended record shape is CLUSTER.genetic_findings with a FHIR R4
DiagnosticReport + Observation/variant projection. commvita ships
no archetype definitions and no AQL, and the default openEHR target in the shipped
configuration is a mock, so no composition is persisted. The openEHR rating for this module is
Partial, and the identifiers that appear on seeded referrals are seed values, not evidence
of a write.
The pharmacogenomics tab is illustrative, and it carried citations nobody had read. The diplotypes and phenotypes shown are demonstration data. The tab also asserted per-alert provenance naming published pharmacogenomic guidelines, a regulator safety update and a research knowledge base, and stated a specific drug dose — none of it read from source, because those sites are unreachable from this build environment. All of it has been removed from the product and none of it appears in this document. The clinical argument — that a metaboliser status belongs at the point of prescribing rather than in a letter — is sound; the knowledge base and the wiring are both absent, and each organisation would have to govern and source its own.
There is no patient-facing genomic consent screen. The consent model anticipates one and commvita Sign is the signature ceremony that would carry it. Until it is built, consent is recorded by the clinician who obtained it.
Three claims in the module were wrong and were corrected while this document was written. It named an RBAC permission that has never existed, asserted that genomic data was held in a CDR, and stated that all genomic compositions were queryable over FHIR. None of that was true. They are named here rather than quietly fixed, because a document that inherits a product’s false claims launders them.
Non-SaMD. This module records clinical decisions and presents recorded data. It does not diagnose, does not classify variants, and does not decide who is tested. The clinical judgement is the clinician’s and the classification is the laboratory’s.