6 ms·

I don't understand how this isn't a violation of HIPAA. Comparing a DNA upload against the medical records of other people without their express written consent

I don't understand how this isn't a violation of HIPAA. Comparing a DNA upload against the medical records of other people without their express written consent seems to me to be wrong. I think there is a legal issue here around wether uploading your medical data to a 3rd party service allows that service to take ownership of your medical data and allows them to do what they please with it. DNA absolutely falls under PII (personally identifiable information). I can't understand how a company to collect and use this information without (it appears) any rules or regulations. Not only is it a security risk and a privacy violation but it has implications for every aspect of your life and the lives of your children and immediate relatives. I can't understand how this can be run out of someone's house with a part time volunteer staff with no security. Mind Blown.

inetknght 7y ago
> I can't understand how this can be run out of someone's house with a part time volunteer staff with no security. But that's the promise of software and the internet. The ability to compete globally with minimal effort.
streb-lo 7y ago
By creating a profile and uploading your DNA -- you're giving consent for your DNA to be indexed. Whether or not you should be requiring the consent of all people with similar DNA is the real question -- but given Americans' obsession with individual rights I don't see it changing. In their eyes, why shouldn't they be permitted to upload and share their own DNA?
- shadowgovt 7y ago
  Yeah, that's the tricky thing. Individual ownership of information as a principle doesn't cover the set of all things people care about when information is shared between individuals (or infer-able about another individual based on information of a sharing party).
- LadyCailin 7y ago
  I know it was a rhetorical question, but because of negative externalities. Same reason I can’t dump pollution in the river that runs through my property, because that polluted your property downstream.
  - duahncjak 7y ago
    The only externality demonstrated is catching the Golden State Killer.
  - ianai 7y ago
    That seems like a much better legal analogy. If anything, this should probably be considered search and seizure without a warrant. That would make the evidence inadmissible in court. Or we carve out searching DNA databases as outside of that amendment. That actually makes more sense to me as even your dna is no longer yours once it’s in the public domain on a hairbrush at the dumpster. IANAL.
- mygo 7y ago
  Most of your DNA is not your own. So this isn’t about sharing a selfie, this is about sharing a group photo, where other people are partly out of frame, but you can still make out who they are. And if we stitch together enough photos, we can make out a lot of people, people who never even took a photo. Although, some would be sharp to point out that in the case of a selfie most of your facial features are also not your own. So it’s mostly a question of where we draw the line as to what is personal and what is shared. But in the case of a murder, if we had an actual selfie of the killer at the scene, we would be able to solve the case fairly quickly using standard investigative methods.
  - paxys 7y ago
    It's exactly like not being allowed to share your selfie because you look too much like your mom or sister.
    - mygo 7y ago
      I said that in my second paragraph. I also said it’s a question of where we draw the line as to what is personal and what is shared. Do we consider a selfie personal or shared? In 2019, we consider it personal.
aggronn 7y ago
When you upload to GEDMatch.com, you are agreeing to make your DNA available to be compared against others for identification or research purposes. That's the entire purpose of the service.
- deleted 7y ago
  [deleted]
- zik 7y ago
  "research purposes" sounds pretty benign though. Most people don't mind helping out some scientists for some intangible greater good. On the other hand if it was phrased "so we can pin crimes on you or your loved ones" people might not be so keen.
tick_tock_tick 7y ago
HIPAA is not a blanket protection applied to medicals records but rather restrictions on some companies and personnel that often work with them. Simply if they aren't a "medical" institute and you give them your health data it's theirs to do what they want and HIPAA plays no role. https://www.hipaajournal.com/who-does-hipaa-apply-to/ https://www.hipaajournal.com/who-does-hipaa-apply-to/
- SubiculumCode 7y ago
  These organization often sell genetic screening services, and I don't see how that is not providing medical services.
  - vageli 7y ago
    > These organization often sell genetic screening services, and I don't see how that is not providing medical services. HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.
    - EpicEng 7y ago
      Aside from that claim being trivially proven false[1], I worked in biotech for more than a decade and this is just wrong. [1]: https://www.healthit.gov/faq/who-must-follow-hipaa https://www.healthit.gov/faq/who-must-follow-hipaa
      - vageli 7y ago
        I actually am on the compliance team of a HIPPA covered entity, and your link does not disprove my point. > Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0] My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1] [0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp
mzs 7y ago
The people give their consent, but what maybe actually is surprising is how the police went about it according to the GSK LATimes podcast. Police made a fake profile online with the killer's DNA. At first they got a match for a relative. It turned-out it too was a fake profile created by another LE agency with the GSK's DNA. This is not illegal.
- blotter_paper 7y ago
  I wonder if they violated the website's terms and conditions by creating a fake account and uploading somebody else's DNA (not that this would be necessarily be illegal).
  - n0rbwah 7y ago
    I suspect law enforcement agencies don't have to worry too much about violating the terms and conditions of a service they're using for an investigation. At worst, their fake account gets closed by the site and they have to go through proper channels if they want to proceed further.
erentz 7y ago
HIPAA doesn’t extend beyond certain health care boundaries. Disability insurance for example aren’t bound to HIPAA in any way. Once you give them your medical records they can do what they like with it.
SkyPuncher 7y ago
> I don't understand how this isn't a violation of HIPAA. HIPAA only applies to "covered entities" - basically if you don't accept insurance, you don't have to be HIPAA compliant.
astura 7y ago
Uh...I think HIPAA might be the most misunderstood law in America. As a general rule: if it's not an insurance company or medical provider (who accepts insurance) HIPAA does not apply. Hint: the "I" in HIPAA stands for insurance. Just because you emailed your great aunt to tell her you have the flu doesn't mean HIPAA suddenly applies to Gmail.

inetknght 7y ago

> I can't understand how this can be run out of someone's house with a part time volunteer staff with no security. But that's the promise of software and the internet. The ability to compete globally with minimal effort.

streb-lo 7y ago

By creating a profile and uploading your DNA -- you're giving consent for your DNA to be indexed. Whether or not you should be requiring the consent of all people with similar DNA is the real question -- but given Americans' obsession with individual rights I don't see it changing. In their eyes, why shouldn't they be permitted to upload and share their own DNA?

shadowgovt 7y ago
Yeah, that's the tricky thing. Individual ownership of information as a principle doesn't cover the set of all things people care about when information is shared between individuals (or infer-able about another individual based on information of a sharing party).
LadyCailin 7y ago
I know it was a rhetorical question, but because of negative externalities. Same reason I can’t dump pollution in the river that runs through my property, because that polluted your property downstream.
- duahncjak 7y ago
  The only externality demonstrated is catching the Golden State Killer.
- ianai 7y ago
  That seems like a much better legal analogy. If anything, this should probably be considered search and seizure without a warrant. That would make the evidence inadmissible in court. Or we carve out searching DNA databases as outside of that amendment. That actually makes more sense to me as even your dna is no longer yours once it’s in the public domain on a hairbrush at the dumpster. IANAL.
mygo 7y ago
Most of your DNA is not your own. So this isn’t about sharing a selfie, this is about sharing a group photo, where other people are partly out of frame, but you can still make out who they are. And if we stitch together enough photos, we can make out a lot of people, people who never even took a photo. Although, some would be sharp to point out that in the case of a selfie most of your facial features are also not your own. So it’s mostly a question of where we draw the line as to what is personal and what is shared. But in the case of a murder, if we had an actual selfie of the killer at the scene, we would be able to solve the case fairly quickly using standard investigative methods.
- paxys 7y ago
  It's exactly like not being allowed to share your selfie because you look too much like your mom or sister.
  - mygo 7y ago
    I said that in my second paragraph. I also said it’s a question of where we draw the line as to what is personal and what is shared. Do we consider a selfie personal or shared? In 2019, we consider it personal.

aggronn 7y ago

When you upload to GEDMatch.com, you are agreeing to make your DNA available to be compared against others for identification or research purposes. That's the entire purpose of the service.

deleted 7y ago
[deleted]
zik 7y ago
"research purposes" sounds pretty benign though. Most people don't mind helping out some scientists for some intangible greater good. On the other hand if it was phrased "so we can pin crimes on you or your loved ones" people might not be so keen.

tick_tock_tick 7y ago

HIPAA is not a blanket protection applied to medicals records but rather restrictions on some companies and personnel that often work with them. Simply if they aren't a "medical" institute and you give them your health data it's theirs to do what they want and HIPAA plays no role. https://www.hipaajournal.com/who-does-hipaa-apply-to/ https://www.hipaajournal.com/who-does-hipaa-apply-to/

SubiculumCode 7y ago
These organization often sell genetic screening services, and I don't see how that is not providing medical services.
- vageli 7y ago
  > These organization often sell genetic screening services, and I don't see how that is not providing medical services. HIPPA only matters if the organization deals in medical insurance. Most people are surprised to learn this fact.
  - EpicEng 7y ago
    Aside from that claim being trivially proven false[1], I worked in biotech for more than a decade and this is just wrong. [1]: https://www.healthit.gov/faq/who-must-follow-hipaa https://www.healthit.gov/faq/who-must-follow-hipaa
    - vageli 7y ago
      I actually am on the compliance team of a HIPPA covered entity, and your link does not disprove my point. > Most Health Care Providers—those that conduct certain business electronically, such as electronically billing your health insurance—including most doctors, clinics, hospitals, psychologists, chiropractors, nursing homes, pharmacies, and dentists.[0] My gym nor personal trainer are covered by HIPPA as just a simple example of health-adjacent businesses for which HIPPA provides no recourse. > Covered entities are defined in the HIPAA rules as (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. Generally, these transactions concern billing and payment for services or insurance coverage.[1] [0]: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html https://www.hhs.gov/hipaa/for-individuals/guidance-materials... [1]: https://privacyruleandresearch.nih.gov/pr_06.asp https://privacyruleandresearch.nih.gov/pr_06.asp

mzs 7y ago

The people give their consent, but what maybe actually is surprising is how the police went about it according to the GSK LATimes podcast. Police made a fake profile online with the killer's DNA. At first they got a match for a relative. It turned-out it too was a fake profile created by another LE agency with the GSK's DNA. This is not illegal.

blotter_paper 7y ago
I wonder if they violated the website's terms and conditions by creating a fake account and uploading somebody else's DNA (not that this would be necessarily be illegal).
- n0rbwah 7y ago
  I suspect law enforcement agencies don't have to worry too much about violating the terms and conditions of a service they're using for an investigation. At worst, their fake account gets closed by the site and they have to go through proper channels if they want to proceed further.

erentz 7y ago

HIPAA doesn’t extend beyond certain health care boundaries. Disability insurance for example aren’t bound to HIPAA in any way. Once you give them your medical records they can do what they like with it.

SkyPuncher 7y ago

> I don't understand how this isn't a violation of HIPAA. HIPAA only applies to "covered entities" - basically if you don't accept insurance, you don't have to be HIPAA compliant.

astura 7y ago

Uh...I think HIPAA might be the most misunderstood law in America. As a general rule: if it's not an insurance company or medical provider (who accepts insurance) HIPAA does not apply. Hint: the "I" in HIPAA stands for insurance. Just because you emailed your great aunt to tell her you have the flu doesn't mean HIPAA suddenly applies to Gmail.