Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
A hacker activating a 3D rendering of DNA data.
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
The Troubling Reason I Obsessively Researched My Pregnancy
A pregnant woman in her third trimester.
At the end of my second trimester of pregnancy, I answered a call from an unknown number.
To be pregnant is to exist on a never-ending receiving line of advice, whether we want it or not.
"I know your due date is approaching," said a stranger at the other end of the line, completely freaking me out. She identified herself as being from Natera, a company that my doctor had used for genetic testing I had consented to months ago.
"Excuse me?" I said.
"Have you considered cord-blood banking?" she said.
"No, I'm not doing that," I said. I had read enough about cord-blood banking, the process of saving stem cell-containing blood from your baby's umbilical cord, to understand that my family was in the vast majority of those that would with extremely high likelihood derive no medical benefit from it. Of course, in the societally sanctioned spending spree that accompanies new parenthood, plenty of companies are happy to charge anyone hundreds if not thousands of dollars plus annual storage fees to collect and manage your cord blood.
"Why not? Have you considered all the bene—"
"I'm not doing it and I don't want to explain my decision," I said before hanging up. I would later learn I neglected to check a miniscule box on my testing consent forms at the doctor to opt out of solicitations. Still, I was angry that I was being telemarketed unnecessary and costly medical services by someone who had been trained to immediately call my judgment into question. I was annoyed that my doctor's office would allow such intrusions at all. When I asked my OB about it at my next visit, she told me there's no way Natera would have gotten my information from them. Apparently even she didn't realize what was on those forms.
The incident with Natera did nothing to heighten my trust of the medical establishment during my pregnancy. I was hardly alone. Almost every mom I knew had expressed a similar sentiment.
"I don't trust doctors," read the text of a loved one when I told her I would probably get an epidural after my doctor recommended getting one because, she said, it can help relax the pelvic muscles during labor. But this friend, a highly educated woman who had had done her research and had two unmedicated births, believed firmly otherwise. "Look it up," she said. Thus commenced more of the furious Googling I found myself doing multiple times a day since deciding I wanted to become pregnant.
To be pregnant is to exist on a never-ending receiving line of advice, whether we want it or not. Information presents to us from Google's never-out-of-reach search bar, friends and family eager to use our pregnancies as an excuse to recall their own, and the doctor's office, where the wisdom of medical professionals neatly comingles with brochures and free samples from myriad companies that would really, really like our business as new moms. Separating the "good" advice from the rest is a Herculean task that many pregnant women manage only with vigorous fact-finding missions of their own.
The medical community in America is poorly equipped to help women navigate the enormous pressures that come with birth and transitioning to motherhood.
Doing my research during pregnancy felt like a defense against the scary unknowns, overabundance of opinions, and disturbing marketing schemes that come with entering parenthood. The medical community in America is poorly equipped to help women navigate the enormous emotional and societal pressures that come with birth and transitioning to motherhood. Too much of what pregnant women experience at the doctor has to do with dated ideas about our care, mandated by tradition or a fear of being sued rather than medical necessity. These practices, like weigh-ins at every appointment or medically unnecessary C-sections (which are estimated to account, horrifically, for almost 50 percent of all C-sections performed in the U.S.), only heighten anxiety.
Meanwhile, things that might alleviate stress – like having thorough discussions about the kinds of interventions we might be asked to accept at the hospital during labor and delivery – are left to outside educators and doulas that insurance plans typically don't cover. The net effect isn't better health outcomes for mom and baby, but rather a normalized sense of distrust many American women feel toward their OBGYNs, and the burden of going to every appointment and the delivery room on the defensive. Instead of being wed to dated medical practices and tangled in America's new motherhood industrial complex, shouldn't our doctors, of all people, be our biggest advocates?
As soon as I found out I was pregnant, I devoured Expecting Better, by Emily Oster, an economist who embarked on her own fact-finding mission during her first pregnancy, predicated on the belief that the advice OBGYNs have been giving pregnant women for decades is out of date and unnecessarily restrictive. The book includes controversial stances, like that having small amounts of alcohol while pregnant is OK. (More recent research has called this view into question.) Oster writes that for the vast majority of pregnant women, it's perfectly fine to lie on your back, do sit-ups, and eat Brie — all things I was relieved to learn I wouldn't have to give up for nine months, despite the traditional advice, which my doctor also gave to me.
Oster recommends hiring a doula, based both on research and personal experience. It's a worthwhile investment for those who can afford it: according to one study, 20.4 percent of laboring women with doulas had C-sections compared with 34.2 percent of women without them. A doula can do many things for a pregnant client, including helping her write a birth plan, massaging her back in labor, and cheering her on, which is especially useful for women who plan to labor without pain medication. Use of doulas is on the rise; according to DONA International, the world's largest and oldest doula association, the number of doulas who have been certified to date is over 12,000, up from 2,000 in 2002.
But the most significant role a doula plays is that of patient advocate in the hospital. This is a profound commentary on the way the medical establishment handles childbirth, a medical event that 86 percent of women aged 40 to 44 had gone through as of 2016. Recognizing the maternal mortality crisis in the U.S., where women are far more likely to die as a result of childbirth than anywhere else in the developed world and black women are three times more likely to die in childbirth than white women, a few states now allow Medicaid to cover doulas. Can you imagine feeling the need to hire an independent non-medical care provider to help you run interference with your doctors and nurses for something like an appendectomy?
I wouldn't have been aware of all the imminent interventions during my labor if my doula hadn't told me about them. Things happen fast in the hospital and doctors and nurses may rush patients to consent before proceeding with things like breaking their water or hooking them up to an IV of Pitocin. Only because my husband and I had spent six hours in birth class — a suggestion by my doula — did I realize that I was empowered to say "no" to such procedures.
Expecting more trustworthy advice to come from my doctor than books or Google or even a doula hardly seems unreasonable.
Of course, we all feel immense pressure to become good parents, and questioning conventional medical wisdom is a natural response to that pressure. "Looking around at the world and saying, who am I as a parent? What is important to me? Who are the wise people? What do I think wisdom is? What is a good decision? If you're a certain type of introspective person, if you're really asking those questions, that's going to include like taking a second look at things that doctors, for example, say," says Koyuki Smith, a doula and birth educator.
Expecting more trustworthy advice to come from my doctor than books or Google or even a doula hardly seems unreasonable. Yet my doctor's office seemed more concerned with checking off a list of boxes rather than providing me with personalized care that might have relieved my understandable anxiety about my first birth. When I still hadn't gone into labor around the time of my due date, my doctor encouraged me to be induced because my baby appeared to be large. I declined but scheduled an induction to "hold my spot" around the 42-week mark.
When I asked what medication would be used for an induction if I had one and she said Cytotec, I told her I had read that drug could cause serious complications, but she dismissed my concerns after I told her they stemmed from a book I read on natural childbirth. The FDA's page on Cytotec isn't exactly reassuring.
The nurse who took me in triage after I went into labor a week past my due date practically scolded me for waiting to go into labor naturally instead of opting for induction sooner. My doula told her while I was struggling to speak through labor pains to get off my case about it. I hadn't even become a mom and I was already doing so many things "wrong." Because I had done my own reading, I felt confident that my choices weren't harming my baby or me.
Becoming a mom would be less daunting if the medical community found a way to help women navigate the pressures of motherhood instead of adding to them. "Our culture at large doesn't support women enough in the complicated emotions that are a part of this process," said Alexandra Saks, a reproductive psychologist and author of What No One Tells You: A Guide to Your Emotions From Pregnancy to Motherhood. "I hope that every practitioner that works with women around reproductive health prioritizes her emotions around her experience."
For many of us, that will mean doctors who help us understand the pros and cons of conventional advice, don't use their offices as marketing channels, and don't pressure women into medically unnecessary inductions. Moms should also receive more attention after delivery both in the hospital and after they get home; a single, quick postpartum visit at six weeks is not an adequate way to care for women recovering from the trauma of childbirth, nor is it an adequate way to ensure women are emotionally supported during the transition. While several people interrogated me about my mental health at the hospital and my doctor's office just before and after birth, if I had been concerned about postpartum depression, I can't imagine feeling comfortable enough in those moments to tell strangers filling out obligatory worksheets.
It also means figuring out how to talk to patients who are prone to Googling their pregnancies with gusto every single day. It would be impossible for many women to shun independent research during pregnancy altogether. But it would also be nice if our doctors didn't add to our impulse to do it.
“Coming Back from the Dead” Is No Longer Science Fiction
A man receiving cardiopulmonary resuscitation (CPR).
Last year, there were widespread reports of a 53-year-old Frenchman who had suffered a cardiac arrest and "died," but was then resuscitated back to life 18 hours after his heart had stopped.
The once black-and-white line between life and death is now blurrier than ever.
This was thought to have been possible in part because his body had progressively cooled down naturally after his heart had stopped, through exposure to the outside cold. The medical team who revived him were reported as being "stupefied" that they had been able to bring him back to life, in particular since he had not even suffered brain damage.
Interestingly, this man represents one of a growing number of extraordinary cases in which people who would otherwise be declared dead have now been revived. It is a testament to the incredible impact of resuscitation science -- a science that is providing opportunities to literally reverse death, and in doing so, shedding light on the age-old question of what happens when we die.
Death: Past and Present
Throughout history, the boundary between life and death was marked by the moment a person's heart stopped, breathing ceased, and brain function shut down. A person became motionless, lifeless, and was deemed irreversibly dead. This is because once the heart stops beating, blood flow stops and oxygen is cut off from all the body's organs, including the brain. Consequently, within seconds, breathing stops and brain activity comes to a halt. Since the cessation of the heart literally occurs in a "moment," the philosophical notion of a specific point in time of "irreversible" death still pervades society today. The law, for example, relies on "time of death," which corresponds to when the heart stops beating.
The advent of cardiopulmonary resuscitation (CPR) in the 1960s was revolutionary, demonstrating that the heart could potentially be restarted after it had stopped, and what had been a clear black-and-white line was shown to be potentially reversible in some people. What was once called death—the ultimate end point— was now widely called cardiac arrest, and became a starting point.
From then on, it was only if somebody had requested not to be resuscitated or when CPR was deemed to have failed that people would be declared dead by "cardiopulmonary criteria." Biologically, cardiac arrest and death by cardiopulmonary criteria are the same process, albeit marked at different points in time depending on when a declaration of death is made.
The apparent irreversibility of death as we know it may not necessarily reflect true irretrievable cellular damage inside the body.
Clearly, contrary to many people's perceptions, cardiac arrest is not a heart attack; it is the final step in death irrespective of cause, whether it be a stroke, a heart attack, a car accident, an overwhelming infection or cancer. This is how roughly 95 percent of the population are declared dead.
The only exception is the small proportion of people who may have suffered catastrophic brain injuries, but whose hearts can be artificially kept beating for a period of time on life-support machines. These people can be legally declared dead based on brain death criteria before their hearts have stopped. This is because the brain can die either from oxygen starvation after cardiac arrest or from massive trauma and internal bleeding. Either way, the brain dies hours or possibly longer after these injuries have taken place and not just minutes.
A Profound Realization
What has become increasingly clear is that the apparent irreversibility of death as we know it may not necessarily reflect true irretrievable cellular damage inside the body. This is consistent with a mounting understanding: it is only after a person actually dies that the cells in the body start to undergo their own process of death. Intriguingly, this process is something that can now be manipulated through medical intervention. Being cold is one of the factors that slows down the rate of cellular decay. The 53-year-old Frenchman's case and the other recent cases of resuscitation after prolonged periods of time illustrate this new understanding.
Last week's earth-shattering announcement by neuroscientist Dr. Nenad Sestan and his team out of Yale, published in the prestigious scientific journal Nature, provides further evidence that a time gap exists between actual death and cellular death in cadavers. In this seminal study, these researchers were able to restore partial function in pig brains four hours after their heads were severed from their bodies. These results follow from the pioneering work in 2001 of geneticist Fred Gage and colleagues from the Salk Institute, also published in Nature, which demonstrated the possibility of growing human brain cells in the laboratory by taking brain biopsies from cadavers in the mortuary up to 21 hours post-mortem.
The once black-and-white line between life and death is now blurrier than ever. Some people may argue this means these humans and pigs weren't truly "dead." However, that is like saying the people who were guillotined during the French Revolution were also not dead. Clearly, that is not the case. They were all dead. The problem is not death; it's our reliance on an outdated philosophical, rather than biological, notion of death.
Death can no longer be considered an absolute moment but rather a process that can be reversed even many hours after it has taken place.
But the distinction between irreversibility from a medical perspective and biological irreversibility may not matter much from a pragmatic perspective today. If medical interventions do not exist at any given time or place, then of course death cannot be reversed.
However, it is crucial to distinguish between biologically and medically: When "irreversible" loss of function arises due to inadequate treatment, then a person could be potentially brought back in the future when an alternative therapy becomes available, or even today if he or she dies in a location where novel treatments can slow down the rate of cell death. However, when true irreversible loss of function arises from a biological perspective, then no treatment will ever be able to reverse the process, whether today, tomorrow, or in a hundred years.
Probing the "Grey Zone"
Today, thanks to modern resuscitation science, death can no longer be considered an absolute moment but rather a process that can be reversed even many hours after it has taken place. How many hours? We don't really know.
One of the wider implications of our medical advances is that we can now study what happens to the human mind and consciousness after people enter the "grey zone," which marks the time after the heart stops, but before irreversible and irretrievable cell damage occurs, and people are then brought back to life. Millions have been successfully revived and many have reported experiencing a unique, universal, and transformative mental state.
Were they "dead"? Yes, according to all the criteria we have ever used. But they were able to be brought back before their "dead" bodies had reached the point of permanent, irreversible cellular damage. This reflects the period of death for all of us. So rather than a "near-death experience," I prefer a new terminology to describe these cases -- "an actual-death experience." These survivors' unique experiences are providing eyewitness testimonies of what we will all be likely to experience when we die.
Such an experience reportedly includes seeing a warm light, the presence of a compassionate perfect individual, deceased relatives, a review of their lives, a judgment of their actions and intentions as they pertain to their humanity, and in some cases a sensation of seeing doctors and nurses working to resuscitate them.
Are these experiences compatible with hallucinations or illusions? No -- in part, because these people have described real, verifiable events, which, by definition are not hallucinations, and in part, because their experiences are not compatible with confused and delirious memories that characterize oxygen deprivation.
The challenge for us scientifically is understanding how this is possible at a time when all our science tells us the brain shuts down.
For instance, it is hard to classify a structured meaningful review of one's life and one's humanity as hallucinatory or illusory. Instead, these experiences represent a new understanding of the overall human experience of death. As an intensive care unit physician for more than 10 years, I have seen numerous cases where these reports have been corroborated by my colleagues. In short, these survivors have been known to come back with reports of full consciousness, with lucid, well-structured thought processes and memory formation.
The challenge for us scientifically is understanding how this is possible at a time when all our science tells us the brain shuts down. The fact that these experiences occur is a paradox and suggests the undiscovered entity we call the "self," "consciousness," or "psyche" – the thing that makes us who we are - may not become annihilated at the point of so-called death.
At New York University, the State University of New York, and across 20 hospitals in the U.S. and Europe, we have brought together a new multi-disciplinary team of experts across many specialties, including neurology, cardiology, and intensive care. Together, we hope to improve cardiac arrest prevention and treatment, as well as to address the impact of new scientific discoveries on our understanding of what happens at death.
One of our first studies, Awareness during Resuscitation (AWARE), published in the medical journal Resuscitation in 2014, confirmed that some cardiac arrest patients report a perception of awareness without recall; others report detailed memories and experiences; and a few report full auditory and visual awareness and consciousness of their experience, from a time when brain function would be expected to have ceased.
While you probably have some opinion or belief about this based upon your own philosophical, religious, or cultural background, you may not realize that exploring what happens when we die is now a subject that science is beginning to investigate.
There is no question more intriguing to humankind. And for the first time in our history, we may finally uncover some real answers.