The fourth workshop session, moderated by Victoria Pratt, the director of the Pharmacogenomics and Molecular Genetics Laboratories at the Indiana University School of Medicine, addressed data sharing, privacy, and security issues in the context of direct-to-consumer (DTC) genomics testing and explored the landscape of emerging regulatory issues in consumer genomics. Amy McGuire, the Leon Jaworski Professor of Biomedical Ethics and the director of the Center for Medical Ethics and Health Policy at the Baylor College of Medicine, focused her presentation on data sharing, privacy, and security. Gail Javitt, a member of the health care and life sciences practice at Epstein Becker Green, discussed the regulation of consumer genomics, and Jordan Laser, the senior director of cytogenetics and molecular pathology at the Long Island Jewish Medical Center and the chair of the professional relations committee of the Association for Molecular Pathology (AMP), spoke about AMP’s position regarding the regulation of consumer genomics.
DATA SHARING, PRIVACY, AND SECURITY
Before ordering a DTC genomic test, McGuire said, consumers should review the company’s privacy protections and understand who might have access to their data according to the accompanying terms of service. If a consumer genomics company violates its own terms of service, the consequences could include a citation by the Federal Trade Commission (FTC) for unlawful trade practices, fines, and potential lawsuits from consumers who suffered damages from that unlawful activity. However, McGuire said, violating the terms of service is not the only way in which consumers’ information might be at risk and their privacy compromised, particularly when it comes to sharing genomic data.
McGuire discussed three groups that may legally obtain access to DTC genomic test data: researchers, those in the health care system, and various other actors such as members of law enforcement. There are a few ways to protect data privacy in the research and health care realms, McGuire said. The first is to protect against unauthorized access to protected data. One mechanism to do this relies on the Health Insurance Portability and Accountability Act (HIPAA). HIPAA protects against the unauthorized disclosure of protected health information by “covered entities,” which includes health care systems. While companies that provide DTC genomics services may not themselves be covered entities, if the health care systems that receive data from them or directly from the consumer are covered entities, then they may not release the individual consumer’s data without authorization, unless it is for the purpose of treatment, payment, or health care operations.
Certificates of confidentiality,1 originally authorized by Congress in 1970, are a legal tool designed to protect the privacy of subjects in federally funded research that involves the collection of sensitive data. According to the 21st Century Cures Act, certificates of confidentiality must be issued by the Department of Health and Human Services to federally funded researchers who are collecting identifiable research data, and researchers who are not federally funded can apply for certificate protections (Wolf and Beskow, 2018). Certificates of confidentiality can protect against access by law enforcement and other actors even in the case of a subpoena or warrant, McGuire said. However, data that are not used for research are not protected by a certificate of confidentiality, she noted.
The second way to protect data privacy is to prevent the discriminatory use of those data. In 2008 Congress passed the Genetic Information Nondiscrimination Act (GINA), which prohibits health insurers and employers from using genetic information, including family health histories, for discriminatory purposes. GINA only applies to health insurers and companies with more than 50 employees; the law does not apply to life insurance, disability insurance, or long-term care policies. There has been heavy criticism of GINA for not being comprehensive in its protections, McGuire said. A national survey that McGuire and her collaborators conducted found that few people have ever heard of GINA, in contrast to HIPAA and the Americans with Disabilities Act (ADA). However, when her team explained what GINA was, 30 percent of the approximately 1,500 people surveyed said that they were less concerned about their privacy. The bad news, McGuire said, was that 30 percent of those surveyed felt more concerned about their privacy after learning about GINA because of the gaps in its protections.
___________________
1 To read more about certificates of confidentiality and how they protect the privacy of research subjects in National Institutes of Health–funded research, see https://grants.nih.gov/policy/humansubjects/coc.htm (accessed December 9, 2019).
The Patient Protection and Affordable Care Act (ACA) and the ADA provide additional protections against genetic discrimination in the areas of health insurance and employment, McGuire said. Finally, she said, there are many states that have state-specific laws that provide even broader protections against genetic discrimination, with California having the most comprehensive state law.
Turning to the emerging issue of law enforcement access to consumer genomics information, McGuire shared the story of the search for a serial rapist, murderer, and armed robber who terrorized California between 1974 and 1986, known to law enforcement and in the media as the Golden State Killer. In 2018, after police had carried out more than 40 years of investigative work, Joseph DeAngelo was arrested and charged with eight counts of first degree murder and is accused of being the infamous Golden State Killer. During the course of their lengthy investigation, police tried to identify the Golden State Killer using numerous DNA samples obtained at the crime scenes, but were unsuccessful because his DNA was not in the national law enforcement database. Several years ago, a Federal Bureau of Investigation (FBI) agent decided to take a new approach, creating a variant profile from crime scene DNA samples and uploading it to a genetic genealogy database called GEDmatch. The database, McGuire explained, allows people to take their DTC genomic testing information and connect themselves with others in the database with whom they share DNA, suggesting a familial relation.
The aim of the FBI’s approach was to identify relatives of the Golden State Killer, and, in fact, a third cousin was identified. The FBI then constructed a massive family tree using public databases, social media, and other sources, and focused on one individual who fit the profile: he was the right age, in the right places at the right time, and he was an ex-police officer. With a suspect in mind, law enforcement followed him and waited to collect DNA from his trash, and tests confirmed that Joseph DeAngelo’s DNA was a match to the DNA collected at crime scenes linked to the Golden State Killer.
This approach has since been used in approximately 100 cases, McGuire said, with hundreds more in the pipeline. Some view this investigative tactic as an invasion of privacy and something that should not be permitted, McGuire said. Since the Golden State Killer case garnered widespread attention, companies have changed their terms of service to include language regarding law enforcement access to their customers’ data. Ancestry.com and 23andMe, for example, will not provide access to their customers’ information without a warrant, and GEDmatch now requires customers to opt into allowing law enforcement to access their information. As a result, the part of the GEDmatch database that is accessible to law enforcement went from 1.4 million people to about 180,000, which McGuire said sig-
nificantly impedes law enforcement’s ability to identify suspected criminals through familial matching. With regard to concerns about genetic privacy, McGuire said that law enforcement does not see a person’s actual DNA sequence. Rather, they see what any other customer looking for a familial match would see—the name on the account for persons who share DNA with them, how much DNA they share, and the implications of that for how closely related they might be. One of the big questions in this space, McGuire said, is whether this violates the privacy of those individuals who match to the person who initiated the DTC testing.
Currently there are no regulations governing this type of use of genomic information, McGuire said. However, the field made strides recently in considering an appropriate path forward, with a Department of Justice interim policy that establishes parameters on the law enforcement use of non-forensic DNA databases for investigative purposes. This policy and other considerations were discussed at an October 2019 meeting that brought together state and federal law enforcement, company officials, consumer advocates, and other stakeholders.2 In closing, McGuire said, there are always risks to privacy in today’s world, and eliminating all risks in the area of consumer genetic testing is not possible. There are also counterbalancing values that are important to consider, such as the use of information to advance research, improve health, and protect public safety. At some point, trade-offs need to be made, McGuire said, and the conversation today is about how to make those trade-offs in a responsible and ethical manner.
REGULATION OF CONSUMER GENOMICS
There are three critical questions regarding the regulation of DTC genomic tests, Gail Javitt said: what to regulate, for what purposes regulations are needed, and who should do the regulating. There are many different aspects of consumer genomics that are currently or could be potentially regulated, including the laboratory performing the tests, the company selling test services, and marketing claims about the benefits of the products. Regulations could also specify the type of training and qualifications necessary to order a test and could govern the use of adjunctive products such as the software used to interpret the data, she said.
The reasons to regulate include setting standards for analytical validity, clinical validity, clinical utility, and the comprehensibility of the information provided to consumers; protecting access to that information; and, more broadly, protecting and promoting public health. For consumer genomics,
___________________
2 The agenda for this meeting is available at https://www.cshl.edu/wp-content/uploads/2019/10/Privacy-Trust-Societal-Benefit-from-Consumer-Genomics-Meeting-Agenda-Banbury.pdf (accessed November 26, 2019).
Javitt said, the question of who should do the regulating is the toughest, most complicated, and most rapidly evolving part of the story. Federal agencies such as the Centers for Medicare & Medicaid Services (CMS), the Food and Drug Administration (FDA), and FTC are involved or potentially could be involved in the oversight of DTC genomic tests, she said, while states have primary authority over regulations pertaining to the health, safety, and welfare of their citizens, including the regulation of the health professions and the scope of laboratory and clinical practice. The courts also play a role in interpreting and enforcing regulations, and payers indirectly regulate the use of DTC genomic test services through their decisions on whether to pay for such tests. Finally, Javitt said, professional societies can establish professional norms that act as de facto regulations and oversight.
Each aspect of regulation of DTC genomic tests is fairly complex and can involve many different groups, Javitt said. For example, clinical laboratories that test samples for the purposes of health assessment are subject to the Clinical Laboratory Improvement Amendments (CLIA). CLIA regulates the quality of the facility, requires laboratories to hire people with certain types of training, and mandates documentation of analytical validity. Most states carry out the implementation and oversight of CLIA, Javitt said, although New York State is exempt from CLIA because its regulations are more rigorous. In the area of analytical validity, CMS has authorized the College of American Pathologists to perform laboratory certification in its stead. Laboratories also use a variety of instruments and tools that are regulated as medical devices by FDA under the Federal Food, Drug, and Cosmetic Act, she said.
One interesting aspect of regulation pertaining to DTC genomic tests has to do with laboratory-developed tests (LDTs), which are tests that laboratories develop for their own internal use instead of using a commercially available, FDA-approved kit. While FDA has the authority to regulate LDTs, it has largely decided to exercise its “enforcement discretion” (meaning to not take enforcement action), Javitt said, although FDA has, in limited circumstances, sent warning letters to specific laboratories objecting to specific LDTs. The FTC is responsible for regulating advertising and promotional claims under its authority to prohibit unfair trade practices, including the use of deceptive advertising. For the most part, the FTC has not initiated actions against DTC genomics companies for their marketing claims, Javitt said (although they have in a few circumstances investigated the privacy practices of certain DTC companies). The FTC also maintains a website with relevant information for consumers who are considering this type of test.3
___________________
3 The FTC provides information to consumers on DTC genetic tests at https://www.consumer.ftc.gov/articles/0166-direct-consumer-genetic-tests (accessed December 10, 2019).
Javitt said that for many years FDA has sent mixed signals regarding its regulatory intentions with respect to LDTs. For example, in 2006 and 2007 FDA released draft guidance for the regulation of in vitro diagnostic multivariate index assays, which are tests that use proprietary algorithms to analyze multiple biomarkers and generate a risk score; however, the guidance was never finalized, and FDA did not end up regulating those assays. Subsequently, in 2010 FDA announced it would regulate DTC genomic tests and companies and that all DTC genomic tests that provided health information in the absence of FDA review were unlawful. As a result, Javitt said, a number of companies changed their business models. In 2013 FDA sent warning letters to five companies, including 23andMe, Navigenics, and DeCode, letting them know that their genetic test offerings were considered a medical device and had not received proper regulatory clearance. At that point, 23andMe stopped offering health-related information and began submitting a number of applications for its tests to FDA, some of which have been authorized for marketing and are once again offered to customers. In 2016, FDA announced that it would not be finalizing a framework for LDT oversight in order to allow for additional public discussion and for Congress to develop a legislative solution. More recently, however, FDA has taken steps to prohibit laboratories from offering pharmacogenomics tests on the basis that, in the agency’s view, the relationship between DNA variations and medication response has not been established (see Table 5-1).
| Date | Action | Summary |
|---|---|---|
| October 31, 2018 | The Food and Drug Administration (FDA) issues safety communication warninga against the use of pharmacogenomics tests |
|
| Date | Action | Summary |
|---|---|---|
| April 4, 2019 | FDA issues a warning letterb to Inova Genomics Laboratory |
|
| Summer 2019 | FDA contacts various entities offering pharmacogenomics testing |
|
| September 2019 | American Clinical Laboratory Association (ACLA) submits a letter to FDA Association for Molecular Pathology (AMP) issues a statement on “best practices” for pharmacogenomics testing |
|
aThe full text from the FDA safety communication warning regarding the use of genetic tests with unapproved claims to predict patient response to medications from October 2018 is available at https://www.fda.gov/medical-devices/safety-communications/fda-warns-against-use-many-genetic-tests-unapproved-claims-predict-patient-response-specific (accessed December 10, 2019).
bThe warning letter from FDA to the Inova Genomics Laboratory can be found at https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/inova-genomics-laboratory-577422-04042019 (accessed December 10, 2019).
The regulation of DTC genomic testing is not simple or straightforward, Javitt said. The delivery of DTC genomic testing includes a number of different activities that are or could be regulated, she said, and different regulatory bodies are responsible, or potentially responsible, for these activities. Who has jurisdiction over some activities remains unclear, and there has been a lack of a coherent or consistent regulatory framework for other activities. “As the amount of genomic information available continues to increase,”
Javitt said, “it is increasingly important to develop consensus regarding the key objectives of regulation and the entities that are best placed to develop and implement policies to achieve these objectives.”
THE ASSOCIATION FOR MOLECULAR PATHOLOGY’S EVOLVING POSITION ON CONSUMER GENOMICS
Jordan Laser used the evolving position statement of AMP as an example to illustrate how the field of consumer genomics testing is changing and some of the current concerns about regulation and privacy. AMP’s first position statement, issued in 2007, reflected the concern that consumers who ordered such tests directly would not be able to fully understand the test results. “Back then we only felt comfortable with such tests being ordered and interpreted through the context of a health care provider,” Laser said. AMP also felt strongly that genomic tests should only be conducted in a laboratory regulated by CLIA.
With the evolution and massive growth of the DTC genomic test industry, AMP changed its position statement in 2015. The group recognized that DTC testing was likely here to stay and that it could provide some level of value, Laser said, so the position statement was updated to support DTC testing with some conditions. AMP remained neutral regarding ancestry testing, deciding that such information posed little risk to the consumer and might lead to an increase in genetic literacy among the public. The group did oppose consumer genetic testing for which the company would then offer secondary services, such as vitamins, movies, and books, that were targeted to specific individuals, he said.
In 2019 AMP updated its position statement once again to reflect another stage in the field’s evolution. The 2019 statement4 delved more deeply and broadly into the issue of transparency around consumers’ ability to understand their results in terms of analytical and clinical validity. The statement also covered the need to educate consumers about the uses and limitations of these tests, and it recommended referrals to genetic counselors to support consumers. The most important addition to the 2019 position statement, Laser said, was a discussion on privacy protections and on the Future of Privacy Forum’s work5 on developing privacy best practices for consumer genomic testing services. These best practices focus on promoting transparency with respect to making sure that consumers get
___________________
4 The 2019 AMP position statement is available at https://www.amp.org/AMP/assets/File/position-statements/2019/AMP_Position_Statement_Consumer_Genomics_FINAL.pdf?pass=63 (accessed November 26, 2019).
5 The Future of Privacy Forum’s document titled Privacy Best Practices for Consumer Genetic Testing Services is available at https://fpf.org/wp-content/uploads/2018/07/Privacy-Best-Practices-for-Consumer-Genetic-Testing-Services-FINAL.pdf (accessed December 11, 2019).
information in language they can understand, providing consumers with choices concerning who has permission to access their data, enhancing privacy protections to include not sharing genetic data with employers and insurance companies, and requiring a legal process before disclosing data to law enforcement.
Laser pointed out several areas where privacy and regulatory protections related to DTC genomic testing have been instituted. The ADA, for example, includes a provision that prevents employment discrimination based on genetic information, Laser noted, and the ACA’s provisions on preexisting conditions includes genetic information. The Code of Federal Regulations, Title 45 Part 46, also provides a number of protections for data used in research.6 The issue is not so much that there are no regulations concerning privacy protections, Laser said, but rather that most consumers do not know about them.
States also offer legal and regulatory protections for consumers, including protection against genetic discrimination by insurers and employers. Several states have also added their own provisions to strengthen GINA by instituting nondiscrimination protections regarding life, disability, and long-term care insurance. For example, Laser said, California has its own expanded version of GINA that also covers emergency medical services, housing, mortgage lending, education, and other state-funded programs.
DISCUSSION
Regulatory Gaps for Direct-to-Consumer Genomic Tests
Vicky Pratt asked where the regulatory and privacy gaps for consumer genomics are. Currently, Laser said, there is a patchwork of protections in place rather than one comprehensive level of protection, and there are concerns that consumers are not aware of these protections and may not know how to navigate them. It is going to be very difficult to build guardrails that completely protect privacy in the DTC genomics space, McGuire added. The goals should be to do the best job possible, to make the regulations as transparent as possible, and to engage the public in a way that increases trust, McGuire said. Another important issue to consider, Javitt said, is the increasing convergence of DTC genomics companies and health care delivery systems. It may be more challenging to try to consider regulatory issues in those two spheres separately because many of the concerns are the same, regardless of who is ordering the test and seeing the results first. An
___________________
6 For more information on the protection of human research subjects, see https://www.govinfo.gov/content/pkg/CFR-2016-title45-vol1/pdf/CFR-2016-title45-vol1-part46.pdf (accessed January 10, 2020).
important step in moving forward with the regulation of DTC genomics, Javitt said, will be gaining consensus concerning what the appropriate risk tolerance should be regarding the validation of evidence. Since that could be a messy and time-consuming process, she said, in the interim consumers should try to be aware of the limitations of the tests they are taking, and companies should try to not oversell their products.
Many consumers may not be aware of third-party companies that offer to interpret the raw data from DTC genomic tests, Pomerantz said, and she asked the panelists how those companies are regulated and by whom. Companies that interpret raw DTC genomic data but do not actually perform the sequencing (sometimes referred to as dry laboratories) represent an area that is falling through the regulatory cracks, Javitt said. In New York State, she said, these companies would likely meet the definition of a laboratory and be subject to that state’s Clinical Laboratory Evaluation Program.7 It is not clear, though, if there is enforcement action, she said. The other potential area of oversight for third-party interpretation companies involves their proprietary software, Javitt said. It is unclear if that software is subject to FDA regulation as medical devices, she said, and although it is very important, this area is not receiving a lot of attention at the moment.
A workshop participant suggested that consumers should have an ongoing ability to request that their data be deleted. The participant also said that consumers should be informed as to whether there is foreign involvement in the companies that offer these tests, a point with which Laser agreed.
Privacy and Genetic Exceptionalism
One workshop participant asked whether there was a need for specific language and federal privacy legislation concerning genomic data. The debate about providing a higher level of privacy protection for genomic information has been going on for a long time, McGuire said, and there are good arguments on both sides. The recent familial matching by law enforcement raises distinctive issues that do require more thought, she added. Balancing privacy, innovation, and research has always been a challenge, Laser said. A world of absolute privacy does not really allow for innovation and effective research, he said, and genetic exceptionalism may be the result of our current level of discomfort around the available evidence. Over time, he said, as more data are collected, one hopes that the discomfort concerning genetics will subside.
___________________
7 More information on the New York State Clinical Laboratory Evaluation Program can be found at https://www.wadsworth.org/regulatory/clep (accessed on December 12, 2019).
Possible Role for Direct-to-Consumer Genomics Companies in Cascade Screening
DTC genomic tests can sometimes have a big impact on families, Geoff Ginsburg said. Cascade screening, the process of contacting family members who may be at risk for a pathogenic variant, is currently quite challenging within the context of the American health care system, in part because of HIPAA regulations, he continued. Perhaps cascade screening would be more effective and easier if it were conducted through the DTC genomics companies instead of within the health care system, because the companies are often not considered covered entities under HIPAA and therefore have more freedom. Many companies may still have confidentiality and privacy rules laid out in their terms and conditions, McGuire said, so any contact of family members would have to abide by those rules. The FTC can also investigate DTC genomics companies for privacy violations, Javitt said, so companies must ensure that the activities they conduct are in line with their stated privacy policies.
