StemCell Therapy

When exploring medical privacy issues, it's very useful to have an overview of the laws that affect control and privacy of medical information. We encourage you to read our legal overview.

GINA, HIPAA, and genetic information privacy

Genetics is the new frontier of medicine and genomic data is the raw material of some of the most advanced medical research now underway. Genetic testing is the current paradigm for diagnosis and treatment of many diseases. Its likely that within 10 years genetic tests for disease markerssuch as presymptomatic testing for the risk of developing adult-onset cancers, Alzheimer's, or chronic diseasesand possibly even whole-genome sequencing will be as routine as urinalysis is now. And the greater availability of population-wide genetic information is happening alongside its digitization in a given individual's electronic health record (EHR).

Genetic data can be obtained from cells we routinely shed, is easily shared, and is in high demand for cutting-edge medical research. Genetic data might be used to develop cures for cancer, paranoid schizophrenia, common tooth decay, and far moremultifarious areas of research that can seem irresistibly compelling. So what can protect the privacy of genetic data in such a world?

Not much, actually. Some laws limit how the information can be used, but none truly protects privacy. And that may not even be possible, because genetic information is unique to every individual. It cannot be de-identified; even if separated from obvious identifiers like name and Social Security number, it is still forever linked to only one person in the world. The de-identification checklist safe harbor from the Healthinsurance Portability and Accountability Act (HIPAA) doesnt include genetic information.

Genetic nondiscrimination laws

The federal laws that deal with genetic information are GINA (the Genetic Information Nondiscrimination Act of 2008) and, more recently, HIPAA. GINA is essentially an anti-discrimination law that has nothing to do with privacy. It prevents group health and Medicare supplemental plansbut not life, disability, or long-term care plansfrom using genetic information to discriminate against you when it comes to insurance.

Title II of GINA prohibits the use of genetic information to discriminate in employment decisions, such as hiring, firing, and promoting. It also restricts employers from asking for or buying genetic information. GINA does not apply, however, unless the employer has more than 15 employees. An Executive Order that accompanies GINA prohibits federal government agencies from obtaining genetic information from employees or job applicants and from using it in hiring and promotion decisions.

The federal Equal Employment Opportunity Commission (EEOC) investigates and enforces GINA claims. One EEOC lawsuit filed in 2013 alleged that a company violated GINA by requesting and requiring job applicants to indicate whether or not they had a family medical history for a variety of diseases and disorders as part of its post-offer, pre-employment medical examination; it was settled for $50,000. A week later the EEOC filed a similar lawsuit against the Founders Pavillion nursing and rehab center in Corning, NY. As of late July 2013, the EEOC "is sifting through about 170 claims filed by workers, applicants and former employees who say companies unlawfully asked for genetic information or used it to discriminate."

In 2013, the HIPAA Omnibus Rule amended HIPAA regulations to include genetic information in the definition of Protected Health Information (PHI). It also prevents use of the data in underwriting for all other types of health insurance plans, but still not for life, disability, or long-term care insurance. Excluding long-term care insurance guarantees that anyone with a tested genetic predisposition to Alzheimers, for example, will be uninsurable. According to the definition, genetic information includes your genetic tests and a family members, your or a family members fetus or embryo, and evidence of a disease in a family member. It does not include your age or gender.

Californias broader genetic anti-discrimination law, known as CalGINA, not only prohibits genetic discrimination in employment (GINAs scope), but also in housing, provision of emergency services, education, mortgage lending and elections. CalGINA amends the Unruh Civil Rights Act to add genetic information to the list of Californians civil rights that entitle them "to full and equal accommodations, advantages, facilities, privileges, or services in all business establishments of every kind whatsoever." The Government Code contains the employment and other membership provisions of the FEHA. Other sections can be found on the California Department of Fair Employment and Housing website.

One problem with GINA that the Omnibus Rule perpetuatesand CalGINA does not address eitheris that GINA is based on a genetics framework that is more than 20 years old. GINA only prohibits discrimination based on genetic information about someone who has not yet been diagnosed with a disease; that is, the disease is not yet "manifest." Today there are many tests for genetic markers that mayor may notbe precursors of a disease and also may mean that you could benefit from preventive treatment. If the presence of genetic markers is considered a manifestation of a disease, then neither GINA nor HIPAA applies to the information.

Protecting genetic information privacy

With genetic dataor any personal health information (PHI)its important to remember that HIPAA only applies to an organization if it is either a "covered entity" or the business associate (BA) of one. Many non-covered entities collect genetic information, such as online genetic testing companies like 23andMe and genealogy websites like Ancestry.com. At the moment, such businesses are only self-regulated, although the federal Food and Drug Administration (FDA) recently told 23andMe that its over-the-counter saliva collection kit and Personal Genome Service (PGS) was being marketed in violation of the Federal Food, Drug and Cosmetic Act. As the FDA put it: "if the BRCA-related risk assessment for breast or ovarian cancer reports a false positive, it could lead a patient to undergo prophylactic surgery, chemoprevention, intensive screening, or other morbidity-inducing actions, while a false negative could result in a failure to recognize an actual risk that may exist."

Obviously, existing laws that deal with genetic information fall short in many ways. One corrective approach to the limits of GINA and HIPAAand not only where genetic information is concernedwould be to apply protections to the data itself, rather than making them dependent on who has the data. This dispenses with the patchwork created by "covered entities."

Some major unaddressed issues concerning genetic information privacy

As accessing and recording genetic information progresses, it raises some serious issues.

A recurring issue in medical privacy is lawful uses of information based on overly broad compelled authorizations, such as in states where individuals must sign a release for substantially all of their health records as a condition of employment or when applying for life insurance or government benefits. In the context of widespread use of EHRsinteroperable, comprehensive, lifetime individual health records that vastly increase the amount of data that can be disclosedthese kinds of releases create significant privacy risks for all health information, including genetic information.

Newborn screening is another problem that arises with EHRs and genetic data. Tests done at birth vary from state to state, but all states must screen for at least 21 disorders by law, and some states test for 30 or more. Currently, tests are limited to conditions for which childhood medical intervention is possible and may be beneficial.

What if that practice changes to includeor mandatetests for adult-onset disorders that cannot be treated in childhoodor for which there is no known treatment, such as ALS, Huntingtons disease, or Alzheimers? The privacy implications of starting a lifetime EHR that includes information about genetic diseases are enormous, and become even greater if the record comes to include evidence of a genetic propensity toward future, as yet incurable, diseases (not to mention the emotional impact on those designated at birth to succumb to a tragic and incurable disease). A great deal of thoughtful analysis and decisionmaking is required to protect this dataand the individuals connected to itfrom exposure, while at the same time not excluding this data from important research.

There is the growing practice, at all levels of law enforcement, of collecting genetic data from suspects when they are arrested and storing the information in a database for later reference. The Supreme Court held in Maryland v. King that such DNA collection, while subject to the Fourth Amendment (using a buccal swab on the inner tissues of a persons cheek in order to obtain DNA samples is a search), does not require a warrant: when there is already probable cause for a valid arrest for a serious offense, collecting a DNA sample is analogous to taking fingerprints or a photo. (See EFFs blog posts on Maryland v. King.)

The Ninth Circuit Court of Appeals, en banc, recently upheld a controversial California law that requires people who are arrested for a felony to provide DNA samples that will be stored in a criminal database accessible to local, state, national, and international law enforcement agencies. The requirement is not limited to serious or violent offenses. The plaintiff in the case, Haskell v. Harris, was arrested for protesting the Iraq war, but was never charged or convicted. The Court compared the California law to the Maryland law upheld by the Supreme Court and found no difference and no Fourth Amendment violation.

The United States has the worlds largest database of DNA profiles. As of November 2013, the FBIs National DNA Index (NDIS) contains over 12 million profiles, and it is still growing. These are primarily from criminals and criminal suspects, but the database also includes parolees, probationers, and people who were simply arrested. It is bound to grow as more states expand the categories of people compelled to give DNA samples for law enforcement. Law enforcement is also known to collect DNA surreptitiously from suspects cigarette butts and coffee cups.

Responding to the difficulty in making an exact DNA match from crime scene evidence, in 2008 California became the first state to authorize familial or kinship matches, which are by design less precise.

Another area of concern in law enforcement DNA collection is the current trend for predictive modeling or behavioral genomics. It raises questions about the potential use of DNA databases to reveal the genetic tendencies of individuals toward certain types of criminal behavior, like violence. Could this lead to practices like preventive detention or protective custody of individuals believed to have a genetic disposition toward crime or anti-social behavior?

Finally, there is a complex ethical issue around the consent for disclosure of genetic information or biospecimens that contain DNA, for research purposes and otherwise. Were used to thinking of consent as individual, which makes sense when the health information is mainly about that person. Genetic information is different: analysis of an individuals DNA is highly informative about his or her offspring, siblings, and parents. The Supreme Court of Iceland, for instance, found in 2003 that a woman had a right to opt out of her fathers genetic information being retained in Icelands national DNA database. Genetic information also bears on demographic categorization, as many genetic predispositions toward specific diseases or conditions are strongly associated with specific ethnic or racial groups. Is individual consent appropriate when DNA analysis can reveal significant information about other peopleas we now see for familial DNA searches?

For a critique of existing genetic information non-discrimination laws, see Are Genetic Discrimination Laws Up to the Task?, an interview with Mark Rothstein in Medscape Today. Rothstein holds the Herbert F. Boehl Chair of Law and Medicine and is the Founding Director of theInstitute for Bioethics, Health Policy and Law at the University of Louisville School of Medicine.

Read more:
Genetic Information Privacy | Electronic Frontier Foundation

This entry was posted on April 19, 2019 at 11:47 pm and is filed under Legal Issues Genetic Medicine. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed. |