Bad Actors Getting Your Health Data Is the FBI’s Latest Worry
In February 2015, the health insurer Anthem revealed that criminal hackers had gained access to the company's servers, exposing the personal information of nearly 79 million patients. It's the largest known healthcare breach in history.
FBI agents worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks.
That year, the data of millions more would be compromised in one cyberattack after another on American insurers and other healthcare organizations. In fact, for the past several years, the number of reported data breaches has increased each year, from 199 in 2010 to 344 in 2017, according to a September 2018 analysis in the Journal of the American Medical Association.
The FBI's Edward You sees this as a worrying trend. He says hackers aren't just interested in your social security or credit card number. They're increasingly interested in stealing your medical information. Hackers can currently use this information to make fake identities, file fraudulent insurance claims, and order and sell expensive drugs and medical equipment. But beyond that, a new kind of cybersecurity threat is around the corner.
Mr. You and others worry that the vast amounts of healthcare data being generated for precision medicine efforts could leave the U.S. vulnerable to cyber and biological attacks. In the wrong hands, this data could be used to exploit or extort an individual, discriminate against certain groups of people, make targeted bioweapons, or give another country an economic advantage.
Precision medicine, of course, is the idea that medical treatments can be tailored to individuals based on their genetics, environment, lifestyle or other traits. But to do that requires collecting and analyzing huge quantities of health data from diverse populations. One research effort, called All of Us, launched by the U.S. National Institutes of Health last year, aims to collect genomic and other healthcare data from one million participants with the goal of advancing personalized medical care.
Other initiatives are underway by academic institutions and healthcare organizations. Electronic medical records, genetic tests, wearable health trackers, mobile apps, and social media are all sources of valuable healthcare data that a bad actor could potentially use to learn more about an individual or group of people.
"When you aggregate all of that data together, that becomes a very powerful profile of who you are," Mr. You says.
A supervisory special agent in the biological countermeasures unit within the FBI's weapons of mass destruction directorate, it's Mr. You's job to imagine worst-case bioterror scenarios and figure out how to prevent and prepare for them.
That used to mean focusing on threats like anthrax, Ebola, and smallpox—pathogens that could be used to intentionally infect people—"basically the dangerous bugs," as he puts it. In recent years, advances in gene editing and synthetic biology have given rise to fears that rogue, or even well-intentioned, scientists could create a virulent virus that's intentionally, or unintentionally, released outside the lab.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that."
While Mr. You is still tracking those threats, he's been traveling around the country talking to scientists, lawyers, software engineers, cyber security professionals, government officials and CEOs about new security threats—those posed by genetic and other biological data.
Emerging threats
Mr. You says one possible situation he can imagine is the potential for nefarious actors to use an individual's sensitive medical information to extort or blackmail that person.
"If a foreign source, especially a criminal one, has your biological information, then they might have some particular insights into what your future medical needs might be and exploit that," he says. For instance, "what happens if you have a singular medical condition and an outside entity says they have a treatment for your condition?" You could get talked into paying a huge sum of money for a treatment that ends up being bogus.
Or what if hackers got a hold of a politician or high-profile CEO's health records? Say that person had a disease-causing genetic mutation that could affect their ability to carry out their job in the future and hackers threatened to expose that information. These scenarios may seem far-fetched, but Mr. You thinks they're becoming increasingly plausible.
On a wider scale, Kavita Berger, a scientist at Gryphon Scientific, a Washington, D.C.-area life sciences consulting firm, worries that data from different populations could be used to discriminate against certain groups of people, like minorities and immigrants.
For instance, the advocacy group Human Rights Watch in 2017 flagged a concerning trend in China's Xinjiang territory, a region with a history of government repression. Police there had purchased 12 DNA sequencers and were collecting and cataloging DNA samples from people to build a national database.
"The concern is that this particular province has a huge population of the Muslim minority in China," Ms. Berger says. "Now they have a really huge database of genetic sequences. You have to ask, why does a police station need 12 next-generation sequencers?"
Also alarming is the potential that large amounts of data from different groups of people could lead to customized bioweapons if that data ends up in the wrong hands.
Eleonore Pauwels, a research fellow on emerging cybertechnologies at United Nations University's Centre for Policy Research, says new insights gained from genomic and other data will give scientists a better understanding of how diseases occur and why certain people are more susceptible to certain diseases.
"As you get more and more knowledge about the genomic picture and how the microbiome and the immune system of different populations function, you could get a much deeper understanding about how you could target different populations for treatment but also how you could eventually target them with different forms of bioagents," Ms. Pauwels says.
Economic competitiveness
Another reason hackers might want to gain access to large genomic and other healthcare datasets is to give their country a leg up economically. Many large cyber-attacks on U.S. healthcare organizations have been tied to Chinese hacking groups.
"This is a biological space race and we just haven't woken up to the fact that we're in this race."
"It's becoming clear that China is increasingly interested in getting access to massive data sets that come from different countries," Ms. Pauwels says.
A year after U.S. President Barack Obama conceived of the Precision Medicine Initiative in 2015—later renamed All of Us—China followed suit, announcing the launch of a 15-year, $9 billion precision health effort aimed at turning China into a global leader in genomics.
Chinese genomics companies, too, are expanding their reach outside of Asia. One company, WuXi NextCODE, which has offices in Shanghai, Reykjavik, and Cambridge, Massachusetts, has built an extensive library of genomes from the U.S., China and Iceland, and is now setting its sights on Ireland.
Another Chinese company, BGI, has partnered with Children's Hospital of Philadelphia and Sinai Health System in Toronto, and also formed a collaboration with the Smithsonian Institute to sequence all species on the planet. BGI has built its own advanced genomic sequencing machines to compete with U.S.-based Illumina.
Mr. You says having access to all this data could lead to major breakthroughs in healthcare, such as new blockbuster drugs. "Whoever has the largest, most diverse dataset is truly going to win the day and come up with something very profitable," he says.
Some direct-to-consumer genetic testing companies with offices in the U.S., like Dante Labs, also use BGI to process customers' DNA.
Experts worry that China could race ahead the U.S. in precision medicine because of Chinese laws governing data sharing. Currently, China prohibits the exportation of genetic data without explicit permission from the government. Mr. You says this creates an asymmetry in data sharing between the U.S. and China.
"This is a biological space race and we just haven't woken up to the fact that we're in this race," he said in January at an American Society for Microbiology conference in Washington, D.C. "We don't have access to their data. There is absolutely no reciprocity."
Protecting your data
While Mr. You has been stressing the importance of data security to anyone who will listen, the National Academies of Sciences, Engineering, and Medicine, which makes scientific and policy recommendations on issues of national importance, has commissioned a study on "safeguarding the bioeconomy."
In the meantime, Ms. Berger says organizations that deal with people's health data should assess their security risks and identify potential vulnerabilities in their systems.
As for what individuals can do to protect themselves, she urges people to think about the different ways they're sharing healthcare data—such as via mobile health apps and wearables.
"Ask yourself, what's the benefit of sharing this? What are the potential consequences of sharing this?" she says.
Mr. You also cautions people to think twice before taking consumer DNA tests. They may seem harmless, he says, but at the end of the day, most people don't know where their genetic information is going. "If your genetic sequence is taken, once it's gone, it's gone. There's nothing you can do about it."
Every year, around two million people worldwide die of liver disease. While some people inherit the disease, it’s most commonly caused by hepatitis, obesity and alcoholism. These underlying conditions kill liver cells, causing scar tissue to form until eventually the liver cannot function properly. Since 1979, deaths due to liver disease have increased by 400 percent.
The sooner the disease is detected, the more effective treatment can be. But once symptoms appear, the liver is already damaged. Around 50 percent of cases are diagnosed only after the disease has reached the final stages, when treatment is largely ineffective.
To address this problem, Owlstone Medical, a biotech company in England, has developed a breath test that can detect liver disease earlier than conventional approaches. Human breath contains volatile organic compounds (VOCs) that change in the first stages of liver disease. Owlstone’s breath test can reliably collect, store and detect VOCs, while picking out the specific compounds that reveal liver disease.
“There’s a need to screen more broadly for people with early-stage liver disease,” says Owlstone’s CEO Billy Boyle. “Equally important is having a test that's non-invasive, cost effective and can be deployed in a primary care setting.”
The standard tool for detection is a biopsy. It is invasive and expensive, making it impractical to use for people who aren't yet symptomatic. Meanwhile, blood tests are less invasive, but they can be inaccurate and can’t discriminate between different stages of the disease.
In the past, breath tests have not been widely used because of the difficulties of reliably collecting and storing breath. But Owlstone’s technology could help change that.
The team is testing patients in the early stages of advanced liver disease, or cirrhosis, to identify and detect these biomarkers. In an initial study, Owlstone’s breathalyzer was able to pick out patients who had early cirrhosis with 83 percent sensitivity.
Boyle’s work is personally motivated. His wife died of colorectal cancer after she was diagnosed with a progressed form of the disease. “That was a big impetus for me to see if this technology could work in early detection,” he says. “As a company, Owlstone is interested in early detection across a range of diseases because we think that's a way to save lives and a way to save costs.”
How it works
In the past, breath tests have not been widely used because of the difficulties of reliably collecting and storing breath. But Owlstone’s technology could help change that.
Study participants breathe into a mouthpiece attached to a breath sampler developed by Owlstone. It has cartridges are designed and optimized to collect gases. The sampler specifically targets VOCs, extracting them from atmospheric gases in breath, to ensure that even low levels of these compounds are captured.
The sampler can store compounds stably before they are assessed through a method called mass spectrometry, in which compounds are converted into charged atoms, before electromagnetic fields filter and identify even the tiniest amounts of charged atoms according to their weight and charge.
The top four compounds in our breath
In an initial study, Owlstone captured VOCs in breath to see which ones could help them tell the difference between people with and without liver disease. They tested the breath of 46 patients with liver disease - most of them in the earlier stages of cirrhosis - and 42 healthy people. Using this data, they were able to create a diagnostic model. Individually, compounds like 2-Pentanone and limonene performed well as markers for liver disease. Owlstone achieved even better performance by examining the levels of the top four compounds together, distinguishing between liver disease cases and controls with 95 percent accuracy.
“It was a good proof of principle since it looks like there are breath biomarkers that can discriminate between diseases,” Boyle says. “That was a bit of a stepping stone for us to say, taking those identified, let’s try and dose with specific concentrations of probes. It's part of building the evidence and steering the clinical trials to get to liver disease sensitivity.”
Sabine Szunerits, a professor of chemistry in Institute of Electronics at the University of Lille, sees the potential of Owlstone’s technology.
“Breath analysis is showing real promise as a clinical diagnostic tool,” says Szunerits, who has no ties with the company. “Owlstone Medical’s technology is extremely effective in collecting small volatile organic biomarkers in the breath. In combination with pattern recognition it can give an answer on liver disease severity. I see it as a very promising way to give patients novel chances to be cured.”
Improving the breath sampling process
Challenges remain. With more than one thousand VOCs found in the breath, it can be difficult to identify markers for liver disease that are consistent across many patients.
Julian Gardner is a professor of electrical engineering at Warwick University who researches electronic sensing devices. “Everyone’s breath has different levels of VOCs and different ones according to gender, diet, age etc,” Gardner says. “It is indeed very challenging to selectively detect the biomarkers in the breath for liver disease.”
So Owlstone is putting chemicals in the body that they know interact differently with patients with liver disease, and then using the breath sampler to measure these specific VOCs. The chemicals they administer are called Exogenous Volatile Organic Compound) probes, or EVOCs.
Most recently, they used limonene as an EVOC probe, testing 29 patients with early cirrhosis and 29 controls. They gave the limonene to subjects at specific doses to measure how its concentrations change in breath. The aim was to try and see what was happening in their livers.
“They are proposing to use drugs to enhance the signal as they are concerned about the sensitivity and selectivity of their method,” Gardner says. “The approach of EVOC probes is probably necessary as you can then eliminate the person-to-person variation that will be considerable in the soup of VOCs in our breath.”
Through these probes, Owlstone could identify patients with liver disease with 83 percent sensitivity. By targeting what they knew was a disease mechanism, they were able to amplify the signal. The company is starting a larger clinical trial, and the plan is to eventually use a panel of EVOC probes to make sure they can see diverging VOCs more clearly.
“I think the approach of using probes to amplify the VOC signal will ultimately increase the specificity of any VOC breath tests, and improve their practical usability,” says Roger Yazbek, who leads the South Australian Breath Analysis Research (SABAR) laboratory in Flinders University. “Whilst the findings are interesting, it still is only a small cohort of patients in one location.”
The future of breath diagnosis
Owlstone wants to partner with pharmaceutical companies looking to learn if their drugs have an effect on liver disease. They’ve also developed a microchip, a miniaturized version of mass spectrometry instruments, that can be used with the breathalyzer. It is less sensitive but will enable faster detection.
Boyle says the company's mission is for their tests to save 100,000 lives. "There are lots of risks and lots of challenges. I think there's an opportunity to really establish breath as a new diagnostic class.”
Bacterial antibiotic resistance has been a concern in the medical field for several years. Now a new, similar threat is arising: drug-resistant fungal infections. The Centers for Disease Control and Prevention considers antifungal and antimicrobial resistance to be among the world’s greatest public health challenges.
One particular type of fungal infection caused by Candida auris is escalating rapidly throughout the world. And to make matters worse, C. auris is becoming increasingly resistant to current antifungal medications, which means that if you develop a C. auris infection, the drugs your doctor prescribes may not work. “We’re effectively out of medicines,” says Thomas Walsh, founding director of the Center for Innovative Therapeutics and Diagnostics, a translational research center dedicated to solving the antimicrobial resistance problem. Walsh spoke about the challenges at a Demy-Colton Virtual Salon, one in a series of interactive discussions among life science thought leaders.
Although C. auris typically doesn’t sicken healthy people, it afflicts immunocompromised hospital patients and may cause severe infections that can lead to sepsis, a life-threatening condition in which the overwhelmed immune system begins to attack the body’s own organs. Between 30 and 60 percent of patients who contract a C. auris infection die from it, according to the CDC. People who are undergoing stem cell transplants, have catheters or have taken antifungal or antibiotic medicines are at highest risk. “We’re coming to a perfect storm of increasing resistance rates, increasing numbers of immunosuppressed patients worldwide and a bug that is adapting to higher temperatures as the climate changes,” says Prabhavathi Fernandes, chair of the National BioDefense Science Board.
Most Candida species aren’t well-adapted to our body temperatures so they aren’t a threat. C. auris, however, thrives at human body temperatures.
Although medical professionals aren’t concerned at this point about C. auris evolving to affect healthy people, they worry that its presence in hospitals can turn routine surgeries into life-threatening calamities. “It’s coming,” says Fernandes. “It’s just a matter of time.”
An emerging global threat
“Fungi are found in the environment,” explains Fernandes, so Candida spores can easily wind up on people’s skin. In hospitals, they can be transferred from contact with healthcare workers or contaminated surfaces. Most Candida species aren’t well-adapted to our body temperatures so they aren’t a threat. C. auris, however, thrives at human body temperatures. It can enter the body during medical treatments that break the skin—and cause an infection. Overall, fungal infections cost some $48 billion in the U.S. each year. And infection rates are increasing because, in an ironic twist, advanced medical therapies are enabling severely ill patients to live longer and, therefore, be exposed to this pathogen.
The first-ever case of a C. auris infection was reported in Japan in 2009, although an analysis of Candida samples dated the earliest strain to a 1996 sample from South Korea. Since then, five separate varieties – called clades, which are similar to strains among bacteria – developed independently in different geographies: South Asia, East Asia, South Africa, South America and, recently, Iran. So far, C. auris infections have been reported in 35 countries.
In the U.S., the first infection was reported in 2016, and the CDC started tracking it nationally two years later. During that time, 5,654 cases have been reported to the CDC, which only tracks U.S. data.
What’s more notable than the number of cases is their rate of increase. In 2016, new cases increased by 175 percent and, on average, they have approximately doubled every year. From 2016 through 2022, the number of infections jumped from 63 to 2,377, a roughly 37-fold increase.
“This reminds me of what we saw with epidemics from 2013 through 2020… with Ebola, Zika and the COVID-19 pandemic,” says Robin Robinson, CEO of Spriovas and founding director of the Biomedical Advanced Research and Development Authority (BARDA), which is part of the U.S. Department of Health and Human Services. These epidemics started with a hockey stick trajectory, Robinson says—a gradual growth leading to a sharp spike, just like the shape of a hockey stick.
Another challenge is that right now medics don’t have rapid diagnostic tests for fungal infections. Currently, patients are often misdiagnosed because C. auris resembles several other easily treated fungi. Or they are diagnosed long after the infection begins and is harder to treat.
The problem is that existing diagnostics tests can only identify C. auris once it reaches the bloodstream. Yet, because this pathogen infects bodily tissues first, it should be possible to catch it much earlier before it becomes life-threatening. “We have to diagnose it before it reaches the bloodstream,” Walsh says.
The most alarming fact is that some Candida infections no longer respond to standard therapeutics.
“We need to focus on rapid diagnostic tests that do not rely on a positive blood culture,” says John Sperzel, president and CEO of T2 Biosystems, a company specializing in diagnostics solutions. Blood cultures typically take two to three days for the concentration of Candida to become large enough to detect. The company’s novel test detects about 90 percent of Candida species within three to five hours—thanks to its ability to spot minute quantities of the pathogen in blood samples instead of waiting for them to incubate and proliferate.
Unlike other Candida species C. auris thrives at human body temperatures
Adobe Stock
Tackling the resistance challenge
The most alarming fact is that some Candida infections no longer respond to standard therapeutics. The number of cases that stopped responding to echinocandin, the first-line therapy for most Candida infections, tripled in 2020, according to a study by the CDC.
Now, each of the first four clades shows varying levels of resistance to all three commonly prescribed classes of antifungal medications, such as azoles, echinocandins, and polyenes. For example, 97 percent of infections from C. auris Clade I are resistant to fluconazole, 54 percent to voriconazole and 30 percent of amphotericin. Nearly half are resistant to multiple antifungal drugs. Even with Clade II fungi, which has the least resistance of all the clades, 11 to 14 percent have become resistant to fluconazole.
Anti-fungal therapies typically target specific chemical compounds present on fungi’s cell membranes, but not on human cells—otherwise the medicine would cause damage to our own tissues. Fluconazole and other azole antifungals target a compound called ergosterol, preventing the fungal cells from replicating. Over the years, however, C. auris evolved to resist it, so existing fungal medications don’t work as well anymore.
A newer class of drugs called echinocandins targets a different part of the fungal cell. “The echinocandins – like caspofungin – inhibit (a part of the fungi) involved in making glucan, which is an essential component of the fungal cell wall and is not found in human cells,” Fernandes says. New antifungal treatments are needed, she adds, but there are only a few magic bullets that will hit just the fungus and not the human cells.
Research to fight infections also has been challenged by a lack of government support. That is changing now that BARDA is requesting proposals to develop novel antifungals. “The scope includes C. auris, as well as antifungals following a radiological/nuclear emergency, says BARDA spokesperson Elleen Kane.
The remaining challenge is the number of patients available to participate in clinical trials. Large numbers are needed, but the available patients are quite sick and often die before trials can be completed. Consequently, few biopharmaceutical companies are developing new treatments for C. auris.
ClinicalTrials.gov reports only two drugs in development for invasive C. auris infections—those than can spread throughout the body rather than localize in one particular area, like throat or vaginal infections: ibrexafungerp by Scynexis, Inc., fosmanogepix, by Pfizer.
Scynexis’ ibrexafungerp appears active against C. auris and other emerging, drug-resistant pathogens. The FDA recently approved it as a therapy for vaginal yeast infections and it is undergoing Phase III clinical trials against invasive candidiasis in an attempt to keep the infection from spreading.
“Ibreafungerp is structurally different from other echinocandins,” Fernandes says, because it targets a different part of the fungus. “We’re lucky it has activity against C. auris.”
Pfizer’s fosmanogepix is in Phase II clinical trials for patients with invasive fungal infections caused by multiple Candida species. Results are showing significantly better survival rates for people taking fosmanogepix.
Although C. auris does pose a serious threat to healthcare worldwide, scientists try to stay optimistic—because they recognized the problem early enough, they might have solutions in place before the perfect storm hits. “There is a bit of hope,” says Robinson. “BARDA has finally been able to fund the development of new antifungal agents and, hopefully, this year we can get several new classes of antifungals into development.”