Meggan Bushee is a student at the

This past May, Congressman Patrick Kennedy (D-RI) and Congresswoman Anna Eshoo (D-CA) re-introduced a personalized medicine bill to the U.S. House of Representatives. The bill was originally introduced in 2006 by then-Senator from Illinois Barack Obama. While HR 5440, also known as the Genomics and Personalized Medicine Act of 2010 (GPMA 2010), has retained the name of the bill originally introduced by Senator Obama, its approach to the regulation of personalized medicine has taken a new direction.

GPMA 2010 is the fourth version of the GPMA since the original bill of 2006, and includes the most ambitious initiatives of all of its predecessors. Why has the GPMA re-surfaced after three prior versions failed to make it out of committee? According to Representative Kennedy, the bill has been re-introduced in response to increased public awareness and use of genomic tests. At present, GPMA 2010 is before the House Committee on Energy and Commerce. This is the same committee that recently conducted high-profile hearings to review the current state of the direct-to-consumer (DTC) genetic testing registry.

As the tools of personalized medicine, including genetic testing, have become both less expensive and more powerful, calls for expanded oversight of the field have intensified, particularly in the area of DTC genetic testing. While there is a pressing need for appropriate regulation to protect the consumers and patients targeted by personalized medicine, there is an equally pressing need to avoid crafting a system of oversight that will be an obstacle to continued growth and innovation. The current version of the GPMA aims to strike a balance between consumer protection and flexibility to allow for innovation.

This post outlines the material provisions of GPMA 2010 and examines the transformation the bill has undergone since it was first introduced in 2006.

The GPMA Defines Itself. The stated aim of the Genomics and Personalized Medicine Act is:

To secure the promise of personalized medicine for all Americans by expanding and accelerating genomics research and initiatives to improve the accuracy of disease diagnosis, increase the safety of drugs, and identify novel treatments, and for other purposes.

Interestingly, GPMA 2010 is the first iteration of the GPMA to formally define the term “personalized medicine.” However, the bill limits its definition of “personalized medicine” to:

any clinical practice model that emphasizes the systematic use of preventive, diagnostic, and therapeutic interventions that use genome and family history information to improve health outcomes.

It’s a broad definition, but is it broad enough? Conspicuously absent from the definition is any mention of environmental information, a category that is increasingly recognized as critical to the understanding and management of complex and common traits and diseases.

Despite its narrow definition of personalized medicine, GPMA 2010 includes several expansive initiatives. GPMA 2010 would appropriate $150 million for fiscal year 2011 to accomplish these initiatives, including the creation of an Office of Personalized Healthcare and several committees to address translational challenges of personalized medicine, the standardization of the collection of human biological samples, the funding of further research and education on personalized medicine, and the creation of a national biobank.

In order for those initiatives to bear fruit, the GPMA, should it proceed, is likely to find itself in need of a similarly expansive definition of personalized medicine.

The OPH: Coordinating Personalized Medicine. GPMA 2010 would create an Office of Personalized Healthcare (OPH) within the Department of Health and Human Services (HHS). The OPH would have two main roles: (1) to oversee the implementation of GPMA 2010’s initiatives, and (2) to coordinate the activities of various federal agencies and private and public entities. To fulfill these roles GPMA 2010 would appropriate $5,000,000 for fiscal year 2011, and “such sums as may be necessary” for later years.

The OPH is a new addition to the GPMA since its previous version in 2008. Prior to GPMA 2010, the GPMA provided for the establishment of an Interagency Working Group (IWG), an initiative that was first introduced in the 2006 bill. The IWG had goals similar to those of the OPH, but had few specific responsibilities. The IWG was mainly responsible for meeting twice a year and submitting a report every two years on IWG activities. The OPH, on the other hand, would be more directly involved in directing the expansion and acceleration of research, and signifies a large departure from all prior GPMA bills.

Among other responsibilities, the OPH would be tasked with the development of a long-term plan to accelerate the research and development of personalized medicine products. Each year the OPH would issue a report discussing not only progress within personalized medicine research, but also the challenges that the OPH has identified and is currently addressing. This provides a case in point for how the narrow definition of “personalized medicine” in the bill might affect the implementation of the GPMA. To use our example, if the role of environmental factors is not included in the definition, the OPH’s long-term plan might not take adequate account of the need to utilize environmental data in developing effective personalized medicine products.

Importantly, as presently drafted, the OPH would also be responsible for recommending which personalized medicine products should be regulated, and what roles and responsibilities should be assigned to the Food and Drug Administration (FDA) as opposed to the Centers for Medicare & Medicaid Services (CMS). Presumably this would include weighing in on areas where those two agencies’ regulatory authority appears to overlap, including the regulation of laboratory developed tests. Here again, the act’s definition of “personalized medicine” makes a difference.

GPMA 2010 recognizes the need for greater cross-agency coordination and for a centralized task force to direct the implementation of GPMA initiatives. One ongoing concern is that the development of personalized medicine and its translation to clinical practice will be hampered by redundant and inconsistent oversight at the hands of multiple, overlapping regulatory bodies. The OPH would address this concern, at least in theory, by assigning regulatory authority for personalized medicine products, clarifying and simplifying existing regulations, and providing a clear delineation between the roles and responsibilities of the FDA, CMS and other regulatory agencies. The key question, however, is whether adding a new agency (OPH) to the personalized medicine mix would bring much-needed coordination and strategic vision to the field, or whether it would simply add another layer of confusion and bureaucracy.

A National Biobank. Similar to the biobank initiatives in all three previous versions of the GPMA, GPMA 2010 would create a national biobank to collect and integrate human biological specimens and biobank data. As defined by GPMA 2010, “biobank data” includes health information, demographic genotype, molecular profile data, and (despite being excluded from the definition of “personalized medicine”) environmental data.

If implemented, GPMA 2010’s national biobank would not be the first of its kind in this world. Several countries, including the United Kingdom, Japan, Sweden, Finland, and Iceland have already undertaken similar biobanking initiatives. While the United States has many smaller public (at both the state and federal level) and private biobanks, the GPMA would authorize NIH to coordinate the first truly national biobank. Depending on how swiftly the biobank was created, and whether it incorporated samples from previously existing public or private biobanks, it might quickly become one of the largest repositories of biological specimens and data in the world.

While the implementation of the biobank would be left to the Director of the NIH (currently Francis Collins), working in coordination with the Centers for Disease Control and Prevention (CDC), GPMA 2010 does provide a basic framework. The Director of NIH would be responsible for coordinating the activities of the national biobank with the other public and private biobanks and genomic databases in the United States and developing guidelines to “safeguard[] the privacy of…biobank data.” The Director would also be tasked with addressing ownership and patient access issues and investigating new models of informed consent that balance privacy, risk disclosure and the need for long-term and open-ended research, a task that has recently been shown to be particularly challenging.

One inevitable challenge in implementing a truly national biobank populated with broadly characterized specimens will be funding. To establish the national biobank and fund a related grant program, GPMA 2010 would appropriate $150,000,000 for fiscal year 2011, and “such sums as may be necessary” for later years. While the biobank’s data and specimens would be made available to both government and non-governmental entities, it is unclear whether non-governmental entities would bear some portion of the cost of the biobank.

Is $150 million and the vague promise of more to come sufficient for a biobank of such ambition? By way of comparison, while the initial appropriation, as currently drafted, would be larger than the amount used to catalyze the UK’s national biobank in 2006, which collected £62 million from a variety of funding sources, including the Wellcome Trust, the UK’s largest non-governmental source of biomedical funding. For the GPMA’s national biobank to succeed, similar private funding commitments might well be a prerequisite.

The various incarnations of the GPMA have fluctuated in their treatment of race. The 2006 GPMA had an entire section dedicated solely to “Race and Genomics,” and included several initiatives aimed at including minority populations in genomics research and in improving minority populations’ access to genetic services. The 2010 bill lacks the separate section, but does instruct the Director of the NIH to develop guidelines to “ensure the inclusion of underrepresented populations with health disparities in the activities of the national biobank.” That is itself a departure from the 2008 version of the GPMA, which did not specifically mention minority or underrepresented populations at any point. The role of minority or underrepresented populations in genomic research, and the appropriateness of personalized medicine tools and products for minority or underrepresented populations, was an issue that came up several times at last month’s Congressional hearing on DTC genetic tests, and it is one that would be likely to play a central role in any future Congressional discussion of the GPMA and a national biobank.

The GPMA and DTC Genetic Testing. GPMA 2010 directs the FDA to collaborate with the FTC to “identify and terminate…advertising campaigns that make false, misleading, deceptive, or unfair claims about the benefits or risks of products used for personalized medicine.” While similar consumer protection provisions existed in prior versions of the GPMA, the scope has been expanded in the current version of the bill to apply to advertising and marketing of any personalized medicine product (previous versions focused solely on genetic tests).

Events may have overtaken this proposal, however. Last month’s Congressional hearing and GAO report (pdf) highlighted “misleading test results” and “deceptive marketing and other questionable practices” on the part of DTC genetic testing companies. The report was forwarded to the attention of both the FDA and the FTC and, in its aftermath, it seems unlikely that it will take the passage of new legislation for those two agencies to begin working together to more aggressively police the personalized medicine marketplace.

Interestingly, a separate provision of GPMA 2010 would instruct the CDC, the FDA and the FTC to work together to “conduct an analysis of the public health impact” of “products used for personalized medicine (including genetic and genomic tests) for which consumers have direct access” and to do so “to the extent possible from available data sources.” The joint agency initiative would also “analyze the validity of claims made in [DTC] marketing” and “make recommendations…regarding necessary interventions to protect the public from potential harms” of DTC marketing and access to personalized medicine products. While such an undertaking might appear redundant with the GAO’s recently-concluded investigation, the GAO’s report was an admittedly unscientific snapshot of the field (“GAO did not conduct a scientific study but instead documented observations that could be made by any consumer.”), for which it has been frequently criticized. While a more comprehensive and data-driven analysis of the field would be welcome, recent events suggest that agencies such as the FDA are likely to proceed with additional DTC regulatory oversight on the basis of the data (or lack thereof) currently at hand.

Expanding the Role of Companion Diagnostics and Pharmacogenomics at the FDA. Another provision targeted at the FDA would permit the agency, under certain circumstances, to “require the sponsor of a drug or biological product” (emphasis added) to develop a companion diagnostic test in connection with regulatory filings for a new drug. This provision was originally included in the 2006 bill, but was removed in the 2007 and 2008 versions. Those versions merely permitted the FDA to recommend companion diagnostic development to drug and products sponsors.

The 2010 GPMA also instructs the FDA to “clarify and issue guidance” that explains when companion diagnostics will be included in labeling – including appropriate “standards of evidence…such as with respect to the analytical validity, clinical validity, clinical utility, dosing, adverse events, and drug selection…” – and when such tests will be either recommended or required.

In many respects these provisions of the GPMA seem to reflect the increasing reliance on genomic and genetic data in selecting and administering therapeutics, including the use of companion diagnostic tests.

Where Will the GPMA Go From Here? While GPMA 2010 itself represents a significant departure from the bill originally introduced by Senator Obama in 2006, it is exceedingly unlikely to become law in its current form. Among other considerations, the recent (and ongoing) developments in the areas of laboratory developed tests (LDTs) and DTC genetic testing – two important components of personalized medicine – suggest that substantial revisions would be required to reflect an ever-changing technological, commercial and regulatory environment.

At least for the moment, passage of the GPMA in any form does not appear to be imminent. Perhaps it will never become law – at least in anything like its current form – and either existing legislation or other contenders, such as Senator Hatch’s proposal to create a new regulatory category for “advanced personalized diagnostics” – will be used to fill gaps in the oversight of personalized medicine products. Then again, recall that crafting legislation to respond to the successes of modern science and technology can be a painfully slow process. For instance, the only piece of federal legislation specifically directed at genetic technologies and information, the Genetic Information Nondiscrimination Act (GINA), took thirteen years from the date it was first proposed to its signing into law in 2008. After a mere five years, the GPMA likely has a long way to go.

The hearing on “Direct-To-Consumer Genetic Testing and the Consequences to Public Health” was conducted by the House Committee on Energy and Commerce Subcommittee on Oversight and Investigations. The meeting was chaired by Representative Bart Stupak of Michigan. Materials from the hearing, including a briefing memorandum, opening statements from Stupak and Representative Henry Waxman of California and witness testimony are available on the Committee’s website. Also available are materials from the Government Accountability Office (GAO) investigation into DTC genetic tests. These materials include the report the GAO submitted to Congress – “Direct-to-Consumer Genetic Tests: Misleading Test Results Are Further Complicated by Deceptive Marketing and Other Questionable Practices” (pdf) – as well as a YouTube video featuring excerpts from undercover phone calls made by the GAO to DTC companies as part of their investigation (both of which are discussed in detail below).

Opening Remarks. The hearings began with opening remarks from members of the House Committee. Chairman Stupak (MI) began (pdf) by reading from a statement in which he identified a familiar set of concerns pertaining to DTC genetic testing:

…how accurate are the companies’ analyses of direct-to-consumer genetic tests? By sending the customer the results of genetic tests without counseling or medical advice may cause more harm than good for some consumers? How accurate is the health information? How do companies explain differences in their analyses? Is there sufficient government oversight of the practices of direct-to-consumer genetic testing manufacturers?

Representative Stupak was followed in succession by Representatives Burgess (TX), Waxman (CA), Griffith (AL), DeGette (CO), Latta (OH), Christensen (VI) and Gingrey (GA).  As expected, there was considerable overlap in the opening statements. Nearly every Representative expressed his or her desire to ensure that the American public was presented with information that was accurate, safe and effective. They differed, however, in how they thought this might best be done.

Burgess and Waxman, for instance, were consistent in their hearing-long concern that the benefits of personalized medicine not be derailed either by unscrupulous DTC testing companies or by overly intrusive government regulation, and generally urged the use of a “deft touch” in regulating the industry. Others, including Representative Parker Griffith, struck a more alarmist tone, comparing the information supplied by DTC genetic testing companies to his throwing a snake into the middle of the Congressional hearing. According to Griffith, when presented with genetic risk information for serious diseases such as Alzheimer’s or cancer, consumers are likely to panic first and ask questions only later, if at all. Representative Phil Gingrey (GA) was on the same page, expressing his concern that DTC genetic testing might lead patients to jump to the wrong conclusions “or, indeed, jump off of a building” without appropriate guidance.

Other Representatives had specific issues they wished to explore. Representative Diana DeGette (CO) focused throughout the day on the privacy of genetic information collected and maintained by DTC companies. She acknowledged, quite correctly, that current laws (including GINA) provide incomplete protection against the misuse of genetic information. Representative Donna Christensen (VI) devoted her opening – and the majority of her subsequent questions – to the treatment of ethnic and racial minorities by DTC companies. Particularly worrying to Christensen were instances (documented by the GAO’s investigation) in which DTC companies failed to adequately notify minority consumers that their test results were incomplete or inaccurate. This typically occurred with respect to traits where the underlying genetic research was conducted in Caucasian populations and not yet verified in applicable minority populations.

Reports from the Regulators. Following the opening statements, the first witnesses called to testify were Gregory Kutz, Managing Director of Forensic Audits and Special Investigations for the GAO and Dr. Jeffrey Shuren, Director of the FDA’s Center for Devices and Radiological Health (CDRH). Kutz began by presenting findings from the GAO’s investigative report into DTC genetic testing products and marketing (pdf).

For those seeing the report for the first time (a group that included all of the DTC companies present at the hearings), Kutz’s testimony and the GAO’s report certainly raised some eyebrows. Although, by the GAO’s own admission, it “did not conduct a scientific study but instead documented observations that could be made by any consumer,” its conclusions to Congress were crystal clear: DTC genetic testing companies provide “results that are misleading and of little or no practical use.” The GAO reached this conclusion following a year-long, two-part investigation into the tests and marketing practices of DTC companies.

Part I: The Tests. During the first phase of the investigation, the GAO purchased 10 tests each from four companies (23andMe, Navigenics, Pathway Genomics and Decode Genetics). For each company the GAO selected five donors and submitted two samples – one containing factual information and one “using fictitious information, such as incorrect age and race or ethnicity.” In findings representative of those published in Nature by Ng et al. last year, the GAO found that the four DTC companies did not provide consistent risk estimates for all customers across the full range of conditions tested. Although the GAO report doesn’t do the math, Kutz testified before Congress that 58% of the time donors received different predictions for the same disease.

The issue of consistent genetic interpretation and risk reporting is an issue that DTC companies have widely acknowledged, both during the course of the GAO investigation and elsewhere. Previous efforts include a collaboration led by the Personalized Medicine Coalition to develop guidelines for scientific validity and 23andMe’s recent letter to the heads of NIH and FDA requesting assistance in developing transparent standards for reporting the positive and negative predictive values of genetic tests. There was widespread agreement among the companies, regulators and Congressmen that this is an area where DTC must improve in order to help avoid consumer confusion and there can be little doubt after today’s hearing that this will be a top priority for DTC companies and regulators alike.

The GAO also investigated how risk predictions matched against factual illnesses and family medical histories, with the GAO and several Representatives emphasizing the example of one donor with an implanted pacemaker for an irregular heartbeat who “was told that he was at decreased risk for developing such a condition.” While this particular example was widely discussed at the hearing, as Steven Pinker eloquently explained last year upon learning that he was at a high risk for baldness despite possessing a flowing mane, prediction is not the same as diagnosis. The fact that the two do not always align is far from damning evidence against DTC genetic testing, or indeed genetic testing in general. Unfortunately, this distinction was largely overlooked in the GAO report and in the Congressional hearing.

The GAO also criticized the four DTC companies for their poor performance in handling samples from (fictitious) African American and Asian customers and the companies’ failures to provide follow-up interpretation and consultation support as advertised. Here is the GAO’s summary of its findings from part one of the investigation:

Comparing results for 15 diseases, we made the following observations: (1) each donor’s factual profile received disease risk predictions that varied across all four companies, indicating that identical DNA can yield contradictory results depending solely on the company it was sent to for analysis; (2) these risk predictions often conflicted with the donors’ factual illnesses and family medical histories; (3) none of the companies could provide the donors who submitted fictitious African American and Asian profiles with complete test results for their ethnicity but did not explicitly disclose this limitation prior to purchase; (4) one company provided donors with reports that showed conflicting predictions for the same DNA and profile, but did not explain how to interpret these different results; and (5) follow-up consultations offered by three of the companies provided only general information and not the expert advice the companies promised to provide.

Part II: The Follow-Up. After receiving and comparing the test results supplied by the companies, the GAO followed up by conducting the second phase of its investigation: “undercover calls to the companies seeking health advice.” The GAO presented excerpts from those calls in the form of a dramatic YouTube video shown at the hearing.

A number of the encounters presented in the video are unquestionably troubling. The first, for instance, is a conversation between a GAO investigator and a company (identified by Kutz at the hearing as Navigenics) representative discussing the woman’s breast cancer results:

Fictitious Customer: So if I’m high risk, does that mean I’ll definitely get breast cancer?

Company Representative: You…you’d be in the high risk of, you know, pretty much getting it.

The GAO reports that “experts” considered “this statement ‘disconcerting’ and ‘horrifying’ because it erroneously implies that the test can diagnose breast cancer and could needlessly alarm consumers.” (Note also that this is a good example of the prediction/diagnosis confusion, discussed above.)

Other DTC encounters that received particular scrutiny included:

• a representative from a DTC company (identified at the hearing as Pathway Genomics) encouraging a fictitious consumer to collect and send in a saliva sample from her fiancé, without his consent, in order to surprise him with the results. Testing without consent - so-called “surreptitious testing” - is illegal in some form in more than 20 states, according to a recent report from the Genetics and Public Policy Center (pdf).
• a representative from a separate DTC company (identified by Representative Stupak as GeneWize Life Sciences) appearing to endorse the use of supplements as an alternative to or replacement for blood pressure and cholesterol medication. Such supplements, whatever their value, have not been approved by the FDA to treat, prevent or cure disease.

The GAO reported that 10 of the 15 companies it investigated engaged in what it termed “deceptive marketing, misinformation, and questionable practices.” There is really little room to disagree with the GAO’s findings. At best the examples highlighted by the GAO report reflect poorly informed company representatives; at worst they represent irresponsible marketing and even outright “fraud,” a term Kutz used in his testimony to Congress.

Where the report is lacking, however, is in its failure to identify which companies were guilty of which practices, and whether such practices are representative of the DTC genetic testing industry as a whole. It was initially confusing – to Congressmen, witnesses and the audience alike – whether the companies selected for follow-up interviews were the same as those selected for initial testing. (They were not; the pool for the second phase of the investigation was expanded by an additional 11 companies.) In testimony to Congress at the hearing, it was frequently unclear whether Kutz’s comments and conclusions (which often referenced various sections of the GAO report, jumping between the two sections) pertained to the DTC companies currently before Congress, to some or all of the 15 companies reviewed as part of the full GAO investigation or to the entire DTC genetic testing industry.

One result of this confusion was a tendency for Congressmen and even other witnesses to default to the lowest common denominator in describing the DTC genetic testing industry. Despite a clear range in testing and business practices (recall that for 1/3 of the companies investigated, the GAO uncovered no questionable marketing behavior) the term “snake oil” was repeatedly invoked to describe all DTC genetic tests.  For example, during one stretch of Q&A, Representative Stupak paused the conversation to remind the audience that “in the last 48 hours this committee went from Gulf Oil to Snake Oil; we are on top of our game.” Representative Griffith took it a step further, accusing DTC companies of being in the business not of selling genetic tests but of marketing, using the tests as a lure to encourage consumers to part with genetic and other information and adding them to marketing lists for vitamins, drugs and supplements (note: the prior link incorrectly identifies Representative Latta).

To reiterate, there is no question that the GAO uncovered disturbing and even “horrifying” instances of misleading and even fraudulent practices employed by certain DTC genetic testing companies. Steps must be quickly taken to halt such practices. But it remains unclear whether the examples cited by the GAO are representative of the entire DTC genetic testing industry and, for that reason and others, what the proper regulatory response to such practices should be.

In its section on Corrective Action Briefings, the GAO report notes that it briefed the FDA, NIH and FTC on its findings in May and June of this year. There can be little doubt that one or more of those agencies will soon take steps aimed at eliminating certain of the practices identified by the GAO. What those steps might be – and whether they will target specific companies or the industry as a whole – remains to be seen.

The FDA’s Plan. While details of what new regulatory oversight might be in store for DTC genetic testing were expectedly sparse, some modest insight came from the testimony of Dr. Shuren of the FDA (written testimony). Shuren’s oral and written comments emphasize that the FDA subjects a genetic test to regulatory oversight only if it qualifies as a medical device; “that is, if it is intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease.” Shuren specifically mentioned genetic tests for ancestry or curly hair as tests that would not be subject to FDA regulation (and, it would appear, are likely to be permitted to remain on the market provided they are marketed and sold appropriately). Shuren’s comments lent weight to the argument that the FDA, at least for the moment, considers “intended use” to be a key factor in determining whether and how to regulate a genetic test.

Shuren also made it clear that the FDA did not consider many of the genetic tests provided by DTC companies to be LDTs because they were purchased from another company and not developed in-house. Shuren singled out Pathway Genomics (which operates its own CLIA-certified lab) as an example of a non-LDT DTC genetic test. Shuren did not clarify whether the FDA intended to apply this same rigorous assessment of what is and what is not an LDT to any of the estimated 2,500 – 5,000 (Shuren’s own “conservative estimate”) non-DTC genetic tests currently offered for sale as LDTs without FDA clearance or approval under the Agency’s policy of “enforcement discretion.”

With respect to DTC genetic tests, Shuren’s written comments – briefly echoed in his testimony – reflect the FDA’s previously reported concern with the changing nature and scope of genetic testing. “For example, one company provided test reports for 17 diseases, conditions, or traits in 2008 but provided over 100 types of results in 2010.” Shuren’s testimony cites “escalation in risk and aggressive” marketing as the reasons that ultimately convinced the FDA to send Pathway Genomics a letter on May 10th informing the company that its product was a medical device subject to regulation. Under questioning from Representative Burgess, Shuren admitted that he thought the FDA “should have acted sooner” to address DTC genetic tests.

So what is the FDA’s plan now that the public meeting and Congressional hearing have come and gone? Will the Agency continue to send informational letters to DTC companies and start to take even more aggressive actions? That will likely be part of the strategy – perhaps even a significant part – but Shuren also outlined the barest details of a plan to help allow DTC genetic tests to remain (or at least re-enter) the market. Shuren indicated the FDA was looking into the possibility of working with the NIH, scientific experts and community representatives to review the scientific literature and identify viable genetic association claims and appropriate standards of interpretation. Shuren also mentioned that the FDA is looking at ways to allow the Agency to approve general tests or testing platforms through a scheme that would allow additional data to be added to tests, and claims or interpretations presented to recipients, without having to seek additional FDA approval or clearance. Details of the plan were minimal, and given the context seem likely to apply both to DTC genetic tests and LDTs more broadly, but we will need to wait for the FDA to publicly elaborate on its plans (Shuren’s written comments do not address either of these topics).

None of the above should be taken to suggest that the FDA intends to let DTC genetic testing companies off of the hook when it comes to FDA clearance or approval. In response to questions from Representatives Waxman and Burgess, Shuren indicated that he thought most DTC tests would be classified as Class III or Class II devices (not Class I or Class II, as Burgess had suggested) and that, while companies that come to the FDA with data and low-risk tests in hand might be permitted to remain on the market for an interim period pending FDA review, “if they aren’t ready with the data or there are concerns about patient safety, then we would not allow them to market” their tests.

As usual, precise details and timing remain “to be determined,” or at least “to be publicly announced.”

Over the Horizon. Representatives Burgess and Waxman also pressed Shuren to discuss whether he felt the FDA was prepared to address the challenges of personalized medicine, including technologies (presumably including whole-genome sequencing) that are “just over the horizon.” Waxman, in particular, while expressing his desire to ensure that companies not mislead the public, worried about setbacks that might result from branding the entire industry as a group of charlatans and responding by pulling all of the products from the market. Shuren, for his part, held fast to his line that the FDA’s primary concern was that information presented to patients was truthful, accurate and understandable.

Similarly, Burgess worried whether the FDA possessed the tools (read: resources) to deal with what lies ahead, including the potential regulatory responsibility for entirely new areas of personalized medicine such as DTC genetic testing and LDTs. Shuren responded that the FDA has authority to adapt its current regulations and resources to new technologies, and was considering “down-regulating” less risky devices to make resources available for DTC/LDT regulation.

Finally, Shuren was asked by Waxman whether he thought DTC genetic testing companies were helping to advance the state of scientific knowledge, thereby bringing the ideal of personalized medicine closer to reality. Shuren responded that he believed DTC companies were interpreting and synthesizing scientific research, but not directly contributing. (23andMe general counsel Ashley Gould later offered her own perspective, citing recently published research derived from customer data as evidence to the contrary.)

DTC Takes the Stage. After the regulators stepped down, representatives from 23andMe, Navigenics and Pathway Genomics were invited to testify, along with Dr. James Evans of the University of North Carolina-Chapel Hill. In addition to his many titles and responsibilities, Dr. Evans was the “primary consultant” to the GAO during the course of its investigation.

Evans’ prepared remarks (pdf) largely reflect his opening statement to the Committee, which focused on the need to balance the ample benefits of genetic testing with the critical importance of ensuring that patients and consumers receive high quality and accurate information, that their privacy is protected and that the claims made on behalf of genetic testing “comport with reality.” Throughout his comments Evans was adamant that while more regulation was needed, particularly over DTC genetic tests, individuals should continue to be permitted direct access to their genomic information:

I believe that the public deserves access to the information contained in their own genomes. But they also deserve an honest accounting of what such information means and the assurance that it is derived in a manner that ensures quality, reliability and confidentiality.

The opening statements that followed from Ashley Gould of 23andMe (written testimony), Vance Vanier of Navigenics (written testimony) and David Becker of Pathway Genomics (written statement) were comparatively brief.

Gould talked about 23andMe’s achievements in advancing genomic access and research and, while acknowledging the necessity of a sensible regulatory framework that ensures consumers receive scientifically valid, accurate and understandable information, emphasized the need for more data about the risks and uses of DTC genetic testing prior to regulation. Vance Vanier followed by describing DTC genetic testing as a tool that could help fight preventable disease and emphasized that not all DTC genetic testing companies operate using the same business model or hold themselves to the same standards. Vanier highlighted Navigenics’ focus on clinical genetic testing and its commitment not to sell or share any customer data with third parties (both distinctions from other DTC genetic testing companies). In wrapping up the introductory comments, David Becker of Pathway Genomics largely echoed Vanier and Gould while reminding the Committee that, while he believed a reasonable regulatory framework could be developed to permit DTC genetic testing, Pathway had already voluntarily suspended DTC sales of its products while working with the FDA to address its concerns.

After that the questions – and attacks – resumed. As the only witnesses not provided with access to the GAO report prior to the hearing, the DTC representatives were at a distinct informational disadvantage from the outset. Members of Congress peppered the companies with questions about whether they agreed that the “triumvirate” of companies:

• needed more consistent standards for genetic risk prediction (all three agreed they did);
• needed some form of additional regulatory oversight (all three agreed they did);
• must be willing to implement strong consumer privacy protection measures (all three agreed they did); and
• were providing medical advice and interpretations (23andMe and Pathway largely held to the company line that their tests are for “informational or educational” purposes, while Navigenics embraced the clinical aspects of its service).

As the panel wound down, Representative Stupak pressed the DTC companies to consider withdrawing their products from the marketplace pending development of an adequate system of regulatory oversight. Gould declined to take the bait, focusing on the rights of consumers to access their genetic information. Vanier attempted to argue that such a drastic move would harm not only Navigenics but other small businesses as well, and render the entire industry hostile to investment and invention. Vanier was quickly redirected by Stupak into conceding that the company was pre-profitable and “losing money every year.” Becker again pointed out that Pathway had already ceased offering its tests for sale directly to consumers and saw no need to withdraw completely from the marketplace.

The final line of questioning from Representative Burgess concerned international efforts to review or regulate DTC genetic testing, with all three companies conceding that, to their knowledge, the FDA was taking the lead in pursuing regulatory oversight of the industry. While neither the Congressmen nor the companies seemed overly familiar with international efforts to review and regulate DTC genetic testing, they clearly exist. In the U.K., for instance, the House of Lords reviewed the DTC genetic testing landscape in its 2009 report on genomic medicine and the Human Genetics Commission is currently developing a “Common Framework of Principles” for DTC genetic testing. Other countries have been even more proactive, with Germany enacting legislation that effectively banned all DTC genetic testing just last year. It will be interesting to see whether the heightened scrutiny of DTC genetic testing by U.S. regulators prompts regulatory or legislative bodies in other countries to take a closer look at adjusting or enforcing laws and regulations pertaining to DTC or other forms of genetic testing.

The Future of DTC? Four and a half months ago, in “Why the State of Personal Genomics is Not as Dire as You Think,” I wrote the following:

Over time, the diversification of personal genomics will be a good thing, aiding in the identification of viable business models and separating legitimate businesses from snake-oil salesmen. But it will require time, investment (not all of which will be recouped) and quite probably additional legislative or policy interventions, particularly in the areas of intellectual property and regulatory review that apply to personal genomic services…

Looking ahead, I am confident that [Linda] Avey is correct when she writes that personal genomics will become “such an every day concept that future generations will be amused that we even questioned its viability.” And judging from the abundance of activity and advancement in the field as a whole, as well as the dozens of entrepreneurs and investors that have contacted me in recent months to discuss their plans for starting or growing personal genomics businesses, I think it will hardly take a generation before personal genomics moves mainstream.

In the months since, the field of personal genomics has been shaken by a string of regulatory developments, each seemingly more dire than the last. From the failed Pathway Genomics/Walgreens partnership to the FDA’s letter-writing campaign to today’s events, especially the GAO’s conclusion that DTC genetic tests mislead consumers and are of no practical use, it is clear that “additional legislative or policy interventions” are no longer probable. They are inevitable, and they are likely to be substantial.

In spite of these developments - and no matter how many times the term “snake oil” is thrown around – I continue to believe that it is premature to declare the death of DTC genetic testing, or its close cousin personal genomics. There remains a broad spectrum of possible responses available to Congress and the various regulatory agencies now scrutinizing the field of genetic testing and, while today’s events did not paint DTC genetic testing in the most favorable light, the industry and many of its companies have received considerable (and deserved) praise on other days.

Obviously, much depends on where the regulatory and legal landscape moves from here. Certain possibilities, such as enhanced genetic test transparency and FTC oversight to separate legitimate tests from fraudulent ones, would strengthen the DTC industry over the short- and long-term. Others, including applying the traditional medical device regulation framework to all or most DTC genetic tests, have the potential to deal a considerable setback to DTC companies, consumers and investors. With nearly limitless possibilities, everything hinges on the precise details and timing of the new regulatory framework, whatever it may be.

No matter what comes next, over the long term I continue to believe – based on my day-to-day interactions with investors, companies, consumers and researchers – that there is considerable demand for direct consumer access to personalized genetic information. And this demand is only going to increase with time. The personal genomics landscape is certain to change, possibly drastically, in the coming weeks and months. But I am extremely doubtful that it will be wiped clean. As long as demand persists, I have confidence that companies, consumers and regulators will find a way to work together to continue to provide individuals with direct access to and control over their genomic data.

As we’ve previously discussed, a partial match between two DNA profiles may indicate that the donors of the corresponding samples may be related. In familial searching, a database is searched for the purpose of identifying partial, rather than exact, matches against the sample of unknown origin. Those partial matches are then used as investigatory leads.

Though familial searching has been used with some success in other countries, few states openly endorse its practice. Those states that permit the use of partial matches at all generally prohibit the intentional search for those matches, requiring instead that they be discovered inadvertently. California began using familial searching in 2008 in a first attempt to identify the Grim Sleeper. At the time, the failure to produce a suspect was seen as a strike against the technique: if familial searching could implicate privacy concerns and subject innocent individuals to excessive genetic surveillance, it certainly could not be justified without being able to point to positive results.² Since then, one DNA profile of particular interest was added to California’s database: that belonging to the son of the man now identified as the Grim Sleeper.

While these concerns—which focus on the broad impact of sustained, widespread familial searching—cannot be overcome simply by reference to discrete cases, the procedure followed by the DNA laboratory that conducted the tests in this case seems to have at least helped to assuage the critics. As discussed by Maura Dolan in the Los Angeles Times, the ACLU of Southern California endorsed the procedure utilized by the investigative team, which included control of the investigation by a “familial search committee.” For instance, unanimous approval of the committee was required both before the name of the partial match donor was released to the Department of Justice and before the name of the suspect and the supporting DNA findings were released to the Los Angeles Police Department.

The capture of a high-profile serial killer will likely spur public opinion in support of familial searching. The fact that the ACLU (which is the motivating force in a lawsuit challenging another of California’s controversial DNA practices, the collection of DNA samples from individuals upon arrest) has endorsed the practice used by the state in achieving the arrest is likely to garner additional attention. We’ll keep you updated as more jurisdictions explore the possibility of implementing formal policies concerning familial searching.

[Update 7/15: The ACLU attorney quoted in Dolan's LA Times article has contacted the GLR to clarify that they do not "endorse" familial searching. Instead, the ACLU believes that the procedures used in familial search investigations deserve statutory protection and additional oversight, which they argue for in a post on their own blog.]

__________________

¹ He has since been charged with 10 counts of murder, with the arraignment scheduled for August 9. At this point, the presumption of innocence must be respected. The material contained in this post is intended for discussion purposes only and should not be construed as an opinion on the guilt or innocence of the individual charged.

² As detailed in an earlier post, one common concern voiced by critics of familial searching is that because minorities are disproportionately represented in DNA databases they would in turn be disproportionately implicated by the results of familial searching.

But once DNA samples are collected, when are they actually analyzed? As discussed by Christopher Heaney and Sara Huston Katsanis in The Contra Costra Times, many states currently have considerable backlogs in testing DNA samples, including those collected from convicts, arrestees and victims. Katie’s Law, by increasing the number of samples that require analysis, is likely to exacerbate these backlogs. Worse yet, Heaney and Katsanis point out that other federal funding awards are determined by the size of a state’s backlog—the larger the backlog, the more funds the state can receive. While the intent of Katie’s Law is to expedite the delivery of justice, there is concern that its practical effect may indeed be just the opposite.

A direct, Constitutional challenge to the practice of taking and retaining arrestee DNA samples, led by the ACLU, is currently wending its way through the Federal court system. The Ninth Circuit Court of Appeals is scheduled to hear oral arguments (pdf) in that case (Haskell v. Brown) next week and the Genomics Law Report will continue to provide updates as this issue develops.

On May 18, the House of Representatives passed the Katie Sepich Enhanced DNA Collection Act of 2010, informally known as Katie’s Law.¹ Under the bill, those states that collect DNA from individuals arrested for certain serious crimes (murder, voluntary manslaughter, serious sexual offenses or serious kidnapping offenses) and compare the samples to those in the CODIS database at least once receive a 5% bonus on certain federal crime prevention grants.² States that also collect samples from individuals arrested for less serious crimes and submit all profiles collected from arrestees for inclusion in CODIS would instead receive a 10% bonus. The bill is now with the Senate Committee on the Judiciary.

Weighing the Constitutionality of Arrestee Collection. But is the practice of compulsory arrestee DNA collection constitutional? To date, most challenges to DNA collection have involved convicts, not arrestees. The few cases dealing with arrestees have not reached consistent results—the federal law has been both upheld and struck down, and state courts in Minnesota and Virginia have also reached opposite results.³ A brief look at the methodology accepted by four courts illustrates how these disparate results occur.

In these four cases, the courts employed a balancing test that weighs the government’s interests in collecting DNA from arrestees against the privacy interests of those arrestees. The different outcomes can be attributed to the weight that the courts give the individual factors. The courts that have upheld arrestee DNA collection have generally adhered to the position that DNA collection, at least in this context, is akin to the accepted practice of taking fingerprints.⁴ Because the government’s interests (e.g., ensuring that law enforcement has properly identified the arrestee, determining whether there are outstanding warrants for the arrestee and collecting evidence to facilitate re-capture in the event that the arrestee should escape or flee) are sufficient to justify fingerprinting the arrestee, these courts believe that DNA collection is similarly justified.

By contrast, courts that have struck down arrestee DNA collection emphasize the privacy interests of the arrestee. For these courts, cases permitting DNA collection from convicts are not persuasive because arrestees, unlike convicts, have not been through a judicial process and do not have diminished expectations of privacy.⁵ Indeed, under the Katie’s Law bill, for a state law to qualify for the federal incentives, it would be required to allow acquitted individuals to have their profiles removed from CODIS. Minnesota’s statute contained such a provision, which the Minnesota Court of Appeals addressed in striking down the law. The court reasoned that, by including the provision, the legislature signaled that the privacy rights of an individual who has not been convicted outweigh the government’s interests. This is a curious example of a court deriving a legislature’s policy position from the very statute that it finds to be in violation of that policy. In any event, under this line of analysis, if an arrestee has not suffered a diminished expectation of privacy, his privacy interests outweigh the government’s law enforcement interests.

A Direct Challenge to Katie’s Law. Each case described above has arisen in the context of an individual convicted of one offense based on DNA evidence obtained when the individual was arrested for a separate offense. Accordingly, it is the act of collecting the DNA sample upon arrest that serves as the critical point in the analysis. As such, the cases do not address the entry and retention of the DNA profile in CODIS.

In Haskell v. Brown, however, the ACLU has squarely addressed those issues in the context of its challenge to California’s version of Katie’s Law. This case, which is currently awaiting argument before the Ninth Circuit Court of Appeals, does not stem from a conviction achieved on the basis of DNA collected from an arrestee. Instead, the ACLU’s case challenges the very act of taking and retaining DNA samples in CODIS. In Haskell, the named plaintiffs were arrested and compelled to submit DNA samples for checks against CODIS. The searches did not result in any database hits. One of the plaintiffs was not charged with a crime. The ACLU has sought a declaratory judgment that the California version of Katie’s Law is unconstitutional, as well as preliminary injunction prohibiting California from collecting DNA samples from arrestees. The case has survived a motion to dismiss and obtained class certification. The District Court for the Northern District of California, however, denied the ACLU’s motion for a preliminary injunction, and the ACLU has appealed that denial to the Ninth Circuit.

As part of Ninth Circuit’s decision on the preliminary injunction, it will probably evaluate the likelihood of the ACLU succeeding on the merits of its claim for declaratory relief. Accordingly, while the panel’s decision likely will not dispose of the ACLU’s claims, the reasoning behind that decision should serve as a useful indicator of how a circuit court of appeals views the constitutionality of the procedures included in Katie’s Law. Further, because the case does not arise as a challenge to a criminal conviction, the court will be able to evaluate the legal arguments without the possibility of a conviction being overturned. In the coming months, we’ll follow this case and the legislative progress of the federal version of Katie’s Law, as well as providing a more in-depth look at the court cases that will serve as a backdrop to the national debate regarding arrestee DNA collection.

_______________

¹ The bill passed under a suspension of the rules, meaning that it was subject to severely limited debate, but required a 2/3 majority to pass. After 25 minutes of debate, the measure passed the house by a vote of 357 to 32.

² The incentives are based on the Edward Byrne Memorial Justice Assistance Grant (“Byrne JAG”) that states receive. For reference, in 2009, California received about $135 million in Byrne JAG grants; New York received $67 million. A complete state-by-state list is available here (pdf).

³ Minnesota and Virginia have each reviewed their state laws: Minnesota found its law unconstitutional, while the Court of Appeals of Virginia upheld its law. Meanwhile, the Eastern District of Pennsylvania has found that the federal law is unconstitutional, while the Eastern District of California has upheld that same statute.

⁴ The Supreme Court of Virginia has stated: “A DNA sample of the accused taken upon arrest, while more revealing, is no different in character than acquiring fingerprints upon arrest.” Anderson v. Commonwealth, 650 S.E.2d 702, 705 (Va. 2007).

⁵ In response to the state relying on cases upholding DNA collection from convicts, the Court of Appeals of Minnesota has noted that “the reduced expectation of privacy that was present in the cases the state cites is not present here.” In re C.T.L., 722 N.W.2d 484, 491 (Ct. App. Minn. 2006).

The research began two decades ago, ostensibly to search for a genetic variant that might be contributing to the increasing rate of diabetes in the tribe. The diabetes research proved unfruitful, but the blood donated by the Havasupai tribe members, and the DNA extracted from it, led to a number of follow-on research projects, grants and publications. It was that research – including searching tribe members’ DNA for variants linked to schizophrenia, and inferring the likely ancestral origins of the tribe’s founders – that led to lawsuits, millions in legal fees and, ultimately, the settlement.

Implications of the Havasupai Settlement. Harmon’s article provides a concise background to the dispute, and briefly describes the $700,000 settlement between ASU and the tribe to “remedy the wrong that was done.” Harmon and unnamed “legal experts” suggest that the settlement is significant because “it implied that the rights of research subjects can be violated when they are not fully informed about how their DNA might be used.”

In some respects, this is a trivial conclusion. One of the most important and well-known elements of the Common Rule – the regulatory regime that governs federally-funded human subjects research – is that researchers must seek, and participants provide, informed consent. Participants that are uninformed cannot provide valid consent and, thus, their rights as subjects are violated. In that respect, at least, the Havasupai case tells us nothing new. (I have not seen the settlement, but I doubt that it will (a) be made public or (b) contain an express admission of guilt from ASU, both factors that will limit its relevance to future similar scenarios.)

But the Havasupai case and Harmon’s article shine light on an important, and difficult, problem that continues to face scientific researchers, particularly those exploring human genetic variation: what does it really mean to provide “fully informed” consent for genomic research?

Fully Informed Consent? Looking at the text of the Common Rule, there are requirements that the researchers describe the nature and purposes of the research (§ 46.116(a)(1)), as well as both reasonably foreseeable (§ 46.116(a)(2)) and unforeseeable (§ 46.116(b)(1)) risks of participation. But the standard of informed consent that must be achieved is not explicitly spelled out. Is it “reasonably informed,” “substantially informed,” “fully informed” or something else altogether? (Interestingly enough, the language that Harmon uses – “fully informed” – does appear, but only in sections regarding research on pregnant women and fetuses, which is not applicable in this case.) Even if a clearer standard were articulated, how would researchers demonstrate that it had been satisfied?

The requirement of informed consent is part of the bedrock of modern human subjects research in the United States, and it is not going anywhere. In fact, the story of the Havasupai, as well as the tale of Henrietta Lacks (told so remarkably well in Rebecca Skloot’s new book) and other past failures of informed consent, suggest the informed consent requirement is here to stay, as well it should be.

A Difficult Balance. Yet, as we push forward into an era of large-scale, personalized genomic research, it is impossible to ignore the difficulties – legal, ethical and practical – that informed consent requirements impose. For example, truly informed consent for genomic research might require participants to possess a deep – or at least working – understanding of the underlying science. That sets a very high bar, and finding sufficient numbers of participants capable of providing such consent could restrict important research.

Even more daunting, however, is the difficulty of fully informing participants of the benefits and risks of participation in genomic research – particularly where the resultant findings could conceivably be linked back to the individual or, as in the case of the Havasupai, the individual’s community – when the researchers themselves lack this understanding. What genetic information can tell us about disease and other traits, and how this information can be used or misused in the case of individuals, is an area of continuing uncertainty. With the publication of the draft human genome sequence a decade in the rearview mirror, we know more than ever before. But there is still much that we don’t know.

Thankfully, new research models and strategies for seeking informed consent are being developed and tested. For instance, the Personal Genome Project (PGP) – for which I am an advisor, including with respect to the informed consent protocol – employs a model of “open consent.” The PGP focuses on preemptive and extensive risk disclosure, along with rigorous participant pre-screening to ensure that the risks of participation are understood. More broadly, the difficulties of informed consent and genomic research is an issue that the NIH is studying on an ongoing basis, with multiple internal working groups looking at different dimensions of the problem. Nevertheless, informed consent for genomic research poses a considerable challenge for policymakers, funding bodies, researchers and participants, and it is unlikely that any of the existing models represent a perfect approach.

None of this should be taken to mean that informed consent for genomic research is impossible. To admit that would leave us with the unenviable choice of sacrificing either the informed consent of participants or the valuable scientific research they enable. What the case of the Havasupai tribe does underscore, however, is just how difficult a task this is. It is clear that the next generation of personal genomics research will require more than purely scientific breakthroughs. We also need to think creatively about the ethical and legal framework in which such research is conducted, to make sure that it continues to promote scientific progress while protecting the participants – no matter what their background – that make such research possible.

As we’ve written earlier (“Back to the Future: NIH to Revisit Genomic Data-Sharing Policy”), the ability to link – and to share – genotype and phenotype data (including medical records, particularly treatment and outcome data) will be essential to the development of the next generation of genomic research. One of the most common ways to link genotype and phenotype data is to combine genomic data with electronic medical records (EMRs). A particular patient’s EMR may contain everything from basic biographical information to family medical history to current diagnoses, including ICD codes. When it comes to associating genes with medical conditions, researchers rely on International Classification of Disease (ICD) codes to categorize individual patients by disease type and search for shared genetic variations that might play a causal role.

Cracking the Codes. Obviously identifying information (e.g., biographical information) is generally required to be removed pursuant to HIPAA regulations. ICD codes, however, are sometimes retained for purposes of genetic association research and, in some circumstances, a set of otherwise anonymous ICD codes pulled from an EMR can be traced backwards to identify the specific individual supplying the codes.

The new research from Loukides et al., a team which includes data privacy pioneer Bradley Malin, recognizes the potential for genomic privacy risks created by linked genotype-phenotype datasets. Loukides and his colleagues propose a mechanism for modifying such datasets to eliminate one route to individual re-identification while retaining enough information to make the data useful. From the abstract:

This work proposes an approach that provably prevents this type of data linkage and furnishes a result that helps support GWAS. Our approach automatically extracts potentially linkable clinical features and modifies them in a way that they can no longer be used to link a genomic sequence to a small number of patients, while preserving the associations between genomic sequences and specific sets of clinical features corresponding to GWAS-related diseases. Extensive experiments with real patient data derived from the Vanderbilt’s University Medical Center verify that our approach generates data that eliminate the threat of individual reidentification, while supporting GWAS validation and clinical case analysis tasks.

The approach from Loukides et al. involves (i) designating individual-level medical data that are potentially identifiable (the ICD codes) and then (ii) modifying the data in such a way that they no longer pose a risk of re-identification. The team’s approach combines a privacy policy (determined by reference to the size of subsets that can be created using the ICD codes) with a utility policy (a set of diseases that can be categorized by combining various ICD codes without overly distorting the phenotypic information those codes represent) to construct a dataset that “provides provable protection from individual reidentification based on clinical features” while enabling important GWAS research.

A Balancing Act. The primary reason why genomic privacy even presents as an issue, of course, is that most individuals are uncomfortable publicly sharing their genomic and medical data. Although some “information altruists” agree to waive their privacy rights and participate in research projects – most notably the Personal Genome Project, which employs a fully public data release and consent model – most genomic research, and particularly research that combines genomic and other medical data, is premised upon some level of privacy for the participants.

The fundamental tension is how to balance individual desires for privacy with a collective interest in employing linked genotypic and phenotypic data to advance scientific understanding and, ultimately, provide improved medical care to individuals. Pure privacy – or sharing no data that could possibly be re-identified – is an untenable solution, because it is impossible. On the other hand, requiring participants to waive all privacy rights is equally untenable because it would, in all likelihood, dramatically restrict the available pool of research participants. (And, as The Wall Street Journal reported today, patients may lie to their doctors if they believe their EMRs will ultimately be shared without appropriate privacy protections, behavior that would hamper both research and medical care.)

Viewed in light of this ever-present tension, the model proposed by Loukides et al. should be applauded for its contribution to the continuing project of striving to balance the conflicting desires of robust individual data privacy and broad access to linked medical and genomic datasets. As Malin puts it: “Generating data is expensive, and it’s both good science and good etiquette to reuse data. The challenge is to do it while protecting people.”

By seeking to block a significant path to re-identification (even if it is impossible to eliminate all possible re-identification scenarios) while preserving the utility of the published data, the approach put forth by Loukides et al. can provide needed comfort to researchers, institutions and participants considering the publication of linked genotype-phenotype datasets. After all, simply because data might be identified does not mean that it need be easily identifiable, and in many research settings robust privacy protection mechanisms will continue to serve a critical function.

Teri Manolio, director of the Office of Population Genomics at the NHGRI, agrees that the team’s approach shows promise. “It does a good job of trying to maximize the information shared while minimizing the risk for re-identification, recognizing that these goals are in dynamic tension and both cannot be fully met at the same time.” Encouraging words from an agency that has struggled to strike the proper balance between privacy and access when it comes to genomic data.

One Kind of Re-Identification. Whether the Loukides method will be adopted remains to be seen, and a technical analysis of the algorithm is beyond the scope of this article. Either way, while the approach described by Loukides and his team – if validated – appears promising, it is important to emphasize that this particular privacy protection mechanism addresses only one pathway of genomic data re-identification. Even if the Loukides et al. method “eliminates the threat of individual reidentification” using statistical measures applied to certain linked genotype-phenotype datasets, researchers have recognized that re-identification can occur in a variety of ways.

As George Church pointed out, one of the most prevalent forms of re-identification occurs through accidental or intentional releases of data that were never intended to be public, such as the data breaches tracked by the Privacy Rights Clearinghouse. Such unintended data releases could, at least in theory, compromise otherwise secure datasets. Re-identification is thus unlikely to be a risk that is ever susceptible to complete elimination. (For a more complete discussion of this issue, see our previous post, “Re-Identification and its Discontents.”)

The Genomic Privacy Two-Step. Loukides and his colleagues recognize that they are providing only a partial solution, and note that genomic privacy tools such as theirs are only effective when applied in an appropriate fashion. As the authors point out, “as is true of all data anonymization methods, our approach leaves the decision of selecting a suitable privacy protection level…to data owners or policy officials.”

Furthermore, striking a sensible balance between privacy and access is only the first step in developing a responsible approach to privacy in genomic research. Researchers and institutions must also be sure to communicate the relevant trade-offs to those individuals whose data will be used in the research, to ensure that they understand – and agree with – whatever risk of identification has been deemed appropriate to the proposed research.

Tackling both prongs of genomic privacy – the risk of re-identification and accurate communication of that risk – is necessary to ensure that the next generation of genomic research is conducted in a way that is technically robust, as well as ethically, legally and socially responsible.

Last week, a paper in the Proceedings of the National Academy of Sciences presented research that every person – even twins whose DNA is practically identical – possesses a unique bacterial signature. It appears that traces of that bacterial signature can be recovered from household surfaces, including a computer keyboard, and potentially used to link a crime scene to a suspected criminal. The researchers’ findings are summarized in ScienceNOW (“CSI’s Latest Clue – Bacteria“).

This week, an online article at Discover Magazine, reports on research published in the journal Forensic Science International:Genetics that describes how hair or fur from household pets can be genetically profiled and used to tie suspected criminals to a crime scene. In fact, as the Discover article notes, “a man was recently convicted on second-degree murder in Canada after fur found on his discarded jacket matched that of Snowball – the victim’s cat.”

These are both further reminders that as genetic testing tools and techniques become increasingly inexpensive and widespread, the use of DNA in forensics, as in other areas, will continue to expand. And as James’s earlier article points out, there are a number of unresolved issues that must still be addressed to ensure that forensic DNA – human, feline or otherwise – is used in an accurate, responsible fashion.

(Image courtesy of Wikimedia Commons.)

In this post we’ll take a look at the current system of forensic DNA profiling, starting with the Combined DNA Index System (CODIS), which is the FBI program that oversees DNA profile databanking in the United States. It comprises databases at the local, state and national levels, with the National DNA Index System (NDIS) the crown jewel. The CODIS program operates as a powerful law enforcement tool but, in the eyes of some – including President Obama – it is not yet powerful enough. But even the existing CODIS collection, with its nearly eight million DNA profiles, poses a number of interesting ethical, legal and social issues.

In a follow up post we’ll take a look at President Obama’s push to expand CODIS to include mandatory arrestee profiling, as well as other developments in forensic DNA policy, such as the provocative New York Times editorial earlier this week calling for a nationwide database that would keep the DNA profile of every American – from hardened convicts to newborn babies – on file for law enforcement use. Our follow-up will explore the question of whose DNA profiles should be included in the CODIS system and used for law enforcement purposes, as well as the issues raised by expanding the scope of CODIS as proposed by President Obama and others.

Today, however, we begin the Genomics Law Report’s coverage of the issues surrounding the collection and use of forensic DNA with an introduction to CODIS and an examination of two important aspects of the program that are the subject of ongoing controversy: (1) the controversial use of partial DNA matches as an investigative tool and (2) the recent efforts by scientific researchers to gain access to the profiles maintained in the NDIS in order to evaluate the accuracy of DNA matches it produces.

CODIS: Quick and Dirty. Under CODIS, each state maintains a State DNA Index System (SDIS) at one of its laboratories. An SDIS is comprised of at least two indices—the Offender Index and the Forensic Index. DNA profiles are constructed from samples taken from people convicted of certain crimes (as defined by each individual state, but usually encompassing, at a minimum, all felonies) and are housed in the Offender Index of the corresponding SDIS. Similar DNA profiles are constructed from samples taken from crime scenes (but from an unknown contributor) and are housed in the Forensic Index. A state may also maintain additional indices in its SDIS (for example, an Arrestee Index of the type favored by President Obama is currently maintained by eighteen states, as well as by the FBI).

The NDIS includes the same three indices for use in criminal investigations: the Offender Index, the Forensic Index, and the Arrestees Index.¹ Individual states may forward profiles from the corresponding indices of their respective SDIS to the NDIS, accompanied by an identifying number indicating the state and laboratory that supplied the profile. As a result, the information maintained in the NDIS is de-identified: that is, it is linked only indirectly (through the coded identifier) to the contributor’s name or other personally identifying information.

The FBI utilizes the CODIS software to perform three primary searches in the NDIS on a weekly basis: it compares the profiles in the Offender Index to those in the Forensic Index; those in the Arrestee Index to those in the Forensic Index; and those in the Forensic Index to the rest of those in the Forensic Index.² A match from either of the first two searches would link a known individual to a crime scene—which is a potentially powerful piece of evidence in a criminal investigation—while a match from the third search could tie together two previously unconnected crimes, allowing the investigating authorities to collaborate in developing investigative leads. If CODIS identifies that two profiles are identical, the states that submitted the profiles in question are notified of the match. At that point, the investigating authorities from the two states must contact each other directly to proceed.³

The Use of Partial Matches. An emerging issue is whether the FBI should notify the states when two profiles are not identical, but are extremely similar. For example, if the two profiles exactly match at many loci and present at least one similar allele at each locus, this “moderate stringency” match is unlikely to occur between unrelated individuals. Instead, a more likely result is that the contributors of the two samples are related. (Exactly how likely is an area of disputed scientific research, and one of the main reasons disclosure to the NDIS is sought, as discussed below.) Thus, if an Offender or Arrestee profile demonstrates a moderate stringency match with a Forensic profile, it is possible that a relative of the offender or arrestee was the contributor of the forensic sample, creating a connection that law enforcement agencies are understandably interested in exploring.

Currently, a number of states allow or have allowed partial matches to serve as the basis for law enforcement investigations of known offenders’ relatives, but the exact policies of the states can be difficult to discern. According to one survey conducted in November 2009, at least 15 states allow DNA analysts to inform law enforcement of partial matches, though at least 10 of those states required that the partial match be discovered unintentionally.⁴

Meanwhile, in Britain, the use of partial matches is widespread. It famously led to the capture of the “shoe rapist,” a serial rapist in the city of Rotherham who escaped capture for more than 20 years. After his sister’s DNA profile—which was included in the national database because of a DUI arrest—returned a partial match to evidence taken from the scene of one of his attacks, police solved the crime within eight hours.⁵

At the national level in the United States, the Scientific Working Group on DNA Analysis Methods Ad Hoc Committee on Partial Matches made recommendations to the FBI director about the use of partial matches in an October 2009 report. Despite expressing concern about the frequency of partial matches between profiles contributed by unrelated individuals, the committee ultimately concluded that the informed and practiced use of partial matches is beneficial.

Issues Associated with Partial Matching. The practice of using partial matches as investigatory leads is one that raises difficult issues on both sides. Law enforcement officials consider partial matching an important investigative tool, while critics argue that it can unduly subject innocent individuals to intrusive investigations through no fault of their own. Convicted offenders, by virtue of committing a qualifying crime, have arguably surrendered a portion of their privacy rights and may be justifiably included (pdf) in a DNA database such as the Offender Index. To a somewhat lesser extent, arrestees have arguably surrendered a portion of their privacy rights as well.

The relatives of these offenders and arrestees, on the other hand, have done nothing to justify disparate treatment as compared to any other law-abiding citizen. Nonetheless, a partial match between a sample from an unknown contributor in the Forensic Index and a prior offender or arrestee whose DNA is contained in the applicable CODIS index, if provided to investigators, will implicate (potentially) innocent relatives of the offender / arrestee as suspects. Accordingly, these individuals then face the specter of “guilt by genetic association”; they are suspects in investigations because of the prior actions of their genetic relatives.

Using a partial match to identify a guilty individual would be less controversial if they reliably indicated a genetic relationship between the two samples. While it is known that the samples in any partial match come from two separate individuals, the fact is that in many partial match examples those two individuals are not related at all. In these cases, a profile from the Forensic Index partially matches a profile in the Offender or Arrestee Index not because of a genetic relationship between the two individuals, but simply because of chance.

Some commentators are particularly concerned that the current overrepresentation of minorities in the criminal justice system will, in turn, produce a disproportionate number of partial matches that implicate minorities as suspects. Maryland attorney Stephen B. Mercer put the concern plainly: “What you’re gonna end up seeing is nearly the majority of the African American population being under genetic surveillance. If you do the math, that’s where you end up.”

Access, Accuracy and the NDIS. Another concern surrounding the use of partial matches is the rate of false positive in forensic DNA matching. False positives occur when two profiles are described as a statistical match when, in fact, they originate from genetically unrelated sources. False positives appear in two different forms. The first is when two samples are declared to be a perfect match – on the basis of sharing the same snippets of genetic code at a sufficient number of locations they are determined to have been provided by the same individual – but, in reality, were supplied by two separate (but possibly genetically related) individuals. The second example of a false positive was described above in the context of partial matching. It occurs when a partial match is reported, and the two samples believed to be provided by genetic relatives, when in fact the samples come from individuals that are not (closely) genetically related.

Both complete matches and partial matches are determined based upon the frequency with which alleles appear at certain forensic loci within a given population. The measured allelic frequencies dictate the number of positions at which two DNA samples must be identical in order to declare a match or partial match. Thus, determining these frequencies correctly is of paramount importance to avoiding false positives and ensuring the accuracy of both direct and partial matches.

Important factors in evaluating the discriminatory power of DNA profile matches—including estimates of allele frequencies and loci independence—have to date been determined through the use of relatively small collections of profiles.⁶ Recently, a number of researchers have questioned the accuracy of the data used to construct profile matches and have mounted a campaign to obtain access to the nearly eight million DNA profiles currently stored in the NDIS.

Advocates of opening access to the NDIS argue that the much larger NDIS dataset would enable researchers to confirm the accuracy of the figures and assumptions used to construct and match DNA profiles. Most prominently, last December forty-one researchers signed on to a letter published in Science Magazine using this reason as its headline cause for NDIS disclosure. Also targeted are the assumed frequencies of some phenomena—for instance, the likelihood that a combination of three forensic samples could appear consistent with a combination of two samples, thereby confusing the forensic analysis—that have thus far only been calculated through simulation. In each case, researchers argue that access to the NDIS could lead to a clearer and more accurate understanding of the likelihood of such phenomena.

Until recently, the FBI has taken a hostile stance toward attempts to study DNA databases, despite the express statutory recognition of the possibility of anonymous disclosure,⁷ citing privacy concerns and the burden of disclosure. In particular, though the DNA segments (technically referred to as short tandem repeats, or STRs) selected by the FBI for the composition of a DNA profile have been frequently referred to as “junk DNA,” some commentators have expressed concern that future scientific advances may reveal uses of limited forensic profiles that stretch beyond simple identification, including, for example, predicting an individual’s disease susceptibility.⁸ Other commentators counter that concern over the number of similar profiles discovered through studies of smaller databases is overblown. Nevertheless, in response to the Science letter, the FBI appears to have adopted a slightly more receptive tone: “We are exploring ways to investigate some of the topics,” says Dr. D. Christian Hassell, Assistant Director of the FBI’s Laboratory Division. Even so, without a release of anonymized DNA profiles for research (a decision that comes with its own, separate set of issues) or a relevant, thorough statistical analysis of those profiles, the movement for disclosure is unlikely to subside.

Definitive answers to these questions will go a long way in determining how comfortable Americans – and courts – are with proposals that would dramatically expand the circumstances in which forensic DNA profiles are collected and used. We’ll dig deeper into these and other issues in an upcoming post.

(image provided by Wikimedia Commons)

_______________________

¹ In addition, the NDIS maintains three indices that are related to the identification of missing persons: the Missing Persons Index, the Unidentified Human Remains Index, and the Biological Relatives of Missing Persons Index.

² Each state uses CODIS, through a license from the FBI, to perform the same three searches.

³ Note that a match between an Offender profile and a Forensic profile is generally used as a basis for probable cause to obtain a new sample from the known contributor of the Offender profile, rather than as evidence used in court.

⁴ High-profile cases have been less successful in the United States. In 2008, California attempted to identify the “Grim Sleeper” using familial searching, but failed. More recently, however, a rapist on the Isle of Wight was identified thanks to a partial match between crime scene DNA aignd the DNA of the rapist’s daughter.

⁵ Apparently, routine searches in the CODIS program “allow[] for a little imprecision at each location because of so many different laboratories and agents.”

⁶ Illustratively, five scientists published their findings on allele frequencies in the Journal of Forensic Science in 2003 using just 700 unique DNA profiles.

⁷ In 42 U.S.C. § 14132, Congress specifically contemplated and authorized disclosure of the anonymous profiles for research purposes.

⁸ Recent scientific research has shed further doubt on what is an increasingly discredited notion: that DNA which exists outside of protein-coding regions should be considered “junk DNA.”

Contributed by

In late February, the state of Texas incinerated 5.3 million newborn bloodspots.

The background – the Genomics Law Report has had several posts (here and here) about the ongoing situation involving 5.3 million newborn bloodspots in a state biorepository in Texas. Often referred to as “residual” bloodspots, these are the tiny dried bloodspots left over after states conduct mandatory screening for specified diseases. State practices regarding retention of the residual bloodspots vary widely, with some destroying them promptly and others storing them indefinitely. Where post-screening use of the bloodspots occurs, the most common use is for quality assurance and quality control of the screening tests. Some states also permit the release of small sets of bloodspots for research.

Any such research must be done in compliance with the federal Common Rule applicable to clinical research and HIPAA, the federal medical privacy law. To simplify these laws’ complex requirements – what researchers must do depends on whether the samples or information will be made available in an identifiable or de-identified form. If a researcher receives identifiable information, then informed consents, privacy authorizations, and Institutional Review Board (IRB) reviews are mandatory. If the researcher receives only de-identified samples or information, no parental consent or privacy authorizations are required, although some states, including Texas, still insist on IRB review.

In the case of Texas, newborn bloodspots were collected and retained since 2002, building up a repository from 5.3 million children. Between 2002 and 2009, the Department of State Health Service (DSHS) provided 8350 de-identified samples to researchers – 0.16% of the total samples available. DSHS did not obtain parental consent for the distribution of these 8350 samples, as it was not required for de-identified use, although it did conduct an IRB review for each project. The research projects included studying the genetic causes of deafness to investigating inherited immune disorders, as listed on a DSHS web page describing research disclosures and uses. In the very small number of cases where identifiable research was conducted (200 out of 5.3 million), the state obtained prior consent from the parents, as required by research and privacy laws.

As Adam Doerr discussed in a post on February 2, the Texas Civil Rights Project brought a class action against the state in March 2009 on federal constitutional grounds, alleging that the retention and use of the samples without parental knowledge or consent was an illegal search and seizure. The plaintiffs did not allege privacy law violations. Meanwhile, the state legislature passed a bill enacting an opt-out program applicable to babies born after May 2009. After the state failed to win a motion to dismiss, it settled the case with the plaintiffs in December 2009, agreeing, among other things, to destroy all bloodspots collected before the new opt-out law.

Allison Williams Dobson’s post on March 1 updated readers on the ensuing developments. A Texas news site reported that 800 samples had been sent to a federal Armed Forces mitochondrial DNA database used to help categorize the ethnicity of missing persons’ remains. Department emails revealed that the state had considered publicizing its agreement witha state university for the long-term storage of the bloodspots, but chose not to do so out of concerns about public sensitivity. The plaintiffs’ attorney, Jim Harrington, was furious, a key state legislator felt he had been misled by the omission, and sharp criticisms were traded among the attorneys on both sides.

The bottom line – the destruction of the bloodspots proceeded on schedule.

This unfortunate outcome represents an incalculable loss to the research community and, through their work, to the individuals and families who are waiting for breakthrough treatments for diseases. Realizing what a loss this would be if it couldn’t be prevented, an ad hoc coalition came together in January to try to reach a compromise solution and save the bloodspots. Genetic Alliance, a national nonprofit dedicated to advancing health through genetics, for which I serve as Senior Counsel, brought together privacy advocates, University of Texas researchers, prominent Texans, and technology companies that offer online consent management and biospecimen management services, to try to quickly craft a solution whereby the bloodspots could be saved and parents could be offered meaningful consent options. We fashioned a coordinated program involving not only parental consent tools but also public education on the medical advances that could be achieved if parents allowed their children’s blood to be used in research. The coalition was seeking outside philanthropic funding so that the state would bear no additional cost.

Somewhat surprisingly, we quickly succeeded in reaching preliminary agreement with the plaintiff’s attorney, who was amenable to amending the settlement to postpone the destruction of the bloodspots if progress was being made on a parental consent mechanism. Our team also had numerous encouraging conversations with key legislators who hoped for such a compromise. DSHS, however, declined to open the settlement and postpone the destruction, citing their concern that any further disruption might jeopardize the viability of the newborn screening program intended to protect babies’ immediate health. We were, frankly, hopeful that we might be able to persuade DHSH to change its mind.

But then the story about 800 bloodspots being sent to the federal forensics database ran online. Even though those samples were de-identified and sending them was thus permissible under privacy and research laws, the uproar that followed poisoned the atmosphere in Texas. Tempers flared, accusations flew, the blogosphere of people suspicious of government exploded, and in the words of state Senator Duell, “if there was any way the bloodspots were going to be saved, the whole thing fell apart at that point.”

What can we learn from this highly unfortunate outcome? Among the lessons is that when angry and anxious parents confront state health departments who are trying to run public health programs, we should not be surprised that the long-term interests of research and scientific advances are ignored altogether. Neither parents who would have wanted their children’s bloodspots to be saved and used in research, nor countless parents who are eagerly waiting for the discovery of tests and treatments for their children’s conditions, had any voice whatsoever in the litigation or the public policy decision-making. Likewise, researchers who could have defended the tremendous medical benefits expected from their research played no part. Decisions were made under pressure and stress that simply did not reflect a broad spectrum of society’s interests. In addition, this sad case reveals that the status quo of widespread public ignorance about newborn screening and residual bloodspot uses has a high potential for erupting into acrimony and ill-advised decisions. Ignoring parents’ desires for more knowledge and decision-making will continue to put these bloodspot biorepositories – a national treasure trove for research advances – at peril. Surely, we can do better than this.