3 ms·

>The type of information genetic-testing companies collect is currently not protected by the Health Insurance Portability and Accountability Act (HIPAA), our na

>The type of information genetic-testing companies collect is currently not protected by the Health Insurance Portability and Accountability Act (HIPAA), our nation’s health privacy law. Nice work by the genetic testing industry lobbyists.

fkyoureadthedoc 3y ago
Do you have a reference for this? Was it ever actually considered? Or are you just making things up?
- hnburnsy 3y ago
  https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-genetic-privacy-20190702-story.html https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g... >“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.
  - hnburnsy 3y ago
    From the same article, 23&me is lucky they are not covered under HIPPA... >The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
  - fkyoureadthedoc 3y ago
    HIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.
- ccooffee 3y ago
  The laws and regulations around genetic information seem to be (intentionally?) easy to misread. Health and Human Services has a FAQ page[1] which states: > genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4]. I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.) [1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip... [2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ [3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-testing-companies-is-genetic-data-adequately-protected-in-the-absence-of-hippa/ https://lawforbusiness.usc.edu/direct-to-consumer-generic-te... [4] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
  - eep_social 3y ago
    I think the problem is that HIPAA is less strict than the zeitgeist believes. Makes perfect sense since your family doctor will have you sign an acknowledgement yearly. The reality is that health data is for sale from all kinds of vendors including pharmacies. As long as it’s “not identifiable” it’s fair game. My work health plan uses a separate “pharmacy benefit manager” to end run around the restrictions on what it can do with that data.
cj 3y ago
If physical DNA were PHI, then everywhere we deposit DNA would need to have the same security as your doctor's office. But the data revealed in analyzing the DNA (e.g. if you have a genetic disorder) should be PHI. It's odd how something could go from "not PHI" to "now this is PHI" just by processing something like a piece of hair. "At what point does it turn into PHI" would be a difficult question to answer. IMO protection of DNA related data deserves something different than HIPAA.
- deadbeeves 3y ago
  I might be wrong, but I don't think a genetic sequencer is something that's easy to build in your garage without anyone knowing. So if loose hair is not PHI but the information that the owner of that hair has or not a genetic disorder is PHI, we could say that the PHI starts once the genome of a human is sequenced from a tissue sample. So, yes, anyone who has a genetic sequencer must have the same level of security as a doctor's office. That doesn't seem like a terrible requirement.
  - dekhn 3y ago
    it's not impossible to do DNA sequencing in your garage- either by buying a sequencer on ebay, or implementing your own. However, most of the data you'd generate wouldn't be that useful, instead, I think you could make a spotted microarray, which was one of the early examples of DIY process automation in biology (around 2000), that could be turned to nefarious uses with much less time and capital.

fkyoureadthedoc 3y ago

Do you have a reference for this? Was it ever actually considered? Or are you just making things up?

hnburnsy 3y ago
https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-genetic-privacy-20190702-story.html https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g... >“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.
- hnburnsy 3y ago
  From the same article, 23&me is lucky they are not covered under HIPPA... >The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
- fkyoureadthedoc 3y ago
  HIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.
ccooffee 3y ago
The laws and regulations around genetic information seem to be (intentionally?) easy to misread. Health and Human Services has a FAQ page[1] which states: > genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4]. I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.) [1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip... [2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ [3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-testing-companies-is-genetic-data-adequately-protected-in-the-absence-of-hippa/ https://lawforbusiness.usc.edu/direct-to-consumer-generic-te... [4] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- eep_social 3y ago
  I think the problem is that HIPAA is less strict than the zeitgeist believes. Makes perfect sense since your family doctor will have you sign an acknowledgement yearly. The reality is that health data is for sale from all kinds of vendors including pharmacies. As long as it’s “not identifiable” it’s fair game. My work health plan uses a separate “pharmacy benefit manager” to end run around the restrictions on what it can do with that data.

cj 3y ago

If physical DNA were PHI, then everywhere we deposit DNA would need to have the same security as your doctor's office. But the data revealed in analyzing the DNA (e.g. if you have a genetic disorder) should be PHI. It's odd how something could go from "not PHI" to "now this is PHI" just by processing something like a piece of hair. "At what point does it turn into PHI" would be a difficult question to answer. IMO protection of DNA related data deserves something different than HIPAA.

deadbeeves 3y ago
I might be wrong, but I don't think a genetic sequencer is something that's easy to build in your garage without anyone knowing. So if loose hair is not PHI but the information that the owner of that hair has or not a genetic disorder is PHI, we could say that the PHI starts once the genome of a human is sequenced from a tissue sample. So, yes, anyone who has a genetic sequencer must have the same level of security as a doctor's office. That doesn't seem like a terrible requirement.
- dekhn 3y ago
  it's not impossible to do DNA sequencing in your garage- either by buying a sequencer on ebay, or implementing your own. However, most of the data you'd generate wouldn't be that useful, instead, I think you could make a spotted microarray, which was one of the early examples of DIY process automation in biology (around 2000), that could be turned to nefarious uses with much less time and capital.