The legal and ethical uncertainty surrounding surreptitious genetic testing—which can be broadly defined as any genetic test performed without the knowledge and/or consent of the individual tested—first piqued the public′s interest shortly after the 2008 election thanks to an editorial by Bob Green and George Annas in The New England Journal of Medicine. Green and Annas worried that “persons or groups opposing a candidate [and] hoping to harm his or her chances for election” would obtain and release genetic information without consent, a form of “genetic McCarthyism.” This would not be very difficult, the authors concluded, since “sufficient DNA for amplification and analysis can be obtained from loose hairs, coffee cups, discarded utensils, or even a handshake.”

Nearly three years later, surreptitious genetic testing is back in the news thanks in large part to an in-depth article by Eriq Gardner in the current issue of the ABA Journal. Gardner′s piece examines the practice of surreptitious genetic testing, provides a compelling anecdote from a confessed “DNA thief” and highlights many of the privacy concerns associated with the practice.

The confusing legal landscape of surreptitious genetic testing was covered in detail by the Genomics Law Report late last year, and again early this year following the introduction of legislative proposals in Massachusetts, Vermont and California, each of which would have enhanced individuals′ rights in their DNA samples and data. But Gardner′s piece has drawn new attention to the topic from several law and privacy publications, including The Wall Street Journal′s Law Blog, and also prompted a regular Genomics Law Report reader to dig up another piece of proposed state legislation, this time from Texas.

Texas to Tackle Surreptitious Genetic Testing? The Texas legislation (HB 2110), which was introduced and referred to committee in March, is short and to the point. It would revise the state′s property code to include the following key provision:

Sec. 3.002. PROPERTY RIGHT ESTABLISHED.  (a) Subject to Subsection (b), an individual has an exclusive property right in a DNA sample provided by the individual. A person may not, without the informed, written consent of the individual or the individual′s legal guardian or authorized representative:

(1) collect a DNA sample from an individual;

(2) perform a genetic test on an individual’s DNA sample; or

(3) retain an individual′s DNA sample.

The proposed legislation includes expected carve-outs for genetic testing performed in emergency medical, forensic or other similar settings, as well as civil and criminal penalties for statutory violations. Unlike legislation introduced earlier this year in other states, particularly in Massachusetts and Vermont, the Texas legislation is carefully limited in its scope. Absent from HB 2110 are declarations about the “fair market value” of a genome (MA), attempts to expand the legislation′s focus to encompass tangentially related topics such as medical records and gene patents (VT) or efforts to plug acknowledged gaps in the protections provided by the Genetic Information Nondiscrimination Act (MA, VT and CA).

Also noteworthy is HB 2110′s clear statement that the “informed, written consent of the individual or the individual′s legal guardian or authorized representative” is all that is needed to remove a genetic test from the realm of criminal conduct. This is a welcome departure from far more complicated provisions pertaining to DNA sample ownership and control contained in the MA and VT legislative proposals, which have cast doubt on the implications of those pieces of legislation, should they pass, for genomic research conducted in those states. The language in HB 2110 should reassure researchers in Texas and elsewhere that the state does not intend to interfere with ongoing or future genomic research projects (which are already premised on securing the informed, written consent of participants).

A Lesson From Texas. The Texas legislative proposal is largely a positive one, thanks primarily to its simplicity and clarity. In fact, HB 2110 bears a close resemblance to Alaska′s current genetic privacy statute (§§ 18.13.011 et seq.), which is one of the toughest and clearest genetic privacy laws in the nation. Unlike HB 2110, however, Alaska′s statute contains (1) an additional prohibition on the disclosure of results from a genetic test, (2) additional carve-outs from the prohibition on genetic testing, including for paternity testing (one of the most common instances of surreptitious testing) and (3) far more aggressive civil penalties (more than $100,000 if the violation occurred in a for-profit setting).

Differences aside, HB 2110 would make it crystal clear that surreptitious genetic testing is a crime under Texas law, and it would do so without raising concerns about the legislation′s unintended effects on genomic research or the use of genetic information in healthcare, as is the case with the Massachusetts and Vermont proposals. In addition to its clarity and simplicity, HB 2110 is also timely. As we wrote late last year:

Each year, the availability of low-cost, high-quality genetic information expands. Along with a wide array of legitimate and beneficial uses, the growing accessibility of this genetic information brings with it an increasing number of opportunities to employ and to abuse surreptitious genetic testing. As we continue to push forward into the era of personal genomics, the time has come to seriously discuss a comprehensive legal framework for surreptitious genetic testing.

As the swarm of presidential hopefuls, media and political partisans gather in Iowa this weekend, HB 2110 should serve as yet another reminder that there is no comprehensive federal legal framework for addressing surreptitious genetic testing (as for Iowa, at least as of 2008, it too lacked a law clearly banning such testing). This is a fact that the various presidential candidates (including Texans Ron Paul and Rick Perry) would do well to keep in mind as they head off down a campaign trail which will see them traverse the country to shake hands with thousands of strangers, leaving untold used coffee cups and uneaten pizza crusts in their wake, each one a target ripe for surreptitious genetic testing.

Taken as a whole, the legislation, if enacted, would confer upon Massachusetts residents a significantly expanded set of genetic rights than exist under current federal law. Below we examine several of the bill’s most noteworthy proposals.

The MA GBR addresses perceived gaps and limitations in the coverage provided by major federal statutes, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Genetic Information Nondiscrimination Act of 2008 (GINA), and the Constitution of the Commonwealth of Massachusetts, by seeking to place genetic information on a par with medical records.

The MA GBR’s provisions set basic limitations on the use, including the commercial use, of personal genetic information that would go above and beyond the user agreements and privacy policies employed by some commercial services. For example, the MA GBR prohibits the use of genetic information for marketing or determining credit worthiness. With the proliferation of genetic information, particularly in consumer or commercial contexts, such basic limitations would help address concerns about the lack of mandatory restrictions regarding the sale, transfer or other use of personal genetic data.

The Personal Property Theory of Personal Genomes. But the MA GBR goes much further than mere consumer protection reforms. Section 1 of the proposed legislation explicitly declares genetic information to be “the exclusive property of the individual from whom the information is obtained.” (emphasis added)

Granting individuals express property rights in their genetic information would be significant. Not only does the MA GBR contemplate genetic information being controlled from the grave – individuals may bequeath to a surviving spouse or family member authorization to use their genetic information under the terms and conditions of their will – but the MA GBR also recognizes the inherent monetary value of genetic information. For example, the proposed bill would require that, prior to entering into a contract to share one’s personal health information, genetic material or genetic information, the individual must be notified, orally and in writing, that “their donation is a commodity and is of some material value.” (Section 1(b)) Further, if the collecting entity has a possible future intent to commercialize the genetic information, the individual donor “must be made aware and compensated at a fair market value.” (Section 1(b))

Supporting these and other MA GBR restrictions on the use of genetic information are the bill’s proposed civil and criminal penalty provisions, which are likely to generate considerable discussion as the bill works its way through the legislature. On the civil side, violations of the MA GBR are automatically violations of the state’s unfair or deceptive practices act (Chapter 93A Section 2), and violators additionally are subject to statutory damages of $5,000 ($100,000 if the MA GBR violation resulted in profit or monetary gain to the violator). The bill provides for both a private and public right of action, and it carves out only limited exceptions for violations by members of law enforcement, employees of the state DNA database, and those working under judicial order. On the criminal side, Section 16 of the MA GBR amends the Commonwealth’s Identity Theft Law (Chapter 266 Section 37E) to add genetic information to the list of “personal identifying information” protected from identity thieves. The identity theft law currently defines “personal identifying information” to include, among others, a person’s social security number, mother’s maiden name, financial account numbers and computer passwords. If the MA GBR is passed, those found guilty of identity theft stemming from the misappropriation of genetic information could face maximum fines of $5,000 and imprisonment for two-and-one-half years.

While individual citizens may have little chance of detecting or deterring larger entities from illicitly obtaining or using genetic information, the MA GBR provides at least the possibility of government action in the face of such violations. The civil and criminal penalties provided by the MA GBR, if enacted, would offer one of the strongest set of protections yet against surreptitious genetic testing.

The Next Generation of GINA? The MA GBR also seeks to expand upon the protections afforded by the Genetic Information Nondiscrimination Act of 2008 (GINA). GINA comes in two parts and prohibits genetic discrimination by healthcare insurance providers (Title I) and employers (Title II).

Despite its broad protections, which are still being implemented, GINA has several widely recognized gaps. Most notably, Title I of GINA does not proscribe genetic discrimination in the areas of long-term care, life or disability insurance.

The MA GBR seeks to expand on Massachusetts’ already broad protections against the use of genetic information by insurers while plugging some of the gaps left by GINA. Section 2 strikes language in Massachusetts law that currently allows insurers to use genetic information submitted on an insurance application to set terms for the applicant’s disability or long term care insurance policy. (See Chapter 175, Section 108I(c)) Section 3 similarly addresses life insurance. (See Chapter 175, Section 120E) Section 4 addresses auto insurance. Taken as a whole these provisions would significantly revise current Massachusetts insurance law and create what would appear to be, at least with respect to the use of genetic information, the most insured-friendly climate in the entire country.

It should come as no surprise that Massachusetts, of all states, would have an interest in addressing the gaps in GINA’s coverage. The widely-publicized Risk Evaluation and Education for Alzheimer’s Disease (REVEAL) study, led by researchers at the Boston University School of Medicine, has for years published data suggesting that genetic information (in this case genes associated with Alzheimer’s susceptibility) can have a material effect on an individual’s decision to purchase long-term care or life insurance. Though such a genetic test is not currently common, or thought to be commonly requested or utilized by insurers in determining coverage or setting rates, Massachusetts residents and lawmakers are clearly aware of the issue and the potential consequences of GINA’s limitations.

A Bill of Rights or a Barrier to Progress? The merits of the MA GBR will be heavily debated on Beacon Hill over the course of the coming months. Turna Ray of Pharmacogenomics Reporter noted last week that, as of early February, the bill had the support of six Massachusetts state senators and 13 state representatives. Despite speculation that private interests, particularly insurers, might seek to block the bill’s passage – or at least scale back its protections – Steve May, the executive director of the Forum on Genetic Equity, the advocacy group which crafted the bill, is confident that the MA GBR will pass.

Whether the MA GBR passes in its current form, or indeed whether it passes at all, one fact is inescapable – the MA GBR’s efficacy will be inherently limited by geography. And that geographic limitation could also produce unintended effects on personalized medicine innovation, both within Massachusetts and more broadly.

While the MA GBR would provide an unprecedented degree of security and control to Massachusetts’ residents and their genetic data, has it struck the proper balance against other considerations? For example, while the bill carves out minor exceptions for law enforcement, employees of the state DNA database and those acting upon judicial orders, those safe harbors are probably not broad enough to protect all legitimate scientific and research activities. Further, such a dramatic increase in the proscribed uses of genetic data, and in the restrictions and costs imposed even on lawful uses, could well erect unintended barriers to the type of innovative genetic research conducted at numerous Massachusetts institutions – both non-profit and for-profit. For example, would the added compliance and compensatory costs of the MA GBR (just what is the fair market value of an individual’s genome these days anyhow?) discourage academic or commercial users of genetic data from seeking out or even accepting Massachusetts residents?

This is a delicate line to walk. On the one hand, thanks to a decade of progress since the first human genome was sequenced, widespread personalized genetic data is not only possible – something we could not say as recently as a few years ago – it is more meaningful and, yes, more valuable than ever before. On the other hand, as we are frequently reminded, we have a long way to go in our understanding of human genomics, including how to use personal genetic data to bring about truly meaningful improvements in our health and quality of life.

In addition to the myriad scientific and technological challenges which must be overcome, for the next decade of human genomics to be a successful one, law and policy makers must work with the public to balance individual rights against societal interests. The push to create strong individual rights in genetic data, and to couple those rights with robust privacy protections, must also acknowledge the vital importance of broadly collecting and sharing genetic and other health data in research, clinical and commercial settings. The trick will be to design systems strong enough to prevent abuse but flexible enough to promote innovation and adapt to not only changing scientific, medical and commercial practices but also to evolving social attitudes around genetic data.

While it is clear that change in our legal and regulatory structures is needed, it is not clear if the MA GBR represents the right sort of change. On the one hand, as the Forum on Genetic Equity’s press release (pdf) and the legislation’s name itself declares, the Genetic Bill of Rights may represent fundamental and needed change that will pave the way for sweeping federal changes. On the other, and just like the New York bill we discussed last month, the bill may be an overly protectionist “legislative band-aid” that would grant excessive genetic rights and privacy protections to a minority of individuals at the expense of more meaningful commercial, scientific and clinical innovation.

Just as important as the potential effect of the Massachusetts legislation on Massachusetts residents and researchers is its effect on the ongoing national conversation about these issues. Certainly, legislation that takes effect in Massachusetts would have an outsized effect on biomedical research, investment and innovation, given the prominence of Massachusetts in these areas. But ultimately a patchwork of state regulations cannot be the answer. Whatever the balance to be struck between individual genetic rights and privacy and the needs of genomic research, medicine and commerce, this is an issue that is by its very nature national – and even global – in scope.

Credit the Forum on Genetic Equity and its Beacon Hill supporters for aggressively pursuing these issues, and continuing to push the dialogue forward. Ultimately, however, for the next decade of genomics to be anywhere near as successful as the previous one, meaningful regulation will require much more than the MA GBR, or similar state-level efforts. It will require a major and coordinated national and international effort to replace our current patchwork scheme with one that protects personal genomic data while providing the clarity and flexibility researchers, clinicians and companies need to unlock the potential of those data.

The first is primarily a curiosity: the allegation that Chinese authorities are spying on deCode Genetics, Iceland’s most prominent genetic research company and provider of the direct-to-consumer genetic testing service, deCODEme. Nobody seems to know exactly what China is looking to gain by clandestinely exploring Iceland’s genetic genealogy. You are welcome to speculate in the comments.

The second raises broader issues: the revelation that the State Department’s ongoing human intelligence collection directives include requests for “biometric information” on key world leaders, including United Nations arms inspectors, the Director General of the World Health Organization (WHO) and key advisors and aides to United Nations Secretary General Ban Ki-moon. A separate cable detailing intelligence collection priorities in Africa’s Great Lakes region clarifies that “biometric information” includes “health [data]…fingerprints, facial images, DNA, and iris scans.”

Not disclosed in the WikiLeaked cables: why the State Department wants the biometric data or whether any have been successfully obtained.

Surreptitious Testing: An Overview. The cables are, however, a reminder that the law surrounding the surreptitious collection and testing of biometric data, including DNA, remains extremely murky.

While the extent to which surreptitious testing is performed in diplomatic and intelligence contexts is not publicly known, such testing is commonplace in law enforcement settings. For example, police routinely collect and analyze “abandoned DNA” during forensic investigations. Indeed, one of the primary indices of the FBI-run Combined DNA Index System (CODIS) is the Forensic Index. The Forensic Index is comprised of DNA profiles constructed from biological specimens from unidentified individuals collected at crime scenes. These DNA profiles are then compared against similar offender and arrestee indices, which are also housed in CODIS, to aid in law enforcement efforts. Several high-profile criminal investigations, including the recent arrest of the “Grim Sleeper” serial killer, have been aided by this technique.

Concerns about surreptitious sampling and testing have also appeared in other contexts. During this past summer’s Congressional hearing on direct-to-consumer (DTC) genetic testing, the Government Accountability Office (GAO) presented results from a series of undercover encounters with DTC companies. One recording appeared to show a company (later identified as Pathway Genomics) encouraging a prospective customer to collect and send in a saliva sample from her fiancé without his consent, in order to surprise him with results of a genetic test.

In 2009, New Scientist reporters Peter Aldhous and Michael Reilly used similar tactics to demonstrate that it was possible to obtain genetic information about someone without that individual’s consent and detailed their experiences in a special investigation: how my genome was hacked.

Shortly after the 2008 presidential election, an article appearing in The New England Journal of Medicine (NEJM) considered the possibility that, by the time the 2012 election rolls around, presidential candidates might be at significant risk of surreptitious genetic testing. The authors worried that “persons or groups opposing a candidate [and] hoping to harm his or her chances for election” would obtain and release genetic information without consent, a form of “genetic McCarthyism.” This would not be very difficult, the authors concluded, since “sufficient DNA for amplification and analysis can be obtained from loose hairs, coffee cups, discarded utensils, or even a handshake.” The WikiLeaks revelations about State Department officials seeking biometric information on world leaders indicate that the NEJM speculation may already be reality on the world stage.

There are numerous other scenarios in which surreptitious genetic testing might be employed to acquire information about less famous but equally unwitting individuals, including to establish paternity or to evaluate a potential romantic partner.

Legal Uncertainty Surrounds Surreptitious Testing. To many, it seems like “there oughta be a law” against surreptitious genetic testing, at least in certain settings. However, as reported last year by the Genetics & Public Policy Center, there are “limited legal safeguards against surreptitious DNA testing or its potential consequences for those subject to nonconsensual testing.”

While the 2008 passage of the Genetic Information Nondiscrimination Act (GINA) prohibits the unauthorized acquisition or use of genetic information in certain contexts (health insurance and employment), it offers only limited protection against surreptitious testing. For instance, while it covers most of the Federal government, including the State Department, GINA does not apply to the military or the VA. It also does not restrict behavior outside of the insurance and employment contexts including, for example, by political adversaries or their supporters during a presidential campaign. (Interestingly, the NEJM article declined to advocate for “laws that would make it a federal crime to sequence a candidate’s DNA without consent,” preferring voluntary restraints and education instead.)

Other Federal statutes, such as the Health Insurance Portability and Accountability Act (HIPAA) may offer protection under certain scenarios (e.g., the use and disclosure of genetic information by covered entities, predominantly health plans and healthcare providers) but, again, fall short of providing a complete and clear prohibition on surreptitious genetic testing.

The 2008 GPPC report also looked at state law to evaluate which states proscribe surreptitious DNA testing (pdf). Determining the exact number of states that prohibit this behavior depends heavily on context. Some state statutes prohibit unauthorized acquisition or analysis of genetic information, while others apply only to unauthorized disclosures. Similarly, some state statutes appear to encompass all manner of genetic information, whereas others cover only certain genetic information (e.g., health-related information) or apply only to certain settings (e.g., employment or insurance discrimination). The National Conference of State Legislatures (NCSL) has also compiled data on state genetic privacy laws and, like the GPPC report, the NCSL data indicates considerable variability at the state level.

In the absence of a comprehensive federal law, state prohibitions are currently the main source of relevant law when it comes to restricting surreptitious genetic testing. But not all states have such laws. Whether surreptitious genetic testing is illegal thus typically depends on a combination of who is doing the testing, whom they are testing, what they are testing for, how they are using the results and, most of all, the state or states in which those activities take place.

Finally, there is a possibility that surreptitious genetic sampling and testing may be prohibited on either common law or constitutional grounds, at least in certain situations. For example, in the Texas newborn blood spot litigation, which we covered earlier this year, the plaintiffs alleged both Fourth Amendment (unreasonable search and seizure) and Fourteenth Amendment (right to privacy) violations resulting from the state’s policy of retaining newborn blood spots for ongoing research without explicit parental consent. While both claims survived summary judgment, and may have helped precipitate the litigation’s settlement, these and other legal theories remain untested in most states and under most circumstances.

What We Should Learn From WikiLeaks. Coming full circle, the leaked State Department communiqués raise important questions to which we do not have clear answers. In particular: under what circumstances is the surreptitious collection of biometric data, including genetic data, appropriate?

For most, the answer to that question will depend to some degree on context. Should State Department officials gathering intelligence abroad have a greater or lesser ability to pursue surreptitious genetic testing than domestic law enforcement agents? Should private individuals be permitted to conduct surreptitious genetic testing in certain circumstances (e.g., to confirm paternity) but not others (e.g., when shadowing a politician or celebrity)?

While individual answers may vary, we expect the law to provide us with clear guidelines. As is made clear by the above analysis, however, there exists a wide range of scenarios where surreptitious genetic testing, should it occur, would fall squarely within a legal gray area.

This is in stark contrast to the situation in other countries. In the United Kingdom, for instance, the Human Tissue Act 2004 made it a “criminal offence to take a sample from someone to test their DNA without their consent, except for medical purposes and lawful investigative purposes” as of 2006. Similarly, while Germany’s new Human Genetic Examination Act (also known as the GenDG) is overly restrictive in many respects, § 8(1) of the GenDG (pdf) clearly prohibits “any genetic examination or analysis” without the “express, written consent of the subject person, both in regard to the respective genetic examination and genetic sample.”

Whether the United States adopts the same approach to surreptitious genetic testing or not, the issue must be addressed. We must articulate, much more clearly than at present, the situations in which unconsented genetic testing, analysis and disclosure is permissible, and those in which it is proscribed.

Each year, the availability of low-cost, high-quality genetic information expands. Along with a wide array of legitimate and beneficial uses, the growing accessibility of this genetic information brings with it an increasing number of opportunities to employ and to abuse surreptitious genetic testing. As we continue to push forward into the era of personal genomics, the time has come to seriously discuss a comprehensive legal framework for surreptitious genetic testing.

As part of its program, Berkeley offered students the option to participate in genetic testing for three common genetic variants relevant to the body’s ability to metabolize milk products, alcohol and folic acid. The University’s original plan was to allow students to elect to receive the results of their tests as part of the program. Two weeks ago, however, the California Department of Public Health (CDPH) ruled that if Berkeley wanted to return personalized genetic data to some of its freshmen, the testing must be conducted at the direction of a physician and performed by a licensed clinical laboratory. The significant logistical burden and cost of complying with the CDPH’s ruling forced Berkeley to modify its program. While some aspects of the program will go forward, no student will be able to access any personalized genetic information.

(CDPH’s ruling was unexpected. Berkeley’s Dean of Biological Sciences, Mark Schlissel, noted that the department’s ruling “relies on an interpretation of legal statutes that is entirely different from the interpretation of the same statutes by UC’s top lawyers.” The ruling itself has potentially significant implications for genetic research across the country, although that topic is the subject for a future post.)

The focus of this post is the rapid mobilization of critics of the Berkeley program and the power of public controversy to spur regulatory action and, ultimately, to force the University to adopt a fundamentally different approach to personal genomics education than originally intended. This in spite of a detailed internal review process that consumed substantial resources and required Berkeley’s Institutional Review Board (IRB) to approve the project. Examining how and why this happened is instructive for evaluating the future prospects of personal genomics research and innovation.

A Controversy Emerges. From the outset, a handful of bioethicists and public interest groups voiced hypothetical concerns about the risks of offering genetic testing to Berkeley’s freshmen. The Council for Responsible Genetics greeted the program’s launch with a letter to the University (pdf) that warned that genetic information “has the risk of being used out of context in ways that are contrary to the interests of the individual, perhaps even discriminatory and certainly privacy invasive.” Similarly, an article in The New York Times featured Boston University bioethicist George Annas, who posed the following hypothetical:

What if someone tests negative [for alcohol metabolization], and they don’t have the marker, so they think that means they can drink more? Like all genetic information, it’s potentially harmful.

Finally, the Center for Genetics and Society linked the Berkeley program to contemporaneous developments in direct-to-consumer (DTC) genetic testing, and warned that “students might think, ‘Berkeley gave it to us. It must be good. UC Berkeley would never be giving its incoming students anything bad or controversial.’”

In short order, what began as an innovative approach to introduce incoming students to genetics and personalized medicine by offering those students the opportunity to personalize their experience quickly became a controversy.

From Controversy to Regulation. Controversial educational initiatives are hardly new. Indeed, they are part of the mission of many institutions of higher education, including Berkeley. In responding to initial criticisms of the program (pdf), the University emphasized that “provoking a free and open discussion about issues surrounding genetic testing is an important aspect of educating our students to be informed citizens.”

Unquestionably, there is considerable value in subjecting all forms of innovation to close scrutiny. In fact, in any Common Rule-governed human subjects research, this is a requirement. Among the many criteria for IRB approval of a human subjects research project is the requirement that “risks to subjects are reasonable in relation to anticipated benefits.” The provision of informed consent is a separate, and similarly important, prerequisite to approval. Berkeley’s own IRB reviewed the University’s project, applied these and other statutory criteria, and ultimately approved the project.

Despite not being legally required to do so, Berkeley actively engaged with the program’s critics from the outset. A program that was vetted internally was now being vetted by the public, with the University’s active participation. In response to public feedback the University modified the project to clarify the project’s voluntary nature, the informed consent process and its separation from actual or perceived industry conflicts of interest.

Critics of the Berkeley program, however, were not satisfied. They continued to urge first the University and then California legislators to much more dramatically alter the program, or even to discontinue it entirely. The constant stream of criticism had an impact. Over the course of the summer, legislation was introduced that would have halted the program. That was followed by legislative hearings to debate the program’s merits and, ultimately, by the CDPH ruling that effectively ended the program in its originally-proposed form.

The rapid reaction of regulators to a debate that was largely driven, especially initially, by media reports, “expert” commentary and social media discourse was strikingly reminiscent of another mid-May personal genomics development.

The week before Berkeley’s program was announced, DTC genetic testing company Pathway Genomics and drugstore giant Walgreens announced a partnership that would have made Pathway’s consumer genetic test available through Walgreens’ stores. In Pathway’s case, the leap to controversy was even swifter: the initial story in The Washington Post describing the agreement warned of a “Pandora’s box of confusion, privacy violations, genetic discrimination and other issues.” Nonetheless, the end result was the same as regulators quickly stepped in and demanded changes. Rather than the CPDH demanding physician intervention and a clinical lab, in Pathway’s case it was the FDA declaring the product in question a medical device in need of a time-consuming and expensive medical device clearance or approval. In both cases, swift regulatory action effectively quashed the proposed activity.

Why Debating Personal Genomics is Difficult. Recent developments suggest that innovation in personal genomics is an increasingly difficult undertaking. In addition to the Berkeley and Pathway cases, examples include the FDA’s increased oversight of DTC genetic testing companies (in addition to Pathway), the GAO’s report on the perils of DTC genetic testing and, most recently, criticism of the University of Minnesota’s attempt to bring genetic research to the State Fair. Collectively, this suggests the emergence of a disturbing trend: developments in the area of personal genomics that deserve serious public debate are shaped from the outset by commentators, policymakers and lawmakers more concerned with making a point than with advancing the conversation.

Of course, it is hardly news that emerging areas of science and controversy generate controversy. In recent weeks, the safety and desirability of human embryonic stem cell research has sparked a heated public debate, just as it has at regular intervals for the past decade. The new dynamic facing personal genomics is the rapidity and ease with which any initiative may be branded as “controversial,” combined with the willingness of lawmakers and regulators to intervene directly and rapidly in such “controversial” activities. This may be as much a function of new paradigms in media, politics and public discourse as it is a function of personal genomics itself, but whatever the reason the concern is that it is having a chilling effect on innovation throughout the field.

On the commercial side, the effects of increasing regulatory uncertainty are evident, as businesses and investors are considering abandoning personal genomics or moving their operations – and attendant jobs and capital – overseas. On the research side, similar confusion – particularly in light of the Berkeley program’s fate – continues to discourage researchers from exploring innovative approaches that might help to accelerate our attempts to decipher genetic complexity and, ultimately, provide us all with more effective, less expensive health care.

Whatever the context, there can be no substitute for careful, public and reasoned debate when it comes to evaluating the appropriateness of a new personal genomics proposal. Similarly, there is no substitute for fully informed consent; for ensuring that all individuals – whether they are students, patients or consumers – understand the full extent of the risks attached to a decision to participate in a personal genomics activity. Both are critical in assuring that personal genomics is conducted in a responsible fashion.

But public debate and informed consent require more than an ability to enumerate hypothetical risks. When it comes to evaluating innovative personal genomics proposals, all of us – participants, funders (including taxpayers), media and commentators and, especially, policymakers and regulators – owe a duty to be thoughtful and balanced in assessing their merits. To be blunt, it requires all of us to do more than throw darts at the easiest targets.

This means understanding that it is not enough to simply enable public debate between those with opposing views on the merits of a particular project. It means recognizing that all innovation – scientific, technological, commercial, research, educational, etc. – carries with it a measure of uncertainty, but that uncertainty alone is an insufficient reason to slam on the brakes. It means acknowledging the difference between hypothetical or low-probability risks and actual, documented harms, and recognizing that the first step should be determining which is which. And most importantly of all, it means considering the benefits of innovation in personal genomics that accrue in addition to – and often because of – its risks.

This is not an easy task. Particularly in a field such as personal genomics, which is driven by new and often untested scientific knowledge and technology, it is trivial to examine a new idea and find something that could conceivably go wrong. Is it possible that a freshman tested for a genetic variant associated with alcohol flush reaction could interpret a negative result as a license to consume alcohol in excess? Of course it is possible, for the bar of “possibility” is exceptionally low. It is much more difficult to convert hypothetical risks into actual data on behavior (i.e., do individuals act to their detriment as a result of non-clinical genetic testing in general, and specifically in the case of the alcohol flush variant?), and more difficult still to balance such risks against the benefits of the same activity.

Keeping Our Heads. Realizing the promise of personal genomics will be impossible unless our society is willing to accept some measure of uncertainty and, yes, risk-taking. Our challenge is to figure out not only when the benefits of personal genomics outweigh its risks, but also who should be permitted to make that frequently difficult and personal risk-benefit decision, and in what contexts.

For those who would place that decision in the hands of individuals, there can be no question that we must first provide those individuals with the necessary information and perspective to make an informed decision. But the process of informing personal genomics participants – of informed consent – no matter how thoughtful and comprehensive, can only take us so far. The information will never be complete, the perspective will never be perfect, and the decision will never be without risk.

It is true, too, that there are many situations where society examines the risks associated with a particular activity and decides that they are simply too high – whether to the individual or to society as a whole – to be assumed, even knowingly and voluntarily, by the individual. We do not, for instance, let teenagers consume alcohol. We place restrictions on the acquisition or use of all manner of technologies, from automobiles to firearms. We require regulatory approval and a doctor’s prescription for most pharmaceuticals.

But as a society we also evince a deep respect for autonomy, leaving many risky decisions in the hands of individuals. The decision to drink alcohol or drive a car in the first place (assuming one is of legal age), to become pregnant (and even to terminate a pregnancy) and to provide informed consent to participate in scientific research: all of these decisions we leave in the hands of individuals.

We have not yet determined whether personal genomics is more like the decision to conceive a child– a personal decision free from state intrusion – or the decision to undergo chemotherapy – a personal decision highly regulated by the state. In a field with a landscape as diverse and rapidly-changing as personal genomics, the answer will frequently depend on context. Some aspects of personal genomics (e.g., genetic testing to determine a proper therapeutic treatment) warrant a greater degree of societal intervention than others (e.g., genetic testing to determine geographic ancestry).

The challenge is knowing where to draw that line. The risks posed by automobiles, firearms and pharmaceuticals are well-documented whereas, at least for the moment, the risks of personal genomics remain largely hypothetical. In the absence of clear data, the recent trend to deemphasize the benefits of personal genomics while focusing on its risks, and to use those risks as  justifications to shift control away from the individual, should cause us all to question whether we are drawing that line in the proper place.

If personal genomics is ever to live up to its name, at some point we must allow individuals – including the future leaders of our society, as embodied by Berkeley’s incoming freshmen – to decide for themselves whether and how to participate. To do otherwise, and to continue to aggressively criticize and thereby discourage personal genomics innovation in our zeal to render it a riskless enterprise, would be a mistake.

Meggan Bushee is a student at the

This past May, Congressman Patrick Kennedy (D-RI) and Congresswoman Anna Eshoo (D-CA) re-introduced a personalized medicine bill to the U.S. House of Representatives. The bill was originally introduced in 2006 by then-Senator from Illinois Barack Obama. While HR 5440, also known as the Genomics and Personalized Medicine Act of 2010 (GPMA 2010), has retained the name of the bill originally introduced by Senator Obama, its approach to the regulation of personalized medicine has taken a new direction.

GPMA 2010 is the fourth version of the GPMA since the original bill of 2006, and includes the most ambitious initiatives of all of its predecessors. Why has the GPMA re-surfaced after three prior versions failed to make it out of committee? According to Representative Kennedy, the bill has been re-introduced in response to increased public awareness and use of genomic tests. At present, GPMA 2010 is before the House Committee on Energy and Commerce. This is the same committee that recently conducted high-profile hearings to review the current state of the direct-to-consumer (DTC) genetic testing registry.

As the tools of personalized medicine, including genetic testing, have become both less expensive and more powerful, calls for expanded oversight of the field have intensified, particularly in the area of DTC genetic testing. While there is a pressing need for appropriate regulation to protect the consumers and patients targeted by personalized medicine, there is an equally pressing need to avoid crafting a system of oversight that will be an obstacle to continued growth and innovation. The current version of the GPMA aims to strike a balance between consumer protection and flexibility to allow for innovation.

This post outlines the material provisions of GPMA 2010 and examines the transformation the bill has undergone since it was first introduced in 2006.

The GPMA Defines Itself. The stated aim of the Genomics and Personalized Medicine Act is:

To secure the promise of personalized medicine for all Americans by expanding and accelerating genomics research and initiatives to improve the accuracy of disease diagnosis, increase the safety of drugs, and identify novel treatments, and for other purposes.

Interestingly, GPMA 2010 is the first iteration of the GPMA to formally define the term “personalized medicine.” However, the bill limits its definition of “personalized medicine” to:

any clinical practice model that emphasizes the systematic use of preventive, diagnostic, and therapeutic interventions that use genome and family history information to improve health outcomes.

It’s a broad definition, but is it broad enough? Conspicuously absent from the definition is any mention of environmental information, a category that is increasingly recognized as critical to the understanding and management of complex and common traits and diseases.

Despite its narrow definition of personalized medicine, GPMA 2010 includes several expansive initiatives. GPMA 2010 would appropriate $150 million for fiscal year 2011 to accomplish these initiatives, including the creation of an Office of Personalized Healthcare and several committees to address translational challenges of personalized medicine, the standardization of the collection of human biological samples, the funding of further research and education on personalized medicine, and the creation of a national biobank.

In order for those initiatives to bear fruit, the GPMA, should it proceed, is likely to find itself in need of a similarly expansive definition of personalized medicine.

The OPH: Coordinating Personalized Medicine. GPMA 2010 would create an Office of Personalized Healthcare (OPH) within the Department of Health and Human Services (HHS). The OPH would have two main roles: (1) to oversee the implementation of GPMA 2010’s initiatives, and (2) to coordinate the activities of various federal agencies and private and public entities. To fulfill these roles GPMA 2010 would appropriate $5,000,000 for fiscal year 2011, and “such sums as may be necessary” for later years.

The OPH is a new addition to the GPMA since its previous version in 2008. Prior to GPMA 2010, the GPMA provided for the establishment of an Interagency Working Group (IWG), an initiative that was first introduced in the 2006 bill. The IWG had goals similar to those of the OPH, but had few specific responsibilities. The IWG was mainly responsible for meeting twice a year and submitting a report every two years on IWG activities. The OPH, on the other hand, would be more directly involved in directing the expansion and acceleration of research, and signifies a large departure from all prior GPMA bills.

Among other responsibilities, the OPH would be tasked with the development of a long-term plan to accelerate the research and development of personalized medicine products. Each year the OPH would issue a report discussing not only progress within personalized medicine research, but also the challenges that the OPH has identified and is currently addressing. This provides a case in point for how the narrow definition of “personalized medicine” in the bill might affect the implementation of the GPMA. To use our example, if the role of environmental factors is not included in the definition, the OPH’s long-term plan might not take adequate account of the need to utilize environmental data in developing effective personalized medicine products.

Importantly, as presently drafted, the OPH would also be responsible for recommending which personalized medicine products should be regulated, and what roles and responsibilities should be assigned to the Food and Drug Administration (FDA) as opposed to the Centers for Medicare & Medicaid Services (CMS). Presumably this would include weighing in on areas where those two agencies’ regulatory authority appears to overlap, including the regulation of laboratory developed tests. Here again, the act’s definition of “personalized medicine” makes a difference.

GPMA 2010 recognizes the need for greater cross-agency coordination and for a centralized task force to direct the implementation of GPMA initiatives. One ongoing concern is that the development of personalized medicine and its translation to clinical practice will be hampered by redundant and inconsistent oversight at the hands of multiple, overlapping regulatory bodies. The OPH would address this concern, at least in theory, by assigning regulatory authority for personalized medicine products, clarifying and simplifying existing regulations, and providing a clear delineation between the roles and responsibilities of the FDA, CMS and other regulatory agencies. The key question, however, is whether adding a new agency (OPH) to the personalized medicine mix would bring much-needed coordination and strategic vision to the field, or whether it would simply add another layer of confusion and bureaucracy.

A National Biobank. Similar to the biobank initiatives in all three previous versions of the GPMA, GPMA 2010 would create a national biobank to collect and integrate human biological specimens and biobank data. As defined by GPMA 2010, “biobank data” includes health information, demographic genotype, molecular profile data, and (despite being excluded from the definition of “personalized medicine”) environmental data.

If implemented, GPMA 2010’s national biobank would not be the first of its kind in this world. Several countries, including the United Kingdom, Japan, Sweden, Finland, and Iceland have already undertaken similar biobanking initiatives. While the United States has many smaller public (at both the state and federal level) and private biobanks, the GPMA would authorize NIH to coordinate the first truly national biobank. Depending on how swiftly the biobank was created, and whether it incorporated samples from previously existing public or private biobanks, it might quickly become one of the largest repositories of biological specimens and data in the world.

While the implementation of the biobank would be left to the Director of the NIH (currently Francis Collins), working in coordination with the Centers for Disease Control and Prevention (CDC), GPMA 2010 does provide a basic framework. The Director of NIH would be responsible for coordinating the activities of the national biobank with the other public and private biobanks and genomic databases in the United States and developing guidelines to “safeguard[] the privacy of…biobank data.” The Director would also be tasked with addressing ownership and patient access issues and investigating new models of informed consent that balance privacy, risk disclosure and the need for long-term and open-ended research, a task that has recently been shown to be particularly challenging.

One inevitable challenge in implementing a truly national biobank populated with broadly characterized specimens will be funding. To establish the national biobank and fund a related grant program, GPMA 2010 would appropriate $150,000,000 for fiscal year 2011, and “such sums as may be necessary” for later years. While the biobank’s data and specimens would be made available to both government and non-governmental entities, it is unclear whether non-governmental entities would bear some portion of the cost of the biobank.

Is $150 million and the vague promise of more to come sufficient for a biobank of such ambition? By way of comparison, while the initial appropriation, as currently drafted, would be larger than the amount used to catalyze the UK’s national biobank in 2006, which collected £62 million from a variety of funding sources, including the Wellcome Trust, the UK’s largest non-governmental source of biomedical funding. For the GPMA’s national biobank to succeed, similar private funding commitments might well be a prerequisite.

The various incarnations of the GPMA have fluctuated in their treatment of race. The 2006 GPMA had an entire section dedicated solely to “Race and Genomics,” and included several initiatives aimed at including minority populations in genomics research and in improving minority populations’ access to genetic services. The 2010 bill lacks the separate section, but does instruct the Director of the NIH to develop guidelines to “ensure the inclusion of underrepresented populations with health disparities in the activities of the national biobank.” That is itself a departure from the 2008 version of the GPMA, which did not specifically mention minority or underrepresented populations at any point. The role of minority or underrepresented populations in genomic research, and the appropriateness of personalized medicine tools and products for minority or underrepresented populations, was an issue that came up several times at last month’s Congressional hearing on DTC genetic tests, and it is one that would be likely to play a central role in any future Congressional discussion of the GPMA and a national biobank.

The GPMA and DTC Genetic Testing. GPMA 2010 directs the FDA to collaborate with the FTC to “identify and terminate…advertising campaigns that make false, misleading, deceptive, or unfair claims about the benefits or risks of products used for personalized medicine.” While similar consumer protection provisions existed in prior versions of the GPMA, the scope has been expanded in the current version of the bill to apply to advertising and marketing of any personalized medicine product (previous versions focused solely on genetic tests).

Events may have overtaken this proposal, however. Last month’s Congressional hearing and GAO report (pdf) highlighted “misleading test results” and “deceptive marketing and other questionable practices” on the part of DTC genetic testing companies. The report was forwarded to the attention of both the FDA and the FTC and, in its aftermath, it seems unlikely that it will take the passage of new legislation for those two agencies to begin working together to more aggressively police the personalized medicine marketplace.

Interestingly, a separate provision of GPMA 2010 would instruct the CDC, the FDA and the FTC to work together to “conduct an analysis of the public health impact” of “products used for personalized medicine (including genetic and genomic tests) for which consumers have direct access” and to do so “to the extent possible from available data sources.” The joint agency initiative would also “analyze the validity of claims made in [DTC] marketing” and “make recommendations…regarding necessary interventions to protect the public from potential harms” of DTC marketing and access to personalized medicine products. While such an undertaking might appear redundant with the GAO’s recently-concluded investigation, the GAO’s report was an admittedly unscientific snapshot of the field (“GAO did not conduct a scientific study but instead documented observations that could be made by any consumer.”), for which it has been frequently criticized. While a more comprehensive and data-driven analysis of the field would be welcome, recent events suggest that agencies such as the FDA are likely to proceed with additional DTC regulatory oversight on the basis of the data (or lack thereof) currently at hand.

Expanding the Role of Companion Diagnostics and Pharmacogenomics at the FDA. Another provision targeted at the FDA would permit the agency, under certain circumstances, to “require the sponsor of a drug or biological product” (emphasis added) to develop a companion diagnostic test in connection with regulatory filings for a new drug. This provision was originally included in the 2006 bill, but was removed in the 2007 and 2008 versions. Those versions merely permitted the FDA to recommend companion diagnostic development to drug and products sponsors.

The 2010 GPMA also instructs the FDA to “clarify and issue guidance” that explains when companion diagnostics will be included in labeling – including appropriate “standards of evidence…such as with respect to the analytical validity, clinical validity, clinical utility, dosing, adverse events, and drug selection…” – and when such tests will be either recommended or required.

In many respects these provisions of the GPMA seem to reflect the increasing reliance on genomic and genetic data in selecting and administering therapeutics, including the use of companion diagnostic tests.

Where Will the GPMA Go From Here? While GPMA 2010 itself represents a significant departure from the bill originally introduced by Senator Obama in 2006, it is exceedingly unlikely to become law in its current form. Among other considerations, the recent (and ongoing) developments in the areas of laboratory developed tests (LDTs) and DTC genetic testing – two important components of personalized medicine – suggest that substantial revisions would be required to reflect an ever-changing technological, commercial and regulatory environment.

At least for the moment, passage of the GPMA in any form does not appear to be imminent. Perhaps it will never become law – at least in anything like its current form – and either existing legislation or other contenders, such as Senator Hatch’s proposal to create a new regulatory category for “advanced personalized diagnostics” – will be used to fill gaps in the oversight of personalized medicine products. Then again, recall that crafting legislation to respond to the successes of modern science and technology can be a painfully slow process. For instance, the only piece of federal legislation specifically directed at genetic technologies and information, the Genetic Information Nondiscrimination Act (GINA), took thirteen years from the date it was first proposed to its signing into law in 2008. After a mere five years, the GPMA likely has a long way to go.

The research began two decades ago, ostensibly to search for a genetic variant that might be contributing to the increasing rate of diabetes in the tribe. The diabetes research proved unfruitful, but the blood donated by the Havasupai tribe members, and the DNA extracted from it, led to a number of follow-on research projects, grants and publications. It was that research – including searching tribe members’ DNA for variants linked to schizophrenia, and inferring the likely ancestral origins of the tribe’s founders – that led to lawsuits, millions in legal fees and, ultimately, the settlement.

Implications of the Havasupai Settlement. Harmon’s article provides a concise background to the dispute, and briefly describes the $700,000 settlement between ASU and the tribe to “remedy the wrong that was done.” Harmon and unnamed “legal experts” suggest that the settlement is significant because “it implied that the rights of research subjects can be violated when they are not fully informed about how their DNA might be used.”

In some respects, this is a trivial conclusion. One of the most important and well-known elements of the Common Rule – the regulatory regime that governs federally-funded human subjects research – is that researchers must seek, and participants provide, informed consent. Participants that are uninformed cannot provide valid consent and, thus, their rights as subjects are violated. In that respect, at least, the Havasupai case tells us nothing new. (I have not seen the settlement, but I doubt that it will (a) be made public or (b) contain an express admission of guilt from ASU, both factors that will limit its relevance to future similar scenarios.)

But the Havasupai case and Harmon’s article shine light on an important, and difficult, problem that continues to face scientific researchers, particularly those exploring human genetic variation: what does it really mean to provide “fully informed” consent for genomic research?

Fully Informed Consent? Looking at the text of the Common Rule, there are requirements that the researchers describe the nature and purposes of the research (§ 46.116(a)(1)), as well as both reasonably foreseeable (§ 46.116(a)(2)) and unforeseeable (§ 46.116(b)(1)) risks of participation. But the standard of informed consent that must be achieved is not explicitly spelled out. Is it “reasonably informed,” “substantially informed,” “fully informed” or something else altogether? (Interestingly enough, the language that Harmon uses – “fully informed” – does appear, but only in sections regarding research on pregnant women and fetuses, which is not applicable in this case.) Even if a clearer standard were articulated, how would researchers demonstrate that it had been satisfied?

The requirement of informed consent is part of the bedrock of modern human subjects research in the United States, and it is not going anywhere. In fact, the story of the Havasupai, as well as the tale of Henrietta Lacks (told so remarkably well in Rebecca Skloot’s new book) and other past failures of informed consent, suggest the informed consent requirement is here to stay, as well it should be.

A Difficult Balance. Yet, as we push forward into an era of large-scale, personalized genomic research, it is impossible to ignore the difficulties – legal, ethical and practical – that informed consent requirements impose. For example, truly informed consent for genomic research might require participants to possess a deep – or at least working – understanding of the underlying science. That sets a very high bar, and finding sufficient numbers of participants capable of providing such consent could restrict important research.

Even more daunting, however, is the difficulty of fully informing participants of the benefits and risks of participation in genomic research – particularly where the resultant findings could conceivably be linked back to the individual or, as in the case of the Havasupai, the individual’s community – when the researchers themselves lack this understanding. What genetic information can tell us about disease and other traits, and how this information can be used or misused in the case of individuals, is an area of continuing uncertainty. With the publication of the draft human genome sequence a decade in the rearview mirror, we know more than ever before. But there is still much that we don’t know.

Thankfully, new research models and strategies for seeking informed consent are being developed and tested. For instance, the Personal Genome Project (PGP) – for which I am an advisor, including with respect to the informed consent protocol – employs a model of “open consent.” The PGP focuses on preemptive and extensive risk disclosure, along with rigorous participant pre-screening to ensure that the risks of participation are understood. More broadly, the difficulties of informed consent and genomic research is an issue that the NIH is studying on an ongoing basis, with multiple internal working groups looking at different dimensions of the problem. Nevertheless, informed consent for genomic research poses a considerable challenge for policymakers, funding bodies, researchers and participants, and it is unlikely that any of the existing models represent a perfect approach.

None of this should be taken to mean that informed consent for genomic research is impossible. To admit that would leave us with the unenviable choice of sacrificing either the informed consent of participants or the valuable scientific research they enable. What the case of the Havasupai tribe does underscore, however, is just how difficult a task this is. It is clear that the next generation of personal genomics research will require more than purely scientific breakthroughs. We also need to think creatively about the ethical and legal framework in which such research is conducted, to make sure that it continues to promote scientific progress while protecting the participants – no matter what their background – that make such research possible.

As we’ve written earlier (“Back to the Future: NIH to Revisit Genomic Data-Sharing Policy”), the ability to link – and to share – genotype and phenotype data (including medical records, particularly treatment and outcome data) will be essential to the development of the next generation of genomic research. One of the most common ways to link genotype and phenotype data is to combine genomic data with electronic medical records (EMRs). A particular patient’s EMR may contain everything from basic biographical information to family medical history to current diagnoses, including ICD codes. When it comes to associating genes with medical conditions, researchers rely on International Classification of Disease (ICD) codes to categorize individual patients by disease type and search for shared genetic variations that might play a causal role.

Cracking the Codes. Obviously identifying information (e.g., biographical information) is generally required to be removed pursuant to HIPAA regulations. ICD codes, however, are sometimes retained for purposes of genetic association research and, in some circumstances, a set of otherwise anonymous ICD codes pulled from an EMR can be traced backwards to identify the specific individual supplying the codes.

The new research from Loukides et al., a team which includes data privacy pioneer Bradley Malin, recognizes the potential for genomic privacy risks created by linked genotype-phenotype datasets. Loukides and his colleagues propose a mechanism for modifying such datasets to eliminate one route to individual re-identification while retaining enough information to make the data useful. From the abstract:

This work proposes an approach that provably prevents this type of data linkage and furnishes a result that helps support GWAS. Our approach automatically extracts potentially linkable clinical features and modifies them in a way that they can no longer be used to link a genomic sequence to a small number of patients, while preserving the associations between genomic sequences and specific sets of clinical features corresponding to GWAS-related diseases. Extensive experiments with real patient data derived from the Vanderbilt’s University Medical Center verify that our approach generates data that eliminate the threat of individual reidentification, while supporting GWAS validation and clinical case analysis tasks.

The approach from Loukides et al. involves (i) designating individual-level medical data that are potentially identifiable (the ICD codes) and then (ii) modifying the data in such a way that they no longer pose a risk of re-identification. The team’s approach combines a privacy policy (determined by reference to the size of subsets that can be created using the ICD codes) with a utility policy (a set of diseases that can be categorized by combining various ICD codes without overly distorting the phenotypic information those codes represent) to construct a dataset that “provides provable protection from individual reidentification based on clinical features” while enabling important GWAS research.

A Balancing Act. The primary reason why genomic privacy even presents as an issue, of course, is that most individuals are uncomfortable publicly sharing their genomic and medical data. Although some “information altruists” agree to waive their privacy rights and participate in research projects – most notably the Personal Genome Project, which employs a fully public data release and consent model – most genomic research, and particularly research that combines genomic and other medical data, is premised upon some level of privacy for the participants.

The fundamental tension is how to balance individual desires for privacy with a collective interest in employing linked genotypic and phenotypic data to advance scientific understanding and, ultimately, provide improved medical care to individuals. Pure privacy – or sharing no data that could possibly be re-identified – is an untenable solution, because it is impossible. On the other hand, requiring participants to waive all privacy rights is equally untenable because it would, in all likelihood, dramatically restrict the available pool of research participants. (And, as The Wall Street Journal reported today, patients may lie to their doctors if they believe their EMRs will ultimately be shared without appropriate privacy protections, behavior that would hamper both research and medical care.)

Viewed in light of this ever-present tension, the model proposed by Loukides et al. should be applauded for its contribution to the continuing project of striving to balance the conflicting desires of robust individual data privacy and broad access to linked medical and genomic datasets. As Malin puts it: “Generating data is expensive, and it’s both good science and good etiquette to reuse data. The challenge is to do it while protecting people.”

By seeking to block a significant path to re-identification (even if it is impossible to eliminate all possible re-identification scenarios) while preserving the utility of the published data, the approach put forth by Loukides et al. can provide needed comfort to researchers, institutions and participants considering the publication of linked genotype-phenotype datasets. After all, simply because data might be identified does not mean that it need be easily identifiable, and in many research settings robust privacy protection mechanisms will continue to serve a critical function.

Teri Manolio, director of the Office of Population Genomics at the NHGRI, agrees that the team’s approach shows promise. “It does a good job of trying to maximize the information shared while minimizing the risk for re-identification, recognizing that these goals are in dynamic tension and both cannot be fully met at the same time.” Encouraging words from an agency that has struggled to strike the proper balance between privacy and access when it comes to genomic data.

One Kind of Re-Identification. Whether the Loukides method will be adopted remains to be seen, and a technical analysis of the algorithm is beyond the scope of this article. Either way, while the approach described by Loukides and his team – if validated – appears promising, it is important to emphasize that this particular privacy protection mechanism addresses only one pathway of genomic data re-identification. Even if the Loukides et al. method “eliminates the threat of individual reidentification” using statistical measures applied to certain linked genotype-phenotype datasets, researchers have recognized that re-identification can occur in a variety of ways.

As George Church pointed out, one of the most prevalent forms of re-identification occurs through accidental or intentional releases of data that were never intended to be public, such as the data breaches tracked by the Privacy Rights Clearinghouse. Such unintended data releases could, at least in theory, compromise otherwise secure datasets. Re-identification is thus unlikely to be a risk that is ever susceptible to complete elimination. (For a more complete discussion of this issue, see our previous post, “Re-Identification and its Discontents.”)

The Genomic Privacy Two-Step. Loukides and his colleagues recognize that they are providing only a partial solution, and note that genomic privacy tools such as theirs are only effective when applied in an appropriate fashion. As the authors point out, “as is true of all data anonymization methods, our approach leaves the decision of selecting a suitable privacy protection level…to data owners or policy officials.”

Furthermore, striking a sensible balance between privacy and access is only the first step in developing a responsible approach to privacy in genomic research. Researchers and institutions must also be sure to communicate the relevant trade-offs to those individuals whose data will be used in the research, to ensure that they understand – and agree with – whatever risk of identification has been deemed appropriate to the proposed research.

Tackling both prongs of genomic privacy – the risk of re-identification and accurate communication of that risk – is necessary to ensure that the next generation of genomic research is conducted in a way that is technically robust, as well as ethically, legally and socially responsible.

Contributed by

In late February, the state of Texas incinerated 5.3 million newborn bloodspots.

The background – the Genomics Law Report has had several posts (here and here) about the ongoing situation involving 5.3 million newborn bloodspots in a state biorepository in Texas. Often referred to as “residual” bloodspots, these are the tiny dried bloodspots left over after states conduct mandatory screening for specified diseases. State practices regarding retention of the residual bloodspots vary widely, with some destroying them promptly and others storing them indefinitely. Where post-screening use of the bloodspots occurs, the most common use is for quality assurance and quality control of the screening tests. Some states also permit the release of small sets of bloodspots for research.

Any such research must be done in compliance with the federal Common Rule applicable to clinical research and HIPAA, the federal medical privacy law. To simplify these laws’ complex requirements – what researchers must do depends on whether the samples or information will be made available in an identifiable or de-identified form. If a researcher receives identifiable information, then informed consents, privacy authorizations, and Institutional Review Board (IRB) reviews are mandatory. If the researcher receives only de-identified samples or information, no parental consent or privacy authorizations are required, although some states, including Texas, still insist on IRB review.

In the case of Texas, newborn bloodspots were collected and retained since 2002, building up a repository from 5.3 million children. Between 2002 and 2009, the Department of State Health Service (DSHS) provided 8350 de-identified samples to researchers – 0.16% of the total samples available. DSHS did not obtain parental consent for the distribution of these 8350 samples, as it was not required for de-identified use, although it did conduct an IRB review for each project. The research projects included studying the genetic causes of deafness to investigating inherited immune disorders, as listed on a DSHS web page describing research disclosures and uses. In the very small number of cases where identifiable research was conducted (200 out of 5.3 million), the state obtained prior consent from the parents, as required by research and privacy laws.

As Adam Doerr discussed in a post on February 2, the Texas Civil Rights Project brought a class action against the state in March 2009 on federal constitutional grounds, alleging that the retention and use of the samples without parental knowledge or consent was an illegal search and seizure. The plaintiffs did not allege privacy law violations. Meanwhile, the state legislature passed a bill enacting an opt-out program applicable to babies born after May 2009. After the state failed to win a motion to dismiss, it settled the case with the plaintiffs in December 2009, agreeing, among other things, to destroy all bloodspots collected before the new opt-out law.

Allison Williams Dobson’s post on March 1 updated readers on the ensuing developments. A Texas news site reported that 800 samples had been sent to a federal Armed Forces mitochondrial DNA database used to help categorize the ethnicity of missing persons’ remains. Department emails revealed that the state had considered publicizing its agreement witha state university for the long-term storage of the bloodspots, but chose not to do so out of concerns about public sensitivity. The plaintiffs’ attorney, Jim Harrington, was furious, a key state legislator felt he had been misled by the omission, and sharp criticisms were traded among the attorneys on both sides.

The bottom line – the destruction of the bloodspots proceeded on schedule.

This unfortunate outcome represents an incalculable loss to the research community and, through their work, to the individuals and families who are waiting for breakthrough treatments for diseases. Realizing what a loss this would be if it couldn’t be prevented, an ad hoc coalition came together in January to try to reach a compromise solution and save the bloodspots. Genetic Alliance, a national nonprofit dedicated to advancing health through genetics, for which I serve as Senior Counsel, brought together privacy advocates, University of Texas researchers, prominent Texans, and technology companies that offer online consent management and biospecimen management services, to try to quickly craft a solution whereby the bloodspots could be saved and parents could be offered meaningful consent options. We fashioned a coordinated program involving not only parental consent tools but also public education on the medical advances that could be achieved if parents allowed their children’s blood to be used in research. The coalition was seeking outside philanthropic funding so that the state would bear no additional cost.

Somewhat surprisingly, we quickly succeeded in reaching preliminary agreement with the plaintiff’s attorney, who was amenable to amending the settlement to postpone the destruction of the bloodspots if progress was being made on a parental consent mechanism. Our team also had numerous encouraging conversations with key legislators who hoped for such a compromise. DSHS, however, declined to open the settlement and postpone the destruction, citing their concern that any further disruption might jeopardize the viability of the newborn screening program intended to protect babies’ immediate health. We were, frankly, hopeful that we might be able to persuade DHSH to change its mind.

But then the story about 800 bloodspots being sent to the federal forensics database ran online. Even though those samples were de-identified and sending them was thus permissible under privacy and research laws, the uproar that followed poisoned the atmosphere in Texas. Tempers flared, accusations flew, the blogosphere of people suspicious of government exploded, and in the words of state Senator Duell, “if there was any way the bloodspots were going to be saved, the whole thing fell apart at that point.”

What can we learn from this highly unfortunate outcome? Among the lessons is that when angry and anxious parents confront state health departments who are trying to run public health programs, we should not be surprised that the long-term interests of research and scientific advances are ignored altogether. Neither parents who would have wanted their children’s bloodspots to be saved and used in research, nor countless parents who are eagerly waiting for the discovery of tests and treatments for their children’s conditions, had any voice whatsoever in the litigation or the public policy decision-making. Likewise, researchers who could have defended the tremendous medical benefits expected from their research played no part. Decisions were made under pressure and stress that simply did not reflect a broad spectrum of society’s interests. In addition, this sad case reveals that the status quo of widespread public ignorance about newborn screening and residual bloodspot uses has a high potential for erupting into acrimony and ill-advised decisions. Ignoring parents’ desires for more knowledge and decision-making will continue to put these bloodspot biorepositories – a national treasure trove for research advances – at peril. Surely, we can do better than this.

Contributed by 

The Texas Department of State Health Services (DSHS) could soon face a new federal lawsuit in light of the discovery that it sent 800 anonymous newborn blood samples to a U.S. military DNA lab in 2003 and 2007. As discussed in a post by Adam Doerr on February 2, Texas Civil Rights Project lawyer Jim Harrington successfully negotiated a settlement in 2009 to have DSHS destroy 5.3 million newborn blood samples because it did not obtain informed consent from parents to use the samples for research. Now DSHS has come under criticism over samples it had already released for approved research.

The Texas Tribune reported last Monday under the headline “DNA Deception” that its review of nine years’ worth of e-mails and internal documents, obtained under state sunshine laws,¹ revealed a DSHS agreement to help the military build a national mitochondrial DNA (mtDNA) database. The Armed Forces DNA Identification Laboratory claims a legitimate research purpose for the newborn DNA samples—to improve the identification of missing person remains through analyses of highly stable mtDNA.² Because mtDNA generally lasts longer in a wider variety of tissues than nuclear DNA, it is also more likely to be recovered from particularly old or decayed remains.

Worse than the discovery of the mtDNA project, in further allegations reminiscent of “climategate,” the Tribune claimed that the communications evidence demonstrates an effort by DSHS “to limit the public’s knowledge of aspects of the newborn blood program, and to manage the debate around it.” According to the Tribune, the e-mails demonstrate that “in 2003, when the agency started to release blood spots for outside research, officials knew they had a parental consent issue on their hands—but tried to avoid it.” For example, the Tribune’s web site reproduces an e-mail from a researcher arguing against a press release describing the research (pdf): “This makes me nervous. Genetic privacy is a big ethical issue & even though IRB approval is required for use of the spots in most situations and great care is taken to protect the identity of the spots, a press release would most likely only generate negative publicity.” 

Public perception of science could sustain further damage from the exposure of scientists or their advocates trying to keep quiet about what they were doing because they thought the public would not approve. In response to the new information, Harrington has alleged bad faith on the part of DSHS during the earlier settlement negotiations. He threatened a follow-up lawsuit over the military research use, based on DSHS denials during the negotiations of any “law enforcement” access to the samples.³

It is unclear what relief plaintiffs would be seeking in a new suit. DSHS is already required to destroy the samples and has stated that it will not ask researchers to return samples already released for research. The researchers are obligated to destroy the samples when their studies are completed. Still, these developments serve as yet another reminder that scientists and supporting policy makers need to do a better job of maintaining honest and open dialogue with the public about their research activities.

_______________________________

          ¹ State Sunshine Laws: The Public Information Act of Texas is a series of laws designed to guarantee that the public has access to public records of government bodies at all levels in the state. Texas Government Code, Chapter 552, was enacted in 1993 and has been amended several times since. It gives citizens the right to access records at various levels of Texas government, without a requirement to declare the purpose for reviewing those records.

          ² Human mtDNA is a small circular molecule – only approximately 16.5 thousand bases of sequence as compared to millions of bases of sequence in each of the linear nuclear chromosomes. Much of the mtDNA sequence is identical for all humans, but there are two short hypervariable regions that may be used to identify ancestral origins, as noted by DSHS spokeswoman Carrie Williams. The inheritance of mtDNA is maternal, and in the 1990s a team of British scientists famously exploited this property, along with the strict paternal inheritance of the Y chromosome, to discover a very high probability that Thomas Jefferson fathered at least one of the children of his slave, Sally Hemings. Nature. 1998 Nov 5;396(6706):27-8. Jefferson fathered slave’s last child.

          ³ Reasonable people might disagree about whether the stated goal of identifying human remains constitutes a “law enforcement” purpose. DSHS spokeswoman Carrie Williams explained, “Our understanding of mtDNA is that it’s not used to pinpoint exactly who a person is, but can help determine origins.” She also contended that their “intentions were good ones,” and pointed out in another report that the project has been listed on the DSHS website for weeks.

Since that time, Australia’s National Health and Medical Research Council (NHMRC) has tackled the same issue, publishing new privacy guidelines for health practitioners on the disclosure of genetic information (pdf).

In each case, the basic thrust of the guidance for medical practitioners is the same – there are certain circumstances where a patient’s genetic information may be disclosed against his or her wishes. However, the guidance from the GMC and the NHMRC does differ in several important respects.

First, while the GMC’s guidance applies to all doctors in the United Kingdom, the NHMRC’s guidance is restricted to Australian doctors in private practice. The NHMRC’s guidance also restricts its applicability to the disclosure of genetic information to living genetic relatives for medical purposes. Disclosures relating to unborn children (e.g., information related to embryos or carrier status), to legal but non-genetic relatives (e.g., adopted children or spouses) or for genetic research are all outside of the scope of the NHMRC’s guidelines. The GMC’s guidelines, on the other hand, contain no such specific limitations, referring only to the practitioner’s responsibility to balance the patient’s interests against those of others, and to disclose genetic or other information when justified in the public interest.

It is that “public interest” standard for disclosure that most clearly distinguishes the GMC’s guidance from the NHMRC’s. The NHMRC’s guidance is quite specific:

Use or disclosure of genetic information without consent may proceed only when the authorising medical practitioner has a reasonable belief that this is necessary to lessen or prevent a serious threat to the life, health or safety of a genetic relative.

(emphasis in original)

Dozens of pages of supplemental guidance help practitioners determine when this standard is satisfied and how to manage involuntary disclosure in the event that it should become necessary.

The GMC’s guidance, on the other hand, is far broader in its application and less detailed in its discussion. The discussion of “genetic and other shared information” is confined to a single page and disclosure is permissible whenever it is “justified in the public interest.” The “public interest” standard, in turn, encompasses much more than the prevention of series threats to genetic relatives, including (i) the prevention of communicable diseases or serious crimes, (ii) the furtherance of medical research and (iii) “education or other secondary uses of information that will benefit society over time.”

Narrower and more fully articulated than the GMC’s guidance, the NHMRC’s guidance arguably strikes a better balance between the harms produced by the unconsented disclosure of a patient’s genetic information and the benefits of that information for the patient’s genetic relatives. Whatever you think of the NHMRC’s guidance, however, permitting doctors to disclose genetic information against their patients’ wishes calls forth many of the same questions raised in Emily Sherlock’s original GLR piece.

In certain circumstances, genetic information possesses indisputable value to a patient’s genetic relatives, as well as individuals that are known to the patient but are not genetically related, including non-genetic family members or caregivers. Its disclosure may even operate to further the nebulous “public interest” referred to in the GMC’s guidance. As genetic information occupies an increasingly central role in our medical care and in our lives, policymakers and legislators worldwide must continue to carefully weigh the benefits of compelled disclosure against competing considerations, including, (i) the importance of patient autonomy, (ii) the genetic relatives’ right not to know certain information, (iii) the potential that individuals will forego valuable genetic testing if they fear their genetic privacy will not be respected and (iv) the difficulty of mitigating risks associated with the disclosure of genetic information.