Ordering an at-home blood or genetic test can be convenient. But after you submit a blood or saliva sample and receive your results, you may start wondering who has access to that information, how long it will be kept, and whether it can be shared with anyone else.
Those questions matter because health information held by a direct-to-consumer testing company is not always protected in the same way as information maintained by your doctor, health insurer, or another organization covered by HIPAA.
Understanding what privacy protections apply, how a company may use or share your information, and whether consumer protection laws could be relevant can help you make a more informed decision before providing a sample.
Does HIPAA Protect At-Home Blood and Genetic Test Results?
Not always.
When your health information is maintained by a doctor, hospital, health plan, or another organization covered by the Health Insurance Portability and Accountability Act (HIPAA), certain health information is protected under federal privacy rules.
Direct-to-consumer testing can work differently. Some companies that offer blood tests, genetic testing, hormone panels, or other wellness services may not be HIPAA-covered entities.
Whether HIPAA applies depends on the company, the services it provides, and how your information is collected and handled. That does not mean your information is necessarily without legal protection.
Other federal and state privacy laws may still apply.
The Federal Trade Commission, for example, has authority over certain privacy and data-security practices involving consumer health information, including some companies that are not subject to HIPAA.
New Jersey law also provides protections for certain genetic information, including restrictions on how identifiable genetic information may be obtained, retained, and disclosed. New Jersey's consumer data privacy law also treats certain health and genetic information as sensitive data and imposes additional requirements on covered businesses that process it.
Which protections apply will depend on the company, the type of information involved, how the information was used or disclosed, and which laws apply to the particular situation.
The important point is that health information submitted directly to a consumer testing company may not have the same protections as information maintained by your doctor or health insurer.
What Information Can At-Home Testing Companies Collect, Use, or Share?
The information generated through at-home testing can be highly personal. Depending on the service, it may include:
- Genetic information
- Family health history
- Blood test results
- Biomarker data
- Lifestyle information
- Health questionnaire responses
What happens to that information after testing is complete can vary from one company to another.
Depending on the company's policies, the consent you provide, and applicable privacy laws, information may be used for research, product development, marketing, or other purposes. A company may also share certain information with research partners, service providers, or other third parties, or retain data for future analysis, depending on the circumstances and the legal restrictions that apply.
When a company's privacy or data-handling practices affect multiple consumers, broader legal issues can arise depending on the facts and applicable law.
At Sadaka Law, we understand that questions about consumer privacy often involve more than what information a company collects. How that information may be used, retained, or shared can matter too.
What Should You Look for in an At-Home Test Privacy Policy?
Before purchasing an at-home health test, take time to review the company's privacy policy, consent forms, and terms of service.
Questions worth considering include:
- What information does the company collect?
- How will your information be used?
- Will your information be shared with third parties?
- Can you opt out of certain uses or data sharing?
- Can you request deletion of your information or biological sample?
- How long will your information be retained?
- What security measures does the company describe?
- What happens to your information if the company is sold or acquired?
Reviewing these details can help you understand what you are agreeing to before you submit a blood, saliva, or other biological sample and provide sensitive personal information.
How Can You Protect Your Privacy Before Taking an At-Home Test?
If you're considering an at-home blood or genetic test, a few practical steps can help you make a more informed privacy decision:
- Compare the privacy practices of different testing companies before choosing one.
- Confirm what permissions you are giving before submitting a blood, saliva, or other sample.
- Review available privacy settings and opt-out choices.
- Consider whether you want your information or sample used for research or other secondary purposes.
- Keep copies of the privacy policy, consent form, and disclosures that applied when you purchased the test.
- Check whether the company allows you to delete your account, test data, or stored biological sample later.
The goal is not simply to determine whether a company has a privacy policy. It is to understand what choices you have about how your information is handled before you provide it.
What Should You Do If Your Health or Genetic Information Was Misused?
If you learn that a testing company exposed your health information, shared it in a way you did not expect, or handled it differently from what its privacy policy or disclosures led you to understand, the next questions are often what happened, what information was affected, and what protections apply.
For consumers throughout North Jersey, Somerset and Middlesex counties, and elsewhere in New Jersey, the answer can depend on the type of information involved, the company handling it, how the information was used or disclosed, and the laws that apply to the situation.
Sadaka Law represents people facing complex consumer-protection matters involving corporate conduct and accountability. If you believe a company improperly disclosed or failed to protect your sensitive personal information, contact us to discuss what happened and what next steps may be available.
Disclaimer: The articles on this blog are for informative purposes only and are no substitute for legal advice or an attorney-client relationship. If you are seeking legal advice, please contact our law firm directly.