Hacker News Reader

Comment by ams6110 | Hacker News Reader

> if I was a carrier for a serious genetic disease, I definitely would want access to that information

I'd much rather get that information from an MD who is at least bound by HIPPA regulations, than by a VC funded internet startup.

View on HN

I would much rather get it done anonymously through a VC funded startup than through an MD who is going to unambiguously tie it to my person, log it into an "approved" and "secure" storage and may be required to report it based on some currently unknown set of conditions ("do you have a predisposition to X? let us alert the right folks so they can check you out, just for your own benefit")

I understand that with personal genetics you are unlikely to stay anonymous against a determined effort, but ATM I personally trust my government "trying to do good" less than I trust a random stranger who wants to make a predictable profit for his business. Just my 2c.

So a VC funded startup is not "a random stranger", but doctors are the government?

Doctors are not government, but they are bound by a variety of government regulations (e.g., parent referenced HIPAA). I do trust my own physician, but he still has to report on me in certain cases or he will lose his license.

For big, uncertain queries I initiate I would rather find the answer privately and then decide how public do I want this info to be. Otherwise I am afraid that my options will be curtailed: "did both of your parents have heart problems? sorry, we cannot take you on that climbing trip", etc.

I was under the impression that 23andMe doesn't allow you to anonymously submit a genetic profile.

Some people submit their DNA but switch up their gender so as to theoretically nullify the results for a potential future data breach. (Insurance providers being one concern here.)

Does anyone know if/how 23andme addresses this, or do they care?

Switching the gender would be an ill-advised way to be anonymous. Its easily determined from the raw data itself, based on the presence of Y-chromosome SNPs. I have heard that some people prefer to use fake names, emails, prepaid credit cards, and use a PO box or some other mailing relay to mask their home address.

I'm not sure if 23andMe cares about anonymous users, but they might care about survey results being faked in a large number of users, because that would affect their scientific mission of finding interesting patterns.

They do indeed care.

My brother and I submitted a sample from my dying mother, which they were unable to process properly. We were offered a replacement kit, but at that point our mother had already passed away. When I conveyed this to 23andme, they refunded our kit cost and removed our mother's pending profile from my 23andme account.

From their email:

"Unfortunately it is not possible for us to unregister a kit after an initial sample fails analysis. Replacement kits are automatically registered to the individual the original kit was registered to, and they retain personal registration information including name, birthdate, and legal consent to our Terms of Service and research document.

If we allow someone else to use the replacement kit, the sample would not be associated with their personal information. Additionally that person would not agree to our Terms of Service and provide legal consent for us to process their sample. For privacy and legal reasons, a replacement kit cannot be used by another individual."

I think this is a different circumstance however. It sounds like the issue here was primarily based on obtaining proper consent from the individual being tested, which isn't the same as anonymity.

Check this out though. It seems as if their official stance is they do want your real name, but permit pseudonyms when conversing online. Interesting.

https://customercare.23andme.com/hc/en-us/articles/202907890...

> It seems as if their official stance is they do want your real name

Its because they're selling the data to pharma companies. They have a vested interest in the data being accurate.

https://www.google.com/search?q=23andme+sell+data

That... seems like literally the easiest thing to correct based on a genetic sample.

If you have to submit a payment you aren't anonymous.

Is anyone able to providing a notable source on 23andme and their position on HIPAA regulations?

23andMe isn't a HIPAA covered entity, and HIPAA regulations don't apply to then at all.

Do you have a specific question? Their position is that they follow the law where it applies to them.

I completely agree with your distrust of a random startup, but I encourage you to exercise more caution about your MD. Not that he may have bad intentions but because most of them aren't really computer geeks and your personal information is quite likely to end up on a lost USB stick or out in the wild because of a bad shared password.

I grew up in a family of doctors, and I heard things like them considering to sue google because a patient managed to find his medical record by googling his name. They are scientists, very educated people, but that doesn't mean they understand all technologies.

Reply on news.ycombinator.com