Why home DNA tests might not be as private as you think

Spit in the tube, seal up the envelope, wait three to five weeks, receive a litany of information about your ancestry and health for less than $200. This thrilling, futuristic model has become the cornerstone of several direct-to-consumer (DTC) genetic testing companies over the past decade, and at such a low price point, such tests might seem like the perfect gift for friends and family. But in an uncertain regulatory environment with lax privacy standards, you might want to double-check the true price before letting your curiosity get the best of you.

Your genome consists of thousands of individual genes; these genes come in variants that can reveal information about your ancestry and physical traits like height and eye color. However, genetic variants can also reveal more serious information about your chances of being diagnosed with certain cancers, disorders or rare genetic diseases. While most DTC companies began by giving customers fun and innocuous information about things like cilantro aversion, ice-cream flavor preference, or mosquito bite frequency, your report could now include a section on your predisposition to breast cancer or tell you if there’s a chance your child will have cystic fibrosis if you choose to “opt in” to receive this data. Many customers are finding that this information, in addition to being psychologically burdensome, ends up costing far more than the $200 price tag.

In the US, your genetic information has some legal protection: the Genetic Information Nondiscrimination Act of 2008 (GINA) prevents your employer and your health insurer from using your genetic information when making decisions about hiring, firing or raising your rates. Unfortunately, these are not the only entities that want to take advantage of your genetic information: Life insurance, short- and long-term disability insurance and the military are a few of the actors that do not fall under the aegis of GINA.

Jessica Tenenbaum experienced this first-hand. DTC genetic test results suggested she may be at risk for developing life-threatening blood clots, though she had no personal or family history of this condition. Dr. Tenenbaum, a professor at Duke University who was undergoing fertility treatment, was advised by her fertility specialist that she would need to start self-administered injections of enoxaparin and aspirin twice daily for the remainder of her pregnancy. Though she was fortunate enough to have insurance that covered most of the cost of the treatment (and was was able to “overcome a stronger-than-average lifelong aversion to needles”), additional pitfalls remained. When applying for life insurance several years later, Jessica’s results came back to haunt her: She had to report her risk of clotting, as non-disclosure could have voided her policy. Her monthly rate nearly doubled, a financial hit that she was able to bear, but that could be extremely consequential for many people.

As DTC testing becomes more ubiquitous, stories like this will only become more common. Discovering how genes interact with the environment and what effects they produce is a complex business; this research is fueled, partially, by correlating genetic markers with health outcomes. The more people that participate, the more quickly this research can proceed.

As things stand, 90% of Americans are concerned about unintended privacy consequences that might arise from giving up their genome, and that’s a problem for all of us. A more comprehensive scheme to protect genomic privacy is a rare case where consumers, companies and those who choose not to participate have aligned incentives. Though companies are generally reticent about regulation, it seems likely that they are losing potential customers who would like to use their services, but are concerned about how their data might be used against them in the future. Furthermore, there is no benefit accrued by DTC enterprises if their consumers are harmed by a lack of genomic privacy. Everyone benefits when consumers can be confident their genomic data will be protected, a point highlighted in a recent best practices document released by three top DTC companies in collaboration with the Future of Privacy Forum. As Jessica said, “The one thing I would ask is that you not make it sound like it was a mistake to have done the DTC testing and that DTC is a bad thing. I’m still glad I did it and encourage others … to do it, so we can identify issues like this and work them out to make it a better scenario for everyone.”

If we wish to live in a world where the benefits of genomic medicine are realized as quickly as possible, bolstering confidence about the security of the data is essential. Though there are several ways to go about this, it is likely that legislation will be the most effective path, a position supported by the leading players in the field. The complex and intertwined nature of the US healthcare system is such that few actors have the leverage the federal government does to block the transfer of health data to specific entities. GINA, for all its flaws, was a surprisingly prescient document that should be looked to as a model if we wish to reap the benefits of genomic medicine in a manner that respects privacy and retains trust.