The Genomics Law Report has published a couple of guest commentaries recently dealing with genetic screening—a topic our own Adam Doerr also addressed in two posts this summer dealing with “wrongful life” claims brought against sperm banks by children with genetic diseases inherited from their donor fathers. Such claims are premised on the failure of the sperm bank to conduct genetic screening that could have detected the defective genes—thereby avoiding the conception of the child on whose behalf the wrongful life claim is brought.

In this post, I look at a recent gamete screening controversy—the revelation that a man fathered at least two dozen children, all but two through the donation of his sperm to a bank, despite having a potentially serious genetic defect—and examine numerous issues the story raises. Many relate to whose interests are valued the highest. Should the wellbeing of the children born of the process—the only people involved who have no say in the matter—come first, or does respect for the autonomy of the parents control? I do not attempt to answer the questions posed, but seek to encourage discussion with respect to the need for clearer policies and guidance in a number of these areas.

Another “Bad Sperm” Case.

Keith Syerson of the Chicago-Kent Institute for Science, Law and Technology recently addressed the topic of genetic screening of gamete donors in recent post, The Story of a Sperm with a Bad Heart. Syerson reviewed a study in the Journal of the American Medical Association (JAMA) by Maron, et al. dealing with an anonymous donor who turned out to be a carrier of a mutation associated with the development of hypertrophic cardiomyopathy (HCM). HCM is a congenital heart defect that results in thickening of the heart muscle, which can lead to numerous problems, up to and including sudden cardiac death resulting from the exertion of athletic activity. As Danielle Conrad’s piece on GINA notes, basketball stars Hank Gathers of Loyola Marymount and Reggie Lewis of the Boston Celtics both collapsed and died on the basketball court, and were discovered to have suffered from HCM.

The Maron et al. study revealed that the donor had fathered 22 children through donations, and had two more children with his wife. One of the children had already died of HCM-related heart failure, at the age of two. Sixteen of the children born via donation received genetic tests; eight tested positive for a mutation associated with HCM. One of the donor’s children with his wife also tested positive. Two of the affected children had “massive LV hypertrophy” and the donor had “extensive myocardial fibrosis” of which he was previously unaware.

The authors of the study noted that “some sperm banks test for cystic fibrosis, thalassemia anemia, sickle cell trait, Tay-Sachs, and other genetic diseases that have increased frequency in Ashkenazi Jews; all of these conditions are much less common than HCM in the general population.” While they acknowledged that genotyping for HCM-related mutations would be unlikely “due to its current expense and limited clinical sensitivity,” they recommended echocardiography of potential donors to screen for HCM and, potentially, other diseases that can cause sudden death. The authors also noted that the case “underscores the need for guidelines to notify gamete donors, recipients, and other affected parties once genetic disease arises.”

Syerson cited a commentary JAMA published along with the Maron et al. study, in which Judith Daar and Robert Bryzski described the current environment in which sperm banks operate—with no federal regulation requiring genetic screening, and with the majority of banks not complying with the voluntary “established screening protocols” of the American Society for Reproductive Medicine. (Those protocols (pdf) do call for genetic screening of donors, including for cystic fibrosis and autosomal or X-linked dominant disorders, among others). The regulations that do apply to donations are designed the protect the mother from communicable diseases, not to promote the health of the child.

The Maron et al. study and its recommendations raises numerous ethical questions, many of which will need to be addressed as reproductive genetic screening, including but not limited to the screening of donated gametes, becomes capable of providing more information on a wider range of conditions at a decreased cost, thereby likely becoming more widespread than at present. I identify a number of these questions below. Many relate to whose interests are valued the highest. For example, should not the wellbeing of the children born of the process—the only people involved who have no say in the matter—come first? I do not intend to provide answers to the questions posed. I note, though, that the interests of the children often seem to come last.

Does the Propriety of Genetic Screening Depend Upon the Stage of Life at which It Is Performed?

There seems to be general agreement among those writing on the subject that, as Syerson puts it, “taking added precautions to prevent women from unknowingly receiving sperm carrying genetic mutations that are associated with deadly diseases is a good thing.” Both he and Daar and Bryzski, in their JAMA commentary, express concern that the cost of such testing may affect the ability of the poor to use sperm donors, but neither suggests there is any intrinsic harm in performing such tests. As Adam Doerr reported in “Strict Liability for Sperm?”, a federal court recently held that a sperm bank could be liable for negligence “in failing to properly screen the sperm” under New York law—so that there can be a legal duty to conduct pre-conception screening. But why is there such a duty? Shouldn’t donor children and their mothers take their chances like the rest of us? Is the fact that we can perform such testing reason enough to decide that we ought?

As Hank Greely’s recent ELSI commentary observed, though, with the forthcoming postconception but prenatal genetic testing that will be both cheap and safe, society needs to decide whether to “encourage, discourage, or view as neutral” such tests. Is the same not true for pre-conception screening?

As Danielle Conrad observes, under GINA, once someone is born, it is illegal to screen them for health insurance and employment purposes—which means that basketball players suspected of having HCM will not be subject to genetic tests by their employers, and that even pilots whose passengers’ lives may be at risk from their collapse are exempt from screening for HCM. Of course, GINA applies only to existing people, and donor screening is promoted in order to prevent people with genetic diseases from being conceived. Perhaps the reasoning behind the duty to screen gametes is that no one is hurt by such screening (except perhaps through the stigma attached those who live with the disorders for which screening is performed). Is it simply uncontroversial that mandatory genetic screening before conception is always to be promoted, that mandatory genetic screening after birth for reasons other than medical care is always to be proscribed, and that the only gray area is in between the two, depending on one’s view of the morality of abortion and the destruction of embryos?

Implications of the Duty to Conduct Pre-Conception Genetic Screening

If pre-conception screening is such a clear good, and if sperm banks have a duty to screen for certain genetic disorders simply because such screening is possible, then does it not follow that obstetricians have a duty to provide screening for fertile couples? In Iran, for example, a mandatory premarital screening program originally designed to prevent communicable diseases has been modified to include certain non-communicable genetic disorders, including blood disorder thalassemia. Iran’s experience with mandatory premarital screening for genetic disorders also resulted in it changing its laws to permit prenatal genetic screening, the costs of which are borne by (governmental) health insurers—accompanied by a fatwa (pdf) under Islamic law permitting abortion in thalassemia cases. Iran’s program is generally regarded as having been successful (pdf) in reducing the rate of thalassemia and integrating genetic screening into an existing healthcare system.

Similar premarital and prenatal genetic testing options are offered elsewhere around the world, typically through traditional providers of reproductive assistance, including in vitro fertilization (IVF) clinics, although some companies now offer genetic screening directly to prospective parents via the internet. In addition, some countries, including the United States, presently permit genetic screening—typically through a combination of embryo selection and screening that utilizes pre-implantation genetic diagnosis (PGD) and IVF—for non-medical conditions including sex selection (which is illegal in many other countries, including the United Kingdom, India and China) and even the possibility of selecting for simple genetic conditions such as eye and hair color. However, the practice of utilizing genetic screening to influence non-medical traits or conditions is highly controversial, even in the United States where attitudes toward genetic screening for non-medical traits are generally more permissive. Given advancements in reproductive technologies and scientific understanding, it is conceivable that, eventually, it will be possible to screen for alleles that affect more complex traits such as obesity (pdf) or even elements of cognition. If there is a duty to engage in genetic screening to ward off disease, is there a duty to offer the opportunity to optimize a patient’s children?

And if we take steps to ensure that potential donors with genetic defects do not father children through the donation process, why stop there? Why not take steps to protect children born to such potential fathers through more traditional methods, including implementing mandatory premarital screening (such as employed in Iran and other countries), imposing other conditions or even restrictions on prospective parents with identified genetic conditions, or granting children born with certain conditions the right to sue their parents for the effects of defects that could have been avoided if they had had themselves screened prior to having children?

Is part of the answer that, as practiced in the United States, sperm donation itself can promote genetic defects? Returning to the case of the HCM donor with which we started this discussion, recall that he had 24 children. Another New York donor estimates that he has provided sperm for hundreds of children. There is no legal limit on the number of children a single donor may father in any one city—donors may sire children in numbers not seen since the days of Genghis Khan. If the donor has a genetic defect for which screening is too expensive or not yet possible, he may pass that trait on to a far larger number of descendants than would otherwise be the case. And even if he has no genetic defects, the practice of donor anonymity, combined with the absence of limits on the number of donor children creates a risk that half-siblings will unknowingly meet and conceive children together. England, for that reason, provides that only 10 families may receive gametes from any one donor. In the U.S., though, there is still no legal limit—which can be seen as another example of the law’s focus on the interests of the mother (who would not be directly affected by unintentional consanguinity) rather than the child (who might be).

Screening can also be used by parents who are deaf or are dwarfs, or have other heritable traits, to ensure that their children are like them. This has already happened informally, engendering considerable controversy, and may be happening at fertility clinics as well. Do children deliberately conceived deaf without their consent have a claim against the clinics that assisted in their birth, or against their own parents? Children whose deafness is caused by negligent medical treatment have a claim against those who cause their deafness, as does a child born with hereditary deafness following a physician’s failure to detect and advise her parents of the genetic risk.¹  Is it not inconsistent for states that permit wrongful life claims to deny such claims to children born without hearing due to the intentional actions of others, including their parents?

Donor Anonymity

Returning to the Maron et al. study, it is odd that Syerson as well as Daar and Bryzski read that study as calling for a national searchable database to pass along information about any genetic disorders that may arise. The study contained no such recommendation, but simply noted that the case “underscores the need for guidelines to notify gamete donors, recipients, and other affected parties once genetic disease arises.” However, a database is certainly one way to accomplish that notification and both voluntary and mandatory databases have been suggested by others. Syerson expresses concern that in a database “[w]ithout adequate privacy protections, recipients of a donor’s sperm may be able to contact the donor despite his desire to stay anonymous.” But as the GLR has noted before, when dealing with genomic data, even robust efforts to ensure anonymity may be illusory. Since a donor’s son has a copy of his Y chromosome, the child may have the relevant genomic data necessary to identify the donor father—as one donor’s 15-year old son demonstrated by sending a cheek swab to Family Tree DNA, finding two matches for his Y chromosome with the same last name, and then using the name and the limited information his mother had from the sperm bank to locate his father.

Even if donor anonymity is feasible, is it ethical? Proponents of anonymity are concerned about the effect ending donor anonymity may have on the supply of gametes. Daar, for example, has elsewhere written that “a non-anonymous donor policy in the U.S. would reduce the availability of donor sperm for unmarried women.” In other circumstances, there is a strong presumption that the father should remain responsible for his children. The policy against leaving a mother to support her child alone is so strong under U.S. law, in fact, that even young male victims of statutory rape must pay child support. Courts have “uniformly concluded that the fact that a child results from the criminal sexual act of an adult female with a minor male does not absolve the minor from the responsibility to pay child support.”² Similarly, a husband is presumed by law to be the father of his wife’s children, and the courts in most states will require a man to continue to provide support for those children even when subsequent genetic testing reveals that his wife had cheated on him and the children are not his. Should children of donors be denied the financial support of a father that is compelled on behalf of other children?

Daar is of the view that “[o]n balance, children of single … parents fare as well as children raised in marital … homes.” Her argument implies that, just as there is a duty to screen for genetic problems, it is appropriate to consider the environment in which the donor child is to be raised. However, even an article by authors sympathetic to single parenthood notes that “[m]uch of the literature on single-parent families has focused on the negative consequences for children.” For example, “even in Sweden with its generous welfare state, a major 2003 study found that children raised in single-parent homes were at significantly higher risk for addictions and serious psychiatric problems.” Does the weight to be given the effect of anonymity on the supply of donors depend on the effect single-parent homes have on children?

And even if there is a sufficient number of donors, does an extreme case such as “Octomom” Nadya Suleman, the indigent single mother with 14 donor-conceived children, suggest that limiting access to certain reproductive technologies based on the ability to support the children might in fact be desirable? Not at all, according to several academic commentators. At least one author has taken the contrary position that “[t]he state has a compelling interest to act in the best interest of the offspring that result from infertility treatment”—including an interest in “the ability of the potential parents to provide for the children.” What about limitations based on the age of the recipient mother? A 66-year old woman who lied about her age to a California fertility doctor gave birth to two boys—and died when they were two. The American Society for Reproductive Medicine voluntary protocols include no upper age limit, but do suggest medical evaluation of potential recipients over 45. More generally, Daar argues that “imposing reproductive regimes that deny procreative rights to certain members of a society is dangerously reminiscent of our eugenics past.” Ironically, as we saw above, Daar favors screening gamete donors for genetic defects, which could be considered the actual practice of eugenics. (Of course, such screening would not prevent the rejected donor from fathering children on his own.)

Anonymity itself comes with a cost. One need only spend a little time on the website created by a donor child searching for her father and half-siblings to understand the pain some of these children feel at be deprived of the knowledge of their biological father’s identity. As the daughter of an anonymous donor put it on another such website, “[m]y mother’s need to have a genetic link to her child was valued, while my need to know, love and understand the father with whom I have a genetic link was not.” More than 25,000 such children, their parents, and donors, have registered at the Donor Sibling Registry, trying to connect donor children with half-siblings and fathers—up from fewer than 10,000 two years ago.

Article Seven of the 1989 United Nations Convention on the Rights of the Child (pdf) explicitly protects a child’s “right to know … his or her parents.” Several signatory countries, including Holland, Norway, and Sweden have outlawed anonymous sperm donation out of concern for the effect on the children. In 2002, a British court found that a child does have the “right to obtain information about a biological parent [a sperm donor] who will inevitably have contributed to the identity of his child.”³ In 2005, the UK abolished anonymity for donors, and gave donor children the right to access their “biological pasts” at the age of 18.

Things are different in America. The United States is one of only two countries (along with Somalia) that has not ratified the Convention on the Rights of the Child, and no state bans anonymous donation. A California court has held that a donor child with a genetic disorder has the right to her father’s medical information, any promise of anonymity made by the sperm bank notwithstanding. However, cases involving adoption suggest U.S. courts will not follow the British precedent and provide children with a right to learn the father’s identity. U.S. donor children appear to be left to self-help—including resources such as FamilyTreeDNA.com—if they wish to discover their biological fathers.

The Future of Genetic Screening

Everyone seems to agree that at least some genetic testing of donated gametes is desirable, yet few clinics do it, and no state requires it. As one commentator observes, “hardly anyone in the public or the legislatures is paying attention. The designing of children is occurring subtly, as a result of individual choices through an open market.” While many countries, from Iran to England, have enacted laws affecting genetic screening, for the benefit of the children to be born to those involved, the reproductive legal landscape in the U.S. is sometimes termed Wild West. The lack of regulation is itself a policy choice, and may be the one on which the country settles—but any such decision should be the result of conscious deliberation, considering the interests of children as well as that of their parents.

_________________________________

¹Turpin v. Sortini, 643 P.2d 954 (Cal. 1982).
²L.M.E. v. A.R.S., 261 Mich. App. 273, 288-289 (2004).
³Rose v. Secretary of State for Health, 2002 WL 1446174

1. Is DTC Getting HIPAA? The Health Insurance Portability and Accountability Act of 1996 (HIPAA), the most prominent federal regulation governing the privacy of medical records, established the Privacy Rule to provide national standards for protected medical records. HIPAA’s Privacy Rule currently applies only to “covered entities” and business associates of covered entities. A covered entity is a health plan, health care clearinghouse, or a health care provider. Since a company providing genomic sequencing services is not a health plan or a health care clearinghouse, HIPAA will apply only if such a company is determined to be a health care provider or a business associate of a covered entity.

Direct-to-consumer (DTC) genomics companies are not likely to be considered business associates of HIPAA covered entities. HIPAA defines a business associate as a person or organization that, on behalf of a covered entity, performs an activity involving the use or disclosure of individually identifiable health information, or otherwise performs services for a covered entity where the covered entity provides such health information to the business associate. The American Recovery and Reinvestment Act (ARRA) expanded the definition of business associate for purposes of the Privacy Rule and the Security Rule to include

• entities providing data transmission of protected health information to covered entities (or such entity’s business associate) and requiring access on a routine basis to such information, and
• vendors contracting with a covered entity to allow the covered entity to offer personal health records to its patients.

DTC genomics companies typically do not act on behalf of a covered entity, nor do they provide services to covered entities. Rather, as the DTC name suggests, companies such as 23andMe provide services directly to the consumer. However, this is not always the case. For example, California-based Navigenics, commonly referred to as a DTC genomics company, has announced a number of partnerships with healthcare clinics through which it offers its genotyping services to the clinic for use in developing personalized diagnostic, management and treatment strategies for patients. Just last week, Navigenics announced a partnership with Beth Israel Deaconness Medical Center in Boston to familiarize practicing physicians with its DTC offerings, among other goals. Looking at Navigenics’ list of collaborators reveals a number of relationships where Navigenics appears to be performing services (genotyping and risk prediction) and providing identifiable health information (the genotyping results) to health care providers. Whether or not a particular DTC genomics company qualifies as a business associate depends on the particulars of the services it offers, particularly those that it makes available directly to health care providers; particulars which are subject to change at a moment’s notice in this rapidly evolving field.

Moreover, it is conceivable that a DTC genomics company could be considered a health care provider itself. Although we are not aware of any regulative body that has found a DTC genomics company to be covered by HIPAA (as a health care provider or otherwise), the term “health care” is defined broadly under HIPAA regulations:

Health care means care, services, or supplies related to the health of an individual. Health care includes, but is not limited to, the following:

(1) Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure or function of the body….

If a DTC genomics company provides diagnostic or analytical information to a customer in connection with the customer’s genomic sequence, it may be considered to be offering “diagnostic care” or “counseling with respect to the physical or mental condition of an individual”—and thus, to be a health care provider subject to the HIPAA regulations. Existing DTC providers do offer substantial information that could fall into those categories, including relative risk and lifetime risk calculations for serious diseases (23andMe’s testing service, for instance, includes “carrier reports” for 32 conditions including several cancers, Parkinson’s Disease and diabetes) and the determination of carrier status for alleles with reproductive implications. In addition, other companies such as Navigenics, provide access to board-certified genetic counselors to assist customers in interpreting their results.

The provision of clinical diagnostic information and genetic counseling, even when delivered over a website rather than in a doctor’s office, may constitute the provision of health care. In recent weeks the Genomics Law Report has focused on the recurring calls for standards that would have the effect of blurring the distinction between direct-to-consumer genetic testing and the clinical practice of medicine (also see here, here, here and here). One potential effect of confusing the clinical/non-clinical divide in the DTC setting would likely be to bring DTC service providers unambiguously under the purview of HIPAA as a health care provider. As described below, however, despite the increasingly clinical nature of the services offered by DTC providers, there does not appear to be much enthusiasm for subjecting genomics companies to HIPAA or to other clinical regulations.

2. Why Does HIPAA Matter? Even if a DTC genomics company is deemed to provide a level of service sufficient to make it a covered entity under HIPAA, it may still disclose confidential protected health information (such as a customer’s genetic or genomic results) for the purpose of carrying out “health care operations.” Health care operations are broadly defined in HIPAA Section 164.501 to include business management and general administrative activities. Specifically disclosure is permitted relating to the “sale, transfer, merger or consolidation of all or a part of the covered entity with another covered entity, or an entity that following such activity will become a covered entity and due diligence related to such activity.” Among the amendments to HIPAA contained in the ARRA is a specific prohibition on the sale of protected health information, except for the sale of information in connection with the sale, transfer or consolidation of the covered entity. Therefore, even when HIPAA applies, patient or customer authorization is not required for disclosure of protected health information in the sale of the company’s assets.

HIPAA does not specifically address the bankruptcy of a covered entity; however, it seems that the sale or transfer exception would likely apply. A liquidation in bankruptcy requires the sale of the debtor’s assets. As long as the protected information is transferred to another covered entity in connection with a sale of the assets, presumably individual authorization from the DTC genomics company’s customers would not be required.

For the moment, it does not appear that HIPAA regulations are restricting much if any of the activity currently taking place in the DTC genomics space. However, as a host of factors, including both internal and external pressures, continue to drive many DTC genomics companies closer and closer to activities indistinguishable from the clinical practice of medicine, at least some DTC companies may soon find themselves subject to HIPAA’s regulations. The implications of HIPAA coverage for DTC genomics companies is the subject for another post, but in the limited case of a bankruptcy scenario, even HIPAA coverage would not appear to prohibit a DTC genomics company from transferring its customers’ genomic information.

3. DTC Escapes Stimulus Bill Unscathed? Part of the Stimulus Bill enacted this past spring directed the Department of Health and Human Services (HHS), in conjunction with the Federal Trade Commission (FTC), to conduct a study on privacy, security, and breach-notification requirements for vendors of personal health records (PHRs) and related entities that are not subject to HIPAA. In the meantime, the Act required the FTC to issue a rule requiring these entities to notify consumers if the security of their health information is breached.

The FTC issued a proposed notification rule (pdf) in April 2009, applying to PHR vendors, PHR-related entities, and third party service providers. All three categories, however, are restricted to firms that handle personal health information.

Upon publication of the proposed rule, the FTC solicited comments from the public. One of the comments was from a nonprofit health privacy watchdog group, Patient Privacy Rights, on behalf of the Coalition for Patient Privacy (a group that includes the American Civil Liberties Union and the American Association for People with Disabilities). The Patient Privacy Rights comment (pdf) objected to the limitation of the proposed rule to “the organization and sharing of personal health records,” because the definition of personal health records did not explicitly include genetic or genomic information. As the group explained:

Personal genomics companies such as 23andMe, Navigenics, Knome, and deCODE offer individual genetic testing that can provide customers with novel health services—from determining the likelihood of contracting diabetes, to identifying ancestral roots. Such companies rely on (HIPAA-compliant) labs to analyze patient DNA, which they receive directly, analyze, and store online for access by the patient.

A patient whose genetic information is leaked, stolen, or disclosed could clearly suffer harm as great as that associated with any other PHR health data, as recognized by the various state and federal laws around genetic privacy. The Commission should accordingly determine that personal genomics companies constitute [Personal Health Record] related entities insofar as they ‘access[] information in a personal health record’ or ‘offer[] or maintain[] a personal health record.’

However, when the final notification rule (pdf) was published in August of this year, the FTC had declined to modify the rule as requested by Patient Privacy Rights. The Commission’s final rule contains no mention of genetic data or genomics companies.

While we will have to wait for the completion of the joint HHS/FTC study in February 2010 to see whether it explicitly covers genomics companies in any of its privacy or security regulations, the FTC’s security breach rule suggests that it is unlikely that any such regulations will be immediately forthcoming.

Accordingly, the genomic information supplied by DTC companies is likely to be covered by the FTC’s regulations only to the extent such information constitutes personal health information (thus making a genomics company a firm that handles PHI and subject to the regulations.) This is where GINA comes in.

4. GINA and the Privacy Rule: Did Anything Really Change? The Genetic Information Nondiscrimination Act of 2008 (GINA) requires that the HHS Secretary revise the HIPAA Privacy Rule to make clear that “[g]enetic information shall be treated as health information.” Although GINA required that HHS issue implementing regulations not later than May 2009, it wasn’t until this month that HHS’ Office of Civil Rights issued its proposed rules (pdf). The background discussion of the proposed rule points out, however, that although the term “health information” would be amended “to explicitly provide that such term includes genetic information,” that does not mean that all disclosures of genetic information would necessarily be protected under HIPAA’s Privacy Rule:

We note, however, that as before, genetic information, while health information, is only covered by the Privacy Rule to the extent that it meets the definition of “protected health information.” That is, the genetic information must be individually identifiable and maintained by a HIPAA covered entity (or business associate of a covered entity) (and not otherwise fall within one of the exceptions to the definition).

Thus, although GINA amended the Privacy Rule to cover genetic information, the type of entities covered by the Privacy Rule did not change: it still only applies to HIPAA’s “covered entities.” And so we have come full circle: the key question remains whether DTC Genomics companies are considered to be covered entities, either as health care providers or as business associates of health care providers. While that question remains unsettled, the tone of the note suggests that HHS is not actively seeking ways to apply its regulations to genomics companies.

5. What Does It All Mean? As discussed above, the trend toward clinical activity on the part of many DTC genomics companies could ultimately bring them within the ambit of HIPAA and its Privacy Rule. However, at present it does not appear that there is any federal regulation—including HIPAA—that clearly restricts the transfer of customers’ information as part of a sale of assets by a troubled DTC genomics company.

As we concluded last time, the true test for the handling of individuals’ genetic and genomic information collected by DTC companies will be the first actual bankruptcy. Until then it will remain extremely difficult to predict how regulators and bankruptcy courts will address such a scenario, and the most practical advice at this time, for existing and potential customers, continues to be to understand the terms and conditions offered by each individual DTC genomics company with respect to their customers’ information—and to recognize that, in bankruptcy, genomic data may be transferred to a similar company without regard to those terms and conditions..

As for the DTC companies themselves, the possibility that they may be subjected to regulation under HIPAA and the Privacy Rule—as well as, potentially, a host of other regulations and sources of liability associated with the provision of health care—has implications far beyond the bankruptcy scenario. In the coming weeks the Genomics Law Report will begin to investigate what it might mean for DTC genomics companies if the blurry line between clinical and non-clinical activity in the DTC space finally resolves itself, with the DTC companies on the clinical side of that line.

Direct-to-consumer (DTC) genomics companies are not immune to the current recession. When TruGenetics, a new player in the DTC genomics space, announced in June that it would be handing out 10,000 free genome scans, both Genetic Future and the Genomics Law Report raised questions about the financial viability of its business model, particularly in the current economic climate. Sure enough, on August 21, TruGenetics announced that it had been unable to secure funding sufficient to support its business model as contemplated. Frequent readers know that TruGenetics is not the only DTC genomics company that is struggling. The financial struggles of deCODE Genetics have been well chronicled (see here, here and here) and even new market leader 23andMe has undergone a dramatic shift in its top management as it pursues a new round of financing.

Ultimately, it was a recent headline here at Genetic Future—“deCODE Genetics on the brink of insolvency”—that started us thinking: what would happen if an established DTC genomics company actually went bankrupt? More specifically, what would happen to the genomic (and other) data held by the company? Genomic data is likely to be the company’s most valuable asset. Can that data be sold off to help meet the company’s debts? Bankruptcy can be a confusing and arcane process, with real risks and uncertainties for companies, their creditors and their customers.

In today’s post—the first of three on this subject—we examine the privacy and confidentiality policies of several leading DTC genomics companies to find out what, if anything, they have to say about whether data can be transferred to another company. In the second part, which will appear tomorrow, we take a close look at how the legal system would likely treat a DTC genomics company’s bankruptcy. In the final part, on Wednesday, we attempt to answer the only question that really matters for most readers: what does it all mean for the average DTC genomics customer?

Part I: The Fine Print: What the Privacy Policies Say

Privacy policies are particularly important in the field of DTC genomics where the sensitivity of consumer data is rivaled only by that found in other areas of healthcare and in the financial services sector. Courts and regulators are concerned as well. For instance, the Federal Trade Commission (FTC) has brought actions to enforce “companies’ privacy promises about how they collect, use and secure consumers’ personal information.” The first question, then, is how DTC genomics companies’ Privacy Policies address the possibility of selling customers’ data. As examples, we will consider the policies of two companies, TruGenetics and 23andMe, which, together, help to illustrate the range of policies in place today.

1. TruGenetics. Despite its funding difficulties and the fact that it has invited registrants to remove themselves from its database, TruGenetics does still maintain a website that provides both a Privacy Policy and a Terms of Use. The Privacy Policy (which is incorporated verbatim into the Terms of Use) focuses on data anonymization, transfers requested by registrants and GINA. As for how TruGenetics intends to use registrants’ genomic and other information, the only guidance comes from the Terms of Use, which include the following:

Your questionnaire responses and genetic information will be used for genetic research. One of the main goals of TruGenetics™ is to develop a unique research database for conducting genetic studies. Your decision to use TruGenetics’™ services indicates that you are willing to contribute your questionnaire responses and genetic information to the TruGenetics™ research database. . . . TruGenetics™ may conduct this research, or may partner with another organization, including non-profit and commercial entities, to conduct research. TruGenetics™ may charge a fee for conducting research using this database.

TruGenetic’s policy contains a promise of confidentiality and anonymity—although, as we have written elsewhere, that is a promise that is probably unwarranted—but there is no promise that the data will not be distributed to third parties. In fact, just the opposite is true—the purpose of the data collection is for it to be used by third parties for research, and the policy provides no assurance that the data will not be used for any other reason. TruGenetics’ policy itself therefore is no obstacle to the sale of the data, and provides no detail for a registrant to determine the circumstances under which his or her data might be transferred, either in the ordinary course of business or bankruptcy.

2. 23andMe. 23andMe has three separate policies applicable to users of its DTC genomics service: a Privacy Statement, a Consent and Legal Agreement and a Terms of Service. These policies clearly contemplate that certain personal information, including both genotypic and phenotypic information, may be made available to “commercial and/or non-profit organizations that conduct scientific and/or medical research.” While the Privacy Policy provides that such information will not be made available without “explicit consent,” it is unclear from the terms alone whether this consent requirement is satisfied by the consumer’s signing the Consent and Legal Agreement (which is required prior to any genotyping) or whether separate consents must be sought prior to the disclosure.

23andMe’s Consent and Legal Agreement applies to the company’s “successors and assigns” (as does TruGenetics’), thus expressly contemplating that information may be transferred. Much more explicit, however, is a separate section of its Privacy Policy entitled “Business Transitions” which states candidly that, in the event of “a merger, acquisition by another company, or sale of all or a portion of its assets,… your personal information and non-personal information will likely be among the assets transferred.” Indeed, as 23andMe’s research efforts expand, that information might represent its most valuable asset.

23andMe agrees to provide advance notice via email and prominent notice on the website of such a transfer, as well as to “require an acquiring company or merger agreement to uphold the material terms of this privacy statement, including honoring requests for account deletion.” Notably, although in other situations involving the potential transfer of private data (for instance, for research purposes) 23andMe repeatedly emphasizes that consent will be required before third parties receive access to personal information, that requirement is absent from the “Business Transitions” provision. In addition, the requirement that an acquirer uphold the privacy statement applies only to the “material terms” of the privacy agreement—leaving open the question whether any particular provision of the privacy agreement is “material.”

3. deCODE Genetics. deCODE’s DTC offering, deCODEme, has a Privacy Policy, a Service Agreement and a Terms of Use. These policies are conceptually similar to the 23andMe policies, appearing to permit the sale or transfer of genomic information provided that the terms of the Privacy Policy are generally upheld by the acquirer. While deCODE’s public financial difficulties were in some respects the impetus for this article, its unique legal situation as an Icelandic company doing business in Reykjavik, subject to a distinctive set of bankruptcy laws and statutory restrictions, renders it unrepresentative of other DTC companies. For that reason, we will continue to restrict our analysis to U.S.-based firms. A recent article in the journal Science, however, contains interesting speculation about what might happen to deCODE’s enormous customer biobanks, which is estimated to cover approximately 140,000 individuals, if the company does collapse, including speculation as to how deCODE might transfer its data to another EU entity under Icelandic and EU regulation.

4. So What Does It All Mean? If the company’s policy clearly permits the sale of genomic information in the kind of transaction that could be consummated in a bankruptcy case, then such a sale can go forward. But if the policy prohibits such a sale, or if the policy is unclear or does not address the subject at all, a transfer may still take place—subject to the ins and outs of bankruptcy law, including provisions specifically applicable to personal information. We’ll turn to that in the second part of this series.

Part II: Privacy Policies Through the Looking Glass of Bankruptcy Law

In part one, we discussed the importance of Privacy Policies and other legal agreements in determining how DTC genomics companies will treat their customers’ information, including in the case of a bankruptcy sale. Unfortunately, but not surprisingly, we failed to find much in the way of concrete answers. In this part, we investigate how a bankruptcy court would be likely to evaluate the proposed sale of a company’s genomic database, including in what scenarios it might be willing to set aside the company’s own agreed upon Privacy Policies.

1. Section 363 and the Stalking Horse. Section 363 of the Bankruptcy Code authorizes the sale (typically in an auction) of the assets of a business in bankruptcy. Quick auctions under Section 363 are becoming increasingly common because they allow for the transfer of desirable assets free and clear of liens and other liabilities (while leaving undesirable assets out of the deal), and unlike traditional Chapter 11 reorganizations, do not require the longer and more expensive confirmation process designed to fully protect the rights of creditors. During the current economic crisis, Section 363 was used in the sale of Lehman Brothers to Barclays Capital, in the sale of Chrysler’s valuable assets to Fiat and of General Motors to a new company backed by the U.S. Treasury. Section 363 auctions can also be lightning fast—Lehman Brothers’ assets, which were valued at billions of dollars, were sold less than a week after its Chapter 11 filing—although 2 to 3 months is more common.

In a Section 363 transaction, the bankrupt company agrees in principle to sell its assets to a “stalking horse” buyer, and then, following bankruptcy court approval of the sale procedures, solicits bids in an attempt to solicit a more favorable purchase price. The stalking horse company is often not outbid and winds up acquiring the most valuable assets. As the G.M. example demonstrates, there is no requirement that the stalking horse be a private company. Just as The Wellcome Trust has been mentioned as a potential acquirer of some of deCODE Genetics’ genomic database, a Federal agency such as the FDA or NIH could conceivably organize a bid for genomic assets it deemed important, assuming that it could muster the political and financial capital to proceed at the breakneck pace that can be required of Section 363 bankruptcy proceedings.

In response to a 2005 bankruptcy case (In re Toysmart.com LLC) in which a bankrupt toy company attempted to sell private customer data to its creditors in clear contravention of its own privacy policy, a new procedure was added to Section 363. The procedure requires the appointment of a Consumer Privacy Ombudsman (CPO) prior to the sale or lease of “personally identifiable information” from a bankrupt company when the proposed sale would be inconsistent with a company’s present and disclosed policy “prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with” the company.

2. How To Know If You’ll Need a CPO. By law, the CPO procedure only applies when the proposed sale would be inconsistent with a company’s present and disclosed policy “prohibiting the transfer of personally identifiable information about individuals to persons that are not affiliated with” the company. However, bankruptcy courts have also appointed a CPO to advise them on the transfer of the information when the bankrupt company’s policy (like TruGenetics’) does not discuss whether the data may be sold to another company.¹ Thus, if a DTC genomics company employs a policy that permits the transfer of information and other assets to third parties, the CPO procedure will not apply.

If the company’s policies prohibit such a transfer or, as in the case of most DTC genomics companies, if they are unclear, the CPO procedure may be available to assist the bankruptcy court in evaluating the appropriateness of the proposed sale of “personally identifiable information.” But is genomic information “personally identifiable information”?

In order to qualify as “personally identifiable information” or PII, the information in question must satisfy two criteria. First, it must be “provided by an individual to the debtor in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes.” Data submitted to a private genomics company for personal use (whether clinical or otherwise) would therefore qualify; data submitted for research purposes (which would arguably apply to the TruGenetics model, and possibly to certain services offered by 23andMe) would not satisfy this criteria.

Moreover, PII must contain, as at least part of the overall information content, one of the following specific pieces of information:

♦   Name
♦   Street Address
♦   Email Address
♦   Telephone Number; or
♦   Credit card number

As for something as seemingly personal as, say, a whole genome sequence, or perhaps just a record of 500,000 SNPs? That information, along with “any other information concerning an identified individual that, if disclosed, will result in contacting or identifying such individual physically or electronically,” constitutes PII if and only if it is “identified with 1 or more of the items of information” in the list above. Thus, while genomic information coupled directly with a name or other specified individual information would qualify as PII, de-identified genomic information, regardless of the practical possibility of later re-identification, would not qualify as PII and would not invoke the protections of the CPO procedure. It is unclear whether or not genomic information that was de-identified but capable of being re-identified through, for instance, coded identifiers, would be treated as PII.

Assuming that the presence of PII could be established, recall that the CPO procedure is only available when the proposed transfer would violate the company’s applicable privacy policy. In the case of 23andMe, for example, its privacy policy permits transfers to an acquirer but requires that the acquiring entity agree to the “material terms” of its existing privacy policy. If the agreement with the stalking horse did not mandate agreement to all the terms of the privacy policy—for example, if it declined to agree that the data could be deleted upon request in order to avoid the possibility that a significant number of spooked former customers of 23andMe would demand that their information be removed from the database—the court would then have to determine whether such a provision was material in order to determine whether the proposed transfer violated the privacy policy, a process in which it would be likely to seek input from a CPO (although it could order changes in the asset purchase agreement on its own). Thus, as a practical matter, the CPO procedure is likely to be available in order to evaluating ambiguous DTC genomics privacy policies.

3. What Does the “C” in CPO Stand For, Again? Even if a CPO is appointed, it is the bankruptcy court that must ultimately evaluate and approve the proposed sale of assets. The role of the CPO, if appointed, is to provide information to the court, including with respect to the following:

♦   the debtor’s privacy policy;
♦   the potential losses or gains of privacy to consumers if such sale or such lease is approved by the court;
♦   the potential costs or benefits to consumers if such sale or such lease is approved by the court; and
♦   the potential alternatives that would mitigate potential privacy losses or potential costs to consumers.

Keep in mind that the bankruptcy statute does not require the CPO to represent the interests of the consumers. In fact, “the Consumer Privacy Ombudsman appears more in the role of an expert commentator than a consumer advocate.”²  Also, recall the speed at which auctions under Section 363 are conducted. Given the logistics and time entailed in first determining whether a CPO is warranted and, if so, locating and appointing a CPO, the CPO in most instances can be expected to have “only a day or two to obtain the information he or she needs and digest it.”³  With privacy issues as complex as those that would be presented in a DTC genomics company’s bankruptcy, and in the absence of any guarantee the CPO will be someone familiar with the issues, there is scant hope of a sophisticated analysis.

A review of the cases in which a CPO has been appointed and filed a report reveals a clear pattern: the CPO supports the sale “provided certain conditions were met, such as requiring that (1) the sales be made to qualified purchasers (those in the same business or that would operate the same business as the debtor), (2) the purchaser would serve as a successor-in-interest to the debtor’s … privacy policies and (3) customers be provided an opportunity to opt-in or opt-out of the proposed transfer.”⁴ It appears to be highly unlikely that a CPO would recommend a transfer in which the buyer would not agree, going forward, to abide by the same privacy policy that governed the data prior to the transaction.

So bankruptcy law clearly sees the possibility that genomic data could be sold in violation of its privacy policy—since that is the situation that would trigger review by a CPO. But as we just noted, the actual cases in which CPO’s have conducted such review indicates that, while a bankruptcy court may override a provision in a privacy policy that prohibits the transfer of data to a third party, the CPOs and courts do seem to be unwilling to override other provisions, but rather wish to make sure that the policy is otherwise enforced by the acquirer, and not used for any markedly different purpose than before.

4. The FTC and Other Considerations. Of course, even if the CPO were to recommend a transaction in which the data would no longer be subject to the same kind of restrictions present in the privacy policy when the data was gathered, the CPO’s report is not binding on the court. Furthermore, in such a case—or in a case in which a CPO was not appointed because the information transferred did not qualify as PII—the FTC and state attorneys general could well decide to intervene. As the FTC website states:

A key part of the Commission’s privacy program is making sure companies keep the promises they make to consumers about privacy, including the precautions they take to secure consumers’ personal information. … Using its authority under Section 5 of the FTC Act, which prohibits unfair or deceptive practices, the Commission has brought a number of cases to enforce the promises in privacy statements, including promises about the security of consumers’ personal information.

However, because of the speed at which the typical Section 363 auction takes place, combined with the limited resources of the FTC, it cannot be assumed that the agency (or one or more state attorneys general) will get involved in every case in which private data will be transferred without appropriate authorization in a privacy policy. The field of DTC genomics is sufficiently prominent, however, that it seems unlikely that the FTC would fail to receive notice and, if necessary, review any proposed transfer that raised significant consumer privacy concerns.

So what does this all mean for the average DTC genomics customer? Tune in tomorrow when we attempt to put all the pieces together.

Part III: What Does It All Mean?

In part one, we discussed the importance of Privacy Policies and other legal agreements in determining how DTC genomics companies will treat their customers’ information, including in the case of a bankruptcy sale. Unfortunately, but not surprisingly, we failed to find much in the way of concrete answers. In part two, we dug into the law to investigate how a bankruptcy court would be likely to evaluate the proposed sale of a company’s genomic database, including in what scenarios it might be willing to set aside the company’s own agreed upon Privacy Policies. In this final part, the threads come together as we ask—and attempt to answer—the only question that really matters for most readers: what does it all mean for the average DTC genomics customer?

If you’re concerned that your DTC genomics provider of choice might be a candidate for bankruptcy the very first thing to do, of course, is to consider whether the privacy of your genomic data is even important to you. If you’re applying for (or already enrolled in) the Personal Genome Project, for example, chances are that you wouldn’t much care if 23andMe went bankrupt and decided to sell your information to a competitor, to a pharmaceutical company or to anybody else.

But for the many customers who, at least at present, consider the privacy and security of their genomic data to be an important factor in choosing whether to purchase the services offered by DTC genomic companies, there is simply no substitute for reading to the bottom of the page. When you purchase a product and utilize the corresponding services, including the website where you view your genomic information, you are agreeing to the terms supplied by that company.

As for what those terms say, while it varies on a case-by-case basis and the terms are always subject to change (and they do, in fact, change, often in response to developments in either the law, the company’s business model or both), the prediction here is that if your DTC genomic company of choice goes belly up there is a good chance that its assets, including its database of genomic information, will be up for sale.

The good news is that, in all likelihood, the sale would be restricted to another company that would use the data for substantially the same purposes as the original company and generally agree to abide by the same privacy protections as the now-bankrupt company. Again, those provisions vary by company but generally provide individuals with an ability to terminate their involvement with the company and withdraw their information (to the extent that it has not already been made available to third parties for allowable research or other purposes) from the company’s database.

Finally, as with just about every aspect of genomics law, the most complete and accurate answer is that time will tell. When the first DTC genomics bankruptcy inevitably arrives it will help answer more definitively a host of important questions, including whether and how a government agency might take an interest in commercially acquired genomic data, whether genomic data will be considered personally identifiably information under bankruptcy law and how debtors, creditors, consumers and regulators will react to the sale of large-scale genomic databases.

———————

¹ Luis Salazar, Don’t Fear the Consumer Privacy Ombudsman, 26 American Bankruptcy Institute Journal 42 (2007).

² Warren Agin, Handling Customer Data in Bankruptcy Mergers and Acquisitions-Coping with the Consumer Privacy Ombudsman Provisions of the 2005 Bankruptcy Act, E-Commerce Issues and Developments

³ Agin.

⁴ Salazer.