Is the 23andMe Bankruptcy a Call for Improving Patient Data Privacy Laws?

If you haven’t already heard, 23andMe has filed for bankruptcy. The human genome identity organization provides a saliva collection kit for customers to submit to gain insights into their genetic makeup and historical matches. That’s the consumer-facing identity for the public, anyway. On the backend, the company houses a genetic archive for as many as 15 million customers, according to some reports. Of course, that may not include any who have requested their data be deleted and saliva collection destroyed (that is, if they’re able to log in to the site to do so; since the bankruptcy announcement, the company’s site has been challenging for users to navigate as security experts encourage users to take such action). In addition, the firm experienced a password hack in 2023 that could have exposed the information to as many as 6.9 million customers—for which, it settled with a $30 million payout to eliminate a class-action lawsuit.

Since users agreed to the company’s terms, HIPAA laws don’t apply to patient privacy or how the data can be shared. However, the company is claiming any buyer will need to agree to abide by the organization’s terms as users agreed to when they signed up. That’s not to say a new owner couldn’t then change the company’s privacy terms sometime later down the road. Given the challenges users are experiencing currently with requesting their data be deleted, it’s unclear if they would have the ability to easily consent or not to such a change. 

The reason I’m bringing all of this up is not because of 23andMe’s status as a medical device (years ago, the company went round and round with the FDA over that issue to eventually gain authorization for a number of genetic tests to determine health risk assessments for a variety of conditions, including cancer). Patient and health data collection is growing exponentially in healthcare and many devices are being developed to aid in this effort. Does anyone think this will be the only instance where the fate of patient data will be brought into question following a company going bankrupt, being sold, or merging? 

Looking back at HIPAA, some of the use of patient data is already clear. According to Emergo by UL, data collected by a device would fall under HIPAA privacy rules if the device meets the definition of a “healthcare provider” and it provides “healthcare.” For example, when a device collects data to provide information to a surgeon on the correct size of an orthopedic implant, that data falls under the purview of HIPAA laws. After that, the HIPAA laws get a bit murky and are less clear in what’s covered and what isn’t. 

Also to be considered, with many medical devices, the technology isn’t meant to be interfaced by the patient in the same way 23andMe data is accessed. Therefore, a company providing a device that collects patient data may not have a mechanism in place to enable a patient to easily request their information be eliminated. Further, while a patient may be aware they signed a document that provided rights to their healthcare professional to collect the necessary data for a medical procedure, they may not have read the document that also states the data is returned to the device company. 

Still another scenario where this issue could be a concern—some device companies are collecting patient data for the purpose of developing improvements to the device for future iterations. What happens to that patient data in the event the company is sold? Could it be leveraged as research or as the basis for the development of a completely new device? 

When a company is being sold via acquisition or in a situation such as the 23andMe bankruptcy, the data could become less secure as it is moves from one management platform to another. Are there cybersecurity safeguards in place to ensure the data is transitioned safely and securely between company systems? Might this be an opportunity for hackers to gain access to vital information that’s less than secure?

Patient data in healthcare offers great value for a number of reasons, from device development to improving therapies. However, it’s also critical information that needs to be handled appropriately. A federal privacy law doesn’t exist and state laws vary, for those that actually have them (which is about 20, according to some reports). As such, it’s on the shoulders of medical device manufacturers to ensure data collected by their technologies is safeguarded as well as possible. If data breaches and information sharing become more common due to inadequate protections or the result of a new company owning the data, the patient population is going to be much less willing to provide it.

Sean Fenske, Editor-in-Chief
[email protected]