13 ms·

Florida becomes first state to enact DNA privacy law, blocking insurers

429 points by coronadisaster 6y ago

dkural 6y ago
Relevant background: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim...
awinter-py 6y ago
health is a fascinating area of privacy because (1) it's one of the best-known and beefiest privacy statutes (HIPAA) (2) you have a legit negotiation interest in keeping your info private (wouldn't want to tell an insurer about past history lest they charge you more) and (3) insurers can punish you for witholding information by revoking coverage when they find out this is an important step
- bpodgursky 6y ago
  (2) is not true. SOME people have an interest in keeping their medical info private. Others (probably most people, since healthcare expenses are tail-weighted towards people with VERY expensive medical conditions) have an interest in telling the insurance company EVERYTHING about themselves, because they know if the insurance company is allowed to set up fine-grained risk pools, they'll be in a low-risk and cheaper one. Perfectly reasonable to argue that as a society we don't want insurance to work this way, fully information-dense. But it's not correct to argue that most insurance consumers directly economically benefit from information privacy. It's that we've decided, for society overall, that it's OK to socialize uncommon costs onto the masses.
  - michaelmrose 6y ago
    Actually what percentage of people are likely to never be part of a household that would pay more than average. Pretty much only people who die before getting sick and old.
  - RodgerTheGreat 6y ago
    It is in no one's best interest to provide DNA to their insurance provider in the interest of "full-disclosure" in hopes of negotiating a lower rate. Let's say that today you are aware of no sequences in your genome which correlate with disease. You give a sample to your provider as proof. Tomorrow, a new link is discovered between a disease and a sequence you do have. Your premiums then go up considerably. There is an unbounded number of future medical discoveries which could cause you to be considered risky. This is the fundamental problem with giving away privacy: it's fine, until one day the world changes, and it wasn't fine.
    - bpodgursky 6y ago
      > Let's say that today you are aware of no sequences in your genome which correlate with disease. You give a sample to your provider as proof. Tomorrow, a new link is discovered between a disease and a sequence you do have. Your premiums then go up considerably. Yes, and everyone else's rates go a bit down . It's not a negative-sum game -- assuming a reasonable competitive market, you're going to get a fair rate in a maximal-information pool. You may increase risk somewhat, but if you know -- from personal and historical experience -- that your family is not especially high risk, you're still on average better off sharing as much information as you can.
      - elliekelly 6y ago
        If you want to look for efficiencies in the (US) insurance market from information sharing it’s going to be far more cost effective to even out the flow of information coming the other direction: transparency of pricing. More price information about everything from drugs, to procedures, to copays and premiums. We’ll all save a lot more money by shining a light further up the chain than we will by individually offering up our DNA to save a few hundred bucks each year. And we’ll get to maintain a bit of privacy, too.
        bpodgursky 6y ago
        I don't disagree wrt transparency (although for many people I suspect genomic data is worth a lot more than a few hundred bucks a year), but these are separate concerns. I'm just disagreeing with the OP assertion that "submitting your own DNA is always negative value" Definitely making no claim whatsoever as to what the best way to make healthcare more cost-effective is.
- dtech 6y ago
  (2) and (3) really are an US-only thing. In the Netherlands insurers have to provide at least a government-composited insurance package to everyone, and they have to charge all their clients the same rate.
  - maxerickson 6y ago
    The ACA in the US only allows age and smoking status for pricing and the companies can't arbitrarily cancel policies anymore. The problem is that a big portion of the country either thinks those things are bad or doesn't understand what they are. https://www.hhs.gov/healthcare/about-the-aca/index.html https://www.hhs.gov/healthcare/about-the-aca/index.html
- Spooky23 6y ago
  > (1) it's one of the best-known and beefiest privacy statutes (HIPAA) HIPPA protects you from gossiping staff, everything else is fantasy thinking. When my wife miscarried and was hospitalized from an ectopic pregnancy, sufficient PII was available through various channels for enfamil to send a “Welcome Baby” biz via fedex on the would-be due date.
  - elliekelly 6y ago
    I’m so sorry. I hear advertising stories like this more and more frequently and I wonder when the US will at least ban targeted advertising based on health data - actual and inferred. It‘s despicable.
    - Spooky23 6y ago
      Thanks, I appreciate the thought. We felt really violated by this, and I ended up buying the marketing list in question for my zip code to understand what happened better. It’s unlikely anything will change for the better. The scrubbing of identity data is pretty easy to reverse engineer by design, as the stream of data is used by pharmaceutical companies, insurance subrogation, etc to do all sorts of things. A pharmaceutical sales rep has a scorecard for your doctor — they bpm now how many scripts were written and filled. The people who gather prescription data have your prescription before your pharmacy does. Some states have fed things like Medicaid claim data to companies to mesh against data from insurers to build models designed to target opioid abuse. By correlating events or behaviors tied to abuse to diagnoses, predictive models can be built from unprivileged data. (Remember when Target predicted someone’s pregnancy before they knew a few years ago?)
  - reaperducer 6y ago
    It also doesn't seem to stop organizations with your PII from using your health records to market to you. When I came down with a particular condition, I started receiving advertising solicitations from Walgreens about.
  - heavyset_go 6y ago
    Hospitals and practices make signing over the right to share your data with whomever they please a routine process.
- o-__-o 6y ago
  > (3) insurers can punish you for witholding information by revoking coverage when they find out I keep saying this over and over, read your policy. Make changes before you sign. My life insurance policy has verbiage that specifically says “anything found to be inaccurate after the second year cannot disqualify the insurance” My advisor was explicit in the search for a provider that allowed this. I also may have given up way too much of my information for the privilege, but... worth it.
- NightMKoder 6y ago
  Interesting note: for the purposes of life insurance coverage, your health information is NOT covered by HIPAA. It’s still technically PHI but life insurers aren’t a “covered entity” under HIPAA so are free to blast your information completely unencrypted to any of their partners. It’s ultimately the same reason Apple Health isn’t covered by HIPAA. It is pretty sketchy though given it’s almost involuntary if you want coverage.
rdxm 6y ago
didn't see that coming from FL, but sweet!
Hithredin 6y ago
Great decision! What is the point of insurance if they can predict your health issues.
- toomuchtodo 6y ago
  To properly price the product. Otherwise, people at higher risk are subsidized more heavily by people at lower risk. This isn’t about healthcare insurance (which is protected against the use of DNA data by federal statute). If you’re at higher risk of early death or needing extended long term care, even through no fault of your own, shouldn’t you have to pay more for these optional products? That’s what insurance premiums are for: to appropriately price risk.
  - cure 6y ago
    > To properly price the product. Otherwise, people at higher risk are subsidized more heavily by people at lower risk. But that's the very definition of insurance: spread the risk over the entire pool. US health insurance does not work this way, and it's part of the reason that system is so messed up and super expensive.
    - toomuchtodo 6y ago
      Life, disability, and long term care are not the same as health insurance (which shouldn’t be insurance! It should be universal healthcare). You insure against risk, you pay for care, just as you pay for gas in your car and oil changes, but your insurance covers accidents (which goes so far as to charge people of different genders and ages differently because of the risk demonstrated by the data). Should I be offended that my auto insurance charged me a crazy high premium for driving a high performance sports car at 18 years old as a single male? No! I was a high risk based on the data (which distilled down to my own risk management as then owner of an 18 year old male brain). And if the data (even genetic data) shows someone to be higher risk for an insurance product (again, we’re not talking health insurance or healthcare), they should be exposed to that cost. Life isn’t fair, and this is a poor attempt at tilting the scales if your goal is to make it more fair (considering the size of your risk pools at typical private insurers offering these products). It’s an unfunded mandate.
Animats 6y ago
But the prohibition doesn’t apply to life, disability or long-term care coverage. So it's meaningless unless you buy an individual non-Affordable Care Act policy.
- ls612 6y ago
  GINA already forbids health insurance from doing this at a federal level. This extends those protections on a state level to other types of insurance.
- huntermeyer 6y ago
  Did you read the article? That's the current federal law. Florida is extending that federal prohibition, it now applies to long-term-care, life, and disability insurers.
  - paul_f 6y ago
    Nobody reads the articles apparently. This is getting as bad as reddit :-(
- eli 6y ago
  I’m not sure individual long term care policies are a viable product if you let people who took genetic tests buy it, but can’t take that information into account when setting rates. I think it’s already pretty hard to buy unless you’re in a group plan.
jmpman 6y ago
Can we add this to the constitution?
dooglius 6y ago
Does the Illinois Biometric Information Privacy Act not already cover this?
- elliekelly 6y ago
  Unfortunately it does not. The definition of “biometric identifiers” is pretty narrow: finger print, iris scans, facial geometry, and voice recognition. IIRC genetic information is specifically excluded from the definition as are a host of medical-related types of data (x-rays, for example).
ChrisMarshallNY 6y ago
I would think the DNA companies would support this. Right now, I have no plans to ever get a test. My curiosity as to whether I descended from Dr. Zaius or Cornelius is not strong enough for me to risk having my information available for things like insurance companies dinging me. On another note, I heard that the jury is still out on the lingering aftereffects of COVID-19, and there's a better than even chance that testing positive means that we can be discriminated against for a pre-existing condition for the rest of our lives.
- mattmanser 6y ago
  Doesn't actually matter if you do it, matters if any of your sister, cousins, grandma, dad, mum, aunty, etc. do. Depending on the size of your family, could be hundreds of people, some of whom might be criminals and forced to surrender their DNA.
  - Taek 6y ago
    At least for some genes there will be uncertainty whether you got it.
    - mattmanser 6y ago
      Still will effect your insurance if you have a 25% chance of a particular genetic disease.
      - _emacsomancer_ 6y ago
        It almost seems like for-profit health insurance is a bad idea.
        alliao 6y ago
        privatisation is useful if a problem is too hard... just let the market decide. less so if every aspect of the issue is well known I think...
Vaslo 6y ago
It’s like that film Gattaca is becoming reality
nullc 6y ago
What about GINA? https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim... > The act bars the use of genetic information in health insurance and employment: it prohibits group health plans and health insurers from denying coverage to a healthy individual or charging that person higher premiums based solely on a genetic predisposition to developing a disease in the future, and it bars employers from using individuals' genetic information when making hiring, firing, job placement, or promotion decisions.
- heavyset_go 6y ago
  Doesn't go nearly far enough. Most other types of insurance other than health insurance can discriminate based on genetic data.
- johncearls 6y ago
  I had to scroll down way too far to see this. The added value of the Florida law was at the end of the article. It included: > long-term-care, life and disability insurers.
coronadisaster 6y ago
My profile says that I posted this link 11 hours ago, but the front page says that I posted it 9 hours ago... that was done to boost the post, I guess? (I'm not sure when I posted it)
bozoUser 6y ago
I hope this California bill[0] soon gets enacted into law, that would give extra protection to the residents against selling a customers data without written consent. Written consent is big here!! [0] https://www.sacbee.com/news/politics-government/capitol-alert/article240227106.html https://www.sacbee.com/news/politics-government/capitol-aler...)
zmmmmm 6y ago
I really wish strong protections would be adopted universally for all forms of discrimmination based on genetics. There is an amazing amount of value to be unlocked but we will never get there if people have to roll a giant dice to access their genetic information. I wish I could have any faith that insurance companies would see the longer term benefit in enabling people to freely learn about their health risks and manage them. However I have observed completely the opposite so far - people with very mild genetic results being denied completely unrelated insurance because an insurance algorithm auto-banned them.
- LifeLiverTransp 6y ago
  Its also a one time pad. If you have a strong inheritance of shizophrenia in the family, the likelihood of all your decendants to have it is huge. Thus, if they have it once, they have it always, as long as they can traverse family graphs.
bitwize 6y ago
Interesting. Florida became the home of "Florida Man" because it is notoriously lax on privacy restrictions in another area (arrest records).
- nichos 6y ago
  It's often credited as being one of the most "free" states, with things like information and no income tax.
ausbah 6y ago
"Federal law prevents health insurers from using genetic information in underwriting policies and in setting premiums, but the prohibition doesn’t apply to life, disability or long-term care coverage."

Relevant background: https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim...

awinter-py 6y ago

health is a fascinating area of privacy because (1) it's one of the best-known and beefiest privacy statutes (HIPAA) (2) you have a legit negotiation interest in keeping your info private (wouldn't want to tell an insurer about past history lest they charge you more) and (3) insurers can punish you for witholding information by revoking coverage when they find out this is an important step

bpodgursky 6y ago
(2) is not true. SOME people have an interest in keeping their medical info private. Others (probably most people, since healthcare expenses are tail-weighted towards people with VERY expensive medical conditions) have an interest in telling the insurance company EVERYTHING about themselves, because they know if the insurance company is allowed to set up fine-grained risk pools, they'll be in a low-risk and cheaper one. Perfectly reasonable to argue that as a society we don't want insurance to work this way, fully information-dense. But it's not correct to argue that most insurance consumers directly economically benefit from information privacy. It's that we've decided, for society overall, that it's OK to socialize uncommon costs onto the masses.
- michaelmrose 6y ago
  Actually what percentage of people are likely to never be part of a household that would pay more than average. Pretty much only people who die before getting sick and old.
- RodgerTheGreat 6y ago
  It is in no one's best interest to provide DNA to their insurance provider in the interest of "full-disclosure" in hopes of negotiating a lower rate. Let's say that today you are aware of no sequences in your genome which correlate with disease. You give a sample to your provider as proof. Tomorrow, a new link is discovered between a disease and a sequence you do have. Your premiums then go up considerably. There is an unbounded number of future medical discoveries which could cause you to be considered risky. This is the fundamental problem with giving away privacy: it's fine, until one day the world changes, and it wasn't fine.
  - bpodgursky 6y ago
    > Let's say that today you are aware of no sequences in your genome which correlate with disease. You give a sample to your provider as proof. Tomorrow, a new link is discovered between a disease and a sequence you do have. Your premiums then go up considerably. Yes, and everyone else's rates go a bit down . It's not a negative-sum game -- assuming a reasonable competitive market, you're going to get a fair rate in a maximal-information pool. You may increase risk somewhat, but if you know -- from personal and historical experience -- that your family is not especially high risk, you're still on average better off sharing as much information as you can.
    - elliekelly 6y ago
      If you want to look for efficiencies in the (US) insurance market from information sharing it’s going to be far more cost effective to even out the flow of information coming the other direction: transparency of pricing. More price information about everything from drugs, to procedures, to copays and premiums. We’ll all save a lot more money by shining a light further up the chain than we will by individually offering up our DNA to save a few hundred bucks each year. And we’ll get to maintain a bit of privacy, too.
      - bpodgursky 6y ago
        I don't disagree wrt transparency (although for many people I suspect genomic data is worth a lot more than a few hundred bucks a year), but these are separate concerns. I'm just disagreeing with the OP assertion that "submitting your own DNA is always negative value" Definitely making no claim whatsoever as to what the best way to make healthcare more cost-effective is.
dtech 6y ago
(2) and (3) really are an US-only thing. In the Netherlands insurers have to provide at least a government-composited insurance package to everyone, and they have to charge all their clients the same rate.
- maxerickson 6y ago
  The ACA in the US only allows age and smoking status for pricing and the companies can't arbitrarily cancel policies anymore. The problem is that a big portion of the country either thinks those things are bad or doesn't understand what they are. https://www.hhs.gov/healthcare/about-the-aca/index.html https://www.hhs.gov/healthcare/about-the-aca/index.html
Spooky23 6y ago
> (1) it's one of the best-known and beefiest privacy statutes (HIPAA) HIPPA protects you from gossiping staff, everything else is fantasy thinking. When my wife miscarried and was hospitalized from an ectopic pregnancy, sufficient PII was available through various channels for enfamil to send a “Welcome Baby” biz via fedex on the would-be due date.
- elliekelly 6y ago
  I’m so sorry. I hear advertising stories like this more and more frequently and I wonder when the US will at least ban targeted advertising based on health data - actual and inferred. It‘s despicable.
  - Spooky23 6y ago
    Thanks, I appreciate the thought. We felt really violated by this, and I ended up buying the marketing list in question for my zip code to understand what happened better. It’s unlikely anything will change for the better. The scrubbing of identity data is pretty easy to reverse engineer by design, as the stream of data is used by pharmaceutical companies, insurance subrogation, etc to do all sorts of things. A pharmaceutical sales rep has a scorecard for your doctor — they bpm now how many scripts were written and filled. The people who gather prescription data have your prescription before your pharmacy does. Some states have fed things like Medicaid claim data to companies to mesh against data from insurers to build models designed to target opioid abuse. By correlating events or behaviors tied to abuse to diagnoses, predictive models can be built from unprivileged data. (Remember when Target predicted someone’s pregnancy before they knew a few years ago?)
- reaperducer 6y ago
  It also doesn't seem to stop organizations with your PII from using your health records to market to you. When I came down with a particular condition, I started receiving advertising solicitations from Walgreens about.
- heavyset_go 6y ago
  Hospitals and practices make signing over the right to share your data with whomever they please a routine process.
o-__-o 6y ago
> (3) insurers can punish you for witholding information by revoking coverage when they find out I keep saying this over and over, read your policy. Make changes before you sign. My life insurance policy has verbiage that specifically says “anything found to be inaccurate after the second year cannot disqualify the insurance” My advisor was explicit in the search for a provider that allowed this. I also may have given up way too much of my information for the privilege, but... worth it.
NightMKoder 6y ago
Interesting note: for the purposes of life insurance coverage, your health information is NOT covered by HIPAA. It’s still technically PHI but life insurers aren’t a “covered entity” under HIPAA so are free to blast your information completely unencrypted to any of their partners. It’s ultimately the same reason Apple Health isn’t covered by HIPAA. It is pretty sketchy though given it’s almost involuntary if you want coverage.

rdxm 6y ago

didn't see that coming from FL, but sweet!

Hithredin 6y ago

Great decision! What is the point of insurance if they can predict your health issues.

toomuchtodo 6y ago
To properly price the product. Otherwise, people at higher risk are subsidized more heavily by people at lower risk. This isn’t about healthcare insurance (which is protected against the use of DNA data by federal statute). If you’re at higher risk of early death or needing extended long term care, even through no fault of your own, shouldn’t you have to pay more for these optional products? That’s what insurance premiums are for: to appropriately price risk.
- cure 6y ago
  > To properly price the product. Otherwise, people at higher risk are subsidized more heavily by people at lower risk. But that's the very definition of insurance: spread the risk over the entire pool. US health insurance does not work this way, and it's part of the reason that system is so messed up and super expensive.
  - toomuchtodo 6y ago
    Life, disability, and long term care are not the same as health insurance (which shouldn’t be insurance! It should be universal healthcare). You insure against risk, you pay for care, just as you pay for gas in your car and oil changes, but your insurance covers accidents (which goes so far as to charge people of different genders and ages differently because of the risk demonstrated by the data). Should I be offended that my auto insurance charged me a crazy high premium for driving a high performance sports car at 18 years old as a single male? No! I was a high risk based on the data (which distilled down to my own risk management as then owner of an 18 year old male brain). And if the data (even genetic data) shows someone to be higher risk for an insurance product (again, we’re not talking health insurance or healthcare), they should be exposed to that cost. Life isn’t fair, and this is a poor attempt at tilting the scales if your goal is to make it more fair (considering the size of your risk pools at typical private insurers offering these products). It’s an unfunded mandate.

Animats 6y ago

But the prohibition doesn’t apply to life, disability or long-term care coverage. So it's meaningless unless you buy an individual non-Affordable Care Act policy.

ls612 6y ago
GINA already forbids health insurance from doing this at a federal level. This extends those protections on a state level to other types of insurance.
huntermeyer 6y ago
Did you read the article? That's the current federal law. Florida is extending that federal prohibition, it now applies to long-term-care, life, and disability insurers.
- paul_f 6y ago
  Nobody reads the articles apparently. This is getting as bad as reddit :-(
eli 6y ago
I’m not sure individual long term care policies are a viable product if you let people who took genetic tests buy it, but can’t take that information into account when setting rates. I think it’s already pretty hard to buy unless you’re in a group plan.

jmpman 6y ago

Can we add this to the constitution?

dooglius 6y ago

Does the Illinois Biometric Information Privacy Act not already cover this?

elliekelly 6y ago
Unfortunately it does not. The definition of “biometric identifiers” is pretty narrow: finger print, iris scans, facial geometry, and voice recognition. IIRC genetic information is specifically excluded from the definition as are a host of medical-related types of data (x-rays, for example).

ChrisMarshallNY 6y ago

I would think the DNA companies would support this. Right now, I have no plans to ever get a test. My curiosity as to whether I descended from Dr. Zaius or Cornelius is not strong enough for me to risk having my information available for things like insurance companies dinging me. On another note, I heard that the jury is still out on the lingering aftereffects of COVID-19, and there's a better than even chance that testing positive means that we can be discriminated against for a pre-existing condition for the rest of our lives.

mattmanser 6y ago
Doesn't actually matter if you do it, matters if any of your sister, cousins, grandma, dad, mum, aunty, etc. do. Depending on the size of your family, could be hundreds of people, some of whom might be criminals and forced to surrender their DNA.
- Taek 6y ago
  At least for some genes there will be uncertainty whether you got it.
  - mattmanser 6y ago
    Still will effect your insurance if you have a 25% chance of a particular genetic disease.
    - _emacsomancer_ 6y ago
      It almost seems like for-profit health insurance is a bad idea.
      - alliao 6y ago
        privatisation is useful if a problem is too hard... just let the market decide. less so if every aspect of the issue is well known I think...

Vaslo 6y ago

It’s like that film Gattaca is becoming reality

nullc 6y ago

What about GINA? https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrimination_Act https://en.wikipedia.org/wiki/Genetic_Information_Nondiscrim... > The act bars the use of genetic information in health insurance and employment: it prohibits group health plans and health insurers from denying coverage to a healthy individual or charging that person higher premiums based solely on a genetic predisposition to developing a disease in the future, and it bars employers from using individuals' genetic information when making hiring, firing, job placement, or promotion decisions.

heavyset_go 6y ago
Doesn't go nearly far enough. Most other types of insurance other than health insurance can discriminate based on genetic data.
johncearls 6y ago
I had to scroll down way too far to see this. The added value of the Florida law was at the end of the article. It included: > long-term-care, life and disability insurers.

coronadisaster 6y ago

My profile says that I posted this link 11 hours ago, but the front page says that I posted it 9 hours ago... that was done to boost the post, I guess? (I'm not sure when I posted it)

bozoUser 6y ago

I hope this California bill[0] soon gets enacted into law, that would give extra protection to the residents against selling a customers data without written consent. Written consent is big here!! [0] https://www.sacbee.com/news/politics-government/capitol-alert/article240227106.html https://www.sacbee.com/news/politics-government/capitol-aler...)

zmmmmm 6y ago

I really wish strong protections would be adopted universally for all forms of discrimmination based on genetics. There is an amazing amount of value to be unlocked but we will never get there if people have to roll a giant dice to access their genetic information. I wish I could have any faith that insurance companies would see the longer term benefit in enabling people to freely learn about their health risks and manage them. However I have observed completely the opposite so far - people with very mild genetic results being denied completely unrelated insurance because an insurance algorithm auto-banned them.

LifeLiverTransp 6y ago
Its also a one time pad. If you have a strong inheritance of shizophrenia in the family, the likelihood of all your decendants to have it is huge. Thus, if they have it once, they have it always, as long as they can traverse family graphs.

bitwize 6y ago

Interesting. Florida became the home of "Florida Man" because it is notoriously lax on privacy restrictions in another area (arrest records).

nichos 6y ago
It's often credited as being one of the most "free" states, with things like information and no income tax.

ausbah 6y ago

"Federal law prevents health insurers from using genetic information in underwriting policies and in setting premiums, but the prohibition doesn’t apply to life, disability or long-term care coverage."