Navigating Consumer Protections for Genomics and Precision Health: An Interview with Jennifer K. Wagner and Abdulai I. Rashid
Despite their increasingly critical importance, consumer protections available from the Federal Trade Commission (FTC) and state Attorneys General related to the direct-to-consumer genomics and mobile health industries have not been well characterized. The FTC is the primary federal agency in the United States with responsibility for ensuring the online privacy and data security of consumers outside of medical settings and preventing unfair or deceptive practices by companies that are not governed by the Health Insurance Portability and Accountability Act (HIPAA). State Attorneys General have a state-level law enforcement role in consumer protections related to these industries. Foundational knowledge about the consumer protection activities of these actors is critical for responsible policymaking and can also support empirical ELSI research aimed at understanding the impacts of privacy, data protection, and nondiscrimination policies on members of the public, including equity and social justice impacts. In support of this aim, CERA has helped Jennifer K. Wagner, J.D., Ph.D., Assistant Professor of Law, Policy, and Engineering and Anthropology at Penn State University, make the products of her NHGRI funded project, Consumer Protections for Genomics and Precision Health (R01HG011051), available to the ELSI research community on ELSIhub.
Dr. Wagner’s Consumer Protections for Genomics & Precision Health Information Sheets offer summaries of federal and state laws that offer legal protections that might be applicable to the types of technologies and data collected and used in genomics and precision health activities. CERA spoke with Dr. Wagner and Abdulai I. Rashid, a 3L (third year) student at Penn State Law who contributed to the project, about their motivations for creating the information sheets, who may find them useful, and recommendations for strengthening consumer protections of health-related information.
CERA: Thank you for sharing the products of your recent project on ELSIhub! Could you please tell us about the need you saw for these information sheets? What are the ELSI concerns that these materials are designed to address?
Dr. Wagner: There were two reasons I thought this sort of resource would be helpful. For several years, I worked at Geisinger, an integrated health system in Pennsylvania that has long aspired to be a “learning healthcare system” and has been a strong advocate of genomic medicine with its MyCode® Community Health Initiative. During this time, I frequently interacted and collaborated with licensed genetic counselors at Geisinger and elsewhere who would share with me their frustrations and questions about patients and their families who would want answers to legal questions as part of pre- or post-genetic counseling sessions. I realized genetic counselors were in a tough position. They want to help patients, families, and caregivers by providing understandable and meaningful information; however, while they are trained and well-versed in communicating the current state of the science and managing scientific uncertainty, that is not the case with the current state of the law and managing legal uncertainty. My idea to address this problem was to create a resource analogous to patient education brochures. If patient education brochures were helpful as starting points for individuals to learn more about health conditions and risks, the same idea could be helpful for individuals wanting to learn more about what laws are available where they are. Even if these materials couldn’t possibly get into specifics or provide extensive details or examples, they could help individuals search for more information elsewhere—either by going online or by speaking with attorneys. I also thought these materials could function as quick primers for attorneys—particularly those serving rural communities as general practitioners who do not typically encounter these issues—and lead to the independent legal analysis necessary to provide sound legal advice about how relevant laws apply to a particular scenario for a particular client in a particular place and time.
The second reason I thought this might be helpful is for research and informed consent purposes. Institutional Review Boards sometimes desire or require that researchers highlight certain legal risks and protections in informed consent documents and consent scripts. In genetics and genomics research, that has led to many such documents that mention the Genetic Information Nondiscrimination Act (GINA) of 2008. While reference to GINA is sometimes helpful, it can create a misperception that genetic information is exceptional. Aside from the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we don’t routinely see laws expressly mentioned in this same way, even though many laws could apply to a particular study, group of research participants, or situation. I had been getting a bit concerned about overly protective, paternalistic decisions regarding research that can be attributed to erroneous assessments of the risks posed by research activities relative to the risks encountered in everyday life. This is increasingly a problem when we consider privacy, confidentiality, and data-related harms. I have been concerned with many of us focusing our scholarly attention too much on the clinical settings and not enough on other sectors of society in which data can find themselves and be used (or abused). Our idea was to counter this problem by offering some baseline information about consumer protection laws at the federal and state level that might be applicable to the types of technologies and data we encounter in everyday life, not merely in genomics and precision health activities.
With the usual caveats—every situation is unique, these summaries are not comprehensive, and the laws are continually changing (as existing laws are applied and interpreted in the courts and as new laws emerge from the legislatures)—I think these resources could be helpful for these distinct audiences. Anyone with specific questions about their individual situation should seek guidance from a licensed attorney.
Mr. Rashid: As a law student, I could not easily decipher what rights I had or the interaction between state and federal protections and imagined that other consumers would be in the same position. Like genetic counselors, I realized that physicians would have a medical background, but little knowledge of the legal aspects of their practice and thus would not be able to explain legal issues to patients. Dr. Wagner presented me with the opportunity to make this information accessible to healthcare professionals, patients, and other consumers and I knew it would give them a starting point for learning their rights and a set of things to think about in healthcare, employment, housing, or insurance contexts. These materials provide a basic understanding of the right to be informed and any rights that pertain to the information that is collected in those contexts.
The information sheets are a starting point, not a substitute for a legal professional. I hope that patients and other consumers can use them to ask more targeted questions. Legal professionals may use them be guided toward more in-depth analysis or quickly understand whether an inquiry is within their area of expertise. The information sheets offer a path toward getting help more quickly.
CERA: You created a Consumer Protections for Genomics & Precision Health Information Sheet for each state. Could you give us a sense of how much these protections differ between states?
Dr. Wagner: In general terms, states have similar broad consumer protection laws that might apply to situations outside of the HIPAA-governed environment. This reflects their history. These broad protections are the result of a movement to supplement the Federal Trade Commission Act with a model version enacted across the states. We do see some variability in these broad consumer protection laws. Moreover, the variability in legal protections for data-related harms is increasing rapidly as states—like Washington and its suite of laws passed with the My Health, My Data Act—enact legal reforms to shore up consumer health data privacy or enact laws related to genetic privacy in particular.
Mr. Rashid: As Dr. Wagner stated in her reply, most states have similar consumer protection laws for non-HIPAA related situations. The National Consumer Law Center compiled information about the consumer protection laws of every state and territory and ranked the protections in the state as strong, mixed, weak, or undecided. This showed that, while written in similar language, state statutes are enforced differently. In the past year, many states have passed either genetic or genomic data protections or broad consumer protection statues. Since these are new laws, how the courts interpret them is going to determine which states now have the strongest protections.
CERA: Do differences in consumer protections between states suggest new federal protections to you or do state-level differences make sense to retain in some cases?
Dr. Wagner: If we look at privacy law reform generally in the United States, last year’s American Data Privacy and Protection Act (ADPPA) was the closest the nation has come to updating its approach to data protections in a long time, although it was ultimately not successful. There was notably strong opposition from the California delegation, as in California there already are state-level comprehensive consumer privacy laws (i.e., the California Consumer Privacy Act of 2018 or CCPA and 2020 California Privacy Rights Act or CPRA), a genetic information privacy act, and distinct laws related to confidentiality of medical information. I do not necessarily think that variation needs to be “solved” with rigid new federal laws; however, I do think that state approaches make it increasingly challenging for entrepreneurs and other professionals trying to innovate and implement genomic, mobile, and precision health technologies and programs. This is not only a challenge from a compliance perspective but also a challenge when trying to ensure equity across geographically dispersed product and program offerings to individuals (whether they be consumers, patients, research participants, clients, etc.).
CERA: Do you have any recommendations for strengthening consumer protections related to genetic and genomic and mobile and digital health-related information in the U.S.?
Dr. Wagner: Federal data protection laws that set more robust baseline protections by way of data stewardship—regardless of whether those data originate in a medical setting and regardless of whether those data are categorized as “health” data—would be quite useful. Also, a private cause of action (that is, an authorization for individuals to go to court to compel performance and seek remedies for violations) in addition to government enforcement is, in my professional and personal view, critical.
Mr. Rashid: I agree with Dr. Wagner that a private right of action is critical. Right now, consumers or patients are required to go through their attorneys general office to pursue any cause of action. This can result in consumers losing out on restitution and other remedies if the incident is not seen as widespread enough to be pursued. When consumers can more easily seek remedies for violations of their rights, companies and other data holders are more likely to comply with existing laws.
CERA: Would you like to say anything else about this project?
Dr. Wagner: This project was exploratory in the sense that we were trying to identify areas for our legal analysis that often are dismissed from ELSI research—those areas beyond the HIPAA-protected environment of hospitals, doctors’ offices, and clinical laboratories. As we examined activities at the federal and state level, we basically confirmed that there has been relatively little activity…until recently! A seismic shift in how the FTC approaches anticompetitive practices in all industries (including genomics and precision health) is underway. This will have big implications for the business side of things. Also, in the past year, the recognition that the Dobbs decision by the Supreme Court poses major implications for privacy and data justice has spurred the introduction and advancement of consumer health privacy laws across the states. While our analyses of relevant enforcement activity that had been occurring prior to the Dobbs decision found those efforts to be rather unremarkable, this is a pivotal moment in time for ELSI research. Based on our experience during this study, we believe data practices among the various actors involved in emerging biomedicine and biotechnologies should be a critical focal point for ELSI examination for years to come, including matters of dataveillance, data justice, and health equity. Finally, I’ll mention that some of the normative legal analysis we started as part of this project, and that we will continue to develop, tries to illuminate worrisome implications for precision medicine resulting from a major court decision (in a case that did not involve scientific or medical litigants or questions) related to how our constitutional freedoms of speech and nondiscrimination interact. While those implications are perhaps unintended, they could be far-reaching. I will be eager to share that work with my colleagues in the ELSI community soon.
Mr. Rashid: This project was my first large research project as a research assistant. I was surprised to see both the lack of consumer data protections across the country and then, over the course of a summer, the passage and enactment of many, similar state laws focused on genetic and genomic information and general data protections. This shift seems to be creating laws focused on the long-term data protection needs of consumers. It is also the goal of the FTC to move away from its current regime of determining anticompetitive actions. Unlike the gradual shifts in this area before, these dynamic shifts in government will likely be noticed by consumers. Dr. Wagner has done a great job allowing me to explore my interests in intellectual property law with work on tasks that intersected consumer protection and intellectual property foci. My focus on the intersectionality of law allowed me to make connections between consumer protection, antitrust, and intellectual property. This was an amazing opportunity to learn what areas of law are of interest to me.
The full set of Consumer Protections for Genomics & Precision Health Information Sheets are available in the policy resources section of ELSIhub. You can also find an information sheet for a specific U.S. state or territory using the table below.
