Protecting genetic privacy.

What is genetic information? How is it different from other personal medical information?

Genetic information comes in different varieties. Some, such as information about eye color, is obvious--that is public information. Other, such as information about genetic predisposition to diseases like cancer or dementia, is very private. We could decide that we will treat all personal genetic information as very private medical information like HIV status. But we should recognize that personal genetic information has three unique characteristics.

1. It will be able to tell us what is likely to happen in our medical future. However, genetic information is written in a code--DNA (deoxyribonucleic acid)--that we have just begun to break. In this sense, our DNA can be thought of as our "probabilistic future diary."

2. DNA tells us not just about ourselves but also about our genetic family--our siblings, parents, and children.

3. The misuse of genetic information has a horrible history, including U.S. sterilization and immigration policies and the pseudoscience of the Nazi "racial hygiene" program.

I believe these characteristics should lead us to give DNA information even more protection than sensitive medical information now has.

In what sense can the information in our genes--our DNA--be considered our "future diary"?

I use the term "probabilistic future diary" as a metaphor, both to describe the type of information coded into our genetic makeup and to emphasize its private and personal nature. During the early days of debate on the diaries of U.S. Senator Robert Packwood, William Safire wrote that diaries are seen as uniquely personal and private because they are meant "to inform our aging self about our younger self." The DNA molecule can be viewed as a "future diary" in that when we are able to decode DNA, it will inform our younger self about our aging self.

This probabilistic information is uniquely personal and is likely to have a profound impact on how we think about ourselves, our life prospects, and our future. For example, if we find ourselves at high risk for early-onset Alzheimer's disease, we may alter our career or family plans. Moreover, should this information be shared with others--friends, family, and employers--it may also have a major impact on how they think about us.

This should not, however, be interpreted as a wholly deterministic view of our future. We are not our genes, and most inheritable diseases, from cancer to heart disease and dementia, are the result of multiple genes interacting with each other and the environment in ways we may never be able to predict with any certainty.

What is the Human Genome Project?

First, some vocabulary. "Genome" is just a fancy term for the complement of genetic material in the set of chromosomes of a particular organism. Genetic material is built out of four chemicals called nucleotides--adenine, guanine, cytosine, and thymine--strung together in pairs to make the famous double-helix-shaped DNA molecules. The Human Genome Project is a worldwide scientific undertaking to map and establish the sequence of the approximately 3 billion pairs of nucleotides that make up the 23 different chromosomes of the human genome.

"Genetic mapping" consists of assigning individual genes to specific chromosomes. "Sequencing genes" involves actually determining their structure. Humans have 22 pairs of autosomal chromosomes, which everyone has, and two Xs or an X and a Y chromosome, which determine sex.

The primary reason scientists want to locate and sequence the approximately 100,000 human genes is to provide the infrastructure to do future scientific investigations. The public, Congress, and many physicians are more interested in potential practical applications--in the detection, prevention, and treatment of disease. The Human Genome Project is expected to take another 5 to 10 years to complete.

What areas of the law are implicated in DNA research?

DNA research will affect confidentiality, privacy, discrimination, and patenting. Patenting has already been the subject of litigation in the United States and international treaty proposals.

Virtually all areas of health care law will be implicated. Examples include setting the standard of care for clinical use of new diagnostic products, human experimentation in genetic therapies, the right to obtain certain information (as in genetic screening of the fetus), and the right to refuse to be screened or tested.

What did James Watson, the first head of the U.S. Human Genome Project, mean when he said that the idea of huge databanks of DNA information on individuals is "repugnant"?

Watson's point was that the new genetics should be used to help people, not to make their lives worse. He believes that the idea of the government having DNA profiles in its computer banks would lead people to feel they had less control over their lives and their future. He also thinks that such databanks would represent an Orwellian future we should try to avoid.

Watson's concern is not a new one in modern civilization. Aleksandr Solzhenitsyn, the Russian dissident writer, put it this way in his 1969 book Cancer Ward:

As every man goes through life he fills in a number of forms for the record. ... A man's answer to one question on one form becomes a little thread, permanently connecting him to the local center of personnel records.... Each man, permanently aware of his [hundreds of] threads, naturally develops a respect for the people who manipulate the threads ... and for these people's authority.

No individuals, I think, want to see the threads of their DNA transformed into bonds that tie them to their government or job or that can be used by those in authority to restrict their opportunities in life. I call this fear the nightmare in the dream of the new genetics.

What kinds of DNA databanks currently exist in the United States?

Current collections of DNA samples range from the PKU blood spots that now are done on all infants in the United States and stored by most state health departments, to the U.S. Army's collection of blood samples from all enlisted personnel, to the Red Cross blood collection, to tissue samples held in physicians' offices and hospitals.

Virtually any collection of samples of blood, semen, hair, saliva, or other bodily tissue from which DNA can be extracted and analyzed can be considered a DNA bank. This sample list also makes it clear that we will have to distinguish between the sample itself (e.g., a blood sample) and the genetic information that is extracted from the sample by genetic analysis. It is after genetic information is extracted and recorded that a DNA bank becomes a DNA databank.

My colleague Leonard Glantz and I are currently drafting a model federal statute on genetic privacy for the Ethical, Legal, and Social Policy part of the U.S. Human Genome Project. When we began this project more than a year ago, we thought we would be drawing up guidelines for DNA banks and DNA databanks. We quickly discovered that such a variety of entities could be considered "DNA databanks," that uniform regulations did not make sense.

We concluded that it would be more effective and protective of privacy to concentrate on the actual activities involved in obtaining a person's DNA and analyzing it for genetic information regardless of the type of entity conducting these activities: collection, storage, use, and disclosure.

Don't the FBI and some state law enforcement agencies have DNA databanks to use in criminal investigations?

Yes. Segments of DNA can be taken from blood, hair, or semen specimens and analyzed. This is called DNA fingerprinting or profiling. The technique can be used to exclude individual suspects, and in some cases it can even identify those who were at the scene of a crime with a high degree of probability. [See also William C. Thompson, DNA Evidence in Criminal Law on page 34 in this issue.]

DNA fingerprints are useful for identification purposes only. They tell us nothing about a person's genetic condition or predisposition. So long as the FBI and law enforcement agencies are restricted to using DNA profiling for identification purposes only, their use of this genetic material does not raise any more privacy concerns than fingerprinting does. This is just one example of how a use restriction can both permit genetic materials to be used and protect individual privacy concerns.

On the other hand, it should be noted that privacy concerns similar to those raised by Watson, Orwell, and Solzhenitsyn would be intensified dramatically if the FBI collected DNA samples not just from crime-scene materials and convicted felons but also from many or most U.S. citizens. We could then become what Glantz has described as "a nation of suspects."

Who owns a person's DNA?

That's a difficult conceptual problem. For privacy purposes, I think it makes sense for society to treat the information contained in people's DNA as their information and to make it a crime for anyone to extract that information from their DNA without their explicit authorization. I would go even farther and require that these authorizations be knowing and that they be restricted to a specific test or purpose.

Boilerplate language or waivers must be prohibited in these authorizations because of the dangers to individual privacy. Also, it is not possible to meaning-fully waive rights to infromation that cannot now be extracted from a DNA sample but will be extractable at some point in the future.

Why all the concern about future genetic testing?

The DNA molecule has some remarkable characteristics. Perhaps the most important ones in relation to privacy are that DNA is immutable over time and that a virtually infinite number of copies can be made from one small sample. Thus, storing DNA samples creates the potential for performing many genetic tests on that sample in the future, when the testing capabilities materialize. Unless we require authorization for each new test of a sample, individuals will have no control over the genetic information that is known about them by other people and organizations.

Do you have other concerns about future genetic tests?

Society will have to address at least three major areas of concern soon: presymptomatic disease screening and testing of adults, children (including neonates), and fetuses.

Adult testing is probably the least problematic, provided that we require explicit authorization before any testing. Even with authorization and counseling, however, it will still be difficult for individuals to decide what course to take. For example, when the breast cancer gene, BRCA-1, is finally identified, who should get screened? Just women in families with a history of breast cancer or all adult women? If a woman is found to have such a gene, what should she be counseled to do about it? Is a bilateral mastectomy now to be considered proper preventive medical treatment, or is regular mammography screening called for?

And no matter what you decide about cancers, would you give the same answer for the dementias, such as Alzheimer's disease? Would you want to know if you will suffer from Alzheimer's disease sometime in the future, should you live long enough?

Once such genetic tests are available to adults, it will be difficult to prevent parents from demanding that their children be screened--even if there is nothing that can be done to prevent the expression of the disease and it will not appear before adulthood. Is this information that parents should not have access to?

And finally, of course, pregnant women and their physicians will seek to screen fetuses. Are there genetic conditions, such as breast cancer or Alzheimer's disease, that we should not permit physicians to screen fetuses for? On what legal basis can a decision to ban tests be made?

All these are questions that we have just begun to discuss. They will require much more attention--preferably before the actual genetic screening tests are introduced into clinical practice.

What legal safeguards can be implemented to protect the privacy of genetic information?

I usually have little sympathy for those who say, "There ought to be a law." But in this case, there should be one. As we focus on health care reform at the national level, there is a growing and quite proper recognition that medical information is inadequately protected.

It used to be said, and not in jest, that everyone could get access to a patient's medical information except the patient. We have now given the patient access as well, but there is a real need to guard your medical information from those who would use it against you: insurance companies, creditors, employers, educational institutions, the police, and other government agencies. We will need federal legislation to protect medical records, but even this will be insufficient to protect personal genetic information because of its unique characteristics.

We need genetic privacy legislation that carefully defines personal genetic information and then prohibits collection or analysis of genetic samples without specific authorization. The law should also prohibit the sharing of genetic information without the subject's specific authorization--which should only be given after the genetic information has been obtained and shared with the person.

We also need rules governing the storage, access, and destruction policies of DNA banks and databanks. Because the privacy concerns of Watson are shared by many, I doubt that much of this will be very controversial.

The most difficult questions will be how to deal with the genetic information of minors and incompetents, how genetic information is or should be shared in families, and how research on genetic conditions can be conducted without compromising privacy. We have no answers to these questions today, but I have some hope that we will have them soon, since we are at last beginning to take genetic privacy seriously.