The American Civil Liberties Union (ACLU) has filed a complaint on behalf of breast cancer patients who claim Utah-based Myriad Genetics violated HIPAA law by refusing to turn over the patient’s own genetic data.

POLITICO reports the patients wanted the genetic information so it could be donated to ClinVar, the federal database of disease-related gene sequences. Myriad has reportedly refused to share its information with ClinVar in the past, but in this situation, the ACLU argued the company was legally obligated to release the information to patients if requested, pointing to a HHS rule released in January that said “the full gene variant information generated by the test” must be provided by clinical laboratories that conduct next generation sequencing of DNA.

Myriad reversed course and gave the patients mentioned in the complaint the requested data on May 18, but they decided to move ahead with filing a complaint with HHS’ Office of Civil Rights.

“We are thrilled that Myriad took a step in the right direction and provided our clients with the genetic data they sought,” Sandra Park, senior staff attorney with the ACLU, said in a statement. “But it’s not enough to provide genetic information only to the patients listed in our complaint. Myriad needs to recognize that HIPAA protects all of its patients’ rights to access their complete genomic information.” 

The ACLU said Myriad described its release of the data as voluntary, and Myriad continues to assert the informaton is a part of the “designated record set” as defined by HHS.

Myriad countered that by providing the information, the complaint should be dismissed.

“We believe the company has acted appropriately, responsibly and in compliance with the laws and regulations governing patients' rights to access their genetic data," Myriad general counsel Richard Marsh said in a statement.  "Our policy is that all patients who receive a test from Myriad can obtain their test results and records directly from the Company or through their healthcare provider."

In the future, company spokesman Ron Rogers told Reuters it would provide the same genetic information to anyone who requests it.

Myriad’s policies on when to release genetic information have led to legal defeats before. In 2013, the company lost a case before the U.S. Supreme Court over its patents of the BCRA1 and BCRA2 genes.