Tips for Protecting Your Privacy

Clinical/Research

Always ask your doctor or health care professional how they handle personal genetic information and whether they work with any third party entities that have access to such information

Always ask your doctor or health care professional if a particular medical procedure or research protocol involves genetic testing.

You will need to make a personal decision on whether your genetic test results, specimens collected or health care information will be available for anonymous or coded genetic research. Speak with your doctor or health care provider and make sure to thoroughly read the notice form provided to you.

Never consent to any medical procedure or research protocol that does involve genetic testing without knowing (1) what genetic information is being collected, (2) what will be done with that genetic information, (3) what security measures are in place to protect the privacy of that information, and (4) what will done with any genetic samples after the genetic test(s) is complete.

If you DO NOT want your results of a genetic test, specimens collected or health care information available for anonymous or coded genetic research you must indicate so in writing to your doctor or health care provider.

If you change your mind in the future, it is YOUR responsibility to inform your health care provider and it would only affect results of genetic tests, specimens collected or health care information from that date forward.

Request a Copy of Your Health Records.  Your Provider May Charge a “Reasonable Fee” for Such Copies.

Direct-to-Consumer Commercial Genetic Testing

When you are considering whether or not to do business with an online DTC company check if the site has a prominently-posted privacy policy? If so, what does it say? (Just because they call it a “privacy policy” doesn’t mean it will protect you – read it for yourself. Many are little more than disclaimers saying that you have no privacy! So read them carefully.) If the policy sounds OK to you, do you have a reason to believe it? Have you ever heard of this company? What is their reputation? And are they backing up their privacy statement with a seal program such as TRUSTe ( http://www.truste.org/ ) or BBBonline ( http://www.bbbonline.org/ )? (While imperfect, such programs hold Web sites to at least some minimal baseline standards, and may revoke, with much fanfare, the approval-seal licenses of bad-acting companies that do not keep their word.) If you see a seal, is it real? Check with the seal-issuing site to make sure the seal isn’t a fake.

Insurance

Know your rights under GINA, HIPAA and your specific state law.  Never volunteer family history or other genetic information.

Employment

Know your rights under GINA and your specific state law.  Be careful what you say about your family history and other genetic information to your employer and co-workers. You should not send genetic information from a work computer or e‐mail address.

Forensic

FORENSIC DNA COLLECTION: A CITIZEN’S GUIDE TO YOUR RIGHTS SCENARIOS AND RESPONSES

1. DNA Dragnets

Scenario

You are between the ages of 18 and 35 and live in a city, town or neighborhood where a homicide has occurred. A police officer comes to your home and requests a cheek swab of your saliva so that a DNA profile can be obtained. You are told that the purpose of obtaining your DNA is to exclude you as a suspect. This is what is known as a DNA dragnet to find the perpetrator of a crime. You are told that you have the right to refuse but if you do, the police will treat you as a potential suspect. You are not told anything about what will happen to your DNA profile and the biological sample from which it is drawn after the case is closed.

Legal Rights and Responses

You have the right to refuse to allow police to conduct a cheek swab. It is legal for police to ask for a voluntary DNA sample but they must be careful about how they phrase the request. A Fourth Amendment violation can occur if police mislead an individual; for example, by saying he or she has a duty to provide a sample or saying that the person will be treated as a suspect for refusing. The courts have repeatedly determined that the taking of DNA constitutes a “search” under the Fourth Amendment. It is also improper for police to threaten to report names to the press of those refusing to provide a sample.

DNA dragnets are not always truly “voluntary” and may feel extremely coercive. People are often afraid to say no to police out of fear that their refusal may cast suspicion on them. But you have the right to say no and you should exercise that right. If you agree to provide a DNA sample, you should assume the police will keep it forever and will include your profile in the offender database. Because you have given the sample voluntarily, you may not be eligible for your state’s procedure to have the sample expunged. If you have any concerns about giving a sample voluntarily, you should tell the police that you wish to talk with a lawyer about the consequences of providing a sample before you decide whether to give one. Although the police may be suspicious of your refusal, they cannot obtain a warrant based only on that refusal.

While law enforcement officials may promise to destroy samples after testing, there is no way to determine if the evidence has in fact been destroyed. After a DNA dragnet of over 1,000 men in Louisiana failed to find a match to the suspect’s genetic profile, law enforcement officers entered the local men’s DNA profiles into the state’s criminal database. Some individuals have sued, usually without success, to have their DNA profiles removed and biological samples destroyed.

2. Arrestee DNA Collection

Scenario

You are arrested and detained but not charged or convicted of any crime. Can the police obtain a profile of your DNA? Can they upload the profile to the national forensic DNA database, CODIS (Combined DNA Index System), operated by the FBI? Are you obligated to give the police a biological sample (blood or saliva)?

Legal Rights and Responses

If federal agents detain and arrest you, they have the authority to take DNA from you and to immediately upload it to CODIS. If local authorities arrest you, depending on the laws in your state, you may be obligated to give a DNA sample. The DNA Fingerprint Act of 2005 allows states to upload profiles to CODIS. Eleven states (Alaska, Arizona, California, Kansas, Louisiana, Minnesota, New Mexico, North Dakota, Tennessee, Texas and Virginia) currently allow for involuntary DNA collection from individuals merely arrested or suspected of a crime. You should familiarize yourself with the laws in your state and if they do not provide for involuntary collection, you should consult with an attorney before submitting to a DNA test.

Usually the police need a search warrant to collect your DNA unless you have been convicted of a crime. Under federal law, the government requires people arrested for certain crimes to provide DNA samples. These laws probably violate the Fourth Amendment to the U.S. Constitution which guarantees “the right of the people to be secure in their persons, houses, papers, and effects against unreasonable searches and seizures.” The conduct of a “search” generally requires probable cause and a judicial warrant, or at least individualized suspicion. However, the courts have yet to decide this question. If the police want to take a sample of your DNA, you should make it clear that you are not voluntarily providing a sample, recognizing that they may take it anyway.

In April 2008, the U.S. Department of Justice proposed a rule for compelled DNA sample collection from arrestees and detainees under the DNA Fingerprint Act of 2005 and the Adam Walsh Child Protection and Safety Act of 2006. The rule directs federal agencies that arrest or detain individuals to obtain DNA samples if the agency also takes fingerprints from such persons and specifies procedures for collection. The rule does not indicate whether an arrestee/detainee will be advised of their right to legal counsel before a DNA sample is taken, nor does it provide for an appropriate period of delay to accommodate judicial review if counsel for the arrestee wishes to seek a determination by a court of the legality of the DNA sample collection before it occurs. Substantial questions surround the constitutionality of compelled DNA seizures from people who have not been convicted of crimes and the issue has yet to be definitively determined by the courts. In addition, the rule proposes to sanction the use of physical force and compulsion against unconvicted and presumably innocent individuals. Finally, the rule allows federal agencies to contract with private entities to carry out the collection of DNA samples.

3. Familial Searching of DNA

Scenario

A detective visits your home and explains that the DNA profile of a second cousin of yours was a close, but not identical, match with the DNA profile obtained from biological evidence left at a crime scene. The detective explains that the perpetrator of the crime is very likely a member of your family and s/he would like to ask you questions about your family. In addition, the detective requests a cheek saliva swab from you so that you can be eliminated as a suspect in this crime.

Legal Rights and Responses

You do not have to talk to the police or let them into your home. You can tell them that you want to consult with an attorney before deciding whether to speak with them (and then do so). You can also tell them that you simply do not wish to talk to the police at all, as is your right under the Fifth Amendment against self-incrimination. You do not need to provide a DNA sample unless they have a search warrant that requires it.

In 2006, laws that limited familial searching were loosened and police are increasingly engaging in familial or “low stringency” DNA searches. DNA profiles in government forensic DNA databases are used to identify parents, children, siblings and relatives whose profiles are not in the databases, thus the term familial searching. Because DNA is inherited, family members share a common gene pool and are likely to have similar profiles. Fully cognizant of this, governments permit DNA databases to be searched for near matches between DNA profiles contained in databases and profiles collected at crime scenes. In this way, governments are expanding genetic surveillance beyond those individuals whose DNA is contained in databases to wholly innocent family members. This means that if you share genes with someone convicted or merely arrested for a crime, your genetic information is also in the government’s database, even if your relative is never convicted of a crime.

The realities of the criminal justice system ensure that communities of color will be disproportionately affected by familial searching. From 1994 to 2004, African-Americans were five times more likely than whites to be incarcerated, and in 2000, African-Americans and Latinos comprised 63% of incarcerated adults even though collectively they represented only 25% of the U.S. population. This reality is perpetuated by racial profiling, discriminatory sentencing and general racial bias in the criminal justice system. Consequently, many racial and ethnic minorities who have never committed or even been accused of committing crimes are increasingly being trapped in a genetic surveillance web of “guilt” by familial association.

4. Non-Violent Crime Convictions and DNA Sampling

Scenario

You have been convicted of a non-violent crime and placed on probation. You have never served jail time. The police department requests a blood sample so they can file a profile of your DNA.

Legal Rights and Responses

Most courts have held that if a statute authorizes the government to collect DNA from a person convicted of a felony then the police may do so, although almost all of these cases involve people convicted of violent felonies. You should talk to a lawyer about whether the law authorizes them to take a sample based on your specific conviction and whether that law is constitutional.

There may be an issue regarding the terms of probation – a boiler plate condition might be to comply with this sort of request. Most states collect DNA samples from all felons. Many states also collect DNA samples from individuals who have committed certain kinds of misdemeanors.

5. Retroactive DNA Profiling

Scenario

You have served two years in jail for failure to comply with a court order to pay child support. Before your release, the police want to place your DNA profile on CODIS, the national forensic DNA database. What are your rights with regard to retroactive DNA profiling?

Legal Rights and Responses

The U.S. Constitution most likely does not prohibit applying DNA laws retroactively. Some state constitutions may prohibit it and some DNA collection laws do not apply retroactively to people convicted before the laws went into effect. The expectation of privacy is greatly lessened while in confinement, so while you do not have to voluntarily comply, your DNA sample will likely be taken from you involuntarily.

6. Surreptitious DNA Sampling

Scenario

You have refused to give police a DNA sample in their familial search. The police subsequently go through your curbed garbage during the night to obtain samples of your DNA from discarded items such as plastic cups or cigarette butts. Can the police forage through your garbage to obtain samples of your DNA?

Legal Rights and Responses

This practice, known as “surreptitious sampling,” is currently legal. There is no expectation of privacy in garbage once it is out on the curb. Courts have found that there is no expectation of privacy in discarded genetic material and that the practice of surreptitious sampling does not violate the Fourth Amendment. The U.S. Constitution does not prohibit the police from searching your garbage because you are deemed to have abandoned it. State constitutions or laws may prohibit the police from doing this.

7. Genetic Privacy

Scenario

Your DNA profile has been uploaded onto the national forensic DNA database because of a previous arrest. The police give another agency of government that is studying behavioral genetics access to the DNA database, which includes your profile. The police also allow the genetic investigators to examine the original biological sample of anyone in the database. What are your rights? What laws, if any, protect the privacy of your genetic information?

Legal Rights and Responses

Such use, without individual informed consent, is improper. The Fourth Amendment to the Constitution protects the privacy of genetic information collected for law enforcement purposes from being used in unrelated research projects. Personal data should be used for the purpose for which it was collected. Individuals convicted of a crime have fewer civil rights and may not be successful in challenging the sharing of their profiles. Those who were arrested and not convicted do not lose their rights, however, and may have a legitimate claim in a court of law. The reality, however, is that you will probably never know if other governmental agencies have access to your DNA profile. This could be extended to an array of potential research such as the possibility of the government licensing your DNA sample to a private company to help it develop some sort of commercial product.

8. Removal of DNA from Databases

Scenario

You have been charged with criminal trespass in a political demonstration. Your DNA was taken during the booking procedure. You were never convicted of a crime. Do you have the right to have your DNA profile removed from the database and the biological sample destroyed?

Legal Rights and Responses

Under the DNA Fingerprint Act of 2005, it is more difficult to have your DNA profile removed and the sample destroyed. In the past, if an individual was acquitted or if charges were dismissed, the state had the burden of removing an arrestee’s sample from CODIS, the national DNA database. Under the new legislation, the arrestee is required to file a certified copy of a final court order establishing that all charges have been dismissed, the case resulted in an acquittal or that no charges were filed.

Laws in 29 states specifically require that DNA evidence be retained. Wisconsin law mandates that the biological sample be destroyed after a DNA profile is created. Laws in Connecticut, Georgia, Nebraska and Virginia require permanent retention; Arizona retains them for 35 years.

In all of the above instances, it is imperative that individuals exercise their due process right to legal counsel.

What Else Can I Do to Protect My Genetic Information?

  • You should get to know the important rights outlined on this site.
  • You should always ask questions about your rights.
  • You should NEVER give health information to someone if you are not certain they are authorized to have your information.
  • You should not enter information online unless it is a secure website that you trust.
  • You should document and keep a record of all consents given to access your genetic information

What Should I Do If My Rights Are Denied or I Don’t Believe My Genetic Information Is Being Protected Properly?

Contact a privacy officer.

Every health care provider and health plan covered by the federal health privacy law must appoint someone on their staff as a privacy officer. If you experience a problem related to the privacy of your medical records or access to them, you might want to contact this individual in an effort to resolve the problem.

File a federal complaint with the appropriate Federal agency

The U.S. Department of Health and Human Services Office for Civil Rights is the federal agency charged with enforcing the federal health privacy law. This office has the authority to impose civil and criminal penalties if they find a violation of the law. Your complaint must be filed within 180 days of the incident. You can also go directly to http://www.hhs.gov/ocr/privacy/index.html

The Equal Employment Opportunity Commission (EEOC) is the federal agency charged with enforcing the employment provisions of the Genetic Information Nondiscrimination Act (GINA). This office has the authority to either investigate and impose civil penalties or offer you a “right to sue” letter which is required before pursuing private litigation.  Your complaint must be filed within 180 days of the incident. You can go directly to: http://www.eeoc.gov/employees/howtofile.cfm

Several federal agencies are involved in enforcing the health insurance provisions of GINA. The U.S. Department of Labor (DOL) has primary jurisdiction over employer health benefit plans. Questions about genetic discrimination in your job-based health insurance coverage can always be directed to DOL. The Secretary of Labor has authority to fine employer-sponsored health benefit plans that do not comply with GINA. You can go directly to: http://www.dol.gov/oasam/programs/crc/complaint.htm

The U.S. Department of Health and Human Services (HHS) has jurisdiction over health insurers and the policies they sell to individuals and employers. HHS also has jurisdiction over Medigap supplemental policies sold to Medicare beneficiaries. However, states (which traditionally are the primary regulators of health insurance) are allowed to adopt and enforce standards that are at least as protective as those required by GINA. The Secretary of HHS will enforce GINA protections when states fail to do so.  You can go directly to: http://www.hhs.gov/ocr/office/file/index.html

In addition, the Internal Revenue Service (IRS) has authority to assess tax penalties on employer-sponsored health benefit plans that do not comply with GINA.

Seek state‐level recourse

California:

There are officials in our state who are able to help you address violations of federal and state privacy laws. Among those likely to help are:

California State Attorney General:  http://oag.ca.gov/
California State Insurance Commissioner:  http://www.insurance.ca.gov/
Medical Board of California/Department of Consumer Affairs: http://www.mbc.ca.gov/

Outside of California:

Find your state attorney general: http://www.naag.org/
Find your state insurance commissioner: http://www.naic.org/
Find your state medical board http://www.fsmb.org/

Seek private counsel to explore a lawsuit

Remember you do NOT have the right to sue a health care provider or health plan for a violation of the federal privacy law, but a documented violation of the federal law may strengthen a privacy case you bring in state court though not all states offer an individual cause of action under state privacy laws.

Remember that YOU decide what information about yourself to reveal and when, why, and to whom.

Genetic Privacy is the Law: Know Your Rights!