Genetic Privacy

By Alissa Johnson
National Conference of State Legislatures

Advances in genetics have ignited a public debate over the privacy of genetic information and samples. The personal, predictive and familial nature of genetic information poses a new threat to civil liberties, according to some observers. Others contend that genetic information is simply another form of health data and, therefore, should be treated similarly under the law. Regardless of whether genetic information is exceptional, genetic privacy remains linked to the larger policy issue of health information privacy. Therefore, an understanding of broad medical privacy protections and genetic-specific protections, both at the state and federal level, is necessary to develop informed public policy.

Federal Action

In April 2001, the Department of Health and Human Services adopted "Standards for Privacy of Individually Identifiable Health Information," as required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Health plans, health care providers, and other entities covered by HIPAA were required to comply with these standards—known as the HIPAA rules—by April 2003, or April 2004 for small health plans. The act compels the health insurance industry to make changes to provide patients greater control over medical information. At the same time, the HIPAA rules promote public health, and, therefore, allow some exceptions to the limits on disclosure for public health agencies.

State Action

Laws in every state protect the privacy of medical records to some degree. In addition, genetic-specific privacy protections exist in 29 states, although the measures vary widely. Washington became the first state to treat genetic information the same as other health data under privacy law when it amended its health privacy law in 2002 by adding genetic information to the definition of protected health information. All state genetic privacy laws, with the exception of Washington's, tend to include a few basic characteristics. First, these laws take a “genetic exceptionalism” approach, which means that they treat genetic information differently from other medical records. Second, genetic privacy protections often focus on the information rather than on the user or use. Third, state genetic privacy laws rely on various measures to safeguard genetic information during different handling processes—like testing, acquisition, retention and disclosure. Finally, genetic privacy laws are designed to promote greater individual control over personal genetic information but use different means—such as consent requirements, rights to access, civil remedies and property rights—to achieve this end.

Laws in 16 states require informed consent to perform or require a genetic test or obtain genetic information, and 26 states require informed consent or written authorization to disclose genetic information. Michigan, Nebraska and South Dakota place higher standards on the performance of genetic testing, but treat the information like other health data once it is created.

Property Rights. Consumers of health care services and research institutions both have a stake in property rights to genetic information. The debate centers on two types of property rights—intellectual and personal.

State Genetic Privacy Laws

Any Party

Alaska, Arizona, Delaware, Florida, Illinois, Massachusetts, Missouri, Nevada, New Hampshire, New Jersey, New Mexico, New York, Oregon, South Dakota, Texas, Vermont

Insurers

California, Colorado, Georgia,* Hawaii, Louisiana (and state agencies), Maryland, Rhode Island (and employers), South Carolina, Utah (and employers), Virginia, Washington

Others

Arkansas (researchers only), Michigan and Nebraska (physicians or individuals conducting a genetic test)

Perform or Require Genetic Test

Alaska, Arizona, Florida, Georgia, Massachusetts, Michigan, Nebraska, New Mexico, New York, South Carolina, South Dakota, Vermont

Obtain Genetic Information, DNA sample or both

Alaska, Delaware, Nevada, New Jersey, New Mexico, Oregon

Retain Genetic Information, DNA sample or both

Alaska, Delaware, Nevada, New Jersey, New Mexico, New York, Oregon

Disclose Genetic Information

Alaska, Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Hawaii, Illinois, Louisiana, Maryland, Massachusetts, Missouri, Nevada, New Hampshire, New Jersey, New Mexico, New York, Oregon, Rhode Island, South Carolina, Texas, Vermont, Virginia, Washington

*Some sections such as personal property right apply to any party.

Intellectual property rights provide an incentive for researchers to recover costs by allowing discoverers of a gene and its function to apply for a gene patent through the U.S. Patent and Trademark Office. Patents have been awarded for numerous genes or parts of genes linked to conditions, such as those associated with breast cancer, but many individuals are disconcerted by the notion that corporations may own rights to their biological material. Some observers contend that patents provide an incentive, but others believe that the fees charged by patent holders will slow scientific progress.

While the federal government has focused on the patent system, some states have looked at personal property issues. Alaska, Colorado, Florida, Georgia and Louisiana explicitly define genetic information as personal property based on the belief that individuals should be able to own this uniquely personal information. Alaska extends its personal property right to DNA samples. In 2001, Oregon repealed a property right to genetic information and DNA samples that originally passed in 1995. Some genetics researchers express concern that these laws may permit study participants to interfere with research projects or to stake claims to profits derived in part from the study of their genes.

Balancing Privacy With Other Values. Privacy undeniably has great value, but policymakers also should recognize the effects of privacy laws on other social goods, such as health care, medical research and public health. Privacy protections frequently conflict with these values. For example, laws that require health care providers to obtain patient consent for each disclosure of genetic information, even if to consult with a colleague on a diagnosis or treatment, may inhibit the delivery of care. The challenge for policymakers lies in striking an equitable balance among privacy protections and other worthy goals.

Selected Reference

National Conference of State Legislatures, Blue Ribbon Panel on Human Genetic Technologies, Genetics Policy Report: Privacy, Denver: NCSL, 2002.

Contacts for More Information

Alissa Johnson
NCSL-Washington, D.C.
(202) 624-5400
alissa.johnson@ncsl.org

U.S Department of Health and Human Services, Office of Civil Rights, http://www.hhs.gov/ocr/hipaa.

Return to previous page Genetic Technologies Project Page