The Limits of State Laws to Protect Genetic Information

George J. Annas, J.D., M.P.H. (2001). Sacred Secrets -- The Privacy of Medical Records. N Engl J Med 345: 371-372

During the 2000 presidential campaign, Al Gore characterized the DNA code as a secret code like that of the Nazis. In his words, "with the completion of the Human Genome, we are on the verge of cracking another enemy's secret code. When we intercept and decipher the coded messages that cancer sends from cell to cell, we will turn the tide, and win the war against cancer."[1] Gore was expanding the metaphor of the war on cancer, and commandeering the DNA code in the service of that metaphor. At about the same time, then president Bill Clinton called the DNA code "the language in which God created life."[2] The metaphors we use to describe a thing profoundly affect how we think about it. A variety of metaphors have been used to describe human DNA, including "the book of life," the "book of man," "the holy grail of biology," and the "blueprint of life."[3]

Metaphors both inform and misinform, since they represent one thing as another.[4] Given the proliferation of secret-code metaphors and hyperbolic religious metaphors for the human genome, it is not surprising that there is great concern about how to protect personal DNA information, including genetic variations that predispose a person to various diseases, such as breast cancer. I have suggested elsewhere that a person's DNA can usefully be viewed as a coded "future diary" and that it should be considered as personal and private as a diary about that person's past. [5, 6] In 1995, my colleagues and I proposed a federal genetic-privacy act for the Human Genome Project. [7, 8] However, other than the inclusion of the undefined term "genetic information" as something group health plans cannot use to deny eligibility under the Health Insurance Portability and Accountability Act of 1996, no federal legislation has been enacted. In the absence of federal legislation, the states have had to act on their own to protect the privacy of individual genetic information and to protect against discrimination on the basis of such information. Most states now prohibit discrimination on the basis of genetic information in one or more types of insurance, about half prohibit such discrimination in employment, and more than a dozen require informed consent before a genetic test can be performed. [9, 10] One of the most recent state laws, enacted in Massachusetts in 2000, covers all these areas. [11] An examination of the Massachusetts law illustrates the main areas of concern, how political compromises can undermine the best intentions, and the limits of state privacy and antidiscrimination laws governing genetic information. All state legislation presumes that genetic information requires special protection; whether this presumption is valid is itself a point of contention. [12]

The Massachusetts Genetic-Testing Law

The Massachusetts law is designed to protect persons from discrimination based on the results of genetic testing. The law requires that informed consent be obtained before most genetic tests are performed and prohibits employers and some insurers from requiring genetic testing or using the results of such testing in a discriminatory fashion. [11] The protected genetic information generally includes "any written or recorded individually identifiable result of a genetic test . . . or explanation of such a result." Thus, the definition of "genetic test" is central, and in the law this definition varies depending on the entity involved. A genetic test is defined as "a test of human DNA, RNA, mitochondrial DNA, chromosomes, or proteins for the purpose of identifying genes, inherited or acquired genetic abnormalities, or the presence or absence of inherited or acquired characteristics in genetic material." [11]

Written informed consent is required before conducting a genetic test or divulging its results. The informed-consent document must contain the following information: a statement of the purpose of the test; a statement that the person being asked to provide consent has been informed of the reliability of positive or negative test results and the level of certainty that a positive result serves as a predictor of the condition in question; a statement that the person has been informed of the availability and importance of genetic counseling and has been given, in writing, the name of a genetic counselor or medical geneticist who will provide such counseling; and a general description of each specific condition tested for and the person or persons to whom the test results may be disclosed. [11]

The requirement to obtain informed consent does not apply to genetic testing performed by physicians or hospitals for diagnostic purposes. For health insurers and health maintenance organizations (HMOs), however, informed consent is required for both predictive and diagnostic tests. A narrower definition of genetic information applies to disability and life insurance companies, and a broader definition (including family history) applies to employers.

The informed-consent requirement is also not applicable to newborn screening and tests for drugs, alcohol, cholesterol, or antibodies to the human immunodeficiency virus when these tests are performed by physicians or hospitals. Each of these exceptions reflects successful lobbying on the part of interest groups. There is also a specific exception to reobtaining consent for "pharmaco-economic" research to determine the cost-benefit ratio of specific treatments for genetic diseases and a more general exception for "confidential research information," both of which were demanded by the state's major research hospitals and biotechnology companies. Confidential research information is specifically defined as follows:

Any results of a genetic test maintained pursuant to pharmacological or clinical research protocols which are subject to and conducted in accordance with the review and approval of an Institutional Review Board . . . which protects the confidentiality of the individual who is the subject of the genetic test either by encryption, encoding or other means . . . or where the identity of the individual is unknown or protected from disclosure by encrypting or encoding. [11]

The antidiscrimination provisions prohibit employers, employment agencies, labor organizations, and licensing agencies from discriminating against a person on the basis of genetic information (e.g., using such information as a basis for firing or refusing to hire, represent, or grant membership or a license to the person). In addition, they are not allowed to require genetic testing or the disclosure of the results of genetic testing; offer an inducement to undergo genetic testing; ask questions about genetic information; use genetic information to affect the terms of a relationship with the person; or "otherwise seek, receive, or maintain genetic information for non-medical purposes." [11]

The provisions governing insurance are more complicated. They basically prohibit medical insurers, HMOs, and insurance agents from canceling coverage, refusing to issue or renew coverage, or discriminating in any other way on the basis of genetic information. Disability and long-term care insurers may use genetic information "to set the terms of a policy provided that such information is reliable information relating to the insured's mortality or morbidity, based on sound actuarial principles, or actual or reasonably anticipated experience." Life insurance companies may ask applicants if they have undergone genetic testing, but applicants cannot be required to answer this question (although failure to do so may result in an increased rate or denial of coverage). If the applicant has undergone genetic testing, the results may be used if they are reliable. This determination is ultimately made by the insurance commissioner, with the assistance of a special commission to investigate the use of genetic-test results in connection with the issuance of life, disability, and long-term care insurance.

To enforce these provisions, the law relies on the state's consumer-protection act, which provides for payment of attorney's fees and triple damages in the case of "willful and knowing" violations and also authorizes the attorney general to seek an injunction against the offending party. However, those measures will help only persons who incur financial damages because of a breach of privacy or discrimination, making the law relatively toothless.

Discrimination on the Basis of Genetic Information

The ability to discriminate against someone on the basis of genetic information requires that the information exist. Many people have refused to undergo genetic testing because of fear that they might lose their job or insurance coverage or otherwise suffer discrimination. [9] That is probably why many commentators have consistently insisted that specific legislation to prevent genetic discrimination is necessary. [13] Because existing state laws differ and not all states have them, Francis Collins, the director of the National Human Genome Research Institute, and others have called for federal legislation to outlaw the use of predictive genetic information by health insurance companies and employers. [14] This makes sense.

Under existing law, the federal government can try to prevent genetic discrimination in employment through its power to regulate interstate commerce. The Equal Employment Opportunity Commission has taken the position that the use of genetic tests to discriminate against workers is a violation of the Americans with Disabilities Act. [15] This year, in its first genetics enforcement action, the commission sought to enjoin the Burlington Northern Santa Fe Railway from testing some of its employees without consent. [16] Burlington Northern was accused of secretly performing a DNA test that was thought to indicate the presence or absence of a predisposition to the carpal tunnel syndrome in employees seeking workers' compensation or disability payments. Burlington Northern almost immediately settled the case. The company agreed to stop genetic testing of its employees. The commission is continuing its investigation of the initial allegations and may seek compensatory and punitive damages of up to $300,000 each for the 20 to 30 workers who were tested. In a separate lawsuit by the union, which was dismissed without prejudice, the company also promised to publicly support federal legislation prohibiting genetic testing in the workplace. [17] Nonetheless, the Equal Employment Opportunity Commission is ill equipped to deal with genetic discrimination in a systematic way. [18]

The Massachusetts law ostensibly protects workers against what Burlington Northern did by prohibiting employers from seeking, receiving, or maintaining genetic information for nonmedical purposes. But the employment protection did not help the Burlington Northern employees, even though the genetic test was performed in a Massachusetts laboratory, Athena Diagnostics, because the workers were not employed in Massachusetts. Moreover, even though the genetic test was performed in a Massachusetts laboratory (which is covered by the law) without the required certification of the company's physician that informed consent from the workers had been obtained, if the workers did not incur substantial monetary damages as a result of this violation they have no real remedy under Massachusetts law. In early July, however, the chief sponsor of the Massachusetts law, Senator Linda Melconian, asked the attorney general to determine whether Athena Diagnostics violated the law.

Discrimination by insurance companies on the basis of genetic information is much more complex. Although it could be addressed by federal legislation governing interstate commerce, insurance has historically been regulated at the state level. This is likely to remain true for life, disability, and long-term care insurance. Health insurance, however, is more of a necessity than these other forms of insurance. The federal government has statutory authority to establish antidiscrimination rules for health plans. [19] Courts, however, may conclude that because of the Employee Retirement Income Security Act, states have no authority to regulate discrimination based on genetic information in employer-sponsored group health plans.

Privacy of Genetic Information

Genetic privacy is a much broader rubric than genetic discrimination. [5, 6, 20, 21] The results of genetic tests can affect how a person is treated by others, such as insurers and employers. The person tested, however, is the one most directly and intimately affected by the result. The results of genetic tests can change people's perceptions of themselves, "their personality, their self-worth, their sense of security, and their relationships with loved ones." [9] Antidiscrimination legislation, although necessary, is not sufficient to provide protection from these potentially life-changing effects of genetic testing. Privacy rules are required, such as the provision in the Massachusetts law that written informed consent be obtained before a genetic test is performed.

Almost all the definitions of "genetic test" and "genetic information" in state statutes have been criticized as either too broad or too narrow. One argument is that all medical information has a genetic basis, so it is wrong to single out genetic information for special treatment. [22] Another is that laws governing genetic privacy should apply only to information about DNA sequences. [7] The Massachusetts law represents an intermediate approach. It defines genetic information as not only DNA, RNA, and information derived from chromosomes but also the results of protein tests performed "for the purpose of identifying genes" or genetic conditions.

Whether the results of protein tests should be considered genetic information is controversial. Some clinical tests, such as hemoglobin electrophoresis, are protein tests. To many observers, protein tests and gene tests seem the same. There are reasonable arguments on both sides. My own view is that, as a practical matter, statutes designed to protect genetic information should be limited to direct gene-based information, even though the results of protein or other tests can sometimes reveal information about DNA sequences as well. The New York State Task Force on Life and the Law has taken a different view. In a report on genetic testing, it concluded that the fact that a test for beta-globin protein could identify the DNA sequence that caused sickle cell disease was a sufficient reason not to distinguish between DNA and protein tests. [22]

For the most part, a person's DNA does not change over time. Once physicians or researchers have obtained a DNA sample from a person, they can perform an innumerable number of new DNA tests on the sample without ever needing to see the person or obtain another sample. Thus, extensive personal information can be obtained without the person's knowledge or consent. Information gleaned from DNA testing is uniquely private because it can be used to predict (not determine) a person's medical status in the future.

Privacy and Genetic Research

The Massachusetts law seeks both to protect individual privacy and to promote genetic research. It accomplishes the latter, but only at the expense of the former, because informed consent is not required in the case of so-called confidential research information, as I have discussed. This means that researchers can use and share the results of genetic testing if their study protocols have been approved by an institutional review board and if the identity of the subjects is concealed by encryption, encoding, or other similar means. In my view, this measure is too vague to be protective. Researchers should be required to obtain informed consent for the research use of genetic data that can be linked to an individual person.

Meaningful protection of privacy in the context of genetic research also requires that a distinction be made between genetic information derived from DNA and the DNA sample itself. Because the DNA sample can be viewed as a coded medical record, I believe separate rules are needed for DNA samples. One approach is to require that DNA samples be destroyed or their identifiers removed as soon as the research for which consent was provided has been completed. Another is to require informed consent for the storage of DNA samples and for any new studies involving the samples and to give the research subject the right to have the samples destroyed at any time. [7, 8] Still another way to protect the privacy of genetic information is to recognize a person's property rights with regard to his or her DNA. Most people understand that ownership usually means control. Thus, explicit recognition of a person's ownership of his or her DNA may make it clear, especially to researchers and biotechnology companies, that the party with the greatest interest in the information contained in a DNA sample is the person from whom the sample was obtained and that this person properly has the right to decide whether and how the DNA is used. These and other privacy issues in DNA research continue to be discussed and debated at both the national and the international levels, not just at the state level. [6, 23, 24] Serious penalties for violating a person's rights with regard to the privacy of genetic information are also needed to make the protection of these rights meaningful.

Conclusions

The Massachusetts genetic-testing statute provides stronger protection against discrimination, especially in employment, than it does against invasion of privacy. Ultimately, I believe that federal legislation should address genetic discrimination by employers, as well as such discrimination by health insurers and group health plans. President George W. Bush recently announced his support for legislation that will prohibit genetic discrimination on the part of both employers and health insurers. [25] In his words, "to deny employment or insurance to a healthy person based only on a predisposition [to disease] violates our country's belief in equal treatment and individual merit." [26] Protection against genetic discrimination by life, disability, and long-term-care insurers should remain the responsibility of individual states; the Massachusetts law provides a useful template in this respect. Although privacy is reasonably protected by requiring that written informed consent be obtained for genetic testing and the release of test results, in my opinion, the exceptions, particularly for research, are not justified. I think thabursecific informed consent should be required. I also believe that the Massachusetts law is seriously defective in its failure to protect a person's privacy rights in the storage and retesting of identifiable DNA samples and in its failure to provide either a strong penalty or an effective remedy for the violation of these rights.

The privacy of genetic information could continue to be protected state by state, with each new state law drawing on the lessons learned by others. As I have argued elsewhere, however, uniform federal protection would be more effective. [7, 8] The experiences of the states over the past six years provide a reasonable basis for federal legislation. DNA is not a Nazi code, but neither is it the language of God. It is highly personal, private information that may reveal intimate aspects of a person's possible medical status in the future. To protect the privacy of genetic information, we should limit its creation and dissemination and give people control over their DNA samples.

Source Information

From the Health Law Department, Boston University School of Public Health, Boston.

References

  1. Vice President Gore's remarks on cancer. FDCH political transcripts. June 2, 2000:20.
  2. White House remarks on decoding of genome. New York Times. June 27, 2000:F8.
  3. Swazey JP. Those who forget their history: lessons from the recent past for the human genome quest. In: Annas GJ, Elias S, eds. Gene mapping: using law and ethics as guides. New York: Oxford University Press, 1992:45-56.
  4. Nelkin D. Molecular metaphors: the gene in popular discourse. Nat Rev Genet 2001;2:555-559.
  5. Annas GJ. Privacy rules for DNA databanks: protecting coded 'future diaries.' JAMA 1993;270:2346-2350.
  6. Roche PA, Annas GJ. Protecting genetic privacy. Nat Rev Genet 2001;2:392-396.
  7. Annas GJ, Glantz LH, Roche PA. The Genetic Privacy Act and commentary. (Accessed July 13, 2001, at http://www.bumc.bu.edu/www/sph/lw/pvl/act.html [no longer available, link updated])
  8. Roche PA, Annas GJ, Glantz LH. The Genetic Privacy Act: a proposal for national legislation. Jurimetics 1996;31:1-11.
  9. Andrews L. Future perfect: confronting decisions about genetics. New York: Columbia University Press, 2001.
  10. National Conference of State Legislatures. State genetic privacy laws. (Accessed July 17, 2001, at http://www.ncsl.org/programs/health/Genetics/prt.htm.)
  11. Mass. G.L. c. 254 (2000).
  12. Murray TH. Genetic exceptionalism and future diaries. In: Rothstein MA, ed. Genetic secrets: protecting privacy and confidentiality in the genetic era. New Haven, Conn.: Yale University Press, 1997:60-76.
  13. Jagutis MA. Insurer's access to genetic information: a call for comprehensive federal legislation. Marquette Law Rev 1999;82:429-45.
  14. Lasalandra M. Genetic code yields larger protein puzzle. Boston Herald. February 25, 2001:3.
  15. Equal Employment Opportunity Commission. Enforcem emguidance: disability-related inquiries and medical examinations of employees under the Americans with Disabilities Act. July 27, 2000.
  16. Sixel LM. Genetic testing gets a trial run. Houston Chronicle. February 16, 2001:B1.
  17. Settlement agreement. Press release of the Equal Employment Opportunity Commission, Washington, D.C., April 18, 2001.
  18. Abelson R. Anti-bias agency is short of will and cash. New York Times. July 1, 2001:1.
  19. Mariner WK. State regulation of managed care and the Employee Retirement Income Security Act. N Engl J Med 1996;335:1986-1990.
  20. Laurie G. Challenging medical-legal norms: the role of autonomy, confidentiality, and privacy in protecting individual and familial group rights in genetic information. J Leg Med 2001;22:1-54.
  21. Fedder RS. To know or not to know: legal perspectives on genetic privacy and disclosure of an individual's genetic profile. J Leg Med 2000;21:557-592.
  22. Genetic testing and screening in the age of genomic medicine. New York: New York State Task Force on Life and the Law, 2000:98.
  23. Research involving human biological material: ethical issues and policy guidance. Rockville, Md.: National Bioethics Advisory Commission, 1999.
  24. Greely HT. Iceland's plan for genomics research: facts and implications. Jurimetrics 2000;40:153-91.
  25. Cummings J, Simpson GR. Bush readies plan for legislation to prevent genetic discrimination. Wall Street Journal. June 25, 2001:B2.
  26. Radio address by the president to the nation, June 23, 2001. (Accessed July 13, 2001, at http://www.whitehouse.gov/news/releases/2001/06/20010623.html [Internet Archive link].)