powered by:
save your skin foundation
genomic testing and privacy: protecting patient data and confidentiality
9 minute read
any organizations that handle personal information are expected to implement strict security protocols.
getty images
stay up to date on this topic
welcome to the second installment of healthing’s three-part series on genomic testing. in our first entry, we introduced the concept and process of genomic testing and its potential benefits to health outcomes for canadians. in this article, we look at the data privacy and ethical concerns around genomic testing.
this series was produced by the healthing editorial team with the support of a grant from bioaro, a canadian biotech company with expertise in genomic testing. while bioaro made the production of this series possible, they did not have any editorial influence or control over the content, including review prior to publication.
—
genetic data is arguably the most personal and sensitive information we have about ourselves.
as genome testing becomes more accessible, as a medical practice and direct-to-consumer product, the trade off of learning more about your predisposition to disease is revealing this sensitive information with various sources – many outside canada.
while most of us are comfortable sharing medical information with our family doctors, it’s not widely known that sending medical information outside of canadian borders is common practice.
the global healthcare industry relies on the collaboration efforts of specialist facilities and experts around the world to continue the fight against disease. genetic testing results and patient information are shared regularly. canada is the recipient of data and patients as well.
there are also a number of genetic data products like 23andme that have operations in jurisdictions outside of canada, and a wider array of mobile applications and websites around the world that allow for the sharing of personal medical information.
it begs the questions – do we truly understand the risk of sharing our genetic data? and is it safe in the hands of these organizations and platforms?
advertisement
before canadians can truly unlock the full potential of genome testing, we need to better understand the possible privacy risks and ethical challenges surrounding biotechnology.
genetic privacy starts with you
it’s important to highlight that participating in genetic testing or signing up for a genetic data product is entirely up to you. informed consent is not a binding contract, and citizens have the right to halt the process of genetic testing through a medical institution or request their data be removed from a digital platform at any time.
if you do choose to proceed, the process comes with the understanding of some risk.
katherine linton, lawyer at tyas family law in toronto, says that users should be aware that data cannot always be protected, despite the best efforts of these platforms and institutions.
“the nature of some services (especially those grounded in online data collection) expose the user to inherent risk,” linton told healthing in an email.
“for example, a provider may not be able to safeguard against hackers, but a user sees that risk as negligible. probability dictates that hacking is unlikely, so the user knowingly takes on that risk as a cost of doing business. while some risk is inherent, unavoidable, and understood, a user should be weary of unknowingly taking on avoidable risk”
how is personal health data from genetic testing protected in canada?
in canada, the protection of personal information and data security is primarily governed by the personal information protection and electronic documents act (pipeda). pipeda sets out regulations and guidelines for how organizations handle personal information for the sake of commercial activity, including dna and health data.
under this law, organizations are required to obtain informed consent before collecting, using, or disclosing personal information, and they must take appropriate measures to safeguard it. the purpose of the data collection must also be made clear to the individual prior to sharing their information.
advertisement
“organizations that are subject to pipeda must follow ground rules for the collection, use and disclosure of personal information,” the office of the privacy commissioner of canada (opc) confirmed to healthing in an email.
“the purposes for which the personal information is being collected must be identified by the organization before or at the time of collection, and the information collected must be limited to that which is needed for the purposes identified by the organization.”
the opc oversees compliance of pipeda and leads the charge in working to ensure that organizations are adhering to all data protection laws and addressing privacy concerns.
any organizations that handle personal information are expected to implement strict security protocols, including encryption, secure data storage, access controls, and regular security audits, to prevent unauthorized access, data breaches, or misuse of personal information.
furthermore, the government has identified the institutions that collect health data in canada and outlined the legislation that applies to them – either pipeda or the privacy act. this covers public health agencies, private institutions, publicly-funded hospitals and schools, employers, insurance companies, health-related associations or professional organizations and others.
protection from genetic discrimination
further genetic privacy legislation addresses the concern that genetic information can be used against individuals, leading to genetic discrimination in areas such as employment, insurance coverage, and access to certain services.
the fear is that employers or insurers could use genetic data to make decisions that could be harmful to the individual based on their genetic predispositions to certain diseases – such as denying coverage.
advertisement
the genetic non-discrimination act, passed in canada in may 2017, is a critical piece of legislation designed to protect canadians who undergo genome testing and genetic analysis. under this act, genetic discrimination is prohibited in various aspects of life, including employment and access to goods and services. it ensures that individuals who choose to undergo genome testing will not face discrimination based on their genetic information.
the gnda not only promotes the responsible use of genetic data but also supports the broader goal of protecting individuals’ rights and access to essential services without fear of genetic discrimination.
what happens when personal health data from genetic testing leaves canada?
according to dr. anmol kapoor, cardiologist and ceo of bioaro, a canadian biotech company, when it comes to genomics, once personal health information leaves the country, there is little the individual can do other than rely on the privacy regulations and security of the recipient institution.
“the companies that these samples are sent to overseas, they don’t only keep data files about the patient. they most likely also keep a dna copy of the patient too, which could go in the wrong hands,” he said. “once your data leaves canada … you can’t do anything. it’s gone.”
dr. kapoor’s assessment is mostly accurate. users move further away from the original source of their genetic data the further it is shared, and the risk of hacking and theft is always a lingering threat. also, pipeda does not restrict the “processing or storing personal information, or transferring personal information to an organization for processing” across jurisdictions
however, the opc asserts that institutions with a “real and substantial connection to canada” are subject to the terms of the privacy law regardless of their physical location, and that they agree to a level of responsibility to protect the data.
advertisement
“the act [pipeda] states that an organization is accountable for personal information in its possession or custody, including information that has been transferred to a third party for processing,” the opc clarified. “the organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by the third party.”
the regulations are wide reaching and canada is engaged in a number of agreements with international jurisdictions to ensure the protection of health information – including australia, brazil, china, members of the european union, hong kong, israel, japan, republic of korea, mexico, singapore, the united states and the world health organization.
direct-to-consumer genetic testing: data hacks and revelations
direct-to-consumer genetic testing companies, like ancestry.ca and 23andme provide individuals with accessible and personalized insights into their ancestry, health traits, and genetic predispositions through at-home dna testing kits and online platforms. but they come riddled with both privacy risks and ethical dilemmas.
data breaches that target genetic information can have serious consequences for individuals and their families. users of 23andme were the target of a major data breach in october 2023, impacting millions of accounts. instead of hacking the company’s servers, hackers targeted individual user accounts, particularly those with weak or repeated passwords.
once inside these accounts, the hackers accessed genetic data through the “dna relatives matches” feature, compromising not only the privacy of account holders but also their relatives. this breach highlights the interconnected nature of dna data, where personal information can have wide-ranging consequences, including potential discrimination and other harms.
advertisement
engaging in ancestry testing via direct-to-consumer genetic companies also introduces a set of intriguing yet delicate dynamics. one of the key implications is the potential revelation of unforeseen biological connections and the unveiling of long-kept family secrets.
while these discoveries can be fascinating and offer a sense of connection, they also pose ethical questions, particularly when it comes to the privacy rights of individuals who donated their sperm or eggs anonymously. the moment these genetic links come to light, it may inadvertently expose the identities and personal histories of these donors, breaching the confidentiality they were initially promised.
balancing the desire for knowledge and connection with the protection of privacy rights becomes a crucial consideration in the expanding world of genetic testing and its impact on family relationships.
genome testing and the ethics of patient confidentiality
when genetic test results have the potential to directly affect biological relatives, it prompts consideration about who has the right to privacy.
the dilemma revolves around the balance between an individual’s autonomy to protect their own genetic information and the potential consequences such information may have on close family members. the situation can be further complicated by the question of whether one is morally or legally obligated to disclose positive genetic test results to family members who may be at risk.
consider the scenario of a mother who chooses to undergo genetic testing because she has a family history of breast cancer. her test results indicate that she carries a mutation in the brca1 gene, which significantly increases her risk of developing breast and ovarian cancer.
in this example, the mother now knows she has an elevated risk of developing these specific cancers. but her test results also have implications for her children, particularly her daughters. this is because her brca1 mutation has a 50 per cent chance of being passed on to each of her biological children. the mother now must decide whether or not to share her test results with her family members.
advertisement
from the experience of genetic counsellor alana mistry, withholding the results is a common initial reaction and poses complex challenges in the area of patient confidentiality.
“it can be ethically complex for us as a provider,” mistry told healthing. “it presents sort of this dichotomy – your duty of confidentiality to your patient, but also this duty to warn and prevent harm for their relatives when we know that there’s cancer prevention measures, for example, that could save their lives.
“patient confidentiality certainly takes precedence.”
mistry said the approach to the sensitive subject is to provide information, options and support. this includes additional one-on-one sessions with the patient, the production of a letter to share results and meetings with the family, if desired.
the undeniable fact is that the results can be a harsh reality to digest, and knowing you’re impacting your family members adds more weight to the situation. the desire for privacy seems normal and expected.
“i think you just have to meet patients where they are and really give them the benefit of the doubt. a lot of the reason why they don’t want to disclose it right away is they’re just under shock. they’re feeling overwhelmed. they need a little bit of time to process things,” mistry said.
“our role and our duty is really to the patient that’s in front of us and all we can do is sort of encourage them to do what they feel is right for their family.”
in the final installment of our three-part series, we’ll take a closer look at the future of genomic testing and the evolving medical, scientific and ethical implications that come with biotechnology.
share story
