Privacy Under the Microscope

A Department of Defense (DoD) advisory released on December 24, 2019, warning military service members against using direct-to-consumer (DTC) DNA testing products, must have put a damper on the excitement of those who received these very popular (and deeply discounted for the holidays) stocking stuffers.

The DoD cautioned, “Exposing sensitive genetic information to outside parties poses personal and operational risks to service members. These [direct-to-consumer] genetic tests are largely unregulated and could expose personal and genetic information, and potentially create unintended security consequences and increased risk to the joint force and mission.” For example, the New York Times reported, DNA testing that reveals carrier status for sickle cell disease could limit advancement in aviation specialties.

In the Journal of AHIMA and elsewhere, privacy experts have been warning against DTC genetic tests such as AncestryDNA and 23andMe for some time, citing weak privacy policies in the user agreements that leave individuals’ data vulnerable to hacking, theft, or being de-anonymized. Genetic testing ordered by a physician, in contrast, is protected by HIPAA and has strict controls over how it can be shared. While the Genetic Information Nondiscrimination Act (GINA) prevents insurance companies and employers from using genetic information in decisions about a person’s health insurance eligibility or coverage, GINA does not apply when an employer has fewer than 15 employees. Nor does GINA apply to other forms of insurance, such as disability insurance, long-term care insurance, or life insurance, which has prompted at least one lawmaker in Florida to propose legislation blocking companies from requiring or soliciting genetic information from applicants.

Florida’s incoming House Speaker Chris Sprowls told The News-Journal that he learned about the GINA loophole when applying for life insurance and wondered when and if DTC genetic tests could be used against consumers in this way. Even the National Institutes of Health says it’s “unclear whether genetic information, including the results of direct-to-consumer genetic testing, will become a standard part of the risk assessment that insurance companies undertake when making coverage decisions,” and advises consumers to “weigh the possible benefits and risks of direct-to-consumer genetic testing, including potential impacts on insurance eligibility and coverage, before you start the testing process.”