If you’ve ever spit into a plastic tube or swabbed your cheek and mailed your saliva away to learn about your ancestry or health risks, you might have assumed that the company analyzing your DNA is legally required to keep your genetic data private. But you’d be wrong.
The Health Insurance Portability and Accountability Act, known as HIPAA, protects individuals’ medical information when it’s handled by doctors, hospitals, and health insurance companies. This applies to genetic tests ordered by your doctor but not to those you can buy online directly from companies like 23andMe and Ancestry because these kits aren’t considered medical tests.
That’s a problem, since genetic data can reveal all sorts of sensitive information about you—your ethnicity, your family connections, and even your likelihood of developing Alzheimer’s disease or certain cancers. Law enforcement officers are increasingly using consumer genetic databases to investigate violent crimes.
But a growing number of states are adopting genetic privacy laws in an effort to close these gaps. California became the latest on October 6 when Governor Gavin Newsom signed into law the Genetic Information Privacy Act, which puts restrictions on the data collected by direct-to-consumer DNA testing companies.
