As millions of Americans sat down to Thanksgiving dinner, the biomedical researcher James Hazel sent out a stark warning about the genetic-testing kits that he surmised would be a hot topic of conversation.
Most of them are neither safe nor private.
Hazel reached this conclusion after reviewing the privacy policies and terms of service of nearly 100 genetic-testing companies that offer their services directly to people. Most people use these services either by submitting a sample of saliva or uploading their raw digital DNA signature to a public database. Their lofty common draw is enabling people to learn more about their health, family history, and ultimately their identity.
Hazel, a researcher at Vanderbilt University, studied companies ranging from popular startups like 23andMe — which offers health and ancestry information — to under-the-radar outfits such as GEDmatch, which simply houses genetic information to help people build family trees. His article, which was published on Thanksgiving Day in the journal Science, found that nearly half lacked even a basic privacy document that governed genetic data.
Privacy isn’t the only concern that experts have with consumer genetic tests. In addition to collecting sensitive data on ancestry, companies like 23andMe claim to show how your DNA affects your health. But clinicians, medical professors, and genetic counselors told Business Insider that this information is misleading and could put people at risk of missing warning signs for diseases like cancer.
“It’s very scary for us because patients think they’ve had a genetic test when they haven’t,” said Theodora Ross, the director of the cancer-genetics program at the University of Texas Southwestern.
Still, comprehensive genetic workups — the kind that require a doctor’s visit — remain expensive and time-consuming.
That’s led millions of Americans to rely on at-home kits for most of their genetic knowledge. This holiday season, genetic-testing kits broke sales records. Ancestry announced after Thanksgiving that it had sold 14 million DNA kits worldwide. 23andMe has assembled genetic data on more than 5 million customers.
Experts agree it’s time for a different model, something between a pricey doctor-ordered test and the limited spit kits available in drug stores. And though several companies are trying new approaches, none has emerged as a leader. In the meantime, sensitive customer data is being uploaded and housed in large databases — sometimes forever.
Your sensitive data can be shared with others — even if you’ve never taken a genetic test
For law-enforcement officials to arrest suspected Golden State Killer Joseph DeAngelo on charges including four murders and dozens of rapes, they did not need him to participate in any genetic-testing services.
Instead, DeAngelo’s arrest hinged on the participation of several of his distant family members. At some point, 24 people distantly related to him uploaded their genetic data to a public DNA database called GEDmatch.
After creating a fake GEDmatch profile using DNA they’d gathered at the scene of a 1980 crime, investigators were led to those people. By cross-checking the list against several other databases such as census data and cemetery records, they were able to close in on DeAngelo.
That’s something Hazel and other researchers call “reidentification.” He said it’s a significant risk for people, even if they haven’t ever personally taken a genetic test.
“The fact that law enforcement has access to this with just a subpoena, that was the impetus for my article,” Hazel said. “I wanted to use it to highlight the deficiencies of the system.”
Still, the process required a specialist and years of work, Curtis Rogers, the cofounder of GEDmatch, told Business Insider.
“It takes many people, each supplying little bits of information, to begin the complicated process of solving a cold case,” Rogers said.
‘Informed consent’ is not always informed
Most genetic-testing companies say they use something called “informed consent” to verify that people understand what their genetic data may be used for. Most well-established companies like Ancestry or 23andMe ask for consent when a customer signs up or registers their kit; others put it in a 10- or 20-page terms-of-service document.
Informed consent is especially important because some companies keep genetic data for a long time, sometimes indefinitely. That means it can be used in different ways, including for purposes like solving a murder, that customers might not have anticipated.
DNA data collected by the companies is also being used for drug research, like in the case of 23andMe’s $300 million deal with pharmaceutical giant GlaxoSmithKline, and for research on longevity and aging, like in the case of Ancestry’s now-ended partnership with Google spinoff Calico.
The conflict over informed consent mirrors a recurring debate in medicine about the role of gatekeepers in healthcare. Just as the web made it easy for patients to research their symptoms before reaching out to a doctor, consumer genetic tests have enabled people to query their genome without needing permission from a specialist.
Entrepreneurs say these new capabilities are empowering because they arm people with new information about themselves. Anne Wojcicki, the founder of 23andMe, has said repeatedly that giving individuals the ability to peek inside their genes allows them to be more active stewards of their health.
“My hope is that 23andMe, by being less and less regulated, will enable more people to open their eyes to science,” Wojcicki said at a Fortune conference in 2016.
An Ancestry spokesperson shared that sentiment.
“Our highest priority is protecting our customers’ privacy, starting with enabling our customers to always maintain ownership and control over their own data and educating them on how to manage their privacy settings,” they said.
“Any data included in research collaborations is based on customers’ voluntary explicit informed consent to participate in research.”
But privacy advocates and clinicians disagree with this view. Genetics is a scientific field that even experts are only beginning to understand, they say. Although there are several genetic mutations that we can firmly say are related to disease, there are thousands of tweaks to our genome that we still have yet to even identify, let alone fully comprehend.
Some genetic tests could mislead you about your risk of disease
Today, 23andMe is the only genetic testing startup that does not require interacting with a physician to get information about how your DNA might affect your risk of disease. For $199, you can order its “Health and Ancestry” product online or buy one at a pharmacy.
But genetics experts and clinicians caution against using the test for anything beyond entertainment. The tests are not comprehensive, meaning they don’t look at all your DNA. Experts say they are also frequently misunderstood by patients. Ross, the University of Texas Southwestern clinician, said that whenever a patient comes in with results from an at-home testing kit, she tells them to throw them away.
“When it comes to health, 23andMe is not helping. They’re getting in the way,” she said.
The 23andMe health report looks at some of the genes related to diseases, including breast cancer, celiac disease, Parkinson’s, and Alzheimer’s. It also tells you if you carry a genetic variant that you could pass on to your children, increasing their risk of genetic diseases like cystic fibrosis or sickle cell anemia.
The problem is that a 23andMe report that comes back negative for those genetic variants doesn’t mean you’re at a low risk of disease, because the tests don’t look at all your DNA. Instead, they analyze only a small selection of all the genes that have been highly studied and are known to relate to disease risk.
“If you think of your DNA as a book, the vast majority of consumer genetic tests [let you] see a few letters on the page,” Elissa Levin, the senior director of clinical affairs for personal genomics startup Helix, told Business Insider.
“Those letters are very valuable if that is a particular mutation that’s been highly studied,” Levin added.
More important, while 23andMe tests for three of the tweaks known to be related to breast-cancer risk, there are other disease-linked mutations the test does not include.
“If someone did a consumer genetic test, they could be misinformed that there’s nothing there of concern, when in fact they’ve only looked at a very small part of their genome,” said Lisa Alderson, the CEO of genomic service network and medical practice Genome Medical.
A 23andMe representative said the company makes all these limitations clear to customers when they sign up for the test, and added that the product has been thoroughly reviewed by federal regulators at the Food and Drug Administration.
“Our health product undergoes levels of FDA scrutiny beyond most clinical tests,” the representative said. “Our health tests meet a bar above 99% accuracy and contain information that meets the FDA requirements for clinical validity, meaning it’s information related to one’s health that’s been well established in scientific literature.”
They also said that the 23andMe health report clearly states that a negative report does not mean you are free of disease risk. The report reads:
“[Name], you do not have the three genetic variants we tested. However, more than 1,000 variants in the BRCA1 and BRCA2 genes are known to increase cancer risk, so you could still have a variant not included in this test.”
Current tests may leave out ‘the part that may save your life’
The single most important missing element when it comes to at-home genetic tests may be the human element, experts say.
That facet of genetic testing — translating genetic findings into health guidance that people can use — is the same one that’s vital to a good doctor’s visit. A person-to-person interaction can make the difference between a patient feeling defeated and determined.
Say you learned from a genetic test that you were at a heightened risk of a certain kind of cancer, for example. You might be left feeling hopeless and anxious. But imagine if instead of simply being told you were at a higher risk of cancer, you were also told that you could take a medical imaging test each year that has a high chance of catching your cancer early, when there’s still time to intervene and save your life.
That’s a role many experts say must be played by humans, at least until we have technology that can replace them.
“When you sit down with your doctor or genetic counselor or whoever the human being is who’s talking to you about your result, you get a completely different view of it then if you’re sitting on a computer or it comes in the mail,” said Ross.
But there aren’t enough doctors or genetic counselors to meet the current demand for genetic-testing services. According to a recent report from the National Society of Genetic Counselors, for every graduate of genetic counselor training programs, there are two to three jobs available.
That’s something Helix’s Elissa Levin thinks about a lot. She’s been watching the development of chatbots (robots that you can text or direct message with, similar to normal conversation) and wonders if they might one day play a role in helping deliver the findings of genetic tests.
“To me, part of the balance of providing something responsibly and making a safe and quality experience is making sure the information is provided in a really digestible way,” she said.
But a new and better model hasn’t emerged. There are some genetic testing services that let you order a genetic test through an independent physician who can help translate genetic findings remotely, including from Helix and a startup called Color Genomics.
A brave new world for genetic testing?
Some startups are beginning to experiment with new models for genetic testing. For instance, Nebula Genomics, says you can get your entire genome (your full book of genomic data, rather than simply a few letters) sequenced, own the data set, and earn digital money by sharing it.
Another approach is being pioneered by LunaDNA. Cofounded by Dawn Barry, a 12-year veteran of biotech giant Illumina, Luna is offering to pay people for their genetic information in the form of shares of LunaDNA.
Barry created Luna as one answer to the problematic genetic-testing landscape, which she said doesn’t prioritize privacy or offer people control over their data.
“In many cases you’re buying a product, but maybe you are the product, and those models don’t feel as transparent as they should,” Barry told Business Insider.
She said Luna ensures that when customers contribute their DNA data, that data is anonymized and maintained in what she called an “analytics sandbox,” which protects it from hacking or leaks.
“If you want to delete your data, there’s only one copy,” Barry said. “It’s gone. Your shares go back. You’re forgotten about, so to speak.”