Shifting ownership, shifting protections: Patient privacy and genetic data ownership in the era of mergers and acquisitions

Genetic data, more than ever, are a sought-after asset, often transferred or repurposed under broad privacy policies with limited transparency and passive consent. With the increasing frequency of company mergers and acquisitions within the genetics and genomics industry, growing and underacknowledged risks to patient data privacy have emerged. Though informed consent is a foundational element of clinical genetics, our current process rarely addresses what happens to patient data during business transitions. Regulatory frameworks such as the Health Insurance Portability and Accountability Act (HIPAA) and the Genetic Information Nondiscrimination Act (GINA) provide limited protections; neither governs how de-identified data are handled, nor do they adequately regulate data transfers during business transitions. This article examines how prominent genetic testing companies address changes in data ownership in their privacy policies and consent forms and traces intercompany relationships to highlight how corporate restructuring can quietly alter who holds and controls patient data. As data sets are increasingly combined within our digital health ecosystem and possibly paired with consumer-generated and publicly accessible information, machine learning now enables re-identification in ways unimaginable to the framers of HIPAA and GINA and at a pace that surpasses our ability to revise or enact protective legislation. As genetic data continues to be a highly valuable asset, genetic counselors must incorporate privacy and ownership as essential parts of informed consent. Although no single counseling model can cover every potential risk that needs to be discussed, overlooking these issues leaves patients unaware of how their data might be used, shared, or sold in the future.