It used to be that high technology meant nuclear physics and missile systems, and presented the threat of physical destruction. Today, "high tech" means biotechnology and electronic communication systems, and the focus has shifted to concerns about more subtle problems like loss of privacy, inability to control personal information, and the discriminations and other adversities that often follow.
The Human Genome Research Program is like a "big bang" that created two expanding universes: one full of galaxies of biotechnological advances, the other full of a myriad of laws dealing with the handling and use of genetic information. The legislative universe may be expanding at a greater rate. By recent count, 14 bills pertaining to the use of genetic information were introduced in the 104th Congress for consideration in 1996, and 7 bills are already on the agenda of the 105th Congress. State legislatures, many of which have enacted numerous laws over the last decade to protect genetic information and prevent discrimination, now face a surge of over 60 bills to expand these protections, with more being introduced each week--4 bills will soon be introduced in Massachusetts, 5 bills have been introduced in both Hawaii and Connecticut, and at least 11 bills are now before legislators in Michigan. The focus of these bills and prior laws is genetic privacy and discrimination. These pieces of legislation contain varying definitions of genetic testing and genetic information; diverse rights and duties for patients, doctors, employers, insurers, and other parties; and a variety of decision-making criteria, enforcement measures, and sanctions.
Why All the Fuss?
Since the advent of biotechnology, scientists and biotech firms have touted genetic information as especially revealing, more so than conventional medical information, of a person's current and future health status. The public appears to accept that this revelatory quality may pose new diagnostic and therapeutic opportunities and other health benefits, but also seems to perceive that such information could expose individuals to a broad range of informational abuses commonly encountered in society, from job and insurance discrimination to manipulation and constraints on personal choices and freedoms. In addition, there is the prospect that genetic information, much like psychiatric information, may provide new opportunities for hasty, arbitrary, and stigmatizing labeling of individuals, without adequate recourse for the victims of such labeling.
These concerns are reinforced by media reports on the misuse of genetic information. Such accounts have included announcements that a genetic basis for certain behaviors, for example violence and criminality, has been determined; that a patient's genetic information was sold by his physician to a company that subsequently profited from the information; that employers and insurers seek and use genetic information to exclude certain applicants in order to reduce financial risks and maximize profits; and that adoption agencies, police, and other organizations want such information to make decisions that will suit their agendas but restrict individual choices, freedoms, and opportunities.
Further reinforcing public concerns about the vulnerabilities likely to be created by the availability of more and more genetic information is the failure of numerous laws enacted over the years to maintain the confidentiality of patient and employee medical records. Privacy law can be ambiguous and is open to broad interpretation by the courts. And special laws that were enacted to aggressively prevent various discriminations based on health status, such as the Americans with Disabilities Act (ADA), can be self-limiting. Despite 1995 guidance by the Equal Employment Opportunity Commission that the ADA protects those with "an inborn predisposition to a disease" as revealed by "genetic information relating to illness, disease, or other disorders" from discrimination in employment, the EEOC guidance is advisory, lacks the force of law, and leaves resolution of individual cases to litigation and court decisions.
Finally, new health care policies and electronic capabilities arouse public concerns about medical privacy, including genetic privacy. Managed health care systems involve the compilation of information on a patient from multiple physicians and tests, and afford access to many parties, including doctors, hospitals, clinics, pharmacists, state health agencies, administrators, insurers, employers, researchers, and members of the patient's family. Protecting medical and genetic information under these circumstances is highly problematic and is made more so by computerization and electronic access.
The People's Rights
Various technological defenses are emerging as possible means of ensuring medical and genetic privacy.
The New York Times, in an editorial on 11 March 1997, called for improved methods of protecting patient records held by individual physicians or health care providers, and for guarding such information as it is transferred electronically to employers, insurers, and others. In addition to strengthening the legal obligations of various persons to protect patient information, the
Times
proposed that electronic auditing of information access, dedicated modem lines, and even encryption be used.
A similar approach was suggested recently by a special panel of the National Research Council, which found that patient records were inadequately protected in electronic systems. The panel called for technological safeguards, such as passwords and "firewalls" (internal software impediments to access) to prevent unauthorized access and electronic auditing and to improve information management. These approaches are comparable to defenses being developed to protect financial information and assure privacy in new electronic investment and banking systems on the Internet.
In a more traditional arena, many are beginning to consider the courts incapable of providing a coherent response to societal concerns about genetic privacy and discrimination. Operating on a case-by-case basis across the United States, courts must deal with the specific factual and legal issues unique to each case. Thus, they are called on to construe diverse federal and state laws, review specific administrative decisions, and determine the constitutionality of narrow statutory or regulatory requirements in a variety of factual settings. Determinations courts are being asked to make include, for example, whether an insurance company or employer should be obligated to reveal the results of a genetic test it conducted on an applicant or worker to a person, his or her family, or others under the laws of a particular state. In another scenario, a court may be asked to determine if an adoption agency, workers' compensation insurer, spouse, or other relative should have access to the genetic information of individuals under constitutional and common-law doctrines of privacy and relevant federal and state statutes. Judicial decisions on such matters are case-specific and result in a bewildering patchwork of rights and duties across the United States.
Rarely does a clear national consensus emerge from the determinations of hundreds of courts, although it is possible. For example, relatively uniform decisions are being reached by federal and state courts on the constitutionality of state laws that require the taking of genetic material (usually blood specimens for DNA) from convicted sexual offenders for inclusion in state data banks for identification purposes. Arguments that such a nonconsensual taking of genetic information is an unconstitutional search and seizure under the Fourth Amendment of the United States Constitution have failed because courts have determined that the public interest in preventing recidivism and facilitating enforcement far outweighs the impairment of the sexual offender's constitutional rights, and that using DNA identifiers is comparable to using fingerprints.
Given the array of concerns about the misuse of genetic information, the new health care policies and electronic communication systems that may compromise confidentiality, and the inability of the courts to provide coherent solutions, privacy advocates and other interest groups are calling for legislative solutions at state and federal levels.
State Laws
According to Wendy McGoodwin, executive director of the Council for Responsible Genetics, a nonprofit bioethics advocacy organization, a dual legislative strategy is needed: laws to protect genetic privacy and laws to prohibit genetically based discrimination. States are responding, especially to the latter stratagem. At last count, 14 states had enacted laws that address genetic testing and discrimination by insurers, employers, or both. California, Colorado, Georgia, Maryland, Minnesota, New Hampshire, Ohio, Oregon, Virginia, and Wisconsin prohibit health insurers from rejecting applicants or changing their premiums on the basis of genetic information. Iowa, New Hampshire, New Jersey, New York, Oregon, Rhode Island, and Wisconsin prohibit employers from requiring genetic tests or using genetic health predictions in employment decisions. In addition, many other state legislatures have bills pending to protect individuals from these types of discriminatory activities.
The state laws vary in many ways. For example, some forbid the use of genetic information for nontherapeutic purposes or for any underwriting or employment decision purposes, whereas others also prohibit certain unauthorized disclosures. Some, such as Maryland and Wisconsin, go further and forbid insurers or employers from requiring and requesting genetic
testing.
The council's position paper on this topic favors strong legislation to counter genetic discrimination. McGoodwin disputes claims by insurers that genetic information is necessary to avoid ruinous economic losses. "Genetic conditions exist at a fairly stable incidence in our society. There is no epidemic," she said. "Thus, they are already reflected in the actuarial tables used by insurers to establish rates. In fact, insurers have always insured people at risk for genetic conditions. The social goal of insurance is to spread the risk across communities. If genetic information is used to stigmatize individuals as substandard or uninsurable, the resulting stratification of the community into 'haves' and 'have nots' is contrary to the public interest."
The Biotechnology Industry Organization (BIO), based in Washington, DC, is an international trade association of over 700 companies engaged in biotechnological research and commerce that has been monitoring state legislative developments on genetic information for its member companies. According to Suzanne Tomlinson, bioethics counsel and outreach manager at BIO, more than 60 bills on genetic privacy and discrimination have been introduced in state legislatures in 1997. Many are targeted at preventing discrimination and unauthorized disclosures by employers and insurers in those states that have not yet enacted such measures, or expanding such protections in states that had previously enacted narrowly protective statutes. Some of the bills attempt to break new ground. A sizable cluster (Texas, Vermont, Nebraska, New Mexico, Michigan, Maryland, and Florida) would provide individuals with a property right to their genetic information, a development opposed by pharmaceutical and biotech firms in New Jersey and elsewhere. Several bills would amend existing privacy and human rights laws to expressly encompass genetic information.
Federal Standards
This proliferation of diverse state laws obviously makes research, health care, and business more legally and economically problematic for biotech research firms and their customers. BIO, therefore, adopted a policy statement in late 1996 calling for "federal standards to protect the confidentiality of an individual's medical information, including the results of genetic testing," emphasizing that information from genetic testing "forms part of the continuum of medical information," and should not be inappropriately stigmatized. Federal standards to protect the confidentiality of medical information should, according to BIO, ensure that legitimate and vital medical research is facilitated and should not impede the conduct of clinical trials or the reporting of results to agencies such as the Food and Drug Administration, nor should they prevent the use of "anonymized samples" in research.
BIO cites the Health Insurance Portability and Accountability Act of 1996 (which it supported) as an example of an appropriate federal law with uniform standards for preventing insurers from refusing coverage or charging higher rates on the basis of genetic history to persons enrolled in group health insurance programs. Following that example, BIO calls for a new federal law that would set privacy standards "national in scope to ensure legal uniformity and consistency throughout the states, and to avoid impeding medical research and interstate commerce with a patchwork of inconsistent laws."
BIO's proposal for federal standards that would preempt inconsistent state laws comes at a time when the federal legislative agenda is quite crowded with bills of considerable complexity. Fourteen legislative proposals regarding genetic privacy and discrimination were introduced in the 104th Congress; none were enacted. This year, seven bills have already been introduced in the 105th Congress and pressure grows for a federal response.
The new federal bills differ in certain respects. Several would amend the Social Security Act and other major federal laws to prevent group health plans and other health insurers from using genetic information to deny or cancel coverage or vary premiums, and from requesting or requiring genetic information or disclosing any such information without written authorization by the person tested. One bill would also prohibit employers from requesting genetic testing or information from job applicants and employees and using such information to make discriminatory determinations. Several of the bills provide for confidentiality of such information but allow various exceptions in situations subject to criminal law or court order, or where the information is needed to establish paternity, identification of a body, or diagnose a blood relative.
Patricia Roche, staff attorney of the Health Law Department at the Boston University School of Public Health, points to the problems of defining terms--including genetic information, genetic tests, and genetic analysis--that face Congress. Devising special procedures and duties for genetic matters involves determining the extent to which genetics is defined to be part of an individual's private medical records or treated separately. Congresswoman Harriette Chandler (D-Massachusetts), chair of the state's health care committee and co-chair of the special committee on genetic information policy, is drafting a bill to address this issue, acknowledging its centrality and complexity. As part of this process, the Massachusetts special committee is reviewing what other states have done, paying particular attention to the recent enactment of a New Jersey law on the topic. New issues and situations continue to arise, says Chandler, such as the case of so-called home brew test kits, which are intended to enable a person to provide samples (blood, urine, etc.) to laboratories for analysis. Such laboratories promise confidentiality, so the question becomes how to prevent access to the results of such tests by employers, insurers, family members, and even personal physicians.
A relatively comprehensive model bill for federal enactment, covering virtually all concerns and issues, was drafted by Roche and George Annas and Leonard Glantz, professors of health law at Boston University. Their proposal for a Genetic Privacy Act was followed closely by Senator Pete Domenici (R-New Mexico) in drafting his 1996 federal bill, the Genetic Confidentiality and Nondiscrimination Act. Since no action was taken on his 1996 bill, Domenici, along with Senator Chris Dodd (D-Connecticut), introduced a revised version on 11 March 1997.
Although expected to attract considerable attention, the 1997 bill has been overshadowed thus far by another development: Ian Wilmut's cloning of a sheep named Dolly at the Roslin Institute near Edinburgh, Scotland. Congressional hearings, featuring testimony by Wilmut, have focused on this dramatic development, its legal and ethical implications, and the prospect of human cloning.
When the furor subsides, Congress will face a number of proposals for legislation, with the 1997 Domenici-Dodd bill being the most notable because of its scope and detail. This bill defines the circumstances under which DNA samples and genetic information may be collected, stored, analyzed, and disclosed, and establishes the rights and responsibilities of the parties involved. It also contains protections against genetic discrimination in employment and insurance, and mechanisms to enforce those proposed rights and responsibilities.
The most important features of the bill are its attempts to establish national uniformity in genetic procedures, rights, and duties amidst the chaos of state laws and court decisions, and to balance individual rights with other societal interests, including those of the genetics research and business communities. The bill relies on informed consent procedures to assure privacy and control, prescriptive rules to prevent job and insurance discrimination, and both federal enforcement and private lawsuits to deter violations and ensure compliance.
The bill, which would become effective 1 January 1999 if enacted, cites findings that existing legal protections for genetic information are inadequate to ensure genetic privacy and to prevent genetic discrimination, and that uniform rules will protect individual privacy, prevent discrimination, and encourage genetic research. It then defines several terms, such as DNA, DNA sample, genetic information, family, research, insurer, and employer in order to minimize ambiguities.
Title I of the bill establishes procedures that make collection and genetic analysis of a DNA sample contingent upon informing the individual providing the sample about the information likely to be derived, its implications, and related matters, and upon securing written authorization from the individual. The individual's informed consent would also be required for any storage or further use of the sample or access to it by additional researchers.
Title II covers disclosure of genetic information to third persons and makes any such disclosure contingent upon "written authorization of the individual" who is the source of the DNA sample, except for compulsory disclosures required by any judicial, legislative, administrative, or law enforcement proceeding. Authorized recipients are forbidden to redisclose the information without additional authorization by the individual, except in cases involving "the exercise of judgment for professional medical consultation for the direct benefit of a patient." The individual is also authorized to inspect clinical medical records that contain genetic information derived from the sample he or she provided, and is afforded the opportunity to either have such records amended or have a statement of disagreement included in the records.
Title III specifies the content of written authorization for collecting, storing, and analyzing DNA samples and for disclosing and redisclosing genetic information to third parties. It also provides that the individual may consent to subsequent use of the DNA sample for research, future use without identifiers and "commercial use of the DNA sample, with a waiver of, or provision for, economic benefit to the individual."
Title IV deals with job and insurance discrimination. It forbids employers from requesting, requiring, or using the genetic information of an employee or job applicant for the purpose of restricting any right or benefit otherwise due or available to such person. Exception is made "for the purpose of permitting a genetically susceptible employee to avoid occupational exposure" to mutagens or teratogens, or for "determining a genotype that is otherwise directly related to the work and is consistent with business necessity." It also prohibits virtually any discriminatory actions against an individual or family member by an insurer offering a health insurance policy.
Title V establishes a protocol for research involving genetic analysis that includes safeguards against disclosure of genetic information, assurance that necessary authorizations will be secured, destruction of DNA samples unless retention has been authorized, and various other protections against misuse of genetic samples and information. However, records may be inspected "for the purpose of compiling data for statistical or epidemiological studies" if personal identifiers are not copied, removed, or redisclosed. Title VI further amplifies the protocol with regard to transfer or discontinuance of control of DNA samples and genetic information.
Title VII deals with enforcement. It authorizes any individual whose rights have been violated under the act to bring a civil action for damages of up to $50,000 or injunctive relief in federal or state courts. In addition, at the discretion of the Attorney General, a violator may be prosecuted and subject to restraining orders and injunctions, a $50,000 civil penalty, and the investigation and litigation costs incurred by the government.
Title VIII prohibits any state law, regulation, or court decision on many of the subjects covered by the bill unless it either "more completely protects the confidentiality or privacy of an individual with respect to genetic information about the individual" than does the bill, or else affords the individual a greater right of access to his or her genetic information. Strict state conformance to the limitations on disclosure set forth in the bill is required. And individuals are expressly allowed to pursue any other remedies under common or statutory law regarding collection, storage, or analysis of DNA samples, and the disclosure of genetic information.
Reactions to the bill are mixed but tend to be favorable. According to Annas, "The bill is a big step in the right direction, but the DNA should be made the property of the individual from whom it is taken. This would be a more direct and understandable legal concept than the bill's reliance on informed consent procedures to protect privacy and prevent discrimination." McGoodwin, however, finds the bill's reliance on informed consent procedures acceptable, saying, "A property right to one's DNA is not essential for protecting privacy and preventing discrimination."
Annas also supports the bill's focus on genetic privacy rather than medical privacy in general. "There should be national standards for medical privacy but genetic privacy deserves the special attention accorded to it by this bill because of its special quality, namely that it is the 'future diary' of one's predisposition to disease."
The major deficiency of the bill, according to Annas, is that it does not do enough to protect the privacy of the very young. He says, "Testing children and fetuses for predisposition to disease may be justified if there is a legitimate basis for parental concern, such as where there is family history of genetic disease [that] is treatable before majority. Otherwise, genetic testing before majority could lead to special parental constraints on the child's development, essentially stigmatize the child within the family, and have other hurtful consequences. This is a difficult issue and more guidance is needed."
McGoodwin finds the bill's definition of "DNA sample" in terms of human tissue, to the exclusion of blood and other sources of DNA, acceptable, she says, because she believes "human tissue" will be broadly construed to include these other sources. However, she finds the bill's definition of genetic information "woefully inadequate, much too narrow, and leaving many vulnerable [people] without adequate protection." The 1997 bill, she says, "addresses genetic information from DNA analysis only, and ignores other sources of genetic information such as medical examinations and family medical history. We need to define genetic information more broadly as information on inherited characteristics. Otherwise, family members will not be afforded protection against discrimination by this bill."
McGoodwin and Annas also want clarification of the legal effect of the Domenici-Dodd bill on state law. Both find Title VIII to be equivocal in calling for "more protective" state law but with the exception that state laws strictly conform to the bill's provisions on matters involving disclosure. The latter provision, in their view, could deter states from trying to be more protective.
Another perspective on the Domenici-Dodd bill has been taken by the Pharmaceutical Research and Manufacturers of American (PhRMA). According to Gary Persinger, the trade association's vice president for research and information services, pharmaceutical firms are concerned about the impacts on research of the bill, should it become law. Says Persinger, "In dealing expansively with privacy and discrimination issues, the bill could inadvertantly obstruct research that benefits health care throughout society."
Persinger points to Title V, which sets forth new legal requirements for Institutional Review Board approval of clinical research on DNA samples in which the board must find that the potential benefit to society of the research outweighs individual risks, including psychosocial risks. "What are 'psychosocial risks'?" Persinger asks. "Nowhere in this bill is this term defined, and this term will be subject to various interpretations by different [boards]. PhRMA prefers that such requirements be set by the National Bioethics Advisory Commission and NIH, not by congressional action, to avoid risks of misinterpretation."
Similarly, PhRMA members want assurance that patient-identifiable information will not be given an unreasonably broad definition that could unduly impede research, and clarification that the multiple informed consent procedures set forth in the bill can be satisfied by a single written instrument.
Among the group's other concerns are the bill's "conditional" approach to state law preemption, and its separation of genetic information from medical information, which "could lead to problems," Persinger said, "because genetic information may become an integral part of medical records and conflicts could arise over information which could be regarded as being both medical and genetic."
The Domenici-Dodd bill now awaits congressional deliberation. Domenici has expressed the hope that the bill will "invite exhaustive debate and legislative review, so that we will achieve a firm national standard on genetic privacy." But all affected parties will have to reckon with a multitude of new rules and procedures should the bill become law, and its provisions will be tested by litigation and construed by courts over time. So a firm national standard may not be readily achievable in a legal universe beset by pressures to make genetic information "nobody else's business" and countervailing pressures to disclose and use the information for medical and economic advantage.
Michael Baram
Last Update: June 2, 1997