>The type of information genetic-testing companies collect is currently not protected by the Health Insurance Portability and Accountability Act (HIPAA), our nation’s health privacy law.
Nice work by the genetic testing industry lobbyists.
Nice work by the genetic testing industry lobbyists.
But the data revealed in analyzing the DNA (e.g. if you have a genetic disorder) should be PHI.
It's odd how something could go from "not PHI" to "now this is PHI" just by processing something like a piece of hair.
"At what point does it turn into PHI" would be a difficult question to answer.
IMO protection of DNA related data deserves something different than HIPAA.
>“We plan to engage constructively with policymakers on the best enforcement regime,” Haro said, reiterating that the coalition wants “a uniform national data privacy law” that treats all companies the same.
>The federal Health Insurance Portability and Accountability Act, a.k.a. HIPAA, includes penalties ranging from $100 to $50,000 per violation — that is, per hacked record. Violations also can carry criminal charges resulting in jail time.
Health and Human Services has a FAQ page[1] which states:
> genetic information is health information protected by the Privacy Rule. Like other health information, to be protected it must meet the definition of protected health information: it must be individually identifiable and maintained by a covered health care provider, health plan, or health care clearinghouse.
However, according to many other sources[2][3], the interpretation of these rules DOES NOT apply to companies like 23&Me. I assume the company is not considered "a covered health care provider, health plan, or health care clearinghouse", but (again) the HHS definitions are (intentionally?) vague/misleading[4].
I suppose you need to be very familiar with regulatory law to actually make sense of this junk. (I don't know the history of these regulations and carve-outs, but the tin-foil-hat part of me wants to blame lobbyists/legal-corruption for the lack of common-sense and simply worded regulations.)
[1] https://www.hhs.gov/hipaa/for-professionals/faq/354/does-hip...
[2] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6813935/
[3] https://lawforbusiness.usc.edu/direct-to-consumer-generic-te...
[4] https://www.hhs.gov/hipaa/for-professionals/covered-entities...