—–

Comments of the World Privacy Forum to the Secretary’s Advisory Committee on Genetics, Health, and Society regarding the draft report, U.S. System of Oversight of Genetic Testing: A Response to the Charge of the Secretary of HHS

December 19, 2007

To the Committee:

The World Privacy Forum is pleased to have this opportunity to comment on the Committee’s draft report titled U.S. System of Oversight of Genetic Testing: A Response to the Charge of the Secretary of HHS, available at <http://www4.od.nih.gov/oba/SACGHS/public_comments.htm>.

The World Privacy Forum is a non-partisan, non-profit public interest research and consumer education organization. Our focus is on conducting in-depth research and analysis of privacy issues, including issues related to health care. [1]

Overall, we found that the report provides an impressive and thoughtful review of its subject. Much of the discussion of medical and laboratory issues falls outside the zone of our interest and expertise. Our comments focus on some of the privacy consequences of genetic testing that the draft report did not consider in sufficient depth.

I. More attention is needed to privacy consequences

The draft report does include discussion of some privacy consequences. We believe the report would benefit from a more substantive discussion, in particular, of certain aspects of direct to consumer marketing. Specifically, the draft report raises the consequences of direct-to-consumer advertising of genetic tests and consumer-initiated genetic testing. Starting at line 6100, the report states:

Diabetes Ailment Sufferers – Prime Health Solutions

The audience of the # 2.0 DIABETES Ailment Sufferers – Prime Health Solutions Database has an average age of 57 and gender on this file is a 50/50 split. Selections within the # 2.0 DIABETES Ailment Sufferers – Prime Health Solutions database include over 400 Data Points. Buying habits, OTC and Rx are selectable. Type 1 or Type 2 Diabetes selectable. Income segmentation on the file covers a wide range with average HHI of $48,000. [3]

Hispanic Diabetes Sufferers – Prime Health Solutions

The audience of the # 2.0 HISPANIC DIABETES Sufferers – Prime Health Solutions Database has an average age of 48 and gender on this file is a 50/50 split. Selections within the # 2.0 DIABETES Sufferers – Prime Health Solutions database include over 400 Data Points. Buying habits, OTC and Rx product usage are selectable. Income segmentation on the file covers a wide range with average HHI of $42,000. [4]

Absolute Diabetes Ailment List

Derived from a proprietary survey, these are all responders who clearly stated either themselves or someone in their household suffers from some type of Diabetes. This is the ideal list for health and diet offers, healthy cooking books, medications and more! Reach the people who have given permission to receive additional offers and/or information via direct mail, telemarketing, and email! [5]

Diabetes Sufferers – E-mail, Postal, Telephone

Find Type 1 and Type II diabetics, the medicine they prefer and the monitors they use. Vente connects you with the diabetics you’re looking for, with over 6,000 data selects to choose from. [6]

The number of consumers’ names on these lists ranges from more than 100,000 to more than 1.5 million individuals. A search on the DirectMag website (http://listfinder.directmag.com/market) for mailing lists using diabetes as the keyword produced fourteen pages containing 397 lists on the particular day we searched. Some of the lists focused on health care professionals, donors, and others, but a large percentage of lists offered data on consumers known or suspected to have diabetes. Some of the list descriptions mention the availability of other data on the consumers, data that often includes income, age, family size, ethnicity, buying habits, and dozens or even hundreds of other personal characteristics. The availability of this range of personal information is standard today because information about consumers is organized into profiles rather than flat files, which typically reflect only one or two fields. Those who rent the marketing lists can select subsets of other personal or household characteristics to suit a particular marketing campaign.

We offer this information about the wide availability of health care-related consumer data to support our point about the demand by marketers for information about health conditions. Pharmaceutical manufacturers are among the marketers who seek health information about consumers, and some manufacturers already engage in a wide variety of data collection techniques that fall outside any regulatory framework. The appetite of marketers for consumer data goes far beyond health information, of course. The Committee is invited to explore the world of mailing lists and consumer profiles by going to the website cited above and searching for lists of consumers with other ailments and characteristics. The size and diversity of lists available are often surprising to those not familiar with the industry.

Our point is that there is a significant market demand for consumer information, including health information, and that there is a corresponding supply of information. That demand will surely extend to genetic information once it becomes available from any source. Existing enterprises that collect and sell consumer information will seek and sell genetic information in the same way that they seek and sell other health and consumer information. Genetic information will be another profit center for consumer list and consumer profile sellers.

Currently, a keyword search on genetic at listbrokers primarily returns lists for doctors and researchers who are working in the area. But we have little doubt that at some point in time, this same keyword search may return results for consumers with particular genomic characteristics.

III. Direct-To-Consumer Advertising and Consumer-Initiated Genetic Testing Will Fuel Existing Market

For the most part, health information collected, compiled, used, and sold for marketing purposes does not come from the health care system. The health privacy rule issued under the authority of the Health Insurance Portability and Accountability Act makes it difficult or impossible for covered entities to disclose patient information for marketing uses. In addition, professional ethics have always prevented many HIPAA covered entities from sharing patient information for marketing.

Imagine that genetic testing for all or a significant part of the human genome costs only a few dollars. We cannot predict when that might happen, but it seems inevitable that the cost of genetic testing will continue to drop dramatically. Data profilers may find that they can make a profit by offering free or low-cost testing for consumers. The profits come from the sale of a consumer’s genetic profile to marketers during the course of the consumer’s lifetime. Most genetic findings are likely to be relevant for the consumer’s entire life and to have some relevance for blood relatives. The stream of income from data sales over many years may support a significant upfront cost to acquire the core data.

We observe, unfortunately, that it has not proven difficult for unregulated commercial ventures to obtain personal information from unsuspecting or uninformed consumers through a variety of schemes and pretexts, or in exchange for a product, convenience, or opportunity that may have little value. It is likely that many consumers would sign up for free genetic testing in the same way that some have filled out surveys about diabetes and other conditions, surveys which have landed these consumers on the kinds of marketing lists noted earlier in our comments. A salient feature of most marketing lists selling health care information is a prominent notice that the data is “consumer-supplied,” or comes from a voluntary survey, etc.

Data collection techniques are not limited to genetic testing done outside the health care system or to data escaping from PHRs. Testing results that originate within the health care system can leak out in other ways. A recent Federal Trade Commission workshop highlighted the growing trend of behavioral tracking of consumers on the Internet for targeted advertising. Even a consumer in possession of a wholly confidential genetic test result may find that hidden tracking of Internet usage exposes the results indirectly to advertisers and profilers as a result of intensive or even casual searching by the consumer for educational materials. For more on this broad subject, see the Federal Trade Commission workshop page on this topic, <http://www.ftc.gov/bcp/workshops/ehavioral/index.shtml>. Numerous companies are spending millions of dollars to monitor consumers on the Internet, collect their personal information and activities, and sell the resulting compilations to marketers, advertisers, and others.

Much of the consumer data activity that we discuss falls outside any existing regulation. The United States has no general privacy law, and health privacy laws tend only to cover health care providers and insurers. Under the federal HIPAA rule, for example, health information disclosed by health care providers to police, public health agencies, oversight agencies, researchers, or anyone who has the consent of the patient falls entirely outside the sphere of federal health privacy regulation (unless the recipient is otherwise a covered entity). Thus, existing privacy oversight and regulatory mechanisms may be wholly irrelevant because of their inherent limitations. The Committee should not casually assume that federal or state health privacy laws will help in this arena. If a marketer or profiler obtains health information about a consumer, no existing regulation is likely to limit the maintenance, use, or disclosure of the information.

The commercial marketplace includes no shortage of unfair, deceptive, misleading, and fraudulent activities that rely on personal information or that exploit other consumer weaknesses. The ability of the regulatory process to control it is not encouraging and cannot be taken for granted.

On this latter point, we cite the experience of the Federal Trade Commission in overseeing weight-loss advertising. In 2002, the staff of the Federal Trade Commission issued a report titled WEIGHT-LOSS ADVERTISING: An Analysis of Current Trends. [9] The report documented the inability of the FTC to control false or misleading claims:

The use of false or misleading claims in weight-loss advertising is rampant. Nearly 40% of the ads in our sample made at least one representation that almost certainly is false and 55% of the ads made at least one representation that is very likely to be false or, at the very least, lacks adequate substantiation. The proliferation of such ads has proceeded in the face of, and in spite of, an unprecedented level of FTC enforcement activity, including the filing of more than 80 cases during the last decade. (emphasis added). [10]

Imagine that the purveyor of a weight loss product offers genetic testing to find the “right” product for an individual. There is already evidence that some merchants are doing just this. See, e.g., the article Dubious Genetic Testing by Stephen Barrett, M.D. and Harriet Hall, M.D. which discusses a number of existing commercial activities using genetics for dubious weight- loss merchandising. [11] See also the October 2007 call for regulation from the U.K. group GeneWatch, Regulation needed to prevent human genome from becoming massive marketing scam. [12] The SACGHS committee has also taken note of this issue in its December 8, 2004 letter to the Secretary, which eventually culminated in a joint Federal Trade Commission consumer alert in 2006, At Home Genetic Tests: A healthy dose of skepticism may be the best prescription. [13]

We would like to explore additional aspects of this issue not covered in the 2006 Federal Trade Commission alert. A merchant offering a weight-loss or other product based on genetics may conduct actual genetic testing or no testing at all. The consumer may have no way to discern whether a recommendation is based on a real genetic test coupled and a meaningful scientific conclusion; a real genetic test and a false or misleading conclusion; or no test at all. We suspect that phantom genetic testing may provide a new form of fraudulent activity for an unscrupulous merchant.

The difficulty of collecting a blood sample from a consumer has no doubt limited the appeal of marketing other forms of phantom medical testing to consumers in the past. In contrast, the simplicity of obtaining a genetic sample from hair is likely to encourage the dishonest and unscrupulous. Another possible unsavory technique may be for a data seeker to offer to test DNA for one purpose and to tell the consumer the promised finding but not to tell the consumer that the same DNA sample was also tested to uncover other information about the consumer. If a privacy policy is the only safeguard for consumers, then that consumer may be ill-equipped to fully understand how the genetic data may be used and the true risk to the consumer’s privacy.

The draft report considers the need for additional consumer/patient education, and the World Privacy Forum supports increased education for consumers. However, it should be apparent that consumer education will not be enough. The success of fraudulent weight-loss advertising is just one example of the inability of some consumers to distinguish between legitimate and useless products. When merchants marry fraud and deception with personalized genetic information (real or otherwise), their ability to mislead consumers may expand greatly. More consumer education is a necessary response to the problems, but it is far from sufficient.

Other forms of genetic testing may also provide source material for marketers. A genetic test for paternity – already available in the consumer marketplace – could provide information on testing subjects that goes beyond the stated purpose. We can envision the marketing of genetic tests to investigate prospective spouses, neighbors, co-workers, and others. If testing is sufficiently inexpensive, a barber could sweep up and sell hair samples of customers to data profilers.

Current and proposed legislative remedies for the misuse of genetic information tend to focus on the use of the information within health care treatment, payment, and insurance systems. Use of genetic information by an employer is another current or proposed area of regulation. The merits and limits of these laws can be debated, but they do not offer a comprehensive approach to controlling genetic (or health) information. We emphasize again that the commercial collection, maintenance, use and disclosure of health and genetic information about consumers is largely unregulated and uncontrolled. Additional regulation of the testing process may or may not be appropriate, but it will likely not address how the results of testing are used for marketing purposes. [14] Thus, the recommendation for expanding CLIA (at line 3954) is insufficient to address any privacy problem. Data profilers seeking to obtain the results of genetic test could use CLIA labs as long as the price is right.

While our comments have focused on fraudulent uses of data, there are other concerns. We agree that a key concern is protecting patients from unreliable tests and misleading claims about what the tests can do (line 4547 of the report). Even reliable tests and supportable claims may have adverse consequences. For example, legitimate use of genetic test results by those selling high- cost drugs or devices may adversely affect health care costs. The report usefully discusses direct- to-consumer advertising (lines 5321, 6100), a subject with implications for privacy and for health care costs that extends beyond genetic testing. Advertising messages delivered directly to consumers through the mail, through the Internet, through PHRs, or otherwise may be more persistent and may even appear to be more personalized than instructions from health care providers. The consequences may be greater demand for and use of high-cost treatments without necessarily producing better results for individual patients.

The World Privacy Forum, in 2006, wrote the first major report on medical identity theft. [15] In the report, we described the crime, and noted the nightmare it creates for its victims. We defined and described medical identity theft as follows:

Medical identity theft occurs when someone uses a person’s name and sometimes other parts of their identity – such as insurance information — without the person’s knowledge or consent to obtain medical services or goods, or uses the person’s identity information to make false claims for medical services or goods. Medical identity theft frequently results in erroneous entries being put into existing medical records, and can involve the creation of fictitious medical records in the victim’s name. [16]

We noted that there were approximately 250,000 victims of this crime, a number the 2007 Federal Trade Commission’s national identity theft survey affirmed and further quantified by noting that there are approximately 250,000 victims of medical identity theft each year. [17]

Medical identity theft poses issues for genetic testing. If an individual, having stolen someone’s identity, poses as that victim and receives genetic testing, creating genetic records in the victim’s name, what happens then? How does this impact the actual victim? We believe there are profound impacts. First, the victim’s genetic test will not match the criminal’s. This has potential treatment consequences, which are all too typical in the crime of medical identity theft. Second, what about the blood relatives of the victim? Medical identity theft in this case could extend its impacts to blood relatives if shared EHR records include genetic and family history data.

V. Conclusion and Recommendations

In our view, a more in-depth consideration of the privacy issues surrounding genetic tests is needed. If public views of genetic testing are determined in significant part by merchants, list brokers, consumer profilers, fraudulent advertisers, and others outside the healthcare system, many of the substantive health care problems already raised in the report will be much harder to address. Public suspicion and concern about the misuse of genetic information is already high, as evidenced by the passage of so much legislation by the states. If public views end up being significantly affected by commercial activities and by merchandising using identifiable genetic information, it will be much more difficult to achieve the reasonable objective of better integrating genetic testing into health care.

We suggest that the Committee amend the report to include a discussion of the privacy consequences of genetic testing and the use of genetic information in the health care system and – especially – outside the health care system. Privacy may qualify as a key consideration or challenge. We also suggest that privacy be mentioned in the overarching recommendation in the report.

We would be delighted if we were able to suggest a simple recommendation that the Committee might endorse as a solution or response to the privacy issues raised in these comments. But there are no simple answers. We realize, as the Committee emphasizes, that oversight of genetic testing is a complex system involving many different entities at the national and state levels. Privacy could be characterized in much the same way, as a complex system involving different laws and entities and with many significant gaps in regulation. The intersection of these two difficult issue areas only adds to the complexity.

Noting this, we do however, have several recommendations.

First, because none of the entities identified in the report has specific responsibilities for the privacy issues raised in these comments, and none has demonstrated much interest, effectiveness, or leadership in this area, we recommend that each entity involved with oversight of genetic testing pay more attention to the privacy consequences of their activities. If we had to pick a single organization to task with further study, it would be the National Committee on Vital and Health Statistics (NCVHS), which has shown sensitivity and expertise in health privacy. However, if the Department of Health and Human Services was willing, other parts of the Department could also be tasked to consider privacy and genetic testing. As activities regarding personalized medicine and health information exchange move forward, those aspects of HHS need to be brought into the discussion as well, including HITSP and NHIN activities.

Second, we recommend that there be an independent assessment mechanism for genetic tests pre-market, particularly those offered outside the clinical setting. We note that the FDA likely has some role to play in this area. In 2007, the FDA published material on its Critical Path Initiative regarding personalized medicine. [18] While personalized medicine holds much promise, its promise may potentially be sullied by a fraudulent marketing bonanza seeking to take advantage of the lack of regulation in the area of direct-to-consumer genetic testing and advertising. Privacy problems related to this kind of aggressive and unregulated marketing are likely to follow, as discussed at length in these comments. Any independent oversight mechanism regarding genetic tests outside the clinical setting should incorporate robust, meaningful, and enforceable privacy protections as part and parcel of the oversight framework.

Third and finally, we reiterate our recommendation that the Committee amend the draft report to include a discussion of the privacy consequences of genetic testing and the use of genetic information in the health care system and – especially – outside the health care system. We also suggest that privacy be expressly mentioned in the overarching recommendation in the report.

We thank you for the opportunity to provide comments on the draft report.

Respectfully submitted,

Pam Dixon
Executive director,
World Privacy Forum

________________________________________

Endnotes

[1] See <www.worldprivacyforum.org>.

[2] DirectMag, DirectListfinder 2.0, “#1 Ailment Medical Health – Diabetes Type 1,” NEXTMARK ID: 119135, < http://listfinder.directmag.com/market;jsessionid=DCD110A5C001B08C02F7E833D600AB63?page=research/datac ard&id=119135>.

[3] DirectMag, DirectListfinder 2.0, “# 2.0 DIABETES Ailment Sufferers – Prime Health Solutions,” NEXTMARK ID:211336 <http://listfinder.directmag.com/market;jsessionid=1E4AED4FD93B39F3AB51E0C6ED4C6DE2?page=research/da tacard&id=211336>.

[4] DirectMag, DirectListfinder 2.0, “# 2.0 HISPANIC DIABETES Sufferers – Prime Health Solutions,” NEXTMARK ID: 213086 <http://listfinder.directmag.com/market;jsessionid=1E4AED4FD93B39F3AB51E0C6ED4C6DE2?page=research/da tacard&id=213086>.

[5] DirectMag, DirectListfinder 2.0, “Absolute Diabetes Ailment List,” NEXTMARK ID: 117538, <http://listfinder.directmag.com/market;jsessionid=1E4AED4FD93B39F3AB51E0C6ED4C6DE2?page=research/d atacard&id=117538>.

[6] DirectMag, DirectListfinder 2.0, “Diabetes Sufferers – E-Mail, Postal, Telephone,” NEXTMARK ID: 157719 < http://listfinder.directmag.com/market;jsessionid=1E4AED4FD93B39F3AB51E0C6ED4C6DE2?page=research/dat acard&id=157719>.

[7] PHRs not covered under HIPAA include, for example, PHR products at Revolution Health and Microsoft’s Health Vault.These kinds of PHRs typically rely on terms disclosed in a web site privacy policy for privacy protections.

[8] It is beyond the scope of these comments to describe in any detail the various mechanisms of online advertising and how such advertising can function to forward or pass data to advertisers and marketing partners. For more on this, please see The Network Advertising Initiative: Failing at Consumer Protection and at Self-Regulation, World Privacy Forum, November 2, 2007. <https://www.worldprivacyforum.org/wp-content/uploads/2007/11/WPF_NAI_report_Nov2_2007fs.pdf> See also Online Profiling: A Report to Congress, Federal Trade Commission, June 2000. <http://www.ftc.gov/os/2000/06/onlineprofilingreportjune2000.pdf >.

[9] Federal Trade Commission, WEIGHT-LOSS ADVERTISING: An Analysis of Current Trends, September 2002. <http://www.ftc.gov/bcp/reports/weightloss.pdf>.

[10] Id., Executive Summary at 10.

[11] Stephen Barrett, M.D. and Harriet Hall, M.D, Dubious Genetic Testing, Quackwatch <http://www.quackwatch.com/01QuackeryRelatedTopics/Tests/genomics.html>.

[12] GeneWatch.org <http://www.genewatch.org/article.shtml?als[cid]=558225&als[itemid]=558234>.

[13] Letter to Tommy Thompson from SACGHS, Reed Tuckson chair, Dec. 8 2004. <http://www4.od.nih.gov/oba/sacghs/reports/DTCletter.pdf>. FTC Consumer Alert, “At Home Genetic Tests: A healthy dose of skepticism may be the best prescription,” July 2006.<http://www4.od.nih.gov/oba/sacghs/reports/DTC_Consumer_Alert_Jul06.pdf>.

[14] Much of what has been done in this area has been envisioned for use by health care providers. We note, for example, that the OECD has published guidelines for quality assurance in genetic testing, however, these guidelines were specified for use within the clinical context. Additionally, these guidelines are regrettably not as relevant to the U.S. system because in contrast to the EU countries which do have a general data protection law (EU 95/46), the U.S. does not have an omnibus law generally regulating marketing. See OECD, OECD Guidelines for Quality Assurance in Molecular Genetic Testing, May 2007. <http://www.oecd.org/document/24/0,3343,en_2649_201185_1885208_1_1_1_1,00.html>.Also of interest is the October 2007 OECD publication of Genetic Testing: A Survey of Quality Assurance and Proficiency Standards. <http://www.oecd.org/document/55/0,3343,en_2649_201185_39531255_1_1_1_1,00.html>.

[15] World Privacy Forum, Medical Identity Theft: The information crime that can kill you, May 2006. <https://www.worldprivacyforum.org/pdf/wpf_medicalidtheft2006.pdf>.

[16] Id, summary.

[17] Federal Trade Commission, 2006 Identity Theft Survey Report, November 2007. <https://www.worldprivacyforum.org/2006/05/report-medical-identity-theft-the-information-crime-that-can-kill-you> at 21.

[18] See FDA, How FDA Advances Personalized Medicine <http://www.fda.gov/consumer/features/personalmed090607.pdf>.