As Deven blogged about yesterday, the Personal Genome Project (PGP) hopes to convince 100,000 people to post their genetic information online in an effort to widen the available data set and expertise for research. (Although the current participants in the study are entrepreneurs in the biomedical industry and academics, 5,000 other individuals have signed on to take part in it). Businesses also are getting into the act, providing information to consumers about possible medical risks encoded in their DNA for as little as $399.
Consumers should note that the emerging market for genetic information is largely unregulated. As this week’s CQ Weekly reports, the FDA usually does not review the tests for approval and has no explicit regulations on what companies can tell consumers about their likelihood of disease. Companies also are not obliged to adhere to the privacy protections of HIPAA because they fall outside the definition of health care providers, even though some say that they follow HIPAA’s privacy guidelines. Federal law prohibiting discrimination on the basis of genetic data applies only to employers and health insurers, not life insurance companies. On the state level, limited protections exist regarding the collection and use of genetic information to consumers purchasing information about their DNA. State laws regulating genetic testing typically do not apply to genetic information providers. Like federal law, they prohibit employers and insurers from discriminating against individuals on the basis of their genetic information. A number of states, however, do require explicit consent for sample storage, or demand the destruction of samples after the purpose of their collection has been achieved. But, on the main, state laws addressing DNA collection and banking activities do not generally apply to companies that sell genetic testing services directly to consumers.
In an article for the New England Journal of Medicine, Patricia Roche and George Annas explain that absent a comprehensive federal law addressing genetic privacy “those who do relinquish their DNA, assuming that they have control over its uses, may discover that they have given it all away.” As Deven warns, consumers signing up for studies or purchasing information about their genetic data may not appreciate the practical and psychological risks of disclosing genetic information, both for themselves and their families. Although Roche and Annas urge individuals to only “utilize testing services that guarantee to destroy the DNA sample on completion of the specified test,” many may not do so as the popularity of the PGP suggests.