A Stanford Law Professor on Genetic Testing: Who Owns Your Data?

Accessing your genetic data through companies like 23andMe and AncestryDNA is becoming more popular, but who owns the rights to your personal data? According to Hank Greely, a Stanford law professor who focuses on the ethics behind new technologies related to neuroscience and genetics, there are a lot of factors to consider when determining whether an insurance company could discriminate against you based on your genetic information.

• While the Genetic Information Nondiscrimination Act (GINA) prohibits health insurers and employers from discriminating against people based on their genetic information, the act only deals with employment and health insurance, but not life insurance, disability insurance or long-term care insurance
• Even if you do not pursue genetic testing, if a relative has taken a genetic test, someone could access certain genetic information about you if they wanted to
• Clinical trial participants should closely read through the forms they sign before enrolling in a trial to determine whether any research-specific findings from the study will be shared with others

Being Patient spoke to Greely about what you need to know about protecting your genetic data, plus whether big pharma is obligated to release information about data surrounding diseases like Alzheimer’s if they think it could benefit the public.

Being Patient: A lot of people worry about getting genetic testing because if they do have a predisposition to Alzheimer’s disease, they think that insurance companies will discriminate against them, based on this data. As a consumer, how much is our personal data protected if we are getting genetic testing?

Hank Greely: There are a couple of protections. The biggest is the Genetic Information Nondiscrimination Act, passed by Congress about 12 years ago. It prohibits health insurers and employers from discriminating against people based on their genetic information. Information like your ApoE4 status, PS1 status and having the early-onset Alzheimer’s gene variation in your family will be protected. Your family history is also protected.

There are a couple of problems though. The act only deals with employment and health insurance, but it doesn’t deal with life insurance and probably most significantly for the Alzheimer’s community, it doesn’t deal with disability insurance or long-term care insurance. Almost every state—I think 47 states—has similar laws of their own. Some are broader, some are narrower, but none of them have really been tested.

So there are some protections. The protections don’t encompass everything and, of course, the mere fact that something’s illegal doesn’t mean that it doesn’t happen. Race and sex discrimination in employment have been illegal since 1964 and I believe they still occur from time-to-time. So, on that side, that’s the effort to prevent bad things from happening if your privacy gets breached.

There’re also some protections for your privacy itself. One strategy is, make sure no one else sees your information. The other one is, make sure they can’t do anything bad with it. GINA usually ensures they can’t do anything bad with it. The protections for your information though are actually a lot less powerful than most people think, especially if you’re using a direct-to-consumer company like 23andMe. Basically, your protections are whatever protections are included in the agreement with the company. Some companies have stronger protections, some have weaker. Most of them want to be able to use your data for their own purposes. Some of them, like 23andMe, very specifically want to share your data or sell your data. It’s sharing, but they get paid for the sharing.

Being Patient: Can we assume that the data is anonymized, even if they’re sharing it? Typically, 23andMe sends people emails after completing genetic testing, asking whether they can use the data for the “advancement of science.” Will the data be anonymized as long as people don’t tick “yes” when receiving these emails?  

Hank Greely: Yes and no. It will technically be anonymized. They say, and I believe them, that they won’t share your name, social security number, Visa number, address or email address. The problem is, particularly with genetic information, de-identification is a myth in that with any sufficiently robust dataset, if somebody really cared, they could go back and re-identify you. The more data is out there in terms of genetic data, the easier that becomes. But, even if it’s not genetic data, even if all they know is that you’re 39 years old, live in this county and have the following health conditions, for some people, that’s going to be enough to say that’s you and nobody else.

There was a really interesting piece published just last week showing that over 99 percent of people could be identified with 15 demographic kinds of identifiers, none of them even genetic. Computers and the internet have made the reality of de-identification basically go away. Now, having said that, does anybody really care enough to try and re-identify you? Maybe, maybe not. Personally, I’m not paranoid about it. I assume that if anybody wanted to re-identify me they could, but I’m not that interesting, my genetic data is not that interesting, my credit card data is not that interesting, though probably more sensitive than my genetic data. However, that isn’t true for everybody.

Being Patient: The big fear, especially with a disease like Alzheimer’s, is that genetic data could impact your insurance. If a big insurance company knows you have two copies of the ApoE4 gene, which means you could have more than a 90 percent chance of getting Alzheimer’s in your lifetime, that could potentially impact you. Is there any law to protect people who have one or two copies of the ApoE4 gene from insurance companies denying them coverage or knowing what their status is, even though they didn’t hand that information over to the insurance company? 

Hank Greely: The Genetic Information Nondiscrimination Act prohibits health insurance companies from either asking you about it or acting on it. However, oftentimes they will find that information out as a result of what they may need to cover. Let’s say you’ve got an ApoE4 homozygous result and your doctor wants to have a PET scan looking for amyloid plaques. Part of the justification for doing that scan is the ApoE4 homozygous result. The insurance company would, appropriately, know about that in deciding whether or not to pay for the PET scan, but they’re not allowed to use it against you. However, if it’s a disability insurance company or a long-term care insurance company, they can ask and they can use it against you.

Here’s another thing that I don’t think people are paying enough attention to. There’re a lot of ways to predict future diseases including Alzheimer’s. We focused on genetics, in a way, because I think it’s the simplest and the sexiest right now, but people are working on blood biomarkers, cerebral spinal fluid biomarkers, PET scans both for amyloid plaques and for tau tangles. I just learned two days ago about another potential biomarker involving growing cells from your skin cells and turning them into neurons. Neurons derived this way from people with Alzheimer’s disease look different. None of those are covered by GINA. GINA only protects you from genetic information discrimination. It includes family history, but it doesn’t include blood-based biomarkers, cerebral spinal fluid biomarkers, neuroimaging or anything else.

Being Patient: It’s almost like science is moving faster than the law right now. 

Hank Greely: I think that’s right. The real underlying problem with health insurance is that we don’t live in a civilized country that guarantees everybody health coverage. Most of the rich world doesn’t have to worry about that. It is our very unique and uniquely bad system of health coverage that makes this an issue in the United States.

Being Patient: Do clinical trial participants have any legal rights to their data? 

Hank Greely: Part of that’s going to depend on what agreements they signed. You do have a right under the Health Insurance Portability and Accountability Act (HIPPA) to your clinical medical records. That doesn’t necessarily apply to research records, but part of that depends on what kind of trial you’re in. If it’s a research trial that you’re enrolled in through a clinician and that is combining clinical care with research care, you may have a right to the clinical part of it. But, as far as I can recall, I don’t think you’ve got any specific right to the research-specific findings. But you can always ask.

Being Patient: Let’s say someone just got their 23andMe results. They may need to find new health insurance. What should they be asking their providers? Should they even bring it up? How do people make sure they’re protecting their data?

Hank Greely: One thing you can do is pay close attention to what your genetic provider says in their terms and agreements, what boxes you check and what boxes you don’t check because the only big player that’s doing a lot of medical stuff right now is 23andMe. Ancestry and Family Tree aren’t really doing medical stuff. There’s a new one called MyHeritage which is doing medical, but it’s relatively small. Earlier, you mentioned checking the box about whether you want to share your data for research. If you’re really worried about the privacy of your data, you shouldn’t check that box. If you aren’t that worried, you should. So, you should pay attention to what the user agreement says. We have all checked the box that says, “I have read, understand and agree to the following 47 pages of the latest Microsoft Word update,” despite never reading it. But on this one, if you care, you should really pay attention to that.

I think you should always talk to a healthcare provider about your results. Personally, I highly recommend that people talk to genetic counselors. I think counselors are a really nice combination of people who have training in counseling, as well as training in genetics. Your primary care doctor probably has training in neither of those two things. Some of the clinical geneticists do great stuff, but they’re not necessarily great at communicating with real people. Genetic counselors are really good on both counts. I would talk to them and ask them about what, if anything, you should be worried about in terms of protecting your information.

Still, there is no way to completely protect your genetic information. Even signing up for 23andMe doesn’t completely protect your genetic information because if you’ve got a sibling, or a parent, or a child who did the test, that’s half of your information. If you’ve got an identical twin, that’s all of your information. You can’t protect against your family members doing this and from your family members’ information. Somebody who wanted to could find out something about you, or at least probabilities with respect to you. That’s how these really interesting genetic genealogy forensic cases, cold cases, have been solved. The criminals didn’t join Ancestry or 23andMe, but their second, third or fourth cousins did.

Being Patient: Should people feel as if it’s OK to get their genes tested as long as they’ve read the agreement and know what the law is? Since we don’t know where all of this is headed, what if the law changes? Would that make someone’s children more vulnerable to discrimination?

Hank Greely: For kids, unless there’s some specific symptom or other reason to be worried that they’ve got something that will affect them before they’re 18, wait until 18 and let them make their own decision. I really don’t encourage parents to test their children unless there’s a good medical reason for it. Let the kids, when they’re no longer kids, make their own decisions.

More broadly, I think we are headed toward a world where information is widely available. That will include genetic information and health information, which, thanks to electronic medical records, is more widely available than you would like. It includes all of our financial information. I’ve had my social security numbers and things like that hacked three times in the last two years. We’re headed toward a world where either, through illegal hacking or through just legitimate sharing, we’re going to have a lot less protection in terms of what people know and don’t know about us.

For most of us, genetics is not going to be a hugely powerful dangerous thing because it’s like climate. You’ve got a somewhat higher risk for some things and a somewhat lower risk for others. If you live in San Francisco in July, don’t expect heatwaves. If you live in Palo Alto, expect heatwaves, but that doesn’t tell you what the temperature is going to be on July 29th. About 5 or 10 percent of us have something pretty powerful in our genes and those people have some specific reasons to be concerned. The real kicker is unless you’ve been tested, you don’t know whether you’re in that 5 percent or 10 percent. Even then, the biggest thing to worry about, I think, would be health insurance and GINA does a pretty good job of protecting you on that.

Personally, I’ve done Ancestry, I haven’t done 23andMe. I don’t like some of the genetic tests they’re doing. I think their BRCA1 and BRCA2 tests actually should never have been approved because they will mislead a lot of people because they only test for three out of over 1,000 dangerous gene versions. I’m not interested in my APOE status. My wife, whose mother died of dementia, most likely Alzheimer’s, was interested and has gotten that information on her own. I think different people can have different views about it and a lot just depends on what you want. Privacy is not, for me, one of the main considerations, but there are people who care about it more than I do and there are people who care about it less than I do. Figure out what you want and figure out how much protection you’ve got.

Being Patient: Let’s talk about the recent Pfizer case, where it was revealed that they had a lot of insurance data that pointed to the fact that, possibly, a drug called Enbrel could reduce the risk of Alzheimer’s disease. Again, this wasn’t studied, and Pfizer chose not to pursue that information, but they kept the data. This decision raised the moral question of, “Is big pharma responsible to release these types of insights so that even if Pfizer didn’t want to pursue a study, someone else would”? 

Hank Greely: Right. They don’t have a legal obligation. Their legal obligation is mainly to their shareholders. Their ethical and moral obligation though, I think, goes more broadly than that and although we all, including me, from time to time like to dump on big pharma, at least they are trying to find things that will help people. They’re not tobacco. The people I know in pharma really are committed to that, that’s why they do what they do. Given that, I think there is a point where you have to say, “We’re not going to pursue this but others might find it useful,” and make the data available.

I think an association between Enbrel use and Alzheimer’s probably could’ve been revealed sooner. However, it gets tricky if the company is considering pursuing it. Do you make them give away a potential competitive advantage? How confident do they have to be that they’re not going to pursue it? How valuable does the information have to be? There’s been a lot of pushback on whether this Enbrel association actually makes any sense or not and one thing you learn when you hang around medicine long enough is all sorts of things are associated with all sorts of other things, sometimes purely by chance or for reasons that don’t have any particular causal connection.

I’m glad that they made it public, ultimately. I wish they had made it public sooner. I think pharma should think hard about when it can advance public health and science overall by providing information that it doesn’t intend to pursue that might be useful. This goes into a deeper question of sharing science results broadly and sharing data broadly, in an effort to help public health or relieve public suffering, even though sometimes, it puts either a company, a pharma company, a biotech company or an academic researcher at some competitive disadvantage by letting their competitors know what they’re doing. It’s a hard line to draw, but there should be some ethical compulsion to provide the information when it could be helpful.

Being Patient: At Being Patient, we spoke to scientists who felt there weren’t any major leads in the data Pfizer had access to and that the media played this story up. Because Pfizer had access to data, but decided not to pursue research based on their findings, it becomes a question of whether someone else might have chosen to pursue this data or if there was a chance it could help someone. But there’s not a governing body who would say, “You need to release this information.”

Hank Greely: There’s no legal obligation, there’s no ethics governing entity out there. In this case, this is really information that you can get from electronic medical records and so, big health entities, hospital chains or insurers—it doesn’t have to be the pharma company. Kaiser Permanente here in California has seven, eight million members with a good electronic health record. It was the electronic health records from Kaiser that unveiled the heart disease association with Vioxx 15 years ago. Electronic health records should be able to provide a lot of this information in terms of the kind of association that Pfizer saw. So, it’s not just pharma that can spot these things. We need to be looking more seriously for them. The problem right now is that the electronic health records aren’t very good because they’re mainly designed to help hospitals and doctors bill as much money as possible, not so well-designed to provide good health information, with a few exceptions like Kaiser’s.

Also, I want to add something that really doesn’t have to do with the law at all. Alzheimer’s is a disease that’s always both fascinated and terrified me. I’ve got a very good memory and it’s part of who I am and the idea of losing that is particularly worrisome to me. Right now, we are at a strange moment in Alzheimer’s disease research: when the amyloid hypothesis, which has been the reigning hypothesis for 20 years, seems to be falling apart. Billions of dollars have been spent and lost on it. On the one hand, that’s depressing because what looked like our best hope seems to be receding. On the other hand, when you cut down the big trees, all sorts of other things in the forest get a chance to grow. So, for those of you who are following Alzheimer’s research, the fact that the amyloid hypothesis hasn’t worked out is bad, but it does open up a lot of space for people to do other sorts of creative things. Don’t give up hope. People are working very hard on this and someday we’ll kick it. I hope soon.