3 ms·

You keep doubling down on this? The article says that DNA from the clothing sample was sent to Parabon for analysis in July of 2016, and was used in a GEDmatch

You keep doubling down on this? The article says that DNA from the clothing sample was sent to Parabon for analysis in July of 2016, and was used in a GEDmatch search at that time. There's nothing remarkable about my claim, it is right there in the article. Also it simply isn't possible to submit a CODIS profile to GEDmatch, they only accept SNP array data, the matching algorithms only work for dense SNP array data, and CODIS markers are not even SNPs, they are STRs. I did not claim genetic information isn't "medical data". I said that 23andMe is not a "covered entity" under HIPAA. HIPAA only applies to "covered entities". Maybe you should say specifically what it is you think 23andMe is doing that is improper?

droithomme 7y ago
> specifically what it is you think 23andMe is doing that is improper 23andMe acquires, analyzes, stores, and trades in private medical data and does not comply with HIPAA in any way when doing so. We both know that the DNA data you have is personal medical data. You have a PhD and are an executive at one of the largest companies in the world that is trading in DNA data so we both know you are very aware this is true. > DNA from the clothing sample was sent to Parabon for analysis in July of 2016 We both agree the Galvin DNA sample was acquired and analyzed in 2002 as CODIS data and yielded no hits. The article says "In July 2018, the suspect DNA from Galvin’s clothing was submitted to Reston" and then goes on to say "The suspect’s profile was reformatted and entered into GEDmatch". Parabon was not sent the actual original DNA from the underwear. Parabon was sent the DNA profile that was created in 2002. It was then reformatted by their data scientists so that they could do a cold hit search on GEDmatch. It yielded possible distant match on two individuals. They found a common ancestor, and created a descent tree of thousands of people, looking for people with a connection to Seattle. They exhumed one and did a modern microarray on that person, and compared that to the extremely sparse data from the 2002 test. They did not do a modern ~700k size microarray on the Galvin data. You have professional colleagues at Parabon. Ask them. They will confirm what I have said. Also as a professional biological statistician, you more than almost anyone know that cold hitting a sparse sample against a massive database, finding a possible remote connection, and then expanding the search from a 1800s possible ancestor to include all descendants who live in a large metropolitan area near the crime in a city many people migrated to over the decades is quite likely to find many matches and this sort of match is far from conclusive at all. In fact, you are even qualified to be an expert witness in such a case and testify regarding the actual odds. We also both know that there are serious problems with testing amplified DNA samples on clothing that has been stored for 35 years and possibly handled by dozens of people. We also know that even finding high quality single person DNA samples on clothing of a murder victim which exactly matches a suspect (which we did not do at all in this case here) does not prove that the person it matches was the killer and can not reasonably be deemed so without a trial in which a competent defense is presented and considered.
- dahinds 7y ago
  I don't really think you're trying to engage in a good faith discussion, but in case you are: Lots of companies that handle medical information are exempt from HIPAA. "Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule."[1] Generally many of our practices meet or exceed HIPAA requirements, either because we're complying with some other rule (like GDPR, or Common Rule for protection of subjects in research), or because we think we should. You also still haven't given a specific example of something you think we're doing that you don't like. For example acquiring, analyzing and storing medical data is sort of required in order to provide our service to our customers so unless you think DTC genomics is fundamentally without merit this doesn't seem objectionable. If your concern is the "trades in" I think you may not understand exactly how we operate. Our privacy statement says we won't share even de-identified individual-level data without obtaining consent to do so. We rarely do that, for nearly all of our work, we only share statistical results from pooling information from thousands of individuals, where there is no way to extract data about any individual that contributed to the analysis. As for the original article, I'll stake my professional experience that it's simply not technically possible to do a GEDmatch lookup using "reformatted" CODIS data from 2002. The article says that DNA was submitted to Parabon, not a CODIS profile, Parabon uses SNP arrays, GEDmatch uses SNP arrays, and if you think somehow they didn't in this instance you're frankly delusional. There certainly are issues with testing old DNA samples and I'm not arguing about any of the difficulties with establishing chain of custody for old evidence, the complexity of statistics for CODIS matching, asserting guilt without a trial, etc. I haven't made any statements about any of that. [1] https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp

droithomme 7y ago

> specifically what it is you think 23andMe is doing that is improper 23andMe acquires, analyzes, stores, and trades in private medical data and does not comply with HIPAA in any way when doing so. We both know that the DNA data you have is personal medical data. You have a PhD and are an executive at one of the largest companies in the world that is trading in DNA data so we both know you are very aware this is true. > DNA from the clothing sample was sent to Parabon for analysis in July of 2016 We both agree the Galvin DNA sample was acquired and analyzed in 2002 as CODIS data and yielded no hits. The article says "In July 2018, the suspect DNA from Galvin’s clothing was submitted to Reston" and then goes on to say "The suspect’s profile was reformatted and entered into GEDmatch". Parabon was not sent the actual original DNA from the underwear. Parabon was sent the DNA profile that was created in 2002. It was then reformatted by their data scientists so that they could do a cold hit search on GEDmatch. It yielded possible distant match on two individuals. They found a common ancestor, and created a descent tree of thousands of people, looking for people with a connection to Seattle. They exhumed one and did a modern microarray on that person, and compared that to the extremely sparse data from the 2002 test. They did not do a modern ~700k size microarray on the Galvin data. You have professional colleagues at Parabon. Ask them. They will confirm what I have said. Also as a professional biological statistician, you more than almost anyone know that cold hitting a sparse sample against a massive database, finding a possible remote connection, and then expanding the search from a 1800s possible ancestor to include all descendants who live in a large metropolitan area near the crime in a city many people migrated to over the decades is quite likely to find many matches and this sort of match is far from conclusive at all. In fact, you are even qualified to be an expert witness in such a case and testify regarding the actual odds. We also both know that there are serious problems with testing amplified DNA samples on clothing that has been stored for 35 years and possibly handled by dozens of people. We also know that even finding high quality single person DNA samples on clothing of a murder victim which exactly matches a suspect (which we did not do at all in this case here) does not prove that the person it matches was the killer and can not reasonably be deemed so without a trial in which a competent defense is presented and considered.

dahinds 7y ago
I don't really think you're trying to engage in a good faith discussion, but in case you are: Lots of companies that handle medical information are exempt from HIPAA. "Many organizations that use, collect, access, and disclose individually identifiable health information will not be covered entities, and thus, will not have to comply with the Privacy Rule."[1] Generally many of our practices meet or exceed HIPAA requirements, either because we're complying with some other rule (like GDPR, or Common Rule for protection of subjects in research), or because we think we should. You also still haven't given a specific example of something you think we're doing that you don't like. For example acquiring, analyzing and storing medical data is sort of required in order to provide our service to our customers so unless you think DTC genomics is fundamentally without merit this doesn't seem objectionable. If your concern is the "trades in" I think you may not understand exactly how we operate. Our privacy statement says we won't share even de-identified individual-level data without obtaining consent to do so. We rarely do that, for nearly all of our work, we only share statistical results from pooling information from thousands of individuals, where there is no way to extract data about any individual that contributed to the analysis. As for the original article, I'll stake my professional experience that it's simply not technically possible to do a GEDmatch lookup using "reformatted" CODIS data from 2002. The article says that DNA was submitted to Parabon, not a CODIS profile, Parabon uses SNP arrays, GEDmatch uses SNP arrays, and if you think somehow they didn't in this instance you're frankly delusional. There certainly are issues with testing old DNA samples and I'm not arguing about any of the difficulties with establishing chain of custody for old evidence, the complexity of statistics for CODIS matching, asserting guilt without a trial, etc. I haven't made any statements about any of that. [1] https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp