Security Implications of Direct-to-Consumer Genetic Sevices

Direct-to-consumer (DTC) genetic services refer to genetic tests sold directly to consumers via the Internet, television, and other marketing venues without involving healthcare providers such as physicians, genetic counselors, and other healthcare professionals. Companies such as 23andMe and Navigenics offer genetic tests using genome-wide technology direct to consumers over the Internet. Genetic data collected by DTC companies provide an opportunity for future personalized medicine programs that will significantly improve patient outcomes and preventive care. While this may be a promising development, DTC genetic testing raises important security and privacy concerns. This paper aims to identify the most important security threats to consumers of DTC genetic testing services, and explain how to use security technologies and policies to mitigate the threats. In this paper, we first analyze a leading DTC company that demonstrates how security concerns might be intrinsic to contemporary DTC genetic testing services. We then present a threat model and identify the most important security threats to consumers of DTC genetic testing services. Furthermore, we outline security and privacy implications of using DTC genetic services and how DTC companies should elaborate upon them to protect genetic privacy.