On March 6, the Health Law program at Drexel University’s Kline School of Law hosted experts in genetic science, law and ethics to consider new developments in the compilation and use of genetic databases. The setting was a conference titled “My Data, Myself: The Science, Law and Ethics of Genetic Databases” that focused on privacy issues and possible solutions from the perspective of each discipline.

Leading off the conference was Hakon Hakonarson, MD, PhD, director of the Center for Applied Genomics at Children’s Hospital of Philadelphia and professor of pediatrics at the University of Pennsylvania Perelman School of Medicine. Dr. Hakonsarson began his career in Iceland, where he helped to create one of the world’s first genetic databases based on samples from more than half the nation’s population. Iceland is the perfect place to compile a genetic database because the country’s small, homogenous population makes it easy for researchers to find connections between genes, mutations and diseases.

Dr. Hakonarson and colleagues created a company to compile and store the data – deCODE Genetics, Inc. However, its efforts quickly bumped up against legal and ethical concerns. DeCODE had obtained samples from the medical records of Icelanders based on the notion of presumed consent – the assumption that data subjects have consented to inclusion of their information unless they affirmatively opt out.  That did not sit well with Iceland’s Supreme Court, which ruled that going forward, subjects must consent explicitly. As a result, deCODE was not able to include samples from Iceland’s entire population, but it still had enough to conduct a range of important studies.

After leaving deCODE, Dr. Hakonarson founded CHOP’s Center for Applied Genomics, which created a biobank with genotypes of 100,000 children. A database of this size is tremendously valuable in finding biomarkers for genetic diseases to help develop treatments, and it is able to take advantage of novel gene editing technologies, such as crispr-cas9. Its work has helped to advance several new molecular diagnosis and treatment techniques; for example, it enables physicians to prescribe drugs more precisely using metabolic enzyme variants rather than height and weight to determine dosage. It also enables the use of more effective approaches to cancer treatment that are guided by a patient’s genome rather than simply by the organ system affected.  

A decade ago, Dr. Hakonarson’s work might have seemed a science fiction fantasy, but today it is rapidly becoming common practice. A panel of experts in clinical genetics and research described a range of new genetic treatments and directions in research – and the ethical issues they raise. Michelle Holko, PhD, MS, Presidential Innovation Fellow with the National Institutes of Health (NIH) All of Us program, explained the program’s plans for compiling a unique genomic database for research.

All of Us is a historic effort to gather data over many years from one million or more people living in the United States. When completed, it will serve as an international resource for studying the ways individual differences in lifestyle, environment and biological makeup influence health and disease. So far, more than 271,000 participants have contributed biospecimens, answered surveys and agreed to share their electronic health records. About 80 percent of them are from populations traditionally underrepresented in biomedical research. Such a large database that broadly represents the population holds tremendous promise for advancing the field of precision medicine, which targets treatments to each patient’s genetic makeup.

Reed Pyeritz, MD, PhD, William Smilow Professor at the University of Pennsylvania Perelman School of Medicine, described the problem of “variants of uncertain significance,” genetic findings that are difficult to interpret. There had been an assumption that as genetic sequencing and analysis techniques evolved, uncertainties in interpreting the results would diminish. However, the availability of more data at more refined levels has actually increased uncertainties, which has created ethical conundrums for physicians and patients.

Dr. Pyeritz also described a related problem of whether and when to recontact patients as new discoveries affecting the interpretation of their genetic profiles are made. Communication guidelines are lacking, in particular guidelines for obtaining consent from patients for receiving updates. “Recontact is not a simple issue,” said Dr. Pyeritz. In addition to ethical concerns, there are practical constraints. For example, how do you contact patients who change their physical and digital addresses?

Another concern is the appropriate response of clinicians when genetic testing indicates susceptibility to a disease for which the patient was not tested. Is there an ethical duty to communicate these incidental findings? What kind of consent should patients provide before they can be informed of them?

Joann Bodurtha, MD, MPH, professor of genetic medicine at the Johns Hopkins University School of Medicine, warned that insufficient guidelines for obtaining consent, integrating direct-to-consumer and patient-driven research testing, and communicating findings can strain the doctor-patient relationship. “How do we [clinicians] deal with what [is] the relatively established land of developing trust as a health provider [when] the terms of service that are out there are 23 pages long?” she asked.

Beyond these clinical concerns, threats to the privacy of data subjects has raised widespread alarm. A panel of experts on privacy, ethics and law described the landscape in those areas.

Sierra Luther, associate counsel at 23andMe, noted that while current privacy law offers piecemeal guidance for permissible data use, consumers can choose a genetic testing company that “does the correct job, aligns with the practice that you believe, [and] then you will maintain meaningful control over your data.” She described her company’s efforts to lead in that regard by clearly and publicly disclosing its data privacy practices and company-wide security measures, allowing customers to opt-in to the use of their data in research, and subjecting research to review by an internal institutional review board.

Robert I. Field, PhD, MPH, JD, professor at Drexel University’s Kline School of Law and Dornsife School of Public Health, argued that a new form of oversight is needed to protect customers of private testing companies, which are largely unregulated. IRBs oversee human subjects research only when it is federally funded or used for new drug approvals. He proposed the creation of a new mechanism in the form of data protection review boards, which would provide decentralized, expert oversight for commercialized genetic databases.

Holly Fernandez Lynch, JD, MBe, John Russell Dickson, MD Presidential Assistant Professor of Medical Ethics at the University of Pennsylvania Perelman School of Medicine, elaborated on the role of IRBs in protecting privacy in human subjects research and the shortcomings of their oversight. They do not review non-research uses of data, secondary research with deidentified data, research considered to pose limited risk, and activities exempted by local policy. Some of these gaps are addressed by other federal laws, but some are not. She also discussed the role of data access committees, which review requests for access to research databases. But, again, their effectiveness is uneven.

Bringing these themes together was Mark A. Rothstein, Herbert F. Boehl Chair of Law and Medicine at the University of Louisville School of Medicine and Brandeis School of Law. He emphasized the limitations of current laws in the realm of health information privacy.

The Health Insurance Portability and Accountability Act (HIPAA), which is the primary legal protection for patient medical health information, was actually enacted for a different purpose. It was intended to address the problem of job lock, which had kept many employees from changing jobs because a subsequent employer’s health coverage would exclude them based on a preexisting condition. Protection of patient privacy was added as an afterthought. The law directed the Department of Health and Human Services to enact regulations to that end, which became known as the HIPAA Privacy Rule. However, the Rule is limited in scope, applying only to records kept by health care providers, health plans, health clearing houses, and their business associates. It does not apply to employers, life insurance companies, and other entities not in the payment chain. The Rule also includes 12 broadly worded “public purpose” exceptions that allow providers to disclose, without a patient’s knowledge or consent, health information in individually identifiable form.

The Genetic Information Nondiscrimination Act (GINA) was enacted to allay fears regarding discrimination based specifically on genetic information. However, that law is also limited in scope, applying only to discrimination in health insurance and employment. Professor Rothstein remarked that the statute’s definitions of discrimination are “locked in time” because they only apply to “human DNA” and therefore do not cover information generated by such new technologies as epigenetics and microbiomics. Moreover, the law does not apply to life, disability or long-term care insurance, or to genetic discrimination in education, housing and other important areas, and it does not apply once a genetic condition has become manifest.

Professor Rothstein concluded, “We have no privacy. We may think we do, but there is no privacy of health information.” Creating sufficient protections will be difficult, but “not having privacy, I think, would be worse. We’d lose dignity, humanity.”  

The conference took place just before the COVID-19 pandemic began to spread across the United States and social distancing measures were put in place in all states. The topic of genetic database privacy has taken on increasing urgency, as genetic research is called on to help understand the virus’s spread. As research progresses, genetic scientists must appreciate the ethical and legal implications of their work, while ethicists and lawyers need to keep pace with rapid scientific advances. The Health Law program will continue its efforts to build common understandings between these disciplines.

Conference Recording

• Audio Only
• Video