Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
Every weekend since January, pediatrician Cora Collette Breuner has volunteered to give the COVID-19 vaccine to individuals from age 12 to 96 in an underserved community in Washington state.
Even though the COVID-19 vaccines have been shown to be incredibly safe and effective, there's still quite a bit of hesitancy among parents to vaccinate their teenage children, says Breuner, an adolescent medicine specialist at Seattle Children's Hospital and a past chair of the American Academy of Pediatrics' Committee on Adolescence. "They have questions and they have questions," she says.
Breuner patiently answers them all. Even then, parents—who have the final say in whether their child gets the vaccine—may be reluctant to sign off on it.
In 41 states, parents must consent for minors under age 18 to receive a COVID-19 vaccine. One state—Nebraska—requires parental consent for individuals under age 19, according to the Kaiser Family Foundation. Healthcare workers can't legally give teens COVID-19 vaccines otherwise. In a May report, the nonprofit healthcare organization highlights that from a legal perspective, "the landscape may be shifting slightly as more jurisdictions seek to encourage vaccination of young people."
Meanwhile, as the Delta variant creates a new surge in cases, some ethicists and pediatricians argue that state laws should be amended or loosened to allow minors to consent to COVID-19 vaccination on their own, without the need for parental permission.
"COVID-19 has killed millions of people around the world and disrupted the global economy," says pediatrician John Lantos. "It's a global catastrophe that requires special rules."
There are compelling arguments in favor of letting minors consent on their own, says Robyn Shapiro, a health care lawyer and a bioethicist in the Milwaukee area. "By that, I mean they're either old enough or they're evaluated in such a way that they have sufficient understanding of what they're agreeing to."
Shapiro and other ethicists argue that teens are perfectly capable of giving "informed consent"—a key principle in ethics that means fully understanding the benefits and risks of a medical intervention. To give informed consent, a person must be able to process that information in line with their own values. Only then can they make an autonomous choice and sign a consent form, Shapiro says.
Most states already have laws permitting minors to consent to testing and treatments related to sexually transmitted diseases, birth control, behavioral health, and substance abuse. It wouldn't be that much of a stretch to add COVID-19 vaccination to the list, Shapiro says. New Jersey and New York have introduced bills to let teens as young as 14 to consent to getting the COVID-19 vaccine and Minnesota has proposed a bill to allow children as young as 12 to give consent.
With any medical test or intervention, doctors often wrestle with how to best involve teens in conversations about their own health care, says John Lantos, a pediatrician and director of the Bioethics Center at Children's Mercy Kansas City.
"Most bioethicists would say that [teens] should be included to the degree that they have decision-making capacity," he says. "In most cases, that means including them in discussions with their parents in trying to achieve consensus about what the best choice may be."
COVID-19 vaccination also presents a unique circumstance, Lantos notes. It raises the question: Should teens have greater decisional authority because it's a public health emergency? In his opinion, the answer is yes. "COVID-19 has killed millions of people around the world and disrupted the global economy," says pediatrician Lantos. "It's a global catastrophe that requires special rules."
In North Carolina, state legislators are moving to do the opposite. State law currently allows those under 18 to make vaccination decisions on their own, but on Aug. 5, North Carolina's General Assembly approved a Republican-sponsored bill requiring parental consent for 12- to 17-year-olds to get a COVID-19 vaccine.
Kyle Brothers, a pediatrician in Louisville, Kentucky, says it's "ethically justifiable" for states to permit adolescents, especially those on the verge of adulthood, to consent to COVID-19 vaccination and other straightforward medical care.
In many cases, 16- and 17-year-old adolescents are capable of making well-informed decisions, says Brothers, a member of the American Academy of Pediatrics' Section on Bioethics. "The problem is, the law tends not to have that level of nuance," he adds. "We know in the real world that maturing and developing the ability to make decisions is a continuous process, but the law sets a bright line at age 18."
Lacking parental consent, some defiant teens are researching avenues to get vaccinated without their mom's or dad's knowledge. They may have turned to VaxTeen.org, a site operated by a Los Angeles teenager that provides information on consent laws by state.
If parents are wavering on the decision to give consent, Breuner recommends that they speak with a trusted healthcare provider about their specific concerns. These kinds of dialogues often can clarify lingering worries and may help drive up consent rates for teen vaccination.
Vaccine-hesitant parents should hear out their teens who wish to be vaccinated. Teenagers have their own opinions and belief systems, and parents should respect their child's choice to be vaccinated if they wish, considering the minimal risk of harm and the significant benefit to society as a whole.
George J. Annas, professor and director at the Center for Health Law, Ethics & Human Rights at Boston University, says parents have a legal obligation to provide their children with necessary medical treatment, or they could be found guilty of child neglect. The circumstances vary, but in the face of unrelenting COVID-19, he says parents have an ethical duty to consent to teens' vaccination because "the disease is rampant and children are dying."
The Nose Knows: Dogs Are Being Trained to Detect the Coronavirus
Asher is eccentric and inquisitive. He loves an audience, likes keeping busy, and howls to be let through doors. He is a six-year-old working Cocker Spaniel, who, with five other furry colleagues, has now been trained to sniff body odor samples from humans to detect COVID-19 infections.
As the Delta variant and other new versions of the SARS-CoV-2 virus emerge, public health agencies are once again recommending masking while employers contemplate mandatory vaccination. While PCR tests remain the "gold standard" of COVID-19 tests, they can take hours to flag infections. To accelerate the process, scientists are turning to a new testing tool: sniffer dogs.
At the London School of Hygiene and Tropical Medicine (LSHTM), researchers deployed Asher and five other trained dogs to test sock samples from 200 asymptomatic, infected individuals and 200 healthy individuals. In May, they published the findings of the yearlong study in a preprint, concluding that dogs could identify COVID-19 infections with a high degree of accuracy – they could correctly identify a COVID-positive sample up to 94% of the time and a negative sample up to 92% of the time. The paper has yet to be peer-reviewed.
"Dogs can screen lots of people very quickly – 300 people per dog per hour. This means they could be used in places like airports or public venues like stadiums and maybe even workplaces," says James Logan, who heads the Department of Disease Control at LSHTM, adding that canines can also detect variants of SARS-CoV-2. "We included samples from two variants and the dogs could still detect them."
Detection dogs have been one of the most reliable biosensors for identifying the odor of human disease. According to Gemma Butlin, a spokesperson of Medical Detection Dogs, the UK-based charity that trained canines for the LSHTM study, the olfactory capabilities of dogs have been deployed to detect malaria, Parkinson's disease, different types of cancers, as well as pseudomonas, a type of bacteria known to cause infections in blood, lungs, eyes, and other parts of the human body.
COVID-19 has a distinctive smell — a result of chemicals known as volatile organic compounds released by infected body cells, which give off an odor "fingerprint."
"It's estimated that the percentage of a dog's brain devoted to analyzing odors is 40 times larger than that of a human," says Butlin. "Humans have around 5 million scent receptors dedicated to smell. Dogs have 350 million and can detect odors at parts per trillion. To put this into context, a dog can detect a teaspoon of sugar in a million gallons of water: two Olympic-sized pools full."
According to LSHTM scientists, COVID-19 has a distinctive smell — a result of chemicals known as volatile organic compounds released by infected body cells, which give off an odor "fingerprint." Other studies, too, have revealed that the SARS-CoV-2 virus has a distinct olfactory signature, detectable in the urine, saliva, and sweat of infected individuals. Humans can't smell the disease in these fluids, but dogs can.
"Our research shows that the smell associated with COVID-19 is at least partly due to small and volatile chemicals that are produced by the virus growing in the body or the immune response to the virus or both," said Steve Lindsay, a public health entomologist at Durham University, whose team collaborated with LSHTM for the study. He added, "There is also a further possibility that dogs can actually smell the virus, which is incredible given how small viruses are."
In April this year, researchers from the University of Pennsylvania and collaborators published a similar study in the scientific journal PLOS One, revealing that detection dogs could successfully discriminate between urine samples of infected and uninfected individuals. The accuracy rate of canines in this study was 96%. Similarly, last December, French scientists found that dogs were 76-100% effective at identifying individuals with COVID-19 when presented with sweat samples.
Grandjean Dominique, a professor at France's National Veterinary School of Alfort, who led the French study, said that the researchers used two types of dogs — search and rescue dogs, as they can sniff sweat, and explosive detection dogs, because they're often used at airports to find bomb ingredients. Dogs may very well be as good as PCR tests, said Dominique, but the goal, he added, is not to replace these tests with canines.
In France, the government gave the green light to train hundreds of disease detection dogs and deploy them in airports. "They will act as mass pre-test, and only people who are positive will undergo a PCR test to check their level of infection and the kind of variant," says Dominique. He thinks the dogs will be able to decrease the amount of PCR testing and potentially save money.
Since the accuracy rate for bio-detection dogs is fairly high, scientists think they could prove to be a quick diagnosis and mass screening tool, especially at ports, airports, train stations, stadiums, and public gatherings. Countries like Finland, Thailand, UAE, Italy, Chile, India, Australia, Pakistan, Saudi Arabia, Switzerland, and Mexico are already training and deploying canines for COVID-19 detection. The dogs are trained to sniff the area around a person, and if they find the odor of COVID-19 they will sit or stand back from an individual as a signal that they've identified an infection.
While bio-detection dogs seem promising for cheap, large-volume screening, many of the studies that have been performed to date have been small and in controlled environments. The big question is whether this approach work on people in crowded airports, not just samples of shirts and socks in a lab.
"The next step is 'real world' testing where they [canines] are placed in airports to screen people and see how they perform," says Anna Durbin, professor of international health at the John Hopkins Bloomberg School of Public Health. "Testing in real airports with lots of passengers and competing scents will need to be done."
According to Butlin of Medical Detection Dogs, scalability could be a challenge. However, scientists don't intend to have a dog in every waiting room, detecting COVID-19 or other diseases, she said.
"Dogs are the most reliable bio sensors on the planet and they have proven time and time again that they can detect diseases as accurately, if not more so, than current technological diagnostics," said Butlin. "We are learning from them all the time and what their noses know will one day enable the creation an 'E-nose' that does the same job – imagine a day when your mobile phone can tell you that you are unwell."