Live data from Hacker News

23andMe's Fall

wsj.com

221–230 of 282 posts

Re: 23andMe's Fall

#221
> 23andMe had a data breach this fall that exposed nongenetic information of 6.9 million customers

Why does it specify "nongenetic"? Is it because the passwords were exposed? Doesn't that mean that any information accessible with those passwords can also be considered breached?

Re: 23andMe's Fall

#222
post #210

Earlier quoted context omitted.

I believe under HIPAA, you have the right to access any of your medical data. If you really want your data, I would get a lawyer to write a nasty letter to them demanding it.

As usual when HIPAA is brought up, you're wrong. HIPAA is the most misunderstood law in America. Hint, the "I" in HIPAA stands for "insurance." A general rule - if an insurance company isn't involved HIPAA doesn't apply. HIPAA is a law that regulates insurance companies and entities that deal directly with insurance companies, not "medical data." HIPAA doesn't apply to 23andMe. At all. HIPAA only applies to "covered…

> A general rule - if an insurance company isn't involved HIPAA doesn't apply.

Not exactly. If you go to most any healthcare provider, and pay out-of-pocket, HIPAA still applies. More accurately, HIPAA applies to any healthcare providers who transmits any health information in electronic form in connection with a transaction covered by 45 C.F.R. §160.103. Or in other words, basically every healthcare provider is also a covered entity, unless they're completely 100% cash only and don't take insurance for anyone ever. Do these even exist?

Although, still 23andMe wouldn't be covered because they're not providing healthcare services.

Re: 23andMe's Fall

#223
post #152

Ah, 23andMe, the Experian of DNA. Look, I give her great credit for the women in STEM thing, her perseverance in the light of obstacles, and making a 10$ lab kit worth $399 to buyers. But to not understand how far actors would go to get hold of that data, to not understand that the drug industry is brutal because humans are poorly-understood meatsacks (see: anything by Derek Lowe), well, seems like that Yale educatio…

> 10$ lab kit worth $399 Can you elaborate? Does this mean they've added $389 in value, or they swindled people of $389? If it's the former, what did they do to create that value? (Not being snarky, I don't know enough about their business and am legitimately curious. There seems to be a lot of comments here about unfulfilled promises.)

You have to define "value".

Personally, I roll my eyes any time someone questions "value". If a customer is willing to pay $399, then obviously they put the value of whatever the results may be from it at at least $399.

Re: 23andMe's Fall

#224

Earlier quoted context omitted.

If they go bankrupt they should destroy all the data but of course they will rather sell it to recover at least a bit of money.

If they file for bankruptcy, they cannot legally destroy the data. The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors. And many of the promises they have given about it's use can and will be broken by the trustees dissolving the company. The thing you need to consider when you give data to a company is not "will these people misuse this", but "…

> The data is a salable asset, the law requires them to preserve it so that it can be sold and the money returned to creditors.

This would depend on the terms you agreed to at the time you signed the account and submitted your data. I'm aware a lot of companies like to bury marketing disclosures under a busload of T&Cs. But if you didn't agree having your marketable data allowed to be sold the sale the to creditors can't backdoor it in. They can only reach out to you to opt into new terms, which you should refuse.

Re: 23andMe's Fall

#225

Earlier quoted context omitted.

I do too. That's why I've refused to use the kits I've been gifted... I assumed the fallback here was to build up a cache of data to sell. I'd be nice if they could be prevented from doing that, possibly by the court system.

Selling it is not a problem for the same reason they can't make a profit from it. It's not worth much. (They do have valuable data, but it's the survey answers and friend and family connections. Nobody really cares you have a G at SNP 12213244243.)

Isn't there significant value in the medical information, deciding who to offer insurance to and who to refuse to cover in the event that Republicans gain control of the government and repeal the Affordable Care Act?

Re: 23andMe's Fall

#226
post #108
post #33

> To create a recurring revenue stream from the tests, Wojcicki has pivoted to subscriptions. As media companies launched streaming “+” channels, Wojcicki rolled out 23andMe+, offering personalized health reports, lifestyle advice and unspecified “new reports and features as discoveries are made” for an initial $229, with annual renewals of $69. I was a heavy believer of 23andMe until this point. I answered all of th…

As someone who paid for 23andme+, it was pretty much a scam anyway, I got maybe 4-5 more reports over the year, all of which were for random popular ailments like "Anxiety" where the link between your genes and the disease(?) are pretty dubious in the literature and the takeaway was "you are 5% more likely to experience anxiety".

"10% more likely to experience anxiety, once having clicked on this useless link"

Re: 23andMe's Fall

#227
post #210

Earlier quoted context omitted.

As usual when HIPAA is brought up, you're wrong. HIPAA is the most misunderstood law in America. Hint, the "I" in HIPAA stands for "insurance." A general rule - if an insurance company isn't involved HIPAA doesn't apply. HIPAA is a law that regulates insurance companies and entities that deal directly with insurance companies, not "medical data." HIPAA doesn't apply to 23andMe. At all. HIPAA only applies to "covered…

> A general rule - if an insurance company isn't involved HIPAA doesn't apply. Not exactly. If you go to most any healthcare provider, and pay out-of-pocket, HIPAA still applies. More accurately, HIPAA applies to any healthcare providers who transmits any health information in electronic form in connection with a transaction covered by 45 C.F.R. §160.103. Or in other words, basically every healthcare provider is also…

>basically every healthcare provider is also a covered entity, unless they're completely 100% cash only and don't take insurance for anyone ever.

This is correct - I should have been more specific. If a business doesn't take insurance then HIPAA doesn't apply. Not that insurance isn't involved in a specific transaction. I've edited my GP comment to be more specific.

>Do these even exist?

Yes, absolutely.

https://www.healthline.com/health-news/these-doctors-accept-...

https://www.nytimes.com/2012/11/24/your-money/dealing-with-d...

https://www.fawkeshealth.com/insights/are-cash-only-clinics-...

So-called "pill mills" are almost always cash-only when they operate.

There's also health centers on university campuses that are funded through student fees and don't bill insurance.

Re: 23andMe's Fall

#228
I found my biological father and a half-sister thanks to 23andMe. It's hard for me to fully express how much that has meant to me. While I am fully aware of the bad side of DNA testing that many have raised here, I just want to also point out that there is also good that can come from these tests.

Re: 23andMe's Fall

#229
post #128

Earlier quoted context omitted.

If they go bankrupt they should destroy all the data but of course they will rather sell it to recover at least a bit of money.

Remember that it's good opsec to rotate your genome every six months.

Someone should do a genome manager startup

Re: 23andMe's Fall

#230
post #225

Earlier quoted context omitted.

Selling it is not a problem for the same reason they can't make a profit from it. It's not worth much. (They do have valuable data, but it's the survey answers and friend and family connections. Nobody really cares you have a G at SNP 12213244243.)

Isn't there significant value in the medical information, deciding who to offer insurance to and who to refuse to cover in the event that Republicans gain control of the government and repeal the Affordable Care Act?

No, because health insurance companies already know perfectly well what health conditions you have, since they can see your medical spending.

After all, they didn't need your genes when they were denying care in the 90s.

Post reply on HN