Jennifer K. Wagner, J.D., Ph.D., is a solo-practicing attorney in State College, PA, a research associate at the University of Pennsylvania’s Center for the Integration of Genetic Healthcare Technology

Last month, the Pennsylvania General Assembly voted in favor of a bill that would expand the Commonwealth’s criminal database. PA Senate Bill 775 authorizes law enforcement to begin DNA fingerprinting of individuals upon arrest or charge for certain specified crimes (as opposed to only upon conviction) and authorizes familial searching of the state’s forensic database. After third consideration, the amended version of PA Senate Bill 775 passed by a vote of 42-6. The bill has been referred to the judiciary.

The bill had been introduced in March of 2011 by Pennsylvania Senate Majority Leader Dominic Pileggio, who was later joined by a dozen colleagues (including nine Republican and three Democratic sponsors). It immediately garnered the attention of genetics law scholars, including Penn State Dickinson’s School of Law Professor David Kaye, who submitted a thorough statement (pdf) for the Pennsylvania General Assembly’s consideration.

The bill as passed is significantly different from the original bill in at least one respect. The original version of the bill had a narrow, onerous expungement process. That process required an individual to petition the government to have its DNA sample and profile expunged. This process would have put a considerable burden on arrestees whose DNA sample and corresponding DNA profile had been collected at booking. As originally drafted, expungement could only be granted if the individual established by clear and convincing evidence (a relatively high burden of proof) that (1) the charges were dismissed or never filed, (2) there had been an acquittal of the charges, or (3) inclusion was by mistake.

The amended version (pdf) has made the expungement process automatic in some circumstances, mandating that the individual’s DNA sample, record, and profile be expunged if the:

• conviction has ultimately been reversed and the case dismissed;
• charge leading to the individual’s inclusion in the database has been dismissed with prejudice;
• individual has been acquitted of the charge that led to inclusion in the database;
• individual was never charged for the crime that led to the individual’s inclusion in the database;
• prosecutors have decided not to prosecute the individual for the crime that led to the individual’s inclusion in the database;
• charges were not filed within the statute of limitations; or
• individual has been issued an unconditional pardon for the crime that led to inclusion in the database.

It is notable that PA Senate Bill 775 does not limit familial searching to partial CODIS matches but also explicitly authorizes mitochondrial DNA analysis, Y-chromosome analysis, and “[a]ny other suitable method designed to determine that a crime scene DNA profile originated from a close relative of an individual in the State DNA Data Base.”

Ultimately, PA Senate Bill 775’s authorization of familial searching would distance the Commonwealth from its southern neighbor, as familial searching is prohibited in Maryland. Familial searching, discussed on several occasions here at the Genomics Law Report, is permitted in only a few states (including California, Colorado, Texas, and Virginia). A recently published policy report provides valuable background information for those seeking further information on the topic.

Phillip C. Ross is a summer associate at Robinson, Bradshaw & Hinson, P.A. and a rising third-year student at Wake Forest University School of Law.

Many health care providers and other individuals and entities who deal with sensitive patient information may assume that if they comply with the Health Insurance Portability and Accountability Act (“HIPAA”), they need not worry further about the proper use or disclosure of patient data. However, a recent Michigan Court of Appeals decision served as a reminder to those individuals and entities that they must not only ensure compliance with HIPAA, but also any state laws that are more demanding than HIPAA.

HIPAA establishes regulations for the use and disclosure of Protected Health Information (“PHI”) held by “covered entities” (pdf) and “business associates.” PHI is any information held by a covered entity related to health status, provision of health care, or payment for health care that can be linked to an individual.

In Isidore Steiner, DPM, PC v. Marc Bonanni, No. 294016 (Mich. Ct. App. Apr. 7, 2011), the Michigan Court of Appeals held that HIPAA acts as a federal “floor” in establishing standards for the privacy of patients’ PHI. Although Bonanni was decided under Michigan law—and thus is not binding on other states—the decision is likely to be consistent among courts in other states.

The reason? HIPAA explicitly provides that where a state law is more protective of patients’ PHI than the applicable provision of HIPAA—that is, where the state law is more “stringent”—the state law will prevail (pdf).

Breaking Down Bonanni. In Bonanni, the Family Foot Center (the “Center”)—a covered entity—sought to enforce a non-compete agreement with one of its former physicians (Dr. Marc Bonanni). The Center believed that Dr. Bonanni had solicited its patients in violation of the agreement, and as part of pre-trial discovery, the Center requested Dr. Bonanni’s patient lists. Dr. Bonanni objected to this request, asserting that HIPAA and Michigan law protected this information from disclosure unless the Center first gained the consent of the patients in question. The Center filed a motion to compel the disclosure of this information, and the Michigan Court of Appeals chose to apply Michigan law instead of HIPAA.

Generally, HIPAA requires patient consent for the disclosure of PHI, just like Michigan law. However, with respect to responding to a subpoena or discovery request, HIPAA and Michigan law are in conflict. While a HIPAA exception allows for an entity to disclose an individual’s PHI without a written authorization in this situation, Michigan law contains no such exception. In Bonanni, the Court held that Michigan’s law provided more stringent protections than HIPAA for the PHI at issue, and so it applied Michigan privilege law in denying the Center’s discovery motion.

What Bonanni Teaches Us About PHI. The Bonanni ruling certainly limits the information that physicians can release during legal proceedings in Michigan. This will also likely be true in other states with similar discovery laws, as evidenced by a recent California Supreme Court ruling upholding a lawsuit (pertaining to the disclosure of medical records to a credit reporting agency) brought under a state medical information statute with provisions more stringent than HIPAA (Brown v. Mortensen (pdf), Case No. S180862 (Cal. Jun. 16, 2011)). There, too, the court held that HIPAA “authorized and encouraged further state regulation” in matters of patient medical privacy.

However, individuals and entities in every state deal with PHI in many other mediums and contexts outside of a discovery request during litigation, and Bonanni’s broader lesson is that HIPAA serves only as a federal floor when it comes to patient privacy provisions.

For instance, a Health Information Exchange (“HIE”) (also known as a Health Information Organization (“HIO”)) deals with PHI through the use of electronic health records (“EHRs”). An EHR contains sensitive patient data—including certain demographic information that would identify the patient—and it follows the patient to any and all hospitals to which he or she goes. The HIE/HIO pulls in data relating to that patient from the insurance company or government agency, from hospitals and physician offices, labs, pharmacies and other sources of clinical and administrative data. Then, the HIE/HIO provider may, among other things, analyze the patient information and derive alerts and recommendations to turn the data into actionable information. The benefits of such a program are wide-ranging, from simply reducing paper to creating an accessible information portal that enables physicians to coordinate care, use clinical research to devise the best treatments, encourage prevention and better manage chronic conditions.

In short, the effective use of EHRs by HIE/HIOs and other HIPAA covered entities is central to the continued progress of personalized medicine. Nevertheless, while an EHR program may provide a number of important benefits, it is also susceptible to PHI security issues under HIPAA and/or any other “more stringent” state laws, which could present the same state law preemption issue addressed in Bonanni.

For example, if an HIE/HIO—or any other entity subject to HIPAA—wished to use PHI in the course of conducting research, HIPAA would allow (pdf) such a use of PHI with individual authorization, or without individual authorization under limited circumstances. State law, however, may not be as flexible, and many states may lack a research exception to the use of PHI or may require different standards for individual authorization. In such a scenario, the more stringent state law is likely to prevail, restricting the ability of the HIE/HIO or other HIPAA-covered organization to use PHI to conduct research, no matter how important.

As shown by this hypothetical, despite the importance of PHI to the development of EHRs and the advancement of research essential to personalized medicine’s progress, Bonanni and Brown each make clear that that individuals and companies utilizing PHI must consider more than just HIPAA compliance. In fact, those individuals and entities who operate at a regional or national level would need to consider multiple (or even all) states as part of an effective compliance strategy.

Individuals and entities who deal with PHI should contact a qualified attorney who will undertake a detailed analysis of the applicable federal, state, and local laws prior to making any disclosure, transmission, or other use of PHI. By considering all sources of law, and not just the federal rule, health care providers, researchers and technology developers can minimize the inherent risk in dealing with PHI and work towards full compliance with privacy laws.

Patent Reform Legislation Passes House. Several months after the U.S. Senate passed patent reform legislation that would make sweeping changes to America’ patent system, including a switch from a first-to-invent to a first-to-file system for awarding patents, the U.S. House of Representatives finally followed suit yesterday, passing a similar piece of legislation by a vote of 304-117. The version passed by the House, while similar to that passed by the Senate, contained a number of last-minute amendments (pdf).

One change of particular relevance to the personalized medicine community was the removal of a proposed safe harbor for second opinion genetic diagnostic testing, which was replaced by a requirement that the U.S. Patent and Trademark Office (USPTO) investigate the relationship between genetic diagnostic tests, gene patents and exclusive licenses. The USPTO would be given nine months to complete its investigation and to return to Congress recommendations for ensuring the availability of second opinion genetic diagnostic testing. (The USPTO study on genetic diagnostic testing was not included in the bill passed by the Senate in March.)

With both the House and the Senate having now passed patent reform legislation, the next step appears to be a House-Senate conference to resolve inconsistent provisions in the two bills, although according to The Hill it is unclear how soon such a conference will take place.

UK Government Pulls Plug on Human Provenance Project. Nearly two years after the Human Provenance Project was first unveiled (to substantial scientific criticism), the government agency responsible for the project, the UK Border Agency, has finally pulled the plug. The project would have used DNA and isotope analysis of tissues from asylum seekers in an attempt to evaluate their nationality and render immigration decisions. After a wave of criticism following the program′s announcement, and after spending more than $300,000 on screening, the UK Border Agency has scrapped the program in its entirety.

As we wrote back in 2009, the poorly conceived project threatened to disrupt what has been—in both the UK and in the United States—a slow and delicate process to craft legislation, regulation and policies that promote genomic science and the use of personalized genomic data while addressing concerns over the potential misuse of those data. As we wrote then, “with so much genomic science and policy yet to be written, even minor developments produce outsized effects, which makes the potential consequences of the Border Agency’s project so worrisome.”

Thankfully, the UK Border Agency quickly paused the project following initial concerns and, nearly two years later, it appears that no lasting damage has been done. Still, the Human Provenance Project should serve as a reminder to governments worldwide of the need to carefully and publicly vet state-directed personal genomics programs prior to their implementation.

Roundup of tweets from the intersection of genomics, personalized medicine and the law:

• Combined w/ this week’s GenomeQuest announcement (http://bit.ly/kCp0j2) & it’s clear clinical, commercial WGS is here. Now.
• Omicia releases genome annotation software (incl. for clinical/commercial applications) http://bit.ly/l1XpJ6 HT @neandrothal @EricTopol
• FDA report on challenge of monitoring imported food, drugs (http://1.usa.gov/mmWpgd) hints at > difficulty monitoring info-based Dx/devices.
• Study: FDA device clearance times rose 37% since 2006: http://bit.ly/jRxrrV Other news: FDA device studies criticized: http://bit.ly/jGVBH0
• FDA accused of focusing too much on safety (http://bo.st/mCCad9) & of doing too little: http://bit.ly/il4maZ Damned if you do…
• Finally responding to this @genomesunzipped thread. Agree w/ @dkgppc re: need for more data: http://bit.ly/mERhg8 Any ideas how to collect?
• The beat(down) goes on: FDA accused of being a “wet blanket” & “crushing innovation” by MA senator: http://bo.st/kTWrmk
• GLR Post: Prometheus Returns to the Supreme Court, Medical Method Patent Speculation Intensifies: http://bit.ly/kqnDWP
• MT @danielg280: Doing a Webinar 6/21 on legal issues re healthcare & social media w/ @healthblawg http://bit.ly/l2SFvY
• High-level explanation from @wilbanks why for patents, unlike copyrights, transparency is priority #1: http://bit.ly/mRqJAv
• Great idea. MT @RyanMFierce: NC wants to help cash-strapped biotechs w/ $100M in loans http://bit.ly/mau3Gj cc @GlenCaplan
• Still, for efforts like the Human Provenance Project, it can be difficult to unring the bell: http://bit.ly/kRciNK
• $300K too late, but right decision. RT @NatureNews: UK immigration cancels DNA screening programme http://goo.gl/fb/YwQ49
• “The 3 letter word for-the gene FOR something-is the most dangerous word in genetics.” http://bbc.in/mKTY1P HT @eurogene
• MT @matthewherper @ivanoransky @charlesornstein: Despite FDA Criticism, Cancer Drugs Reach Pts Sooner In US Than Europe http://bit.ly/msJTuL
• RT @SampleGW: New Consortium Aims to Streamline Accreditation, Proficiency Testing: http://bit.ly/lBJBLD
• Let’s just hope we do better than MSWord. RT @FierceHealth: Patient rights, safety at heart of #EHR track changes debate http://htl.li/5jkIR
• RT @SampleGW: Medicare to Cover Pathwork Diagnostics’ Tissue of Origin IVD Nationwide: http://bit.ly/kIIOmW
• Well said, @23andMe: “research is a two-way process, where participants are valued as partners in sci. discovery.” http://bit.ly/lgWLrW
• GLR Post: Update: Proposed Second Opinion Safe Harbor for Genetic Diagnostic Testing Withdrawn: http://bit.ly/kOX7qx
• ACLU-led coalition opposes proposed safe harbor for 2nd opinion Dx testing, citing “unintended harms”: http://bit.ly/lJKrqL
• Not only co. to shift focus, at least for moment. MT @RyanMFierce 95% of @Knome revenue from R&D, 5% from customers. http://bit.ly/lFwPow
• House debate on patent reform bill delayed until (at least) next week: http://bit.ly/jtbjY1
• RT @dgmacarthur: New community forum for @CompleteGenomic users: http://bit.ly/kHoys3 Just signed up – interested to see how active it gets.
• GLR Post: DTC Genetic Testing and the FDA: is there an end in sight to the regulatory uncertainty? http://bit.ly/koxrjn
• GLR Post: House Introduces Patent Reform Proposal to Permit 2nd Opinions in Genetic Diagnostic Testing http://bit.ly/j5DeWl
• AdvaMed’s “competitiveness policy” urges creation of “office of medical innovation policy” w/in White House: http://bit.ly/iqXXv9 Good idea.
• “Med-tech CEOs storm Capitol Hill”: http://bit.ly/iBBJNz by @MassDevice Seem unlikely to hear Shuren’s plea for mercy
• Meanwhile, @dgmacarthur @lukejostins & I wonder when DTC regulatory uncertainty might end: http://bit.ly/lxLKda
• CDRH Director Shuren says criticism is affecting hiring, slowing agency: http://bit.ly/maZddr HT @dgmacarthur
• Ion Torrent ($LIFE) expects 400bp reads by year end, $1K genome beginning of ’13: http://bit.ly/kf3tVZ @InSequence
• Update on Noblegen’s “optipore” sequencing tech; targeting clinical seq tests, ’14 debut: http://bit.ly/m55KhH @InSequence
• RT @BVBigelow: BioNanomatrix Moves HQ and nano-scale molecular analysis tech to San Diego’s diagnostics cluster. http://bit.ly/iA2JHx
• RT @RyanMFierce: Broad Institute’s planned expansion roughly the size of two Wal-Mart stores. Wow. http://bit.ly/lCBlsf by @BBJNewsroom
• RT @DailyNewsGW: NIH Awards $200M for New CTSA Sites: http://bit.ly/lO3pdA
• Twin’s rare disease diagnosed, cured. Another “win” for whole-genome seq: http://bit.ly/kuxupr by @Erika_Check HT @drgitlin
• RT @PGxReporter: MDx/PGx Highlights from ASCO 2011: http://bit.ly/mJSwL1
• GLR Post: House Introduces Patent Reform Proposal to Permit 2nd Opinions in Genetic Diagnostic Testing http://bit.ly/j5DeWl
• RT @JohnCFierce: Cancer collaborations are all the rage – but you already knew that. http://bloom.bg/jyuqHA by @robertlangreth
• The “strangest biotech of all” ($UTHR) by @matthewherper, incl a look at its comic book annual report (really): http://onforb.es/lNfZ9w
• RT @dgmacarthur: MT @westr Illumina launching 5M-variant whole-genome genotyping array – the Omni5 – focus on rare variants: bit.ly/ilnaL2
• RT @ldtimmerman: Getting ready for debate on open source bio w/ @sagebio founder Stephen Friend, MIT’s Phil Sharp http://bit.ly/jshQ77
• +1. RT @neandrothal: Chrome extension soon? MT @dgmacarthur: update to handy @SNPTips FireFox plugin for @23andMe data: http://bit.ly/iCDxuP
• The perfect Father’s Day gift? It’s probably not a paternity test: http://bit.ly/iG1QJ9 by @SampleGW
• Here’s more from @23andMe on the breakdown of their database: http://bit.ly/lfldx2 Note that not entire 100K have opted in for research.
• DTC company @23andMe continues to reposition itself, emphasizing reasearch database (now 100K): http://bit.ly/mNnJPF
• Following @phylogenomics for tweets from #synbio5, including current coverage of @geochurch’s talk.
• RT @dgmacarthur: Serious congrats to @markgfh, who won both the European Best Cancer Reporter award & Royal Statistical Society prize today!
• Beginning w/ improved understanding of heterogeneity. RT @FierceBiotech @MaverickNY: changing cancer research paradigm. http://bit.ly/mtJc4y
• RT @JohnCFierce: My take on E&Y’s annual biotech report: It’s tough out there, says Giovannetti http://bit.ly/mm2pN3
• MT @Knome: Today we announce the launch of kGAP 2.0, the 2nd ver. of our #genome interpretation engine http://ow.ly/5hfR7
• RT @genomesunzipped: New Interpretome website provides many handy tools for analysing your @23andMe data: http://bit.ly/lHd2Yw
• RT @LifeSciVC: Welcome my Atlas partner @JFFormela to the Twittersphere. He will undoubtedly have blazing content & sharp wit to add
• RT @westr: 23andMe’s customer breakdown by ethnicity, via @CeCeLMoore http://tinyurl.com/3h5zcv8
• RT @GenCounsNews: Update on advanced degree task force for genetic counselors, including a webinar later this summer http://bit.ly/ilBTHD
• & SEC. Still, can be done. RT @elainewestwick: suspect IP/secrecy concerns a challenge re: Twitter/biotech http://bit.ly/kTWx63 @ldtimmerman
• Brief recap from last week’s MDMA meeting, including familiar FDA criticism from Senator Hatch: http://bit.ly/jwEzdv by @FierceMedDev
• Commons Principles from @Sagebio posted: http://bit.ly/jHEAp2 Ambitious, essential & endorsement-worthy. Add your voice.
• Congrats to @KeonaHealth, Sarda Tech (my dad’s new venture) & others on NC IDEA innovation grants: http://bit.ly/mKsgJd
• Exciting news. RT @neandrothal @NextBio: blog is back w/ a screenshot of upcoming new public site! http://wp.me/pmGXL-e6
• DTC genetic testing company @Lumigenix: “our response to a recent letter from the FDA”: http://bit.ly/lzfL6o
• “I joined GenomeQuest b/c they offer technology to make whole genome dx avail. to patients today-not 10 yrs from now.” http://bit.ly/jR2gVx
• Why Twitter matters for biotech, by @ldtimmerman: http://bit.ly/kTWx63 No surprise, lawyers even slower to adopt Twitter.
• Post by @eurogene on breast feeding, IQ, genetic testing & DTC: http://bit.ly/lGjrDp Comments from @23andMe or @ExistenceG?
• $0.02 from @matthewherper on @patientslikeme tool to match patients to trials using Clinicaltrials.gov: http://onforb.es/m3VmVw
• RT @dgmacarthur: Congrats to @genomesunzipped colleague Don Conrad on his new Nat Genet paper on human mutation rates: http://bit.ly/mhyXgu
• RT @drjonboyg: Raised in this wk’s In Our Time: was germ theory or cracking genetic code biggest leap in human health? http://bit.ly/mkY7p8
• Will need more than 31 senators. RT @NatureNews: NIH finds a few new friends in budget chill http://goo.gl/fb/mfM8O
• RT @westr: “Consumer Genetics Conference Wrap-up – Most Interesting Moments?: http://bit.ly/m5BStq #CGC2011″ -via @wimufi
• MT @mary_carmichael: @dgmacarthur Screenshots don’t do it justice. Key is in use: easy to navigate, cross-ref diff types of content.
• Privacy vs. efficacy driving debate over opt-in or opt-out approach to state EHR systems: http://bit.ly/fD5mF8
• GLR Post: News Roundup: Perception Gaps and Progress in Personalized Medicine: http://bit.ly/kWv9nn
• Company for Shuren? “Health Canada upbraided for inspections of medical devices.” http://bit.ly/l4Kw9e
• RT @BiotechPatent: FDA takes ‘first step’ toward greater regulatory certainty around nanotechnology http://1.usa.gov/jipVTX
• Drugmakers’ Commitment to Personalized Rx Growing Despite Barriers, PhRMA CEO Says: http://bit.ly/jBcQ73 by @PGxReporter
• RT @dgmacarthur: Screenshots of the $ILMN iPad personal genome browser (HT @BioITEditor): http://bit.ly/k06xA9 Surprisingly amateurish.
• RT @genome_gov: Cool 7/18 meeting: Using crowdsourcing for scientific innovation @ NIH’s Natcher auditorium (also webcast) http://qoo.ly/4z7
• FDA ruling on $OREX’s Contravene obesity drug risks driving scarce R&D resources from important field, says @LifeSciVC: http://bit.ly/la5nsi
• RT @cwhogg: Wireless dominates patents for heart, glucose monitors http://tinyurl.com/3ur7jmz
• RT @scotthensley: Curious to see how it’ll work. RT @phrma: Forthcoming @US_FDA Facebook page that will answer ppl’s questions about drugs
• #ASCO11 wrap-up from @ldtimmerman for those (read: all of us) who had difficulty following all of the news: http://bit.ly/kDFaA2

What should we make of this three state “groundswell?” Although not identical in scope or substance to the Massachusetts Genetic Bill of Rights (“MA GBR”), both the Vermont and California proposals appear to reflect a concern (shared by the MA GBR) that, at least when it comes to the use and misuse of genetic information, the current system of federal oversight is inadequate. Then again, as the legislative findings section of the California proposal (pdf) puts it, perhaps “the current explosion in the science of genetics” simply “compels legislative action in this area.”

Today we’ll dig into Vermont’s proposed H.368: “An act relating to privacy of genetic information” (pdf) (the “Vermont Act”). Next week, we’ll tackle California.

The Value of a Genome. In many respects the Vermont Act closely resembles the MA GBR we covered in detail last month and shares its emphasis on genetic information as a personal property right.

Nowhere is this clearer than where, matching the MA GBR word-for-word, the Vermont Act proposes the insertion of a new provision into Vermont’s existing genetic testing statute, declaring “genetic information the exclusive property of the individual from whom the information is obtained.” 18 V.S.A §9330 The Vermont Act goes on to confer upon genetic material the status of “ real¹ property subject to one’s individual control and dominion in accordance with generally held precepts of property law in Vermont.” 18 V.S.A. §9336(a)

After codifying property rights in genetic information, the Vermont Act, just like the MA GBR, goes on to require that any individual engaged in genetic research or commerce be “made aware both orally and in writing that his or her donation is a commodity and is of some material value.” And if the transaction of genetic information occurs in a for-profit context, the individual would be entitled to “compensation at fair market value.” 18 V.S.A. §9336(c) To be sure, we’re still no closer to articulating a valuation method for genetic information than when the idea was first proposed in Massachusetts earlier this year.

Ambition vs. Reality. There are also a few areas where, in its zeal to protect individual genetic rights, the Vermont Act goes a step too far and appears to conflict with federal law, with potentially problematic (or at least confusing) results.

For example, the addition of 18 V.S.A. §9336(d) would provide that:

Any report or record produced by or stored at a hospital; dispensary; laboratory; hospital-affiliated registry; physician; commercial genetic testing company, agency, or association; or insurance institution or its representative pertaining to any genetic information is the exclusive property of the individual sampled or analyzed. Such report or record shall not be considered to be a public record, and the contents thereof shall not be divulged by any person having charge of or access to the report or record without informed written consent… (emphasis added)

While there are three minor exceptions to §9336(d), none would save the provision from a nasty conflict, at least on its face, with other federal laws, including the Health Insurance Portability and Accountability Act (HIPAA).

Under HIPAA, covered entities (including healthcare providers, such as hospitals and physicians) and their business associates are not required to obtain prior consent for certain uses and disclosures (e.g., for treatment, payment and health care operations) of protected health information, including genetic information. The prior consent requirement was removed under HIPAA in certain instances due to its unintended effect of preventing “timely, quality health care to individuals in a variety of circumstances.” The Vermont Act’s supporters should take another look to ensure that §9336(d) would not produce the same unintended effect under Vermont law.

Next is §9336(e), an even broader and more confusing provision:

Information derived from the sequence of the human genome shall be part of the public domain and shall not be considered the property of any individual. Nothing in this chapter shall be construed to grant an ownership right to any individual or entity utilizing the publicly held information from the sequence of the human genome in the furtherance of the creation of a venture or enterprise, including any genetic goods, products, or services.

At first blush, this appears to be more of a statement of policy by the Vermont Act’s sponsors than a statement of law. §9336(e) refers to “the sequence of the human genome,” not a sequence of a human’s genome, and the term “genome” does not appear in the Vermont Act (or in Chapter 217 of the V.S.A.) outside of this single proposed provision.

While efforts to place genomic information in the public domain – including the work of Genomes Unzipped, the Personal Genome Project, SNPedia and The Sage Commons, to cite several such public genomics projects in which we are actively involved – are laudable, mandatory public genomics is not exactly the provenance of the Vermont state legislature.

Or perhaps this is just Representatives Pearson and Wizowaty’s way of asserting their support for the plaintiffs in the ongoing Myriad gene patent litigation by asserting, more than a decade after the fact, that none of the Human Genome Project’s fruits shall be patentable. (Although here, too, Vermont would be treading far outside the scope of its legislative authority.) Either way, this is one provision of the Vermont Act that will need to be either clarified or axed before passage.

Consumer Protection. The Vermont Act comes back to earth, and in line with the MA GBR, in proposing the addition of 18 V.S.A. §9339 and §9340, which together restrict the use of genetic information in marketing and instruct the “consumer protection unit in the office of the attorney” to “investigate and prosecute complaints relating to genetic goods, products, and services.”

As we have argued in the past, when it comes to the burgeoning field of genetic and genomic commerce, one logical and welcome form of regulation would be increased oversight from consumer protection agencies, including both state-level enforcement, as proposed by the Vermont Act, and increased national-level oversight from agencies like the Federal Trade Commission (FTC). (While the possibility of FTC oversight for genomic commerce was back in the news last week, specifically in conjunction with the FDA’s public meeting to discuss direct-to-consumer genetic testing, there are also numerous other areas of genomic commerce that might benefit from increased oversight from consumer protection agencies.)

§9339 also explicitly prohibits “genetic profiling,” which includes any effort to link an individual’s “demographic information” to her “genetic information or genetic material for marketing purposes.” However, the provision would not prohibit marketing on the basis of genetic data if those data were aggregated, did not contain identifying information and could not be used, “directly or indirectly, to obtain identifying information.” That would seem to be a fairly broad safer harbor for would-be “genetic profilers,” but given the inherent difficulty in ensuring that seemingly de-identified genetic information, even when aggregated, won’t be re-identified, this marketing safe harbor might prove to be rather limited in practice.

GINA’s Gaps, Again. As we noted in examining the MA GBR, the Genetic Information Nondiscrimination Act of 2008 (GINA) contains several gaps in its prohibition of insurance discrimination. Notably, while prohibiting healthcare insurers and employers from discriminating on the basis of genetic information, GINA does not address the use of genetic information in long-term care, life or disability insurance.

Even prior to GINA’s passage, Vermont was one of a handful of states with relatively robust statutory protections against genetic discrimination in insurance. Under current Vermont law (18 V.S.A. §9334), no insurance policy—including long-term care, life and disability insurance policies—may be “underwritten or conditioned on the basis of” a required genetic test of an individual insured or the results of a genetic test of any member of the individual’s family. §9332, however, currently permits insurers to require genetic testing in situations where doing so would not violate §9334.

The Vermont Act would revise §9332 to prevent insurers from requiring genetic testing in any setting, regardless of whether it would violate §9334. In combination with §9332(d), the Vermont Act would prevent any insurer from soliciting genetic testing without first obtaining “prior written authorization and informed consent,” including providing a warning that the results of such test might become part of the individual’s permanent medical record or materially impair the availability of insurance benefits. The Vermont Act would not, however, deny such solicitations by insurers outright.

The Vermont Act would also prohibit places of public accommodation (9 V.S.A. §4502) and financial institutions supplying credit (8 V.S.A. §10403) from discriminating on the basis of genetic information.

What does it mean? As with the MA GBR, it is crucial to emphasize that the Vermont Act is a legislative proposal and not current state law. We do not know what level of support the Vermont Act enjoys within the state legislature but, should it pass, the implications—both good and bad—would be substantially similar to those we discussed in our review of the MA GBR.

Next week we’ll examine another legislative proposal, from California, and ask whether these recent developments represent a groundswell of support for more robust genetic privacy legislation.

—————————————————————

¹ The text of the Vermont Act says “real property,” although this would seem to be a clear mistake as real property or real estate refers to land and not to personal or intangible property.

Taken as a whole, the legislation, if enacted, would confer upon Massachusetts residents a significantly expanded set of genetic rights than exist under current federal law. Below we examine several of the bill’s most noteworthy proposals.

The MA GBR addresses perceived gaps and limitations in the coverage provided by major federal statutes, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Genetic Information Nondiscrimination Act of 2008 (GINA), and the Constitution of the Commonwealth of Massachusetts, by seeking to place genetic information on a par with medical records.

The MA GBR’s provisions set basic limitations on the use, including the commercial use, of personal genetic information that would go above and beyond the user agreements and privacy policies employed by some commercial services. For example, the MA GBR prohibits the use of genetic information for marketing or determining credit worthiness. With the proliferation of genetic information, particularly in consumer or commercial contexts, such basic limitations would help address concerns about the lack of mandatory restrictions regarding the sale, transfer or other use of personal genetic data.

The Personal Property Theory of Personal Genomes. But the MA GBR goes much further than mere consumer protection reforms. Section 1 of the proposed legislation explicitly declares genetic information to be “the exclusive property of the individual from whom the information is obtained.” (emphasis added)

Granting individuals express property rights in their genetic information would be significant. Not only does the MA GBR contemplate genetic information being controlled from the grave – individuals may bequeath to a surviving spouse or family member authorization to use their genetic information under the terms and conditions of their will – but the MA GBR also recognizes the inherent monetary value of genetic information. For example, the proposed bill would require that, prior to entering into a contract to share one’s personal health information, genetic material or genetic information, the individual must be notified, orally and in writing, that “their donation is a commodity and is of some material value.” (Section 1(b)) Further, if the collecting entity has a possible future intent to commercialize the genetic information, the individual donor “must be made aware and compensated at a fair market value.” (Section 1(b))

Supporting these and other MA GBR restrictions on the use of genetic information are the bill’s proposed civil and criminal penalty provisions, which are likely to generate considerable discussion as the bill works its way through the legislature. On the civil side, violations of the MA GBR are automatically violations of the state’s unfair or deceptive practices act (Chapter 93A Section 2), and violators additionally are subject to statutory damages of $5,000 ($100,000 if the MA GBR violation resulted in profit or monetary gain to the violator). The bill provides for both a private and public right of action, and it carves out only limited exceptions for violations by members of law enforcement, employees of the state DNA database, and those working under judicial order. On the criminal side, Section 16 of the MA GBR amends the Commonwealth’s Identity Theft Law (Chapter 266 Section 37E) to add genetic information to the list of “personal identifying information” protected from identity thieves. The identity theft law currently defines “personal identifying information” to include, among others, a person’s social security number, mother’s maiden name, financial account numbers and computer passwords. If the MA GBR is passed, those found guilty of identity theft stemming from the misappropriation of genetic information could face maximum fines of $5,000 and imprisonment for two-and-one-half years.

While individual citizens may have little chance of detecting or deterring larger entities from illicitly obtaining or using genetic information, the MA GBR provides at least the possibility of government action in the face of such violations. The civil and criminal penalties provided by the MA GBR, if enacted, would offer one of the strongest set of protections yet against surreptitious genetic testing.

The Next Generation of GINA? The MA GBR also seeks to expand upon the protections afforded by the Genetic Information Nondiscrimination Act of 2008 (GINA). GINA comes in two parts and prohibits genetic discrimination by healthcare insurance providers (Title I) and employers (Title II).

Despite its broad protections, which are still being implemented, GINA has several widely recognized gaps. Most notably, Title I of GINA does not proscribe genetic discrimination in the areas of long-term care, life or disability insurance.

The MA GBR seeks to expand on Massachusetts’ already broad protections against the use of genetic information by insurers while plugging some of the gaps left by GINA. Section 2 strikes language in Massachusetts law that currently allows insurers to use genetic information submitted on an insurance application to set terms for the applicant’s disability or long term care insurance policy. (See Chapter 175, Section 108I(c)) Section 3 similarly addresses life insurance. (See Chapter 175, Section 120E) Section 4 addresses auto insurance. Taken as a whole these provisions would significantly revise current Massachusetts insurance law and create what would appear to be, at least with respect to the use of genetic information, the most insured-friendly climate in the entire country.

It should come as no surprise that Massachusetts, of all states, would have an interest in addressing the gaps in GINA’s coverage. The widely-publicized Risk Evaluation and Education for Alzheimer’s Disease (REVEAL) study, led by researchers at the Boston University School of Medicine, has for years published data suggesting that genetic information (in this case genes associated with Alzheimer’s susceptibility) can have a material effect on an individual’s decision to purchase long-term care or life insurance. Though such a genetic test is not currently common, or thought to be commonly requested or utilized by insurers in determining coverage or setting rates, Massachusetts residents and lawmakers are clearly aware of the issue and the potential consequences of GINA’s limitations.

A Bill of Rights or a Barrier to Progress? The merits of the MA GBR will be heavily debated on Beacon Hill over the course of the coming months. Turna Ray of Pharmacogenomics Reporter noted last week that, as of early February, the bill had the support of six Massachusetts state senators and 13 state representatives. Despite speculation that private interests, particularly insurers, might seek to block the bill’s passage – or at least scale back its protections – Steve May, the executive director of the Forum on Genetic Equity, the advocacy group which crafted the bill, is confident that the MA GBR will pass.

Whether the MA GBR passes in its current form, or indeed whether it passes at all, one fact is inescapable – the MA GBR’s efficacy will be inherently limited by geography. And that geographic limitation could also produce unintended effects on personalized medicine innovation, both within Massachusetts and more broadly.

While the MA GBR would provide an unprecedented degree of security and control to Massachusetts’ residents and their genetic data, has it struck the proper balance against other considerations? For example, while the bill carves out minor exceptions for law enforcement, employees of the state DNA database and those acting upon judicial orders, those safe harbors are probably not broad enough to protect all legitimate scientific and research activities. Further, such a dramatic increase in the proscribed uses of genetic data, and in the restrictions and costs imposed even on lawful uses, could well erect unintended barriers to the type of innovative genetic research conducted at numerous Massachusetts institutions – both non-profit and for-profit. For example, would the added compliance and compensatory costs of the MA GBR (just what is the fair market value of an individual’s genome these days anyhow?) discourage academic or commercial users of genetic data from seeking out or even accepting Massachusetts residents?

This is a delicate line to walk. On the one hand, thanks to a decade of progress since the first human genome was sequenced, widespread personalized genetic data is not only possible – something we could not say as recently as a few years ago – it is more meaningful and, yes, more valuable than ever before. On the other hand, as we are frequently reminded, we have a long way to go in our understanding of human genomics, including how to use personal genetic data to bring about truly meaningful improvements in our health and quality of life.

In addition to the myriad scientific and technological challenges which must be overcome, for the next decade of human genomics to be a successful one, law and policy makers must work with the public to balance individual rights against societal interests. The push to create strong individual rights in genetic data, and to couple those rights with robust privacy protections, must also acknowledge the vital importance of broadly collecting and sharing genetic and other health data in research, clinical and commercial settings. The trick will be to design systems strong enough to prevent abuse but flexible enough to promote innovation and adapt to not only changing scientific, medical and commercial practices but also to evolving social attitudes around genetic data.

While it is clear that change in our legal and regulatory structures is needed, it is not clear if the MA GBR represents the right sort of change. On the one hand, as the Forum on Genetic Equity’s press release (pdf) and the legislation’s name itself declares, the Genetic Bill of Rights may represent fundamental and needed change that will pave the way for sweeping federal changes. On the other, and just like the New York bill we discussed last month, the bill may be an overly protectionist “legislative band-aid” that would grant excessive genetic rights and privacy protections to a minority of individuals at the expense of more meaningful commercial, scientific and clinical innovation.

Just as important as the potential effect of the Massachusetts legislation on Massachusetts residents and researchers is its effect on the ongoing national conversation about these issues. Certainly, legislation that takes effect in Massachusetts would have an outsized effect on biomedical research, investment and innovation, given the prominence of Massachusetts in these areas. But ultimately a patchwork of state regulations cannot be the answer. Whatever the balance to be struck between individual genetic rights and privacy and the needs of genomic research, medicine and commerce, this is an issue that is by its very nature national – and even global – in scope.

Credit the Forum on Genetic Equity and its Beacon Hill supporters for aggressively pursuing these issues, and continuing to push the dialogue forward. Ultimately, however, for the next decade of genomics to be anywhere near as successful as the previous one, meaningful regulation will require much more than the MA GBR, or similar state-level efforts. It will require a major and coordinated national and international effort to replace our current patchwork scheme with one that protects personal genomic data while providing the clarity and flexibility researchers, clinicians and companies need to unlock the potential of those data.

A number of newer developments have caught our attention.

The Council for Responsible Genetics (CRG) in Cambridge, Massachusetts and GeneWatch UK teamed up to announce a new online resource called National DNA Databases last month. The website focuses heavily on the controversial topics of familial searching and advance DNA collection (requiring a DNA sample of all arrestees, when charges are filed, or as part of a plea bargain). In addition to information about 56 nations operating DNA databases around the globe (inaccessible to the public), this resource includes U.S. maps showing “State Rules on Partial/Familial Searching” and “States Collecting DNA Samples from Arrestees,” (same link) both discussed below.

Partial DNA Matching Expanding. Law enforcement officials typically search DNA databases for a profile that matches DNA from a crime scene sample. Partial or familial searching of DNA databases is a new method that allows the searcher to detect profiles that share some aspects of the crime scene DNA when no exact match is found. In states where this type of search is permitted, a partial match may generate new leads through investigation of close relatives of the person whose profile was in the database. All convicted felons and members of the military have been profiled in the U.S. databases for many years now, and increasingly many others are also included (see below). Partial matching effectively broadens the investigator’s castnet to reach close genetic relatives of everyone in the databases. Those family members can then be openly investigated or DNA tested through surreptitious sampling (considered legal because trash is public domain with no associated privacy rights, and thus a discarded coffee cup is fair game).

Last year Cass reported data from 2009 indicating that at least 15 U.S. states allowed the use of partial matches, but at least 10 of those required that the partial match be discovered unintentionally. It can be difficult to determine which states are actually utilizing this tool, because it often takes time to develop an official policy. However, the CRG website says that today at least 15 states allow intentional partial match searches, at least 6 allow a partial match to be utilized if discovered unintentionally, at least 5 have a “draft policy under review,” and 13 are operating under unknown policies. Only 11 states continue to prohibit partial matching and familial searching altogether.

Critics point out that partial matching is problematic for several reasons. For example, being related to a convicted felon or member of the military has no bearing on one’s own innocence. Vocal Maryland defense attorney Stephen Mercer says, “If my brother’s DNA ends up in the database, and he’s forfeited his privacy rights by becoming a convicted felon, has he also forfeited my privacy rights as a wholly innocent family member?” Likewise, members of the military do not intend to compromise their relatives’ genetic privacy simply because they agree to submit their own DNA samples.

Another problem is that the U.S. African-American population currently comprises a disproportionately large percentage of the databases because of their overrepresentation in the prison system. Therefore, partial matches leading to relatives of those in the databases will also disproportionately target African-Americans for criminal investigation. According to CRG, although African-Americans are only 12% of the U.S. population, their profiles constitute 40% of the Federal database. Creating a national database with DNA profiles for all U.S. citizens would go a long way toward solving this problem, but critics of that plan object on the grounds that requiring U.S. citizens to submit DNA is an unconstitutional invasion of bodily privacy.

On the other hand, familial searching is in fact an effective crime-fighting tool. The practice has greater public approval in the UK, where the technique famously led to the identification of the “Shoe Rapist” because of a partial match with his sister. The percentage of the total UK population represented in the national database is much greater than in the U.S. Now, a British MP is calling for DNA testing of the entire male population of Bristol, around 250,000 people, to help solve the murder of Joanna Yeates in December, 2010. Media reports indicate that there was no evidence of sexual assault, but that saliva was found on the exterior of Ms. Yeates’s clothing. And when predators remain at large in the U.S., such as in the Virginia case of Morgan Harrington and the recently announced serial killer in New York, familial searching increasingly gains support in this country too.

Advance DNA Collection Also Expanding. Advance DNA collection in the U.S. also continues to expand at various stages of the criminal procedure timeline. Previously, only persons convicted of felonies were required to submit DNA samples for federal databases. In fact, until 2004, federal law prohibited maintenance of DNA profiles in the databases for anyone who was subsequently acquitted. A very different picture exists now, according to CRG:

Today, 44 states collect DNA from anyone convicted of a felony, 39 states collect DNA from those convicted of certain misdemeanors, 28 collect DNA from juvenile offenders, 6 states collect DNA of all individuals arrested and some states (such as California) have started to retain DNA from individuals identified as “suspects.” Still other states such as Louisiana and New York have been discovered to have “offline” DNA databases including DNA samples and profiles taken from victims or suspects never charged with a crime.

Of particular interest is New York, where Governor David Paterson proposed legislation last year that would require even those convicted of low-level misdemeanors to submit DNA samples. That proposal has been moving slowly in the state legislature, but in the meantime, State Division of Criminal Justice Service Acting Commissioner Sean M. Byrne has issued a letter “strongly encouraging district attorneys in the state to require a DNA sample as a condition of all plea bargains.” Also in December, 2010 in California, Orange County officials unanimously voted to renew the District Attorney’s “spit and acquit” DNA collection program for another year.

Other Expansions of Forensic DNA. Massachusetts gave us the most surprising legal event of 2010 in the world of forensic DNA. The state’s highest court, the Supreme Judicial Court, affirmed the indictment of a DNA profile as a proxy under the name “John Doe” to circumvent the 15-year statute of limitations for rape, which was set to expire in that case. Critics of this decision point out that it essentially does away with the statute of limitations for cases with DNA evidence. The office of the state Attorney General, however, says it will “ensure that the clock does not run out on the use of DNA evidence to hold dangerous predators accountable for their violent acts.”

In newer technologies, Dan Vorhaus wrote last year about the potential use of DNA from a suspect’s pet or the suspect’s bodily bacterial signature to investigate non-human DNA profile evidence. Using a similar rationale, some businesses in the Netherlands have been equipped with a “device that sprays a fine, barely visible mist laced with synthetic DNA” as a way to mark a burglar with a unique DNA signature. Meanwhile, scientists at Erasmus University Medical Center in the Netherlands claim to be able to predict hair color using 13 markers in 11 genes. Previously, only red hair was predictable from DNA sequence. This investigative science needs further validation, but it could be useful, for example, in narrowing down a list of suspects with different hair colors, where DNA evidence has been recovered from a crime scene. And an interesting development was reported in Cardiff (UK), where bus drivers have suffered an unusually large number of personal attacks. The drivers are now being given spit kits, so that if someone spits on them, they can swab the saliva to assist in finding and prosecuting the spitter.

Continuing to Question the Reliability of Forensic DNA. DNA evidence is generally regarded as highly reliable, but lately research scientists have voiced skepticism about the degree of subjectivity sometimes required to make a determination as to when a match is found or when a defendant “cannot be excluded” on the basis of DNA evidence. A 2010 study showed that samples containing DNA from two or more unknown people present special challenges to forensic labs and force the analysts to make some judgment calls. The researchers sent a real gang rape sample to 17 different analysts and received back 3 different conclusions. Only one analyst arrived at the conclusion used to prosecute the one man who was convicted. A lack of national standards is partly to blame for the discrepancy. Ideally too, the analysts would be presented only with the DNA data, but many prosecutors provide the lab with additional information about the case, which may cause bias in the conclusions.

Another study reported a surprisingly high number of “coincidental matches” within state databases. The DNA profiling system is currently based on markers at 13 different variable spots in the human genome (“loci”). This report identified cases where all 13 markers matched in two people who were not identical twins. The researchers also discovered that partial match pairs with 9, 10, 11, or 12 loci in common were more frequent than expected. Both of the problems reported in these studies could be addressed by further examination of the DNA with sequencing or other more refined techniques, but even with the dropping costs of DNA sequencing, this would require tremendous financial investment. It would also increase the risk of exposing medically relevant genetic information, a problem largely avoided by current forensic analysis.

Where to Next for Forensic DNA? In light of these new developments and continuing questions regarding the use of forensic DNA tools and techniques, it is important to highlight one of the oldest and most successful applications of forensic DNA: the Innocence Project. Since its inception, the Innocence Project has used forensic DNA techniques to exonerate over 250 wrongly convicted people in the United States. The Innocence Project has expanded to an international effort, with the United Kingdom’s branch nearing its first exoneration (although not on the basis of DNA evidence), and advancing DNA sampling and analysis technology promises to drive further expansion.

When it comes to forensic DNA, the debate boils down to the same question as in many other contemporary debates, including TSA security searches, wiretapping, etc.: what price (both in financial and privacy terms) is society willing to pay in exchange for additional levels of safety? If events of just the past few months are any indication, this is a question that will continue to be thrust in front of both lawmakers and the voting public until it is more clearly resolved.

As is the case with any piece of new legislation, even after a law is passed, considerable work remains to implement that law in practice. GINA is no different. Congress provided a basic framework designed to eliminate genetic discrimination, but many of the details of the law were left to regulatory agencies.

Two and a half years after GINA’s passage, the first part of that process is still underway. Last month the EEOC issued final rules and regulations implementing Title II of Gina, which applies to employers. (Final regulations for Title I of GINA, which applies to health insurers, have yet to be issued.) With the long-awaited arrival of the EEOC’s final regulations, the next step is to begin to apply those regulations.

MLB’s Genetic Testing Program. In July of 2009 The New York Times reported that Major League Baseball (MLB) had begun using genetic testing to verify the age and identity of Latin American baseball prospects. We analyzed MLB’s genetic testing program and the potential legal concerns raised by GINA in a pair of posts: “MLB Meets GINA” and “MLB’s Genetic Testing Program at the Plate Again.”

While we acknowledged the legitimate interest of MLB and other employers in conducting identity verification testing, we concluded that the MLB genetic testing program edged perilously close to prohibited territory under GINA and and its legality would depend, ultimately, on how the EEOC chose to interpret GINA’s provisions.

In light of GINA and other concerns, MLB reviewed its age and identity verification policies for Latin American baseball players. According to The New York Times, MLB considered switching to fingerprinting as a means of identity verification and even briefly halted the use of genetic testing. As the second Times article reports, however, as of October, MLB was once again utilizing genetic testing for identity verification purposes, although MLB now receives “…only the [genetic test] results in regard to identity—not delicate genetic information.”

After the EEOC Speaks, a Second Look at MLB’s Genetic Testing. Our earlier analyses of MLB’s genetic testing program were based on our attempt to apply the text of GINA as passed by Congress (pdf). The publication of the EEOC’s final regulations (pdf) provides an occasion to re-examine the legality of the genetic testing program under GINA, this time with additional guidance as to how the applicable regulatory agency interprets the law.

On its face, GINA appears to bar employers from requesting or using any genetic information pertaining to current or prospective employees (§ 202), with only a handful of narrow exceptions (§ 202(b)(1)-(6)), none of which appeared applicable to MLB. Still, at least one commentator argued that genetic testing to confirm identity would be consistent with the express purpose of GINA (pdf). That analysis depends in large part on a narrow reading of the terms “genetic information” and “genetic test.” We found it unlikely that the EEOC would adopt such a narrow view of GINA’s protections, but admitted that there was sufficient ambiguity in GINA’s text that we would need to wait to see what the agency actually said.

The verdict is now in, and it does not appear promising for Major League Baseball. The EEOC regulations clarify the meaning of both “genetic information” (29 CFR § 1635.3(c)) and “genetic test” (29 CFR § 1635.3(d)). While the definition of “genetic information” largely tracks the statute, and specifically includes any information about an individual’s genetic tests, the definition of “genetic test” in the EEOC’s regulations is set out with far more specificity than in GINA’s text.

Most significantly, a “genetic test” includes (but is not limited to):

(vii) DNA testing to detect genetic markers that are associated with information about ancestry; and (viii) DNA testing that reveals family relationships, such as paternity.

While the precise nature of the genetic testing performed by MLB is not known, it is highly likely that a genetic test for purposes of identification would fall into one or both of the categories listed above. By more specifically defining “genetic test,” the EEOC has addressed a key statutory ambiguity and substantially weakened the argument that the type of genetic testing conducted by MLB is not covered by GINA.

Is MLB’s Genetic Testing Program Illegal? Without knowing much more about the program, including the nature of the testing and how and where it takes place, it is impossible to give a definitive answer. Nevertheless, it appears that under the EEOC’s interpretation of GINA, substantial questions about the legality of genetic testing for identification, whether by MLB or other employers, remain to be answered.

Unless MLB changes its genetic testing policy yet again, the next step will be to see whether any individuals subject to the policy attempt to challenge it under GINA and, if so, how the EEOC and MLB respond. Unfortunately for the GLR and its readers, much or all of this activity is likely to take place initially outside of public view (although that could change if a dispute were to move through the EEOC and reach the courts).

Editor’s Note: With the holiday season upon us, the Genomics Law Report will be going on hiatus for the remainder of 2010. Happy reading, happy holidays, see you in 2011.

The first is primarily a curiosity: the allegation that Chinese authorities are spying on deCode Genetics, Iceland’s most prominent genetic research company and provider of the direct-to-consumer genetic testing service, deCODEme. Nobody seems to know exactly what China is looking to gain by clandestinely exploring Iceland’s genetic genealogy. You are welcome to speculate in the comments.

The second raises broader issues: the revelation that the State Department’s ongoing human intelligence collection directives include requests for “biometric information” on key world leaders, including United Nations arms inspectors, the Director General of the World Health Organization (WHO) and key advisors and aides to United Nations Secretary General Ban Ki-moon. A separate cable detailing intelligence collection priorities in Africa’s Great Lakes region clarifies that “biometric information” includes “health [data]…fingerprints, facial images, DNA, and iris scans.”

Not disclosed in the WikiLeaked cables: why the State Department wants the biometric data or whether any have been successfully obtained.

Surreptitious Testing: An Overview. The cables are, however, a reminder that the law surrounding the surreptitious collection and testing of biometric data, including DNA, remains extremely murky.

While the extent to which surreptitious testing is performed in diplomatic and intelligence contexts is not publicly known, such testing is commonplace in law enforcement settings. For example, police routinely collect and analyze “abandoned DNA” during forensic investigations. Indeed, one of the primary indices of the FBI-run Combined DNA Index System (CODIS) is the Forensic Index. The Forensic Index is comprised of DNA profiles constructed from biological specimens from unidentified individuals collected at crime scenes. These DNA profiles are then compared against similar offender and arrestee indices, which are also housed in CODIS, to aid in law enforcement efforts. Several high-profile criminal investigations, including the recent arrest of the “Grim Sleeper” serial killer, have been aided by this technique.

Concerns about surreptitious sampling and testing have also appeared in other contexts. During this past summer’s Congressional hearing on direct-to-consumer (DTC) genetic testing, the Government Accountability Office (GAO) presented results from a series of undercover encounters with DTC companies. One recording appeared to show a company (later identified as Pathway Genomics) encouraging a prospective customer to collect and send in a saliva sample from her fiancé without his consent, in order to surprise him with results of a genetic test.

In 2009, New Scientist reporters Peter Aldhous and Michael Reilly used similar tactics to demonstrate that it was possible to obtain genetic information about someone without that individual’s consent and detailed their experiences in a special investigation: how my genome was hacked.

Shortly after the 2008 presidential election, an article appearing in The New England Journal of Medicine (NEJM) considered the possibility that, by the time the 2012 election rolls around, presidential candidates might be at significant risk of surreptitious genetic testing. The authors worried that “persons or groups opposing a candidate [and] hoping to harm his or her chances for election” would obtain and release genetic information without consent, a form of “genetic McCarthyism.” This would not be very difficult, the authors concluded, since “sufficient DNA for amplification and analysis can be obtained from loose hairs, coffee cups, discarded utensils, or even a handshake.” The WikiLeaks revelations about State Department officials seeking biometric information on world leaders indicate that the NEJM speculation may already be reality on the world stage.

There are numerous other scenarios in which surreptitious genetic testing might be employed to acquire information about less famous but equally unwitting individuals, including to establish paternity or to evaluate a potential romantic partner.

Legal Uncertainty Surrounds Surreptitious Testing. To many, it seems like “there oughta be a law” against surreptitious genetic testing, at least in certain settings. However, as reported last year by the Genetics & Public Policy Center, there are “limited legal safeguards against surreptitious DNA testing or its potential consequences for those subject to nonconsensual testing.”

While the 2008 passage of the Genetic Information Nondiscrimination Act (GINA) prohibits the unauthorized acquisition or use of genetic information in certain contexts (health insurance and employment), it offers only limited protection against surreptitious testing. For instance, while it covers most of the Federal government, including the State Department, GINA does not apply to the military or the VA. It also does not restrict behavior outside of the insurance and employment contexts including, for example, by political adversaries or their supporters during a presidential campaign. (Interestingly, the NEJM article declined to advocate for “laws that would make it a federal crime to sequence a candidate’s DNA without consent,” preferring voluntary restraints and education instead.)

Other Federal statutes, such as the Health Insurance Portability and Accountability Act (HIPAA) may offer protection under certain scenarios (e.g., the use and disclosure of genetic information by covered entities, predominantly health plans and healthcare providers) but, again, fall short of providing a complete and clear prohibition on surreptitious genetic testing.

The 2008 GPPC report also looked at state law to evaluate which states proscribe surreptitious DNA testing (pdf). Determining the exact number of states that prohibit this behavior depends heavily on context. Some state statutes prohibit unauthorized acquisition or analysis of genetic information, while others apply only to unauthorized disclosures. Similarly, some state statutes appear to encompass all manner of genetic information, whereas others cover only certain genetic information (e.g., health-related information) or apply only to certain settings (e.g., employment or insurance discrimination). The National Conference of State Legislatures (NCSL) has also compiled data on state genetic privacy laws and, like the GPPC report, the NCSL data indicates considerable variability at the state level.

In the absence of a comprehensive federal law, state prohibitions are currently the main source of relevant law when it comes to restricting surreptitious genetic testing. But not all states have such laws. Whether surreptitious genetic testing is illegal thus typically depends on a combination of who is doing the testing, whom they are testing, what they are testing for, how they are using the results and, most of all, the state or states in which those activities take place.

Finally, there is a possibility that surreptitious genetic sampling and testing may be prohibited on either common law or constitutional grounds, at least in certain situations. For example, in the Texas newborn blood spot litigation, which we covered earlier this year, the plaintiffs alleged both Fourth Amendment (unreasonable search and seizure) and Fourteenth Amendment (right to privacy) violations resulting from the state’s policy of retaining newborn blood spots for ongoing research without explicit parental consent. While both claims survived summary judgment, and may have helped precipitate the litigation’s settlement, these and other legal theories remain untested in most states and under most circumstances.

What We Should Learn From WikiLeaks. Coming full circle, the leaked State Department communiqués raise important questions to which we do not have clear answers. In particular: under what circumstances is the surreptitious collection of biometric data, including genetic data, appropriate?

For most, the answer to that question will depend to some degree on context. Should State Department officials gathering intelligence abroad have a greater or lesser ability to pursue surreptitious genetic testing than domestic law enforcement agents? Should private individuals be permitted to conduct surreptitious genetic testing in certain circumstances (e.g., to confirm paternity) but not others (e.g., when shadowing a politician or celebrity)?

While individual answers may vary, we expect the law to provide us with clear guidelines. As is made clear by the above analysis, however, there exists a wide range of scenarios where surreptitious genetic testing, should it occur, would fall squarely within a legal gray area.

This is in stark contrast to the situation in other countries. In the United Kingdom, for instance, the Human Tissue Act 2004 made it a “criminal offence to take a sample from someone to test their DNA without their consent, except for medical purposes and lawful investigative purposes” as of 2006. Similarly, while Germany’s new Human Genetic Examination Act (also known as the GenDG) is overly restrictive in many respects, § 8(1) of the GenDG (pdf) clearly prohibits “any genetic examination or analysis” without the “express, written consent of the subject person, both in regard to the respective genetic examination and genetic sample.”

Whether the United States adopts the same approach to surreptitious genetic testing or not, the issue must be addressed. We must articulate, much more clearly than at present, the situations in which unconsented genetic testing, analysis and disclosure is permissible, and those in which it is proscribed.

Each year, the availability of low-cost, high-quality genetic information expands. Along with a wide array of legitimate and beneficial uses, the growing accessibility of this genetic information brings with it an increasing number of opportunities to employ and to abuse surreptitious genetic testing. As we continue to push forward into the era of personal genomics, the time has come to seriously discuss a comprehensive legal framework for surreptitious genetic testing.

The GenDG (pdf) took effect early this year and, until recently, little news of its impact on German law, policy or business has made its way across the Atlantic. Last week, however, several prestigious German scientific academies released a report entitled “Predictive Genetic Diagnostics as an Instrument of Disease Prevention.” The “Academy Group,” as the report’s authors refer to themselves, consists of the Leopoldina, the Berlin-Brandenburg Academy of Sciences and Humanities and the German Academy of Science and Engineering Acatech. Astoundingly, according to a recent editorial in the journal Nature, the report is the first from the group in its 350 year existence.

While the Academy Group’s report “discusses all aspects of genetic testing of healthy individuals to prevent disease, including the medical, ethical, economic and legal dimensions of the issue,” it takes particular issue with the GenDG. In a press release announcing its report, the Academy Group characterized the GenDG as “out of touch with the latest technology, almost impossible to implement in clinical practice” and “in desperate need of amendment.”  The complete report (pdf) is available only in German, but the Academy Group’s summary and twenty-two recommendations (pdf) addressing both genetic testing and the GenDG specifically are available in English.

Reviewing the Recommendations. The Academy Group’s recommendations are informed by a fundamental belief that genetic testing should be focused on helping people “to remain healthy, to regain their health or, at least, to alleviate the consequences of illness.” Although the Academy Group briefly notes, later, that genetic testing “can be advantageous for the life planning of a person,” the clear focus is on clinical utility. Apart from genetic research, no meaningful value is ascribed to other uses of genetic testing and data that appear to have gained much more traction in the United States, the United Kingdom and elsewhere, including ancestry testing, self-experimentation and testing for medical conditions that possess personal utility even if they do not rise to the level of current clinical utility.

An Excess of Information. Another theme that runs through the Academy Group’s recommendations is a concern about an “excess of genetic information” generated by the increasing proliferation of genetic testing and, in particular, whole-genome sequencing. Although some may consider there to be no such thing as too much genomic data, the group’s concern is at least consistent with its core belief that genetic data is valuable solely to the extent of its clinical utility. Given that certain genetic data is acknowledged to be of limited clinical value for many individuals, at least as of today, the Academy Group sees such “excesses” as likely.

Despite its underlying concern about excess genetic data, the Academy Group clearly thinks the GenDG’s nearly complete prohibition on the long-term storage of genetic information takes things a step too far. The problem lies with §12 of the GenDG which requires, with very limited exceptions, the “immediate” destruction of genetic information after 10 years. The Academy Group’s recommendations encourage the GenDG to “take into account the aspects of long-term storage and subsequent analysis of the excess of genetic information” and, if adopted, would specifically remove the flat prohibition on storage of genetic information beyond a decade.

The group’s primary recommendation is reasonable: individuals should be allowed to decide, in conjunction with an appropriate healthcare provider, whether to (a) use such excess information in a specific manner (although no examples are provided), (b) destroy the information or (c) “save [it] for the time being in an unused state.” This would, in effect, allow the individual and her healthcare provider to determine what constitutes “excess of genetic information”, rather than continue the GenDG’s approach of statutorily determining non-clinical genetic data to be excess and thus not valuable.

However, the Academy Group’s recommendation extends only to individuals competent to make such a decision. Children or temporarily incompetent adults should not, according to the Academy Group, be given the option to use or seek to interpret any excess genetic information “because this would take the option of ignorance away from the examined person.” The Academy Group recommends that the information be “saved in a restricted form” until “competency is bestowed”—in the case of a child, at her 18th birthday party—at which point the individual would be allowed to decide for herself.

While the Academy Group’s recommendation with respect to genetic testing of children is more permissive than what appears to be allowed under the current GenDG framework, it is still at odds with practices in other countries where the genetic testing of minors for non-clinical purposes is not expressly prohibited.

Genetic Screening and Unintended Consequences. Several other Academy Group recommendations concern genetic screening at various stages, from preconception (carrier testing) to prenatal to postnatal (newborn screening). The recommendations are consistent with the fundamental approach of requiring testing to be related to medical treatment. This leads to the curious consequence of recommending limitations on testing of an unborn child but, once the child is born, encouraging genetic testing.

While the Academy Group recognizes that “healthy people or couples can be interested in finding out whether they are genetic carriers of any recessive hereditary disease…to assess the health risk of their own child,” the group believes that such carrier screening is not yet ready for widespread medical or commercial use. The group recommends:

For the time being, systematic heterozygote examinations with regard to the health risks for the children of the examined people should only be carried out as part of research projects. They should be embedded in secondary medical, ethical and social research in order to gain experience about the personal and social effects.

While numerous carrier screening providers offer services outside of Germany—both directly to consumers and through licensed healthcare providers—the Academy Group appears to have no interest in seeing Germany following suit.

The group’s recommendation, if adopted, could have the unintended consequence of promoting a new form of “medical tourism,” with some German couples taking a quick trip abroad (e.g., to the United Kingdom) for preconception carrier testing.

When the Academy Group turns to testing of newborns, it is critical of provisions of the GenDG that have the effect of discouraging or interfering with such testing:

The Gendiagnostikgesetz considers the newborn screening as a genetic survey. Accordingly, since the Gendiagnostikgesetz came into force, the parents must be provided with a genetic consultation before blood is taken. Baby nurses and midwives, who previously took the blood, are no longer allowed to do this on their own responsibility. There are already indications that this is leading to the newborn screening not being carried out for some newborn babies. This can lead to life-long disability, which could have been avoided with early diagnosis and appropriate treatment.

The Academy Group’s recommendation in response is sensible: the GenDG “should regulate the newborn screening separately” and, presumably, in a fashion that does not hinder the practice from occurring routinely.

Conflicting Duties. A consequence of the GenDG’s extremely patient-centered and protective approach to genetic testing is that, according to the Academy Group, “without exception” the GenDG “considers confidentiality for patients to be of a higher significance than the medical fiduciary duty towards relatives that have a high risk of developing” a genetic condition. Under the GenDG, doctors are strictly prohibited from discussing genetic information with a relative, even where doing so might have significant clinical utility.

The Academy Group recommends a change in the weighting of these competing duties, saying that “in cases of clear medical benefits” doctors be permitted to balance the importance of individual genetic privacy enshrined in the GenDG against the clinical utility of genetic information to an individual’s relatives. Interestingly, the Academy Group does not propose—as it does elsewhere—a specific modification to the GenDG to enable this exercise of physician discretion, and it remains unclear whether following the group’s recommendation would leave doctors on the wrong side of current law.

The difficulty of balancing the competing duties of individual confidentiality, particularly in the context of genetic information, and the broader utility of genetic information, particularly for an individual’s close relatives, is not a problem unique to Germany or the GenDG. The United Kingdom’s General Medical Council addressed this exact issue last year and reached a conclusion similar to that of Germany’s Academy Group. As this issue continues to show up in a variety of contexts, policymakers—and especially doctors—are likely to continue to struggle to strike the proper balance.

Direct-to-Consumer Testing. Unsurprisingly, the Academy Group’s recommendations also tackle the topic of direct-to-consumer (DTC) genetic testing, which remains one of the most hotly contested areas of genetic testing regulation and policy as we head into 2011.

As we noted last year, the GenDG arguably already prohibits all DTC genetic testing. Nevertheless, the Academy Group expresses concern about the “uncertain scientific basis” of DTC tests, as well as with the possibility of surreptitious testing. Seeking to make the GenDG’s likely DTC ban explicit, and consistent with the Academy Group’s emphasis on clinical utility in genetic testing, the group recommends that DTC tests “not be permitted because they do not fulfill the requirements of medical and ethically acceptable predictive genetic diagnostics.” (The Academy Group also offers a separate recommendation banning all DTC advertising for genetic tests.)

The unfavorable outlook of legislators and policymakers toward DTC genetic testing is hardly restricted to Germany. In the United States, a report issued by the Government Accountability Office (GAO) over the summer was sharply critical of DTC genetic tests—although critics of the GAO report’s methodology and conclusions abound—and the Food and Drug Administration (FDA) is preparing to regulate all laboratory developed tests (LDTs), including DTC genetic tests. (For a more complete overview see The Past, Present and Future of DTC Genetic Testing Regulation.)

A Global Perspective. Finally, the Academy Group exhibits at least a partial recognition that Germany’s approach to genetic testing may not be perfectly aligned with the rest of the world.

The Academy Group’s sixth recommendation acknowledges that German laboratories often receive samples from abroad and, were the GenDG to be strictly applied, it might operate to significantly curtail the foreign business of German companies in light of the substantial consenting requirements imposed by the GenDG (among its other provisions). In recognition of this issue, the Academy Group recommends that:

The genetic analysis of a sample acquired abroad by a German laboratory should be acceptable if the doctor that has sent the sample confirms that the person concerned has been provided with information about the being, scope and significance of the genetic examination in accordance with the legal regulations in the sample’s country of origin and the person concerned has subsequently granted his consent.

Quite sensibly, the recommendation appears to permit German laboratories to process samples for diagnostic testing if the submitting doctor verifies that the sample is being sent in compliance with the laws of the sample’s country of origin.

Note, however, that other restrictions imposed by the GenDG appear to remain in place. Given the broad limitations the GenDG imposes on genetic testing products and services, including on both the circumstances in which testing may occur and the type of analyses which may be conducted, it seems likely that, even if this particular recommendation is adopted, German laboratories and genetic testing providers will struggle to offer the same suite of products as their international competitors. If the Academy Group’s aim is to ensure that German laboratories remain competitive at the global level, its recommendations will likely need to be broadened.¹

Other Recommendations. The remainder of the Academy Group’s recommendations echo those made by the vast majority of policy groups to review the issues surrounding the development and adoption of genetic testing. These include a need for (a) more research into the genetic bases of complex traits and the cost-effectiveness of existing technologies and services, (b) more specialists in human genetics and more effective training in genetics for existing medical professionals, (c) a renewed focus on translational research and (d) improved public and educational outreach concerning the “possibilities and limits of genetic medicine.” All of these goals are laudable and, at this point, none are surprising.

What’s Next for Germany? It remains to be seen whether some or all of the Academy Group’s recommendations will be adopted by German lawmakers. Of particular interest are those recommendations that require, explicitly or implicitly, revisions to Germany’s just-passed GenDG legislation.

However, even if all of the group’s recommendations are adopted, GenDG will continue to stand as one of the most restrictive and, yes, paternalistic pieces of genetic legislation passed by any country to date. As other countries continue to grapple with how to appropriately regulate genetic technologies, including genetic diagnostic products, Germany’s experience with the GenDG may serve as a test case for one approach.

_________________________

¹ We are unaware of the effect, if any, that the GenDG is currently having on German biotechnology companies, entrepreneurs and investors, but would welcome feedback from our readers on this point.

We also promised to take a closer look in today’s post at several substantive features of the EEOC’s new regulations.

Defining the Terms. The EEOC, the government agency generally responsible for enforcing federal employment nondiscrimination laws, was the logical choice to promulgate regulations under GINA’s Title II, which governs the use of genetic information by employers and similar entities. But not all of GINA’s statutory provisions were within the EEOC’s area of expertise.

For that reason, the EEOC solicited help from outside agencies, including the National Human Genome Research Institute (NHGRI), to aid in developing both the proposed and final regulations. Despite a few stumbles with the science (notably its description of the BRCA1 and BRCA2 genes), the EEOC’s final regulations—as well as its explanatory preamble—are laudably clear and informative. The preamble and the regulations themselves include numerous illustrative examples—something that was largely lacking in the draft regulations—and they should be particularly helpful to the predominantly non-scientific audience tasked with implementing GINA.

For example, public commenters requested additional clarification with respect to what does and does not constitute a “genetic test.” The EEOC responded in spades. According to the EEOC, genetic tests include (i) BRCA testing and other diagnostic cancer testing, as well as prognostic testing for Huntington’s Disease, (ii) carrier screenings of adults to determine the risk of conditions such as cystic fibrosis or sickle cell anemia, (iii) reproductive genetic testing and screening of all kinds, including amniocentesis, newborn screening and preimplantation genetic diagnosis, (iv) pharmacogenetics testing and (v) DNA testing for ancestry or familial/paternity relationships. In short, just about every technology on the personal genomics landscape appears to fall within the definition of genetic test.

Another important definition, clarified in the final regulations, is that of a “manifest” disease. The EEOC clarifies at several points in the preamble its position that genetic information alone is not equivalent to a disease or disorder: “other signs or symptoms must be present.” The EEOC uses the example of Huntington’s Disease which, despite its high degree of penetrance, is not considered to be a present disease even following a positive genetic test until actual symptoms arise.

This distinction is crucial because, under § 1635.12 of the final regulations, employers are not barred from using, acquiring or disclosing medical information about a “manifested disease, disorder, or pathological condition,” even when such disease or disorder has a genetic component. (However, employers may be barred from discriminating on the basis of such information by other federal law, including the ADA.)

The final regulations also provide greater clarity with respect to the definition of “family member,” which includes all dependents (including spouses, adopted children and other people who are not genetically related) and all other persons “related from the first to the fourth degree of an individual.” Other key terms, including “genetic information,” “genetic services,” and “family medical history” also receive helpful background discussion.

Deliberate vs. Inadvertent Acquisition. It is illegal under GINA for employers to “request, require, or purchase” genetic information. In considering what constitutes a “request” for purposes of GINA, the proposed rule was structured to prohibit the “deliberate acquisition” of genetic information. Some commenters, including the American Civil Liberties Union, criticized this proposed rule for suggesting that employers must have the “specific intent” to acquire genetic information to run afoul of the law. (Others suggested that requiring a “purposeful act” was, in fact, what Congress intended.)

In the final regulations, the EEOC sided with the ACLU in determining that “request” extends beyond a specific or deliberate intent to encompass a variety of actions that are “likely to result” in the acquisition of genetic information.

Despite this broad prohibition on the request of genetic information, GINA provides several exceptions, including with respect to “inadvertent requests” and “commercially and publicly available information.” The “inadvertent” request or disclosure scenario was originally inserted by Congress to address the so-called “water cooler problem,” in which employers inadvertently received genetic information, including family medical history, from employees in the course of routine conversations or interactions. Likewise, the “publicly available information” exception was intended to protect employers who acquired genetic information about their employees by, for instance, watching the evening news.

To aid in understanding the specific contours of these exceptions, the EEOC has provided significant clarifying guidance and examples. For instance, while an employer does not violate GINA by participating in “water cooler conversations”—whether those conversations happen around a conventional water cooler or in more modern settings, including on Facebook, LinkedIn or other social media platforms—that information is not an invitation to bypass GINA. The employer and its agents must “not then ask follow-up questions that are probing in nature.”

Similarly, the category of “commercially and publicly available materials” will generally not include materials made available to the public, or to some portion of the public, on a restricted basis (i.e., when more than simple registration is required for access). For example, research databases made available only to the scientific community or Facebook profile information shared only with “friends” (as opposed to information visible in a public database or on a public website) would not satisfy this exception.

Even genetic information that is available to the public on an unrestricted basis—as is true of genetic information provided by individuals, including one of us, who participate in public genomics projects—is not necessarily fair game for employers under GINA. If employers access such sources “with the intent of obtaining genetic information,” particularly if it comes from a source “that focuses on issues such as genetic testing of individuals” they will not be able to take advantage of GINA’s limited exception for publicly available materials.

As the EEOC explains, GINA’s limited exceptions are “intended to protect from liability a covered entity that inadvertently obtains genetic information and not a covered entity that is actively searching for genetic information.”

When it comes to applying GINA’s various exceptions, employers should remember that Title II of GINA serves three related but ultimately separate functions: (i) a general prohibition on the request for or acquisition of genetic information, (ii) an ever-more-complete prohibition on the discriminatory use of genetic information in employment-related decisions and (iii) strict confidentiality requirements pertaining to any sharing or disclosure of genetic information, however obtained, by employers. Thus, even genetic information that is requested or acquired lawfully under one of GINA’s exceptions is still subject to the remaining two prongs of GINA Title II, and it may not be used to discriminate in employment-related decisions or disclosed in violation of GINA’s confidentiality provisions.

No New Exemptions. In addition to clarifying the scope of existing exemptions, the EEOC specifically declined to introduce new exceptions under GINA relating to the use of genetic information in evaluating the ability of an employee (or prospective employee) to safely and effectively perform a particular job. Exemptions proposed by commenters would have permitted a covered entity to request genetic information (i) as part of “a medical examination conducted to assess an individual’s ability to perform a job” or (ii) “to determine whether an individual has a particular manifested disease, disorder, or pathological condition and where information about [that condition], as opposed to its signs and symptoms, is necessary to evaluate an individual’s ability to perform a particular job.”

The EEOC declined to create such an exemption in each case, citing both a lack of authority under GINA and its belief that “there does not appear to be a case in which the diagnosis, as opposed to the signs and symptoms, is necessary to evaluate an individual’s ability to perform a particular job.”

Shortly after the EEOC released its draft regulations we addressed this particular issue, among others, with a pair of GINA-related posts (see here and here). We considered whether there might be situations in which an employer could have a legitimate interest in testing an employee for a genetically-mediated condition, particularly where the employee’s activities might increase the risk or the severity of such condition becoming manifest during the course of employment.

The primary example we considered was that of professional basketball player Eddy Curry, who was traded by the Chicago Bulls after refusing to undergo a genetic test for Hypertrophic Cardiomyopathy (HCM).

As we wrote then:

Curry’s case is a very good example of a more general scenario that I suspect might pose a real problem once GINA takes effect. How will employers and employees handle situations in which an employer suspects that an employee is either suffering from, or at risk of, developing a medical condition with an identifiable genetic component? (In Curry’s case, it was the irregular heartbeat that created suspicion of HCM.) It would seem that, in most such cases, the employer will be forced to take action without a confirmatory genetic test.

The final regulations decline to create an exemption for this scenario and, indeed, it appears that if this case arose today, the Chicago Bulls might be prohibited from even requesting an HCM test. Although Curry did exhibit some physical symptoms, including an irregular heartbeat, the HCM test would arguably have been necessary to evaluate his ability to perform this particular job (that of a professional basketball player), particularly because the irregular heartbeat and other physical symptoms, on their own, may not have been enough for a conclusive diagnosis.

While the EEOC failed to find sufficient reason to create such an exemption, this situation is likely to appear in other contexts in coming years. While genetic information is primarily used to diagnose or guide treatment for manifest diseases or conditions, it is likely to play an increasing role in determining behavioral and lifestyle decisions—potentially including choice of employment—for conditions not yet manifest. Under GINA, however, except where an employer is required to do so by law, it may not “limit, segregate, or classify an individual…because of genetic information with respect to that individual.” There is no exception for imposing a limitation designed solely to protect the well-being of the employee.

As genetic information becomes more prevalent and more useful, we expect to see a growing tension between an employer’s legitimate interest in ensuring the welfare of its employees (for both economic reasons and out of a legitimate desire to protect its employees from harm) and GINA’s broad prohibition on requesting genetic information.

Employee Wellness Programs. One area where employers are already actively attempting to use genetic information—typically in the form of family medical history—to safeguard the health of their employees (and, in turn, decrease employers’ own healthcare costs) is employee wellness programs.

Increasing numbers of employers have implemented wellness programs, which frequently operate by assessing employees’ personal risk factors (including medical, environmental and behavioral) and encouraging the adoption of healthier lifestyles and practices. Many wellness programs include financial incentives (often in the form of premium discounts) for participation and/or completion.

Following GINA’s passage, and particularly the EEOC’s proposed regulations, many employers were concerned that such wellness programs might violate GINA. The proposed regulations permitted wellness programs only if they were offered on a “voluntary” basis (and if certain other conditions were met). Many commenters worried financial incentives or inducements would be deemed incompatible with the requirement of voluntariness.

In its final regulations, the EEOC has addressed this concern by clarifying the circumstances under which an employer may offer wellness programs that include a request for genetic information (including family history). In order for the wellness program to comply with GINA:

• the employee must provide a prior, knowing, voluntary and written authorization to participate in the program (electronic or online authorizations are allowed);
• individually identifiable genetic information may only be provided to the licensed health care professionals or board certified genetic counselors involved with the program;
• any genetic information received from the wellness provider must be in aggregate terms that do not disclose the identity of specific individuals; and
• employee incentives or benefits related to the program must not be conditioned upon the provision of genetic information.

Most notably, the EEOC determined that financial inducements for wellness programs are allowed, but only where the employer makes it crystal clear that neither participation in the wellness program nor the receipt of any benefit resulting from participation is conditioned upon the provision of genetic information.

What’s Next. Although GINA is now two and a half years old, like all new laws it remains subject to a considerable degree of uncertainty. Thus far, we are aware of only one publicly discussed EEOC claim filed under GINA (although EEOC’s legal counsel estimates “around 200 charges have been filed with EEOC under GINA so far“) and no court decisions interpreting the law. The EEOC’s final regulations are well-written and helpful but, ultimately, it will take years before we understand how GINA operates in practice.