Susanna Smith

On today's episode, I will be talking with legal scholar Anya Prince, who is a professor at the University of Iowa College of Law. Anya's writing and research focuses on health and genetic privacy, particularly the potential for genetic discrimination and the privacy implications of big data and genomic and genetic clinical care and research.

I became really interested in Anya's work because she's published extensively about GINA, the Genetic Information Non-Discrimination Act, writing analysis about what legal protections exist for genetic information in the United States and examining through survey work what healthcare professionals, insurance commissioners, and the public do—and don't—understand about healthcare privacy and the potential for genetic discrimination.

I'm interested in how we protect people's genetic information because as a provider of genetic disease, I personally could stand to lose a lot if protections are insufficient. I also take the view that people, all people, should be able to exercise privacy and control over how their healthcare

In my view, we don't have enough protections in place yet, and we're not well prepared for a future or even the present moment in which genetic information is increasingly driving healthcare decisions and operates as a valuable form of data currency. So thank you for joining me today on Genetic Frontiers, Professor Prince.

Anya Prince

Thanks for having me.

Susanna Smith

I want to start by talking a bit about the big picture. How is privacy viewed or valued in American culture, the legal system, and in healthcare?

Anya Prince

Yeah, so I think, you know, so many people say, oh, privacy is dead. We don't have privacy anymore. But when you actually start talking to individuals about privacy, they really value it in lots of different ways. But I think one of the big problems is there's a disconnect between how the public thinks that privacy is viewed or valued and how the legal system actually values it.

So overall, and we'll talk about the details, I'm sure, today, but the law is not very good at protecting health privacy. And so most notably, the law treats the privacy of health data and genetic data differently depending on if it's within clinical care, within a research setting, or within a commercial space. And so it's really hard for the public to see whether or not the protections match the values that they have for the privacy of their health information.

Susanna Smith

How would you describe Americans' relationship to privacy?

Anya Prince

I think that they value it. I also think that people are happy to share information, especially if they know how it might be used, or if they trust who they're sharing with. So on the one hand, you know, people use social media and post all sorts of things that could tell them about, you know, tell others publicly about their health information and so there's lots of ways where we're not as private about our health information as one might think.

But there's also data that when you tell people that they might be part of a biobank, or you tell people that their genetic information has been commercialized. They're actually surprised about that and uncomfortable with that. And so I think we have a little bit of a both-and, right?

In some ways people don't think about privacy on a regular basis. They just go through the world and social media and the internet without necessarily having that in the forefront. But when you start to ask people how they want their information to be used, I think we start to see more of those values coming in.

Susanna Smith

Yeah, and I think trust is a big part of it, right? Like, how private you want to keep information is often about how you trust whether it's going to be used in a way that might harm you.

So how do you think about the importance of privacy and or data security when it comes to healthcare data versus genetic data specifically?

Anya Prince

So I think, so some argue that thinking about the privacy of genetic information or health information without thinking about just general privacy at large is exceptionalism that we should not think about health privacy or genetic privacy as anything different than just how do we protect data at large? Some people argue that, but I think it makes sense to think about the privacy of health data and the privacy of genetic data as more important or something that should be given extra consideration, both in the law and both by the public.

Part of that is that your genomic data, your health data is incredibly valuable so there's, you know, most of the cybersecurity attacks and threats to data privacy come to hospitals and places that hold our health information because it's just valuable on the dark web. But it's also valuable for advertisers, right? If they know that you might have a predisposition to diabetes, they might try to sell you insulin pumps or healthier foods or whatever that is. And that could be really beneficial to a person, but it still means that somebody is leveraging your health data in certain ways.

And for better or worse, I think people think about their healthcare and especially their genetic data or their genomic data as different than just general data, you know, especially genomic data. It's who we are. It's our blueprint. It ties us to our family members. And so I think people do think about the sharing of their genetic information in a much different way than other health data and other general data, and so therefore, I think about the importance of privacy and data security in that space as heightened since people tend to value the privacy of that information a little more.

I also think, and this might complicate the picture a bit, but some of my other research is in how much we can infer private health information from other information. So let's say we say, Okay, I have a predisposition to colon cancer, and so I don't want my genetic information that that shows that predisposition to be sent around. Okay, well, that's really important to protect that privacy. But if I joined a Facebook group for the Lynch syndrome community or I did a bunch of Google searches or online searches for cancer predispositions, those things could also proxy for that information.

So while I do think it's really important to keep genetic information more private, because like you said, you can't change it I also think it's really important for us to think about how much we need broad data protection to because of the ways that we interact with the world based on what we know about our health information.

Susanna Smith

Yeah, I think that's such a valuable point because we kind of, and even I do this sort of narrow in on certain data points as these are things I want to keep private, but I operate in a world, right? So I'm creating data all around me by my behaviors that is collectible, people can analyze it.

Anya Prince

I was just going to say, it might not be perfect, right? They might get it wrong like you know as a health privacy researcher who does not have a medical background, I search all sorts of diseases on Google, right, to try to just learn about the communities and the predispositions that I'm studying. And so an advertiser might think that I've ended up with 100 different conditions but there could be ways that they could identify it correctly.

Susanna Smith

Yeah. So, you opened with saying, some people say privacy is dead. It sounds like you don't totally believe that. I don't totally believe that, but what does privacy mean in a world where your genetic data, possibly your full genome, could be collected from your toothbrush and your genetic data can implicate others, namely people you're biologically related to.

Anya Prince

Yeah, so these examples do show ways in which it's really hard to completely insulate ourselves from intrusion upon our confidential information. But I agree with you that privacy still matters.

There are some state laws that or some states have laws that are against what's called surreptitious testing so that collecting something from your toothbrush and sending it in for a testing lab. There are laws that help protect against that. But also, I think each time that anybody is able to successfully minimize the amount of data available about them, it minimizes their likelihood of harm. So even if it never completely ameliorates the harm that could come, I think privacy matters because it gives us some control and the ability to lower our risk of future harm that might come if somebody knows our informatio...