Last Week in Tech Policy #64: A Glimpse Into Your Future and Your Past: The Implications of At Home Genetic Testing

(by Casey Warsh, Colorado Law 2L)

Human beings are unique compared to all other species. We learn, communicate, and navigate the earth in ways that are distinct from most other living things. What distinguishes human beings from other species is our DNA, a complex set of instructions that dictates the way our cells, tissue, muscle, and bone come together to create our human form. Despite its complex make up, the mystery behind the double helix is almost a notion of the past.

DNA testing is now accessible to the masses through providers like Helix, 23andMe, and AncestryDNA. Of course, DNA testing has its place when performed by doctors for medical purposes, but should we be engaging in genetic testing from the comfort of our own living rooms? Consumers have responded with a resounding yes. 1.5 million people on Black Friday alone shipped off DNA samples to AncestryDNA for testing.

Genetic sequencing provides insight into geographic and ethnic heritage. Sequencing can also reveal certain medical indications such as an inclination towards developing diseases like Parkinson’s and Alzheimer’s. To many people, developing familial and ancestral connections can be enriching and ultimately provides a sense of belonging.

While home testing promotes awareness, there are certain limitations to consider. For example, unlike traditional genetic testing performed by a physician, these results are given, received, and often interpreted without the benefit of medical supervision. This lends itself to receiving potentially inaccurate results, misinterpretation, or may lead consumers to make major life changes without a comprehensive understanding of all the variables at play.

Widespread sharing of genetic information with third parties may also have significant policy implications. One primary concern is privacy. While consumers can often demand that the provider destroy accounts or even samples, the consumer cannot always make the same demands on the labs involved due to regulatory constraints.

Moreover, while providers assure consumers that they always own their own data, it is not entirely clear what this means. Ownership, as a tenant of property law, implies a right to exclude; ownership in the context of information, like the test results here, is a difficult concept to grasp. Ownership here is limited by the consent provided by consumers to testing companies to share and use the data. This consent typically results in a license to use the data. Specifically, while providers may not own your data, contractual language suggests that providers have significant rights to your data, perhaps even for unclear purposes beyond which consumers might have imagined.

What do consumers consent to, and as a result, what privacy rights do they waive? First, Providers have been approached by law enforcement seeking to gather information. 23andMe, for example, has been asked on five occasions to release details to law enforcement, but has resisted each time. Under circumstances involving subpoenas or court orders, these providers may have no choice but to hand over information.

Second, some providers destroy samples after testing but cannot always force downstream lab to do so. 23andMe’s Privacy Officer and Corporate Counsel noted that while research data is protected under the Certificate of Confidentiality, there are limits to these protections. In addition to law enforcement, research labs seek out this data. According to some providers  the data is sold to these labs only with additional consent. One question that arises, however, is how anonymous this data really is and further, what the repercussions are of security breach given the sensitive nature of this information.

Despite the risk of security breach and other repercussions, selling or providing data for research can potentially lead to great medical breakthroughs. One example of these breakthroughs in the context of non-consent is the case study of Henrietta Lacks. Henrietta Lacks was a woman dying of cervical cancer in the 1950s whose cells were stripped from her body and used to develop numerous vaccines and medical miracles. Henrietta never gave her permission, in fact, she never even knew. Henrietta didn’t have a choice, but here, consumers willingly hand over their samples. The personal agency and consent in this regard begs the question of whether some of the concerns for privacy are obviated in any way.

Another inquiry involves the consumer protections that exist in the world of genetics. Traditionally, the federal statute HIPAA (Health Insurance Portability and Accountability Act) protects individuals from private health information (PHI) exposure. HIPPA provides for sharing of medical data only once it is entirely scrubbed and anonymized. According to a former FDA associate commissioner, it is far easier to discern identities from the anonymized data than we might think. There is significant potential for discrimination and exploitation if sensitive information is leaked to employers, insurance companies, or other interested parties.

In addition to HIPAA, GINA (Genetic Information Nondiscrimination Act) is a federal statute that protects individuals from discrimination by employers and health insurance providers, there are however real limitations to these protections. For example, GINA does not provide discrimination protection against schools, life insurance providers, mortgage lending providers, housing providers, or disability insurance providers.

With the stakes high and data sensitive, this process begs many questions, many of which cannot be answered today. In the face of many privacy and ethical concerns, it is easy to wonder why some would put themselves at risk. On the flip side, getting a glimpse into genetic predispositions and ancestral bearings is interesting and helps us understand how we fit into the world. The motivation to engage in this testing is certainly not unfounded but is no doubt a personal choice.