Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
Dr. Emily Oster on Decision-Making and the Kids' Covid Vaccine
The "Making Sense of Science" podcast features interviews with leading medical and scientific experts about the latest developments and the big ethical and societal questions they raise. This monthly podcast is hosted by journalist Kira Peikoff, founding editor of the award-winning science outlet Leaps.org.
This month, Brown economist and bestselling author Dr. Emily Oster breaks down her decision-making process about why she vaccinated her kids against Covid, and the helpful frameworks other parents can use to think through the decision for their own kids. She also discusses her expectations for school policies regarding vaccines and masks in 2022.
Watch the trailer:
Listen to the Episode:
<div id="buzzsprout-player-9526587"></div><script src="https://www.buzzsprout.com/1714953/9526587-kids-covid-vaccine-and-decision-making-with-emily-oster.js?container_id=buzzsprout-player-9526587&player=small" type="text/javascript" charset="utf-8"></script>
Kira Peikoff was the editor-in-chief of Leaps.org from 2017 to 2021. As a journalist, her work has appeared in The New York Times, Newsweek, Nautilus, Popular Mechanics, The New York Academy of Sciences, and other outlets. She is also the author of four suspense novels that explore controversial issues arising from scientific innovation: Living Proof, No Time to Die, Die Again Tomorrow, and Mother Knows Best. Peikoff holds a B.A. in Journalism from New York University and an M.S. in Bioethics from Columbia University. She lives in New Jersey with her husband and two young sons. Follow her on Twitter @KiraPeikoff.
Six Questions about the Kids' COVID Vaccine, Answered by an Infectious Disease Doctor
I enthusiastically support the vaccination against COVID for children aged 5-11 years old. As an infectious disease doctor who took care of hundreds of COVID-19 patients over the past 20 months, I have seen the immediate and long-term consequences of COVID-19 on patients – and on their families. As a father of two daughters, I have lived through the fear and anxiety of protecting my kids at all cost from the scourges of the pandemic and worried constantly about bringing the virus home from work.
It is imperative that we vaccinate as many children in the community as possible. There are several reasons why. First children do get sick from COVID-19. Over the course of the pandemic in the U.S, more than 2 million children aged 5-11 have become infected, more than 8000 have been hospitalized, and more than 100 have died, making COVID one of the top 10 causes of pediatric deaths in this age group over the past year. Children are also susceptible to chronic consequences of COVID such as long COVID and multisystem inflammatory syndrome in children (MIS-C). Most studies demonstrate that 10-30% of children will develop chronic symptoms following COVID-19. These include complaints of brain fog, fatigue, trouble breathing, fever, headache, muscle and joint pains, abdominal pain, mood swings and even psychiatric disorders. Symptoms typically last from 4-8 weeks in children, with some reporting symptoms that persist for many months.
Second, children are increasingly recognized as vectors who can bring infection into the house, potentially transmitting infection to vulnerable household members. Finally, we have all seen the mayhem that results when one child in the classroom becomes infected with COVID and the other students get sent home to quarantine – across the U.S., more than 2000 schools have been affected this way.
We now have an extraordinarily effective vaccine with more than 90 percent efficacy at preventing symptomatic infection. Vaccinating children will boost our countrywide vaccination rate which is trailing many countries after an early start. Nevertheless, there are still many questions and concerns that parents have as the vaccine gets rolled out. I will address six of them here.
"Novel Vaccine Technology"
Even though this is a relatively new vaccine, the technology is not new. Scientists had worked on mRNA vaccines for decades prior to the COVID mRNA vaccine breakthrough. Furthermore, experience with the Pfizer COVID vaccine is rapidly growing. By now it has been more than a year and a half since the Pfizer trials began in March 2020, and more than 7 billion doses have already been administered globally, including in 13.7 million adolescents in the U.S. alone.
"Will This Vaccine Alter My Child's DNA?"
No. This is not how mRNA works. DNA is present in the cell's nucleus. The mRNA only stays in the outside cytoplasm, gets destroyed and never enters the inner sanctum of the nucleus. Furthermore, for the mRNA to be ever integrated into DNA, it requires a special enzyme called reverse transcriptase which humans don't have. Proteins (that look like the spike proteins on SARS-CoV-2) are made directly from this mRNA message without involvement of our DNA at any time. Pieces of spike proteins get displayed on the outside of our cells and our body makes protective antibodies that then protects us handily against the future real virus if it were ever to enter our (or our children's) bodies. Our children's DNA or genes can never be affected by an mRNA vaccine.
"Lack of Info on Long-Term Side Effects"
Unlike medications that are taken daily or periodically and can build up over time, the mRNA in the Pfizer vaccine is evanescent. It literally is just the messenger (that is what the "m" in mRNA stands for) and the messenger quickly disappears. mRNA is extremely fragile and easily inactivated – that's why we need to encase it in a special fatty bubble and store the vaccines at extremely cold temperatures. Our cells break down and destroy the mRNA within a few days after receiving the instructions to make the virus spike proteins. The presence of these fragments of the virus (note this is not "live" virus) prompts our immune system to generate protective antibodies to the real thing. Our bodies break down mRNA all the time in normal cellular processes – this is nothing new.
What the transience of the delivery system means is that most of the effects of the mRNA vaccines are expected to be more immediate (sore arm, redness at the site, fever, chills etc.), with no long-term side effects anticipated. A severe allergic response has been reported to occur in some generally within the first 15 minutes, is very rare, and everyone gets observed for that as part of standard vaccine administration. Even with the very uncommon complication of myocarditis (inflammation of the heart muscle) and pericarditis (inflammation of the lining of the heart) seen primarily in young men under the age of 30 following mRNA vaccines, these typically happen within days to 2 weeks and many return to work or school in days. In the 70-year history of pediatric (and adult vaccines), dangerous complications happen in the first two months. There have been millions of adolescents as young as 12 years and thousands in the initial trial of children aged 5-11 who have already received the vaccine and are well beyond the two-month period of observation. There is no biological reason to believe that younger children will have a different long-term side effect profile compared to adolescents or adults.
"Small Sample Size in Kids and the Trial Design"
Although the Pfizer trial in children aged 5-11 was relatively small, it was big enough to give us statistical confidence in assessing safety and efficacy outcomes. Scientists spend a lot of time determining the right sample size of a study during the design phase. On one hand, you want to conduct the study efficiently so that resources are used in a cost-effective way and that you get a timely answer, especially in a fast-moving pandemic. On the other hand, you want to make sure you have enough sample size so that you can answer the question confidently as to whether the intervention works and whether there are adverse effects. The more profound the effect size of the intervention (in this case the vaccine), the fewer the numbers of children needed in the trials.
Statistics help investigators determine whether the results seen would have appeared by chance or not. In this case, the effect was real and impressive. Over 3,000 children around the world have received the vaccines through the trials alone with no serious side effects detected. The first press release reported that the immune response in children aged 5-11 was similar (at one-third the vaccine dose) to the response in the comparator group aged 16-25 years old. Extrapolating clinical efficacy results from immune response measurements ("immunobridging" study) would already have been acceptable if this was the only data. This is a standard trial design for many pediatric vaccines. Vaccines are first tested in the lab, followed by animals then adults. Only when deemed safe in adults and various regulatory bodies have signed off, do the pediatric vaccine trials commence.
Because children's immune systems and bodies are in a constant state of development, the vaccines must be right-sized. Investigators typically conduct "age de-escalation" studies in various age groups. The lowest dose is first tried so see if that is effective, then the dose is increased gradually as needed. Immune response is the easiest, safest and most efficient way to test the efficacy of pediatric vaccines. This is a typical size and design of a childhood vaccine seeking regulatory approval. There is no reason to think that the clinical efficacy would be any different in children vs. adults for a given antibody response, given the experience already in the remainder of the population, including older children and adolescents. Although this was primarily designed as an "immunobridging" study, the initial immunologic response data was followed by real clinical outcomes in this population. Reporting on the outcomes of 2,268 children in the randomized controlled trial, the vaccine was 90.7% effective at preventing symptomatic infection.
"Fear of Myocarditis"
Myocarditis (inflammation of the heart muscle) and pericarditis (inflammation of the lining of the heart) have been associated with receipt of the mRNA vaccines, particularly among male adolescents and young adults, typically within a few days after receiving the second dose. But this is very rare. For every million vaccine recipients, you would expect 41 cases in males, and 4 cases in females aged 12-29 years-old. The risk in older age groups is substantially lower. It is important to recognize that the risk of myocarditis associated with COVID is substantially higher. Patients present with new chest pain, shortness of breath, or palpitations after receiving an mRNA vaccine (more common after the second dose). But outcomes are good if associated with the vaccine. Most respond well to treatment and resolve symptoms within a week. There have been no deaths associated with vaccine-associated myocarditis.
In contrast, COVID-associated myocarditis has been associated with more severe cases as well as other complications including chronic symptoms of long COVID. The risk of myocarditis is likely related to vaccine dose, so the fact that one-third the dose of the vaccine will be used in the 5-11 year-olds is expected to correspond to a lower risk of myocarditis. At the lower dose given to younger kids, there has been a lower incidence of adverse effects reported compared to older children and adults who received the full dose. In addition, baseline rates of myocarditis not associated with vaccination are much lower in children ages 5-11 years than in older children, so the same may hold true for vaccine-associated myocarditis cases. This is because myocarditis is associated with sex hormones (particularly testosterone) that surge during puberty. In support of this, the incidence of vaccine-associated myocarditis is lower in 12–15-year-old boys, compared to those who were older than 16 years old. There were no cases of myocarditis reported in the experience to date of 5–11-year-old children in the trials, although the trial was too small to pick up on such a rare effect.
"Optimal Dose Spacing Interval: Longer Than 3 Weeks?"
There is a biologic basis for increasing the interval between vaccine doses in general. Priming the immune system with the first shot and then waiting gives the second shot a better chance of prompting a secondary immune reaction that results in a more durable response (with more T cell driven immune memory). One study from the U.K. showed that the antibody response in people over 80 was more than 3 times higher if they delayed the second dose to after 12 weeks for the Pfizer vaccine instead of the 3 weeks studied in trials. In a study of 503 British health care workers, there were twice as many neutralizing antibodies produced in a longer interval group (6-14 weeks) versus a shorter interval group (3-4 weeks) between doses. However, the safety and efficacy with longer intervals has not been evaluated in the pediatric or other COVID vaccine trials.
In the U.S., the C.D.C. reported that 88 percent of counties are at a "high" or "substantial" level of community transmission. Also, Europe is already experiencing a winter surge of infections that may predict more U.S. winter cases as international travel reopens. During a time of high community virus burden with a highly transmissible Delta variant, relying on one dose of vaccine for several more weeks until the second may leave many more susceptible to infection while waiting. One study from England showed that one dose of the Pfizer vaccine was only 33% protective against symptomatic Delta infection in contrast to 50% for the Alpha variant in adults. There has been no corollary information in children but we would expect less protection in general from one vaccine dose vs. two. This is a particularly important issue with the upcoming holiday season when an increased number of families will travel. Some countries such as the U.K. and Norway have proceeded with only offering older than 12 year-olds one dose of vaccine rather than two, but this was before the current European surge which may change the risk-benefit calculus. There are no plans to only offer one vaccine dose in the U.S. at this time. However a lower dose of the vaccine will likely be studied in the future for adolescents aged 12-15.
For parents worried about the potential risk of adverse effects of two doses of vaccines in their children, it is reasonable to wait 6-12 weeks for the second shot but it all depends on your risk-benefit calculus. There is biological plausibility to pursue this strategy. Although there is no pediatric-specific data to draw from, a longer interval may lengthen immune memory and potentially decrease the risk of myocarditis, particularly in boys. There may only be partial benefit in eliciting protective antibodies after one vaccine dose but only 2-4% of children are hospitalized with COVID once infected, with risk of severe illness increasing if they have comorbidities.
There are also some data indicating that 40% of children have already been exposed to infection naturally and may not need further protection after one shot. However, this percentage is likely a large overestimation given the way the data was collected. Using antibody tests to ascertain previous infection in children may be problematic for several reasons: uncertainty regarding duration of protection, variability in symptoms in children with most having very mild symptoms, and the lack of standardization of antibody tests in general. Overall, if the child has medical comorbidities such as diabetes, parents are planning to travel with their children, if local epidemiology shows increasing cases, and if there are elderly or immunocompromised individuals in the household, I would vaccinate children with two doses as per the original recommended schedule.
Bottom line: Given the time of the year and circulating Delta, I would probably stick with the recommended 3-week interval between doses for now for most children. But if parents choose a longer interval between the first and second dose for their children, I wouldn't worry too much about it. Better to be vaccinated - even if slowly, over time -- than not at all.