4 ms·

Do you have a reference for this? Was it ever actually considered? Or are you just making things up?

hnburnsy 3y ago
https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-genetic-privacy-20190702-story.html https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g... >“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.
- hnburnsy 3y ago
  From the same article, 23&me is lucky they are not covered under HIPPA... >The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
- fkyoureadthedoc 3y ago
  HIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.
ccooffee 3y ago
The laws and regulations around genetic information seem to be (intentionally?) easy to misread. Health and Human Services has a FAQ page[1] which states: > genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4]. I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.) [1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip... [2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ [3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-testing-companies-is-genetic-data-adequately-protected-in-the-absence-of-hippa/ https://lawforbusiness.usc.edu/direct-to-consumer-generic-te... [4] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...
- eep_social 3y ago
  I think the problem is that HIPAA is less strict than the zeitgeist believes. Makes perfect sense since your family doctor will have you sign an acknowledgement yearly. The reality is that health data is for sale from all kinds of vendors including pharmacies. As long as it’s “not identifiable” it’s fair game. My work health plan uses a separate “pharmacy benefit manager” to end run around the restrictions on what it can do with that data.

https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-genetic-privacy-20190702-story.html https://www.latimes.com/business/lazarus/la-fi-lazarus-dna-g... >“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.

hnburnsy 3y ago
From the same article, 23&me is lucky they are not covered under HIPPA... >The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
fkyoureadthedoc 3y ago
HIPAA applies to health care providers and health insurance companies. If you give some other type of entity your PHI they are not beholden to HIPAA. You said that this wasn't part of HIPAA specifically because of lobbying. You haven't provided anything that says that anyone was even considering expanding HIPAA to cover other entities. 23&Me wasn't even around to lobby when HIPAA was penned.

ccooffee 3y ago

The laws and regulations around genetic information seem to be (intentionally?) easy to misread. Health and Human Services has a FAQ page[1] which states: > genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse. However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4]. I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.) [1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hipaa-protect-genetic-information/index.html https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip... [2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/ [3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-testing-companies-is-genetic-data-adequately-protected-in-the-absence-of-hippa/ https://lawforbusiness.usc.edu/direct-to-consumer-generic-te... [4] https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html https://www.hhs.gov/hipaa/for-professionals/covered-entities...

eep_social 3y ago
I think the problem is that HIPAA is less strict than the zeitgeist believes. Makes perfect sense since your family doctor will have you sign an acknowledgement yearly. The reality is that health data is for sale from all kinds of vendors including pharmacies. As long as it’s “not identifiable” it’s fair game. My work health plan uses a separate “pharmacy benefit manager” to end run around the restrictions on what it can do with that data.