3 ms·

Isn’t DNA sequencing my medical information and protected by HIPAA and other privacy laws? Can the police search my medical records without a warrant?

i_am_nomad 7y ago
Not since Smith vs. Maryland, one of the SCOTUS’ truly awful rulings. https://www.theatlantic.com/technology/archive/2013/12/what-you-need-to-know-about-the-third-party-doctrine/282721/ https://www.theatlantic.com/technology/archive/2013/12/what-...
- phkahler 7y ago
  The police can ask you for something without a warrant. You can say no. When they ask a 3rd party like the phone company they are free to say yes and comply if they want. I dont think that would apply to data protected under HIPPA though, which by law is not to be shared without the persons comcent. But IANAL.
  - i_am_nomad 7y ago
    The problem is that the data obtained via a third party, without a warrant, is admissible in court. And IANALE, but HIPAA has exclusions and exemptions for law enforcement.
EpicEng 7y ago
HIPAA doesn't apply to everyone. There's a definition for "covered entities". For example, if you tell me about your medical condition, I can tell anyone I like. I can't find any reference to HIPAA in 23andme's privacy policy and I don't believe they are currently considered a covered entity. I don't even know if their data is considered medical information in the same way a diagnosis would be.
tbyehl 7y ago
> Isn’t DNA sequencing my medical information and protected by HIPAA and other privacy laws? It would depend on the context of how the DNA sequencing was provided. If your Doctor ordered it as part of a treatment plan and billed your health insurance, then yes, it's a medical record covered by HIPAA. If you personally ordered DNA sequencing and gave the results to GEDmatch, then HIPAA does not apply. GEDmatch is neither a Covered Entity[1] nor Business Associate[2] of a Covered Entity. From a legal perspective the DNA database at GEDmatch is no different than phone or banking records. [1] https://www.hhs.gov/hipaa/for-professionals/covered-entities/ https://www.hhs.gov/hipaa/for-professionals/covered-entities... [2] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/ https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...
astura 7y ago
Yeah, the cops can search your medical records if you printed them out and left them with a friend and that friend gave the cops access to them. HIPAA only applies to "covered entities" and their business partners, which are (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. GEDmatch is none of those.

i_am_nomad 7y ago

Not since Smith vs. Maryland, one of the SCOTUS’ truly awful rulings. https://www.theatlantic.com/technology/archive/2013/12/what-you-need-to-know-about-the-third-party-doctrine/282721/ https://www.theatlantic.com/technology/archive/2013/12/what-...

phkahler 7y ago
The police can ask you for something without a warrant. You can say no. When they ask a 3rd party like the phone company they are free to say yes and comply if they want. I dont think that would apply to data protected under HIPPA though, which by law is not to be shared without the persons comcent. But IANAL.
- i_am_nomad 7y ago
  The problem is that the data obtained via a third party, without a warrant, is admissible in court. And IANALE, but HIPAA has exclusions and exemptions for law enforcement.

EpicEng 7y ago

HIPAA doesn't apply to everyone. There's a definition for "covered entities". For example, if you tell me about your medical condition, I can tell anyone I like. I can't find any reference to HIPAA in 23andme's privacy policy and I don't believe they are currently considered a covered entity. I don't even know if their data is considered medical information in the same way a diagnosis would be.

tbyehl 7y ago

> Isn’t DNA sequencing my medical information and protected by HIPAA and other privacy laws? It would depend on the context of how the DNA sequencing was provided. If your Doctor ordered it as part of a treatment plan and billed your health insurance, then yes, it's a medical record covered by HIPAA. If you personally ordered DNA sequencing and gave the results to GEDmatch, then HIPAA does not apply. GEDmatch is neither a Covered Entity[1] nor Business Associate[2] of a Covered Entity. From a legal perspective the DNA database at GEDmatch is no different than phone or banking records. [1] https://www.hhs.gov/hipaa/for-professionals/covered-entities/ https://www.hhs.gov/hipaa/for-professionals/covered-entities... [2] https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/ https://www.hhs.gov/hipaa/for-professionals/privacy/guidance...

astura 7y ago

Yeah, the cops can search your medical records if you printed them out and left them with a friend and that friend gave the cops access to them. HIPAA only applies to "covered entities" and their business partners, which are (1) health plans, (2) health care clearinghouses, and (3) health care providers who electronically transmit any health information in connection with transactions for which HHS has adopted standards. GEDmatch is none of those.