Genetic Privacy Laws Have Loopholes. A New Policy Framework Identifies Five Ways to Fix Them

Most Americans assume that their genetic information is protected from use by insurers. The Genetic Information Nondiscrimination Act (GINA), passed in 2008, bars health insurers and employers from discriminating based on genetic data. Dozens of states have passed additional laws extending those protections to life insurance, disability insurance, and long-term care insurance - areas GINA did not cover.

But a Policy Forum published in Science by legal scholars Anya Prince and Theresa Eckel argues that the existing patchwork of state laws contains systematic weaknesses that leave genetic privacy far less protected than the legislation's bipartisan popularity might suggest. As genetic testing has expanded dramatically - through clinical diagnostic testing, consumer genomics services, and direct-to-consumer ancestry products - the stakes of those weaknesses have grown.

What GINA Left Uncovered

GINA was a landmark piece of legislation, but it was drafted at a time when genetic testing was primarily a medical activity with limited reach. It covered health insurance and employment. It did not cover life insurance, long-term care insurance, or disability insurance - products that many Americans depend on and that may be more consequential for financial security than health insurance in some circumstances.

State legislatures have moved to fill these gaps. Many states have enacted bans or restrictions on using genetic information in non-health insurance contexts, responding to constituent concern about genetic discrimination. The political support for such measures has been consistently bipartisan.

The problem, Prince and Eckel argue, is that the laws are not actually providing the protection their framers and supporters believe they are.

Five Structural Weaknesses

The Policy Forum identifies five specific areas where current state laws fall short.

The first concerns the definition of genetic information itself. Some state laws define genetic information narrowly - covering gene variants but not, for example, the results of genetic risk scores, polygenic indices, or algorithmically derived genetic risk estimates. As the technology of genetic analysis shifts from single-gene testing to population-scale risk modeling, these narrow definitions may exclude the most commercially relevant uses of genetic data.

The second concerns what counts as discrimination. Some state laws prohibit "unfair discrimination" based on genetic information, borrowing language from general insurance law. But in insurance, underwriting - using any available information to price risk - is not inherently "unfair." A law that prohibits unfair discrimination might permit routine underwriting based on genetic risk if an insurer can argue that the pricing is actuarially justified.

Third, some state policies define genetic information at the individual level without including information derived from family members. A life insurer that denies coverage based on a sibling's genetic test result - rather than the applicant's own test - might fall outside the scope of laws written to cover only individual genetic information.

Fourth, the scope of prohibited actions varies. Some state laws prohibit canceling insurance coverage based on genetic information, but do not prohibit using genetic data in underwriting decisions or when setting premiums. A person could therefore have access to coverage in principle while being priced out of it in practice.

Fifth, enforcement and awareness gaps mean that insurers may be requesting genetic information in ways that violate the spirit of protective laws without triggering formal legal challenge - because neither applicants nor regulators consistently monitor for violations.

What Better Laws Would Look Like

Prince and Eckel direct their recommendations specifically at state legislators drafting or revising genetic privacy statutes. They argue for broader definitions of genetic information that encompass derived risk scores and family-based genetic data. They recommend replacing "unfair discrimination" language with categorical prohibitions on using genetic information in specified insurance decisions. They call for explicit inclusion of underwriting and premium-setting as covered activities, not just coverage denial. And they recommend clearer enforcement mechanisms that do not depend on individuals identifying and challenging violations they may not know have occurred.

The practical relevance of these recommendations is immediate. New legislative sessions are beginning in many states this spring, and genetic privacy legislation has active proponents in multiple statehouses. The gap between what people believe existing laws protect and what they actually prohibit is not hypothetical - it is structural.