Exploring Genetic Testing Privacy: Safeguards and Concerns

Not so long ago, genetic testing was aspirational, a process more common to science fiction than accepted medical research. Over the past several decades, however, genetic testing and gene therapy have become mainstream. They are now employed not only in medicine to develop and implement new lifesaving treatments but also by everyday consumers conducting genealogical research. See our prior blog articles on gene therapy innovation, challenges, and regulatory developments. 

Now, with the advent of large databases containing millions of genetic testing results, the public has become increasingly concerned with genetic privacy. Who is entitled to the information collected and stored by both scientific and commercial ventures, and are there any limitations to its use? 

What is Genetic Testing?

Genetic testing entails analyzing an individual’s blood, skin, hair, or other body tissue to look at DNA, chromosomes, or proteins and map the composition of or identify a change or mutation in genetic material. There are more than 77,000 genetic tests currently in use, with many more in development. Some of the major types of genetic testing available in laboratories include: 

• Cytogenetic/chromosomal tests, used to examine the structure and number of chromosomes;
• Biochemical, used to measure enzymes and other proteins produced by genes; and
• Molecular tests, used to look for DNA mutations. 

In the medical setting, the results of a genetic test can confirm or rule out a suspected genetic condition or help determine a person’s chance of developing or passing on a genetic disorder. 

Physicians now routinely employ genetic testing to diagnose a genetic disease, validate a diagnosis in a symptomatic individual, monitor the prognosis of a disease or response to treatment, initiate prevention strategies, or counsel patients regarding life decisions such as career choice and family planning.

Examples of genetic testing currently in use for medical purposes include the following:

• Newborn screening: Almost every newborn in the U.S. is screened for several genetic diseases. Early detection can lead to interventions to prevent the onset of symptoms or minimize disease severity.
• Carrier testing: Couples are tested to learn if they carry, and thus risk passing to their children, an allele (i.e., an alternate form of a gene) for a recessive condition such as cystic fibrosis, sickle cell anemia or Tay-Sachs disease. This type of testing is typically offered to individuals who have a family history of a genetic disorder and to members of ethnic groups with an increased risk of specific genetic conditions. If both parents are tested, the test can provide information about a couple’s chance of having a child with a genetic condition.
• Prenatal diagnostic testing: A tissue sample for testing can be obtained through amniocentesis or chorionic villus sampling to detect changes in a fetus’ genes or chromosomes. This type of testing is offered to couples with an increased chance of having a baby with a genetic or chromosomal disorder.
• Predictive or predispositional genetic testing: Predictive testing can identify mutations that increase a person’s risk of developing disorders with a genetic basis, such as certain types of cancer, prior to the onset of symptoms. These tests are particularly useful if an individual has a family history of a specific disease and intervention is available to prevent disease onset or minimize its severity.

Outside of the medical setting, genetic testing has also become commonplace as a forensic tool. Forensic testing is performed for legal purposes, such as criminal investigations, questions of paternity, and victim identification after fires, hurricanes, or other catastrophic events.

Finally, individuals are now increasingly using genetic testing through direct-to-consumer commercial ventures to map their genealogy or locate and connect with lost relatives through genetic analysis. 

No matter the use, the results are often stored in large databases for future reference. The unique nature of genetic information raises unique privacy and confidentiality considerations. Once an individual’s genetic material is captured, whether for medical research or commercial purposes, there are several access and use restrictions that must be considered.  

What is Genetic Privacy?

Genetic privacy is broadly defined as “the protection of genetic information from unauthorized disclosure to third parties, such as family members, employers, insurers, law enforcement, and the government.” Genetic information is similarly a comprehensive term that, in addition to DNA and biochemical test results, may also incorporate diagnoses made from physical examination and family histories. 

While there is no comprehensive federal law governing genetic privacy, several federal laws and regulations may impact the collection and use of genetic information under certain circumstances. 

In 1991, the Federal Department of Health and Human Services (“HHS”) promulgated a series of regulations titled the Federal Policy for the Protection of Human Subjects, also known as the “Common Rule.” These regulations, which were also adopted by twenty other federal agencies, establish a baseline standard of ethics for government-funded human research in the United States. The Common Rule requires all federally funded research projects that fall under its definition of “human subjects” to obtain meaningful informed consent from each participant prior to their participation. Investigators must inform participants of the potential risks of the study, including risks associated with the release of their private information. The original Common Rule did not explicitly address genetic privacy. In 2017, however, revisions to the Common Rule explicitly extended the requirements for informed consent to include genetic materials. Informed consent for genomic research should clarify the uses of research results, including who may receive or access the information. 

In addition to the regulatory-based Common Rule, two federal statutes have been enacted to protect genetic privacy: the Health Insurance Portability and Accountability Act (HIPAA) and the Genetic Information Nondiscrimination Act (GINA). 

HIPAA regulates the disclosure of medical information in healthcare settings, prescribing how and when health providers can disclose an individual’s medical information. Medical information protected under HIPAA includes genetic information. For example, if a patient has genetic testing done, HIPAA prevents the disclosure of the results to most third parties, whether to the patient’s child or to the patient’s life insurance company, without proper authorization. 

GINA was established to prevent discrimination based on genetic information acquired by health insurers and employers. Prior to GINA, it was legal for a health insurance company to charge higher premiums or deny coverage based on an individual’s genetic information. For instance, a healthy person with a high genetic risk of developing cancer could be denied health insurance or employment. However, with the enactment of GINA, individuals are now safeguarded against such discrimination based on their genetic information. 

Nevertheless, some insurance services may still take genetic dispositions into consideration. HIPAA and GINA do not apply to life, disability, or long-term care insurance companies. GINA does not prohibit a life insurance company from asking if an applicant has had genetic testing, making coverage decisions based on that answer, or even requiring testing prior to coverage. GINA also does not apply to the U.S. military or companies with fewer than 15 employees. 

On the other hand, it is important to note that GINA sets a floor of minimum protection against genetic discrimination but does not preempt states from enacting laws with stricter protections. Many states have either already done so or are considering such legislation. 

One notable state law is the Illinois Genetic Information Privacy Act (GIPA). Illinois’ GIPA has several significant genetic privacy provisions, including: 

1. Restricting all persons and companies from disclosing genetic tests and the information derived therefrom without written consent.
2. Prohibiting employers from “directly or indirectly” using genetic information as a condition of employment, or when determining work assignments or classifications of applicants and employees.
3. Except in the case of long-term care policies, prohibiting insurers from seeking information derived from genetic testing for use in connection with an accident or health insurance policy, and from using or disclosing such information for underwriting purposes. 

California, Florida, Nevada, and Alaska have similarly implemented notable genetic privacy laws.

Internationally, the General Data Protection Regulation (GDPR) contains specific provisions that apply to genetic privacy, ensuring that genetic data is strictly protected and handled with respect for individual privacy rights. It is important for companies to note that the GDPR’s scope is not necessarily limited to Europe and may apply to data processed outside of Europe under certain circumstances, such as if (1) there are sufficient links to activities of institutes within the European Union (EU)/European Economic Area (EEA); or (2) there are offerings of goods or services, or monitoring of behavior or subjects, within the EU/EEA. 

The protections afforded under genetic privacy laws, both domestically and internationally, can be complicated. Companies should consult with legal counsel to be informed of which laws apply under which situations and their implications.

The Way Forward 

Genetic testing and the collection of genetic materials for both research and commercial purposes are now common. The genetic testing market is poised for continued growth as technological advancements, increased awareness, and expanding applications continue to drive demand for genetic testing services worldwide. Vision Research Reports estimates the global genetic testing market size at around $8.84 billion as of 2023 and projects that it will reach $64.73 billion by 2033, with a compound annual growth rate of over 22% between 2024 and 2033. 

With the growth and proliferation of genetic testing, both the government and private industry will need to pay careful attention to developing privacy laws and consumer expectations and ensure appropriate privacy protections are maintained. This includes obtaining informed consent from individuals before genetic testing is performed, keeping collected data secure, and making sure that data is used only for permitted applications.  

Authored by Maria-Cristina Smith, Berkley Life Sciences, VP, Products & Professional Liability Specialist