THE GENETIC INFORMATION NONDISCRIMINATION ACT AT AGE 10: GINA'S CONTROVERSIAL ASSERTION THAT DATA TRANSPARENCY PROTECTS PRIVACY AND CIVIL RIGHTS.

• Author: Evans, Barbara J.

TABLE OF CONTENTS INTRODUCTION: GINA'S FIRST DECADE AND THE CHALLENGES AHEAD 2021 I. CIVIL RIGHTS IN BIOETHICAL DISCOURSE 2029 II. FORMALIZING GENOMIC CIVIL RIGHTS AFTER GINA 2035 III. GINA's RELIANCE ON TRANSPARENCY TO PROTECT PRIVACY AND 2046 CIVIL RIGHTS IV. TRANSPARENCY AS A TOOL OF CIVIL RIGHTS 2055 A. Ensuring Respect for Individual Autonomy 2056 B. Strengthening Privacy Protections 2059 C. Protecting Civil Rights in the Face of Incomplete Privacy 2061 Protections D. Enabling Other Federal Civil Rights 2063 E. Additional Non-Civil-Rights Objectives 2065 V. DISPLACING STATE LAWS BLOCKING TRANSPARENCY 2067 A. State Law Barriers to Laboratory Data Access 2067 B. GINA as a Federal Civil Rights Intervention 2071 VI. INDIVIDUAL DATA ACCESS AFTER GINA 2074 A. Application and Enforcement 2075 B. Exceptions Allowing Denial of Individual Access 2075 1. Exceptions that Have Not Changed Over Time 2075 2. Changes in 2014 that Altered Exceptions for 2077 Laboratory-Held Data C. Scope of Information Access After GINA 2078 1. Basic Access Provisions that Have Not Changed Over 2078 Time 2. Changes in 2013 that Expanded the Range of Genomic 2079 Data Subject to HIPAA Access VII. THE CONSUMER SAFETY REGULATORY EMPIRE STRIKES BACK: SAFETY 2080 AND TRANSPARENCY IN CONFLICT A. Concerns About Individual Access to Research Data 2080 1. FDA Expresses Concern 2080 2. CMS Complicates HIPAA Access 2082 3. OCR Flees Controversy 2089 4. The National Academies Weigh In 2091 B. The Ethical Imperative for Research Data Access 2094 VIII. RECONCILING SAFETY AND TRANSPARENCY 2098 A. Statutory Basis of the Individual Access Right 2098 B. Safety Solutions that Preserve Civil Rights 2100 1. The Limits of Prospective CLIA Compliance as a 2100 Solution 2. Data Destruction Policies 2101 3. Moving Genomic Research to Non-HIPAA Research 2101 Facilities and Implementing Specially Tailored Privacy Policies 4. Issue HIPAA Guidance to Ensure Accurate 2103 Identification of Data in the DRS 5. Warnings, Disclosures, and Other Measures to 2105 Mitigate the Risk of Access 6. Responsibilities of the Medical Profession and 2106 Medical Practice Regulators 7. Covering the Costs of HIPAA Access 2107 CONCLUSION: GINA'S OPEN FUTURE 2109 INTRODUCTION: GINA'S FIRST DECADE AND THE CHALLENGES AHEAD

The Genetic Information Nondiscrimination Act of 2008 (GINA) was born with high expectations. (1) The late Senator Edward Kennedy, who cosponsored the legislation, billed it as "the first major new civil rights bill of the new century." (2) However, GINA celebrated its tenth anniversary last year amid festering doubt about its significance as a civil rights law. (3) Scholars dismiss GINA as having attacked two problems--genetic discrimination in employment and in health insurance--that, as far as the available evidence shows, never actually existed. (4) GINA fails to address problems, such as genetic discrimination in long-term care insurance, that genuinely trouble people who undergo genetic testing. (5) The centerpiece of GINA's civil rights protections--an expanded right of transparency allowing individuals to access genetic information that third parties store about them--remains mired in controversy. (6) This Article explores the individual access right GINA created and explains why it is a crucial tool to protect people's civil rights as genomic testing grows more common and more informative in coming years. A convoluted rulemaking history obscured GINA's role in creating this important right, (7) and GINA enters its second decade like a misunderstood teenager, struggling to be taken seriously as a civil rights law.

If GINA's alleged shortcomings caused no widespread harm over the past decade, this fact lends itself to two possible explanations: The first is that GINA addressed frivolous problems that did not matter in 2008 and, by implication, may not matter now. The second is that GINA addressed important problems and was thwarted in its initial attempt to do so, but somehow we lucked out and escaped serious harm, which still awaits unless we take steps now to ensure that GINA's essential civil rights protections work as Congress intended. I disclose that I lean toward this second view.

Congress enacted GINA during a period of enthusiasm that followed the completion of the Human Genome Project in the year 2000. (8) Those were heady times. When announcing initial results of that project, renowned geneticist Francis Collins declared, "Today, we celebrate the revelation of the first draft of the human book of life," (9) and President Bill Clinton gushed, "[t]oday, we are learning the language in which God created life." (10) Scholars of the era likened genetic information to a "future diary" that is "uniquely powerful and uniquely personal" and able to "predict an individual's... medical future" and foretell the future of one's family members. (11) People worried that a drop of spit on a discarded coffee cup or a strand of hair they shed on the street might enable others to infer deeply personal secrets: where they came from (for example, is their ostensible father really their father?), (12) their mental defects and behavioral shortcomings, (13) and how and when they will die. (14)

GINA, in many respects, was Congress's response to a mass delusion that genetic information is more informative than, at least to date, it has proved to be. (15) As we now know, and as cooler heads knew back then, "[t]he argument from genetic prophecy is not compelling." (16) As of 2014, of the roughly 10,000 mutations that each of us has in our genomes, (17) fewer than 130 could be conclusively linked to a clinically significant health impact. (18) Behavioral genetics, after years of explaining practically nothing, (19) is only now beginning to have predictive power, which remains limited. Basic physical traits like height are influenced by hundreds of interacting genes, such that viewing people's genomes usually reveals little about how tall they are. (20) A 2010 study found that simple metrics, such as a person's waist circumference, are better at predicting future diabetes risk than genetic "models based on 20 common independently inherited alleles." (21)

If GINA failed in its first decade to save us from genetic discrimination, it may have been a harmless error because the human genome was too poorly understood at the time to lend itself to very many discriminatory uses. (22) If GINA failed, then so did the science, and it all somehow worked out. This does not imply, however, that GINA's civil rights protections are unimportant: they may simply have been premature.

Genetic science is rapidly gaining power to explain and predict. (23) As it does so, the potential for genetic discrimination and other inappropriate uses of genetic information grows more real than it was ten years ago when Congress enacted GINA. (24) It is no longer "mere theory or science fiction" that a hacker who misappropriates our genetic information will be able to infer personal characteristics such as our height, ethnicity, hair color, eye color, and facial features. (25) The plan for advancing our understanding of the human genome, and thus our ability to draw such inferences, relies on research that uses large datasets of genetic and other personal data, often without individual consent. (26) We are entering a positive feedback loop in which the research that exposes us to risk of unwanted data disclosures simultaneously fuels the discovery process that makes disclosures all the more damaging. (27) As GINA enters its second decade, the civil rights protections it affords are starting to matter. The goal of this Article is to open a debate about possible solutions to controversies that have undercut GINA's protections during its first decade.

These controversies reflect a clash of competing regulatory paradigms. Passage of GINA expanded the federal regulatory program for genetic and genomic testing. (28) The program had long included consumer health and safety regulations (for brevity, "safety regulations") that aim to protect the physical health and safety of people who undergo genetic and genomic testing. Examples of safety regulations include the U.S. Food and Drug Administration's (FDA's) oversight of in vitro diagnostic testing products, (29) the Centers for Medicare and Medicaid Services' (CMS's) oversight of clinical laboratories under the Clinical Laboratory Improvement Amendments of 1988 (30) (CLIA) regulations, (31) as well as aspects of federal research regulations that minimize physical safety risks to research participants. (32) GINA added a second layer of regulations: civil rights laws that address the social consequences of genetic testing. (33) For example, GINA bans unjust discrimination, (34) strengthens privacy protections, (35) and protects rights that foster fruitful human interactions, such as the rights to speak freely, (36) to receive information relevant to one's decisionmaking, (37) to associate and assemble with others, to engage in scientific inquiry, and to participate in political life. (38)

The transition to a broader federal regulatory program for genetic testing has not gone smoothly. GINA led to the creation, in 2014, (39) of a federally protected, individual right of access (40) to genetic information stored at laboratories covered by the Health Insurance Portability and Accountability Act of 1996 (41) (HIPAA) Privacy Rule, which is a major federal medical privacy regulation. (42) The 2014 Privacy Rule amendments expanded individuals' access to laboratory-held data, (43) including genetic and genomic information as well as assorted other diagnostic test results that laboratories hold in their files. (44) Insofar as these amendments pertain to genetic information, they were implementing a congressional civil rights mandate stated in GINA. (45) Failing to appreciate this fact, safety regulators and some members of the bioethics and medical communities have...