Forensic genetics in the shadows

Abstract

This article examines the controversial practice of law enforcement agencies searching genetic samples obtained in health care settings, without a warrant or consent. While police have previously used public genealogy databases for this purpose, our article describes how they are now secretly accessing genetic information from newborn screening programs and medical tests. This raises ethical and legal concerns, blurring the line between health care and law enforcement. This, in turn, may discourage people from seeking important medical care due to distrust in the police and privacy concerns. To explore public attitudes on this issue, the authors conducted a study examining how lay people view the forensic use of clinical genetic data for different types of crimes. Our findings suggest that people take a utilitarian perspective, where they are more likely to support warrantless searches for serious and ongoing crimes but more likely to oppose these searches for more minor offenses like theft. However, regardless of public support, the little-known practice undermines trust in health care institutions and violates patient privacy. We recommend three legal reforms to restrict law enforcement access to clinical and public health genetic databases and to require explicit consent to forensic uses.

I. INTRODUCTION

In the last decade, law enforcement agencies in the USA have been relying on novel sources of forensic genetics to solve crimes. Specifically, agencies have leveraged large-scale genetic and genealogical databases to put a name to an anonymous tissue, bone, or blood sample.¹ This method is called ‘investigative genetic genealogy’ (IGG), and it has been criticized by the media and legal scholars for potential privacy violations.² However, in most reported cases where the police use IGG, they rely on online public databases where consumers have voluntarily uploaded their genetic profiles. In this article, we will explain how police are also secretly relying on much more private genetic information, contained in public health databases or ordered by a physician.

This use of private, clinical genetic information has occurred without a warrant or the donor’s consent. The lack of consent is particularly troubling because ‘[o]nce law enforcement has access to an individual’s DNA sample…[they] can mine DNA samples for insights not available at the time they were obtained’.³ In addition to potentially blurring the lines between health care and law enforcement, the police use of clinical databases might discourage some from accessing critical treatments, and impair trust in health care.⁴ In this article, we will explain why we should be quite concerned about the forensic use of genetics samples that are connected to health care systems. After providing a great deal of context as to how this could occur, we report on the results of a first-of-its-kind study we conducted on lay attitudes of forensic investigative use of newborn screening programs (NSPs) and clinical genetic tests to solve various types of crimes.

The article will thus proceed in four parts. Part I gives an overview of IGG and the legal and ethical significance of the move from consumer to clinical databases as a source of DNA. Part II describes the design and methodology of our study and summarizes our findings. Part III puts these findings in context and explains how they relate to the current legal protections (or lack thereof) for police use of clinical genetics information. Finally, Part IV concludes with a call for legal reform. Specifically, we argue that: (i) on the federal level, Congress should amend the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) to remove the law enforcement exceptions, and, (ii) on the state level, legislatures should require affirmative parental consent for NSPs and the secondary use of residual blood spots and (iii) permit parents to have their children's bloodspots destroyed after screening. As we will explain, these reforms protect the public trust in health care and law enforcement institutions and ensure people continue to participate in NSPs.

II. BACKGROUND

II.A. What Is IGG, and How Is It Different from Searching Clinical Genetic Databases?

In this part, we will explain what IGG is and what is novel and not novel about it. In short, IGG is incredibly useful when the police have a DNA sample but no name of a suspect or missing person attached to it. It is in the case of these ‘John Doe’ genetic samples where IGG really is a game-changer for improving crime clearance rates.

In 2018, California police famously used IGG to identify and apprehend Joseph DeAngelo, the Golden State Killer.⁵ If the perpetrator’s genetic sample had been in the Combined DNA Index System (‘CODIS’), a genetic database maintained by the Federal Bureau of Investigation, law enforcement would not have needed to use IGG. The IGG process only becomes necessary when the crime scene sample has no match in existing forensic databases.

However, when there is no match in CODIS, as in the case of the Golden State Killer, law enforcement can create a genetic profile from the perpetrator’s DNA left at the crime scene. The profile is then uploaded to GEDMatch or some other public genealogical database, which may result in a partial match to a distant relative. By building a family tree backward, the team can identiy a common ancestor between the crime scene donor and the distant relative on GEDMatch. Using that information, investigators populate the branches of this family tree through sleuthing public records, to find potential sources of the crime scene DNA. Law enforcement can then filter the entries on the family tree by those who are roughly the right age and who could have been in the vicinity of the crime scene at the time. This laborious process eventually led to DeAngelo and enabled his arrest.⁶

More recently, law enforcement used IGG to identify Bryan Kohberger after he murdered four University of Idaho students in 2022.⁷ Rather than waiting for the case to go cold, investigators uploaded DNA that Kohberger left at the crime scene to a genetic database. They located a partial match with a relative.⁸ Coupled with knowledge that the perpetrator likely drove a white Hyundai and lived near Moscow, Idaho, IGG swiftly identified the needle in the haystack, leading to Kohberger’s arrest.⁹

These are just two high-profile examples where IGG was used to provide a name for an anonymous crime scene DNA sample. The leading commercial provider of forensic genetic genealogy, Parabon Nanolabs, claims to have assisted the police in identifying 265 persons of interest since they began marketing their Snapshot™ methodology.¹⁰ When we include cases where police seek to identify anonymous remains, it is estimated that over 400 cases have been resolved internationally using IGG.¹¹

In general, studies show that the public’s attitudes toward IGG are positive, but support varies depending on the type of case in which it is used.¹² For example, Americans generally support the use of genetic genealogy to solve cold cases, like in the case of the Golden State Killer.¹³ An international study found that over 80% of participants supported the use of IGG to solve murders and sexual assaults and to identify human remains.¹⁴ Support for police use of IGG was highest for these types of crimes. Participants stated lower, but still substantial, levels of support for IGG use in illicit drug use and robbery investigations.¹⁵

Despite their general support for IGG, across all types of crime participants have consistently wanted the police to obtain the consent of consumers before using their DNA for IGG.¹⁶ Further, even when other demographic variables are taken into account, participants in prior studies were more accepting of IGG if they generally held positive attitudes toward the police.¹⁷ Despite this data indicating public support, most of the coverage in the popular press has been negative, decrying the method’s ‘creepiness’ and ‘dystopian’ nature.¹⁸ At various points, legislators have proposed bills to stop IGG, often based on concerns that the methodology violates the privacy of innocent people who are not themselves suspects.¹⁹

II.B. The Move from Public to Private Databases and Key Ethical and Legal Distinctions between Ordinary Consumers and Patients

If commentators were worried about these highly-publicized uses of IGG, they are in for a huge shock when they hear about a new source of genetic data. Law enforcement agencies have recently turned to even more clinical and confidential sources: those found in public health biobanks or through tests ordered by a physician.²⁰ Because these samples are connected to health care institutions, their use raises critically different ethical and legal questions from those raised by the use of genealogical profiles contained in online, public databases.

Privacy protections vary depending on how genetic data are gathered and stored. This is why it is important to distinguish between commercial, clinical, and public health databases. When US consumers send their saliva samples through the mail to a direct-to-consumer (‘DTC’) genetic testing company, the law classifies this as a recreational, commercial transaction.²¹ Such companies are not legally obligated to provide the informed consent required of medical professionals. In other words, DTC genetic testing companies do not need to provide consumers with sufficient information to make a well-reasoned choice about whether to submit their DNA.²² Instead, DTC companies are held to a much lower standard: they simply cannot intentionally mislead or deceive consumers.

Importantly, DTC companies are also not subject to medical standards of care because they are not health care providers. To consumers, this means you cannot sue a DTC genetic testing company for medical malpractice and would need to sue for ordinary negligence. Additionally, the data DTC companies collect are unlikely to be subjected to the HIPAA Privacy Rule because they are not considered ‘covered entities’ under HIPAA.²³ This difference is significant because it means companies can disclose users’ genetic information without their consent.²⁴

The sale of Ancestry.com to the Blackstone private equity firm in 2020 recently cleared a class action lawsuit, where plaintiffs unsuccessfully alleged that the sale violated the Illinois Genetic Information Privacy Act.²⁵ DTC companies often employ ‘click-to-accept’ boilerplate agreements, which change frequently and are seldom read. The entire transaction is presumed to be at arm’s length and voluntary—given that nobody needs to participate in genetic genealogy. Many bemoan this state of affairs and worry that consumers are inadequately protected, given the power and information asymmetries between private companies and vulnerable consumers.²⁶ Once your genetic information is out there, it’s out there.

The US Food and Drug Administration (FDA) regulates certain health-related DTC tests as ‘medical devices’, but they have declined to regulate DTC genetic tests for ‘non-medical, general wellness, or low risk medical purposes.’²⁷ Consequently, consumers may assume that the HIPAA Privacy Rule applies to all DTC tests and that they would be told clinically useful information subject to a medical standard of care when that is not the case. This misconception is exacerbated by companies emphasizing clinical imagery in their advertising, to lend medical legitimacy to their commercial endeavors.²⁸ Consumers might therefore assume they are protected by legal standards that do not apply. This raises big concerns for consumer protection, as companies can often change the terms of their agreements unilaterally, with minimal notification requirements.

Now, take this scenario where consumers must put their security and privacy in the hands of for-profit companies and contrast it with when genetic samples are gathered by the staff of a hospital, clinic, or other HIPAA-covered entity. In these settings, the resulting clinical genetic data may be legally protected health information (PHI) and subject to HIPAA’s Privacy Rule. In addition to heightened protection under HIPAA, patients can sue the providers for failure to provide adequate informed consent if they do not disclose all material risks and benefits.²⁹

Crucially, the law treats consumers very differently when they take on the mantle of patient. This is because patients are physically and epistemically vulnerable relative to the sophisticated treating team and that health care is intimate, special, and necessary. For these reasons and others, we hold health care providers to much higher ethical and legal standards of care than other businesses.³⁰ This argues for greater protection for consumers when they become patients. Even so, in the next section, we will discuss how, perversely, there is even less transparency over police searches of clinical and public health data. The database in their cross-hairs is one that stores the DNA of almost every single person born in the USA in the last fifty years.

II.C. Newborn Screening Programs: How Do Your Data Get in One?

Whether they are aware of it or not, nearly every person born in the USA in the past fifty years has given a genetic sample to the government through their state’s NSP.³¹ Within two days of birth, every state permits health care professionals to draw a small blood sample from the infant’s heel to screen for a variety health conditions.³² These NSP programs are developed through state public health authorities and allow for the early detection, and thus early medical intervention, for dozens of fatal conditions. If detected, the treatments can mitigate or eliminate the risk of these diseases and improve health outcomes throughout the rest of the infant’s life.³³ These NSPs therefore serve an important public health function.

After the newborn screening is complete, states typically store the residual newborn blood spots in public health databases for ‘quality assurance, research, or other purposes.’³⁴ Some states store the samples in ways that permit the blood to be used in research or forensic investigation and other states do not. As a result, it is estimated that the government keeps genetic samples from about 200 million individuals in various NSP biobanks.³⁵ This dwarfs the roughly 30 million samples contained in private genetic genealogy databases.³⁶

Enrollment in NSPs is often automatic upon admission to the hospital for labor and delivery, meaning that explicit parental informed consent to the heel stick is usually not obtained or required.³⁷ Most states do allow parents to affirmatively opt out, but this requires parents to be aware of the testing in advance and to pay close attention each time the baby is removed from the room for various testing.³⁸ While all states mandate newborn screening, there is ‘relatively little or sometimes no disclosure regarding the state’s retention of residual dried blood samples, the bio-banking of those samples, or the use of such samples in unrelated research studies’.³⁹ The process by which newborn blood spots are obtained creates ‘serious doubt as to whether parents truly have an opportunity to refuse’.⁴⁰ Given the push for more transparent informed consent in the world of DTC testing,⁴¹ it is all the more concerning that the consent process for NSPs and public health databases is often even less transparent and informed than the process for consenting to DTC tests. Even when parents are aware of the existence of NSPs, they generally do not know that their newborn’s residual DNA sample is retained by the state afterward for research or that it may be used by law enforcement to investigate crimes.⁴² More often, parents do not even know that their child’s heel was pricked, because they sign one blanket consent form upon admission to the labor and delivery unit that covers everything.⁴³

II.D. Residual Bloodspots Are Stored and Searched

These inadequate consent procedures for NSPs were on full display in a recent New Jersey case. In 2022, New Jersey police were investigating a sexual assault case from 1996 that had gone cold.⁴⁴ Police had already narrowed the pool of suspects down to one person but did not have probable cause to obtain a warrant for the suspect’s DNA. Rather than hit a dead end, police decided to subpoena the state’s newborn screening database for the residual blood spot from a now nine-year-old child that was related to one of the chief suspects.⁴⁵ Analysis of the blood spot revealed it belonged to the genetic child of the person whose DNA was left at the sexual assault crime scene. This gave police probable cause to obtain a warrant for a genetic sample from the suspect, the child’s father, which ultimately led to his arrest.⁴⁶ If they knew where the suspect was living or working, they could have simply followed him around and obtained his discarded DNA. However, for reasons that are not clear from the public record, they did not pursue this route.

When the public defenders assigned to his case learned that their client had been identified using an NSP, they filed a lawsuit requesting information about how often this occurs and whether it complies with the Fourth Amendment.⁴⁷ A judge required New Jersey’s Division of Public Health to disclose some details. The court-ordered disclosure revealed that at least four police departments in New Jersey had used NSP in five criminal cases in recent years.⁴⁸

Currently, we do not know how prevalent this in other police departments using different state’s newborn screening databases because the police do not need to (and therefore do not) publicly disclose this. These sorts of investigative practices that go undetected because their fruits do not need to be admitted in court have been referred to by Maneka Sinha as ‘shadow forensics’.⁴⁹ The lack of standards or guidelines for how law enforcement agencies ought to store this information so as to respect donors’ privacy is concerning, given that the police are not known for respecting confidentiality or privacy.⁵⁰

However, we know police in Michigan have also searched their NSP to investigate crime. As part of the discovery process in a lawsuit filed against the state’s NSP, it was discovered that Michigan law enforcement had ‘used the blood samples to identify victims and perpetrators of crimes...[a]nd that such requests have been made and approved numerous times under court order’.⁶⁸ But again, there is no required disclosure or transparency around the police use of NSPs to investigate crimes, so we have no sense of how pervasive this actually is nationwide.

Given that the blood spots are not yet sequenced with the resulting data searchable online, the police cannot go on an open-ended fishing expedition with the NSPs. Instead, the police must have a person in mind who might be a match to the suspect’s DNA.⁵¹ They would then need to pull the particular newborn blood spot card, scrape off a sample of blood to test, and then analyze that blood sample for the identifying loci used by law enforcement.⁵² If police have a clear suspect, they can simply follow them to obtain discarded DNA without a warrant, to test for a match. This makes IGG relatively more helpful in narrowing down the field of suspects to find the needle in the haystack. Even so, in the future states may begin to upload the results of the newborn screening (and perhaps the sequences) to an electronic, searchable database. If this occurs, NSP databases would be easier to search without an identified a priori likely match and could be searched as GEDMatch or CODIS is now.

II.E. How Are Police Able to Search NSPs without a Warrant?

In addition to using NSPs as a default population genetic database, police have used other sources of clinical genetic data to investigate crimes. For example, several years ago, police arrested Dennis Rader, the ‘Bind-Torture-Kill’ (BTK) serial killer, after a court ordered a university health clinic to turn over Rader’s daughter’s pap smear specimen.⁵³ The specimen provided a familial match, and the probable cause necessary for Rader‘s arrest.⁵⁴ This occurred through court order, which is perhaps why we know that it happened at all.

However, it could have happened surreptitiously—without any such judicial authority or oversight. Shockingly, it could have even occurred without violating the HIPAA Privacy Rule, which will be discussed in more detail below.⁵⁵ Similarly, police accessing residual blood spots from NSPs to investigate and prosecute crimes has not yet been found to violate the Fourth Amendment’s right against unreasonable searches and seizures, for reasons we will explain below. In this section, we will survey the chief legal privacy protections and how courts have interpreted their application to permit many surreptitious searches of clinical and public health genetic data.

III. ANALYZING THE WEAK FOURTH AMENDMENT PROTECTION

The Fourth Amendment to the US Constitution prohibits the government from conducting unreasonable searches and seizures.⁵⁶ A search occurs when the government invades someone’s reasonable expectation of privacy to obtain evidence.⁵⁷ The search is considered unreasonable when it is conducted without a warrant, unless an exception applies.⁵⁸ In the last decade, the Supreme Court has issued several Fourth Amendment decisions that complicate our understanding of what counts as a search and whether a warrant is required. For Fourth Amendment purposes, everything hinges on how the data are procured. In California v. Greenwood, the Supreme Court held that people have no reasonable expectation of privacy in the garbage they leave at the curb.⁵⁹ If suspects ‘knowingly expose’ items to public view, the ‘collection of such evidence by the police falls outside the Fourth Amendment’s protections, and “police involvement is neither a search nor a seizure for Fourth Amendment purposes’.⁶⁰

While the Supreme Court has never addressed the question of whether discarded DNA is akin to trash, lower courts have. Almost uniformly, they have analogized the genetic material we inadvertently discard to garbage, finding we have no reasonable expectation of privacy in the DNA testing of cigarette butts,⁶¹ straws,⁶² and drinking cups⁶³ when used to identify people suspected of crime through the discarded DNA they contain. This step—analogizing our discarded DNA to the trash we leave in public spaces—is more convenient than justified. It is a mistake to assume we relinquish privacy over our DNA, simply by going about our daily lives in the world. Indeed, the extraordinary market value of large genetic biobanks subverts the idea that DNA is anything like trash. Under the Fourth Amendment, there are few limits on what the police can later do with the data that flow from ‘lawfully acquired’ evidence.⁶⁴ While closed boxes that are lawfully obtained might not be able to be subsequently opened and searched without a warrant,⁶⁵ state courts have not treated DNA in the same way. Instead, if a suspect discards a cup or cigarette butt, then the police can analyze it for identifying DNA loci without a warrant.⁶⁶

The idea that individuals have no reasonable expectation of privacy in the DNA that they inadvertently discard flies in the face of precedent that recognizes an expectation of privacy over our confidential health data. Importantly, the loci that are used to identify individuals are located in the non-coding regions of our genome that have been (incorrectly) labeled as ‘junk DNA’.⁶⁷ Because it was assumed to be clinically ‘junk’, the use of this non-coding DNA for identifying suspects has not been afforded the same protection as analyses of other bodily fluids such as blood that are obtained without consent and pursuant to a state-run program.⁶⁸

Additionally, unlike the cup or straw that we discard, there is no sense in which parents are ‘discarding’ their DNA and relinquishing their expectation of privacy by participating in a public health program. And also, the loci that are tested for identification purposes still can reveal sensitive information about the person.⁶⁹ As a result, we cannot definitively say whether police accessing public health databases without a warrant would certainly violate the Fourth Amendment. We need to know more about how the police are accessing the database and whether it is permitted under state law.⁷⁰

Everything hinges on how the police gain access to the DNA because ‘once the government is in lawful possession of DNA seized by warrant, with valid consent, or abandoned, the chemical testing of that sample does not require a separate warrant’.⁷¹ That is, if a state statute permits law enforcement to access its NSP, then they can do so, and run chemical analyses on the blood spots, without needing a warrant.

However, if the police gain access to the NSP in a way that is not lawful (eg they did not act pursuant to an authorizing statute or regulation), then accessing the NSP for investigative purposes likely counts as a search for Fourth Amendment purposes. And, if their searching the NSP is a search that is not otherwise authorized, then the next key question is whether a warrant is required.⁷² In the following section, we will describe how the special needs doctrine likely justifies the procurement of the NSP samples, given that the databases have been challenged on Fourth Amendment grounds. But because the focus of this article is not on the procurement, but on the police access to the NSP, we will discuss whether the search is reasonable or subjected to any exceptions to the warrant requirement.

III.A. The Special Needs Doctrine

The initial procurement of newborn blood samples for NSPs is likely justified under the ‘special needs’ doctrine. This doctrine has developed to permit warrantless administrative searches where they involve ‘no individualized considerations of wrongdoing’ and advance goals unrelated to law enforcement.⁷³ For example, the special needs doctrine has justified drug testing all border agents or searching the backpacks of everyone entering the subway for weapons.⁷⁴ Essentially, the special needs doctrine permits warrantless searches of large groups of people ‘where the government’s needs exceed an individual’s right to privacy, such as when a search is considered reasonable because a citizen’s well-being requires it’.⁷⁵ Under the special needs doctrine, the state’s interest in promoting public health and treating newborn genetic disorders could justify the routine search and seizure of a newborn’s DNA.

However, if a state goes beyond the stated public health purpose, it may fall outside of the ‘special needs’ exception.⁷⁶ In Kanuszewski v. Michigan Department of Health, plaintiffs argued precisely this, challenging the state’s NSP on Fourth Amendment grounds. After a few appeals, the case was remanded to the district court in Michigan. Michigan had argued that the Fourth Amendment was not violated because the parents could ask for the NSP samples to be returned or destroyed, and they had no reasonable expectation of privacy over the blood spots because they signed a form consenting to the screening (and many other things). While the named plaintiff acknowledged she had signed a form allowing her child to be screened, she said she did not receive any information on how the blood spots would later be used.⁷⁷

Ultimately, in an amended opinion issued in July of 2023, the district court acknowledged that while the NSP served an important public health function, the indefinite retention and secondary use was not carried out for ‘purely medical reasons’.⁷⁸ Even if the initial procurement ‘fell within the bounds of the Fourth Amendment’, the ‘indefinite retention’ and secondary use were found to violate the plaintiffs’ Fourth Amendment rights.⁷⁹ Given the ‘unique and sensitive nature of genetic information’, the district court found that the samples required more protection from secondary uses and disclosure, and the NSP required a better consent process.⁸⁰ From the opinion:

Even if the drawing and retention of the blood samples was carried out for purely medical reasons—which is not the case here—it would not provide blanket immunity from Fourth Amendment examination. The NSP, while undeniably providing a significant medical benefit, also involves the routine collection and indefinite retention of samples that contain highly personal genetic information. The crucial distinction lies in the nature of the information derived from these samples and its acknowledged use beyond immediate medical needs.

The court then ordered an injunction, requiring Michigan to attempt to obtain informed consent from the parents for the retention of their newborn‘s samples and their secondary uses, by July of 2024. If the state fails to accomplish this, the state will be required to destroy all of its data in the NSP.⁸¹ As of the time of writing, it is not known whether the state satisfied the terms of the injunction.

Because the immediate objective of NSPs is to screen all newborns for fatal diseases and not to investigate someone for a crime, the initial collection of blood spots is likely to be upheld by the Supreme Court.⁸² However, in light of the Kanuszewski case, NSPs should make sure that parents affirmatively consent to the indefinite storage and secondary use of the samples by researchers or law enforcement. Otherwise, so long as the plaintiffs can demonstrate they have standing, and will suffer irreparable harm,⁸³ the NSP program could be found to violate their Fourth Amendment rights. This could trigger an injunction, which could end the NSP’s data collection.

Even if the initial procurement and storage are deemed to not violate state or federal privacy rights (which is most likely under current case law), the posture changes when police use the NSP database for forensic investigations. Once the police have a suspect in their crosshairs and are searching for the suspect’s relative’s DNA, this ‘individualized suspicion’ means the targeted search cannot be justified under the ‘special needs’ doctrine. Some other exceptions to the Fourth Amendment would need to apply because this is no longer ‘divorced from the State’s general law enforcement interest’.⁸⁴

III.B. The Third-Party Doctrine Ought to Protect from Warrantless Searching of NSPs

There is another doctrine, called the third-party doctrine, that prior to 2018 would have likely permitted a warrantless search of NSPs. The third-party doctrine comes from a line of cases holding ‘that “a person has no legitimate expectation of privacy in the information he voluntarily turns over to third parties” … “even if the information is revealed with the assumption that it will be used only for a limited purpose.”’⁸⁵ The idea was essentially that if someone voluntarily shares their information with others, they are waiving their reasonable expectations of privacy in that information. This doctrine once permitted warrantless searching of consumer databases like phone records and information consumers voluntarily uploaded online. However, in 2018 the Court decided Carpenter v. United States, where they fundamentally altered the third-party doctrine. The Court held that merely sharing your data with a third party is not enough to waive privacy rights.

Carpenter involved the police accessing a week’s worth of cell phone location data for the accused. By collecting large volumes of tracking data, law enforcement was able to piece together Carpenter’s whereabouts, which implicated him in the charged crimes. The Court held that police needed a warrant to access this location data, even though the individual had technically shared his location with his cell phone company.⁸⁶

The Court recognized that ‘[i]n light of the deeply revealing nature of [certain kinds of data], its depth, breadth, and comprehensive reach, and the inescapable and automatic nature of its collection, the fact that such information is gathered by a third party does not make it any less deserving of Fourth Amendment protection’.⁸⁷ This was a sea change. The opinion listed factors for assessing whether the disclosure vitiates expectations of privacy. All of these factors (the revealing nature of the data, the sheer volume, the number of people affected, the cost of the search, and the automaticity of disclosure) all point toward maintaining expectations of privacy in the NSP blood spot data.

Under the majority’s reasoning in Carpenter, it is unlikely that parents could be said to relinquish the privacy expectations of their children’s blood spots because of ‘the inescapable and automatic nature of [the data] collection’. To be sure, procurement is often done automatically, it includes vast amounts of private data that we do not yet fully even know how to interpret, and it is done typically without explicit consent. The cost of searching the NSP is also much lower than traditional forms of surveillance.

The sheer amount of information contained in the DNA in a residual blood spot exceeds the ‘depth, breadth, and comprehensive reach’ of the cell phone records in Carpenter. With NSPs, massive amounts of data are collected on almost everyone born in the USA. While the particular loci that are used to identify individuals for forensic purposes are in these non-coding regions, the information contained in the blood spots can reveal not just identity but also sensitive future health risks.⁸⁸ While we can never be certain how a future Court would rule, the Carpenter factors all seem to tip in the direction of requiring a warrant to search the NSP database.

The application of the third-party doctrine is yet another basis for distinguishing the method used to apprehend the Golden State Killer with the search of NSPs. Recall that in that case, law enforcement relied on a public genetic database called GEDMatch. This did not require a warrant, and likely would not even under Carpenter. Unlike the cell phone location data or the NSPs, consumers explicitly, voluntarily, and affirmatively uploaded their genetic profiles to these public, recreational sites. The consumers were much more aware of the voluntary disclosures they were making because they had to take several affirmative steps to do so. And, unlike the difficulty of opting out of cell-phone tracking and participating in public life, it is quite easy to opt out of participating in GEDMatch and still remain an engaged citizen.

Recognizing that their business model demands privacy protections, the more reputable DTC genetics companies state that they will only comply with a police request for genetic information with a warrant or subpoena.⁸⁹ However, such protections sound in the contract law of user agreements and could be revised at any time.⁹⁰ The bottom line is that the Fourth Amendment’s third-party doctrine likely permits warrantless searching of these public, user-generated consumer databases, and likely does not permit the warrantless searching of the much more private NSPs.

III.C. Inadequate Remedies and Legal Barriers to Relief

To summarize, current interpretations of the Fourth Amendment likely prohibit police from searching residual NSP blood spots for a familial ‘match’ without (i) a warrant, (ii) statutory or regulatory authorization, or (iii) some sort of ex ante consent. Parents do not relinquish their reasonable expectation of privacy in the sample by participating in the public health program, and they never explicitly consented to these data being shared or used for law enforcement. However, the fact that police are doing this, despite its likely unconstitutionality, exposes the insufficiency of existing remedies.

The remedy for a Fourth Amendment violation is the exclusion of the evidence in a criminal trial,⁹¹ and this violation cannot be asserted vicariously.⁹² So, if an individual’s private information is searched, and it results in someone else being charged with a crime, the Fourth Amendment provides no remedy.⁹³ This incentivizes police to search genetic databases for innocent relatives who can provide a ‘match’.

If the relative whose DNA was searched or seized wanted to hold the police accountable for the privacy violation, they must initiate a private suit for the violation of Section 1983 of the federal Civil Rights Act.⁹⁴ These civil actions are brought against people ‘acting under the color of law’ who violate the plaintiff’s ‘clearly established statutory or constitutional rights of which a reasonable person would have known’.⁹⁵ In addition to having high evidentiary burdens and low success rates, they require the individual to find their own private counsel and fund the suit. They are thus an imperfect remedy for the relatives of suspects who are never charged themselves but whose private data were unreasonably searched. Private tort suits might also be available, but there too the plaintiffs face significant hurdles in finding attorneys who will take the case and in overcoming governmental immunity.

When the Fourth Amendment falls short, state statutes might provide some redress. In Minnesota, parents argued that the lack of consent to secondary uses of the blood spots created a privacy violation under state law.⁹⁶ The Minnesota Supreme Court agreed. Allowing researchers to access the retained blood spots was found to violate Minnesota’s genetic privacy law, and the case was remanded for compliance. This is an important case because it emphasizes that state constitutions and statutes can afford greater privacy protection than the federal Constitution.

In Washington, a defendant sued for a violation of the state’s version of the Fourth Amendment, arguing that he had a privacy interest in the small percentage of his relative’s single-nucleotide polymorphism (‘SNP’) profile that he shared with him and which was used to arrest him. The state found that he had a ‘subjective expectation of privacy that society recognizes as reasonable’.⁹⁷ This interpretation of privacy has the potential to complicate many other areas of medical privacy. Do I have privacy rights in my sister’s breast cancer diagnosis, such that she should not be able to tell people about it, given that I also have the same mutation? Do I have an expectation of privacy in the complicated story of my childhood that I also share, in part, with my cousins? It will certainly be very interesting to see how courts tease apart the personal expectation of privacy in a relative’s genetic data or the percentage of DNA we might share. However, even with this expansive view of privacy, it was the criminal suspect who challenged the IGG in that case. Given the interpretation of ‘standing’ in the opinion, it is very unlikely the family member whose DNA provided the link to the suspect would have been able to bring a claim under Washington state law.

IV. HIPAA

Because newborn blood spots are typically obtained in a hospital or clinic by a health care professional, parents might expect them to be protected under the HIPAA Privacy Rule from unauthorized disclosure to the police. However, the Rule contains several exceptions that permit disclosures of medical data to law enforcement without a warrant. Generally, the HIPAA Privacy Rule requires covered entities, such as health plans and most health care providers, to obtain the patient’s authorization before sharing their PHI. PHI is ‘individually identifiable information… collected from an individual, that… is created or received by a’ health care provider and ‘relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual’.⁹⁸ The blood spot sample would constitute PHI, as it is tied to a newborn’s name and medical record. However, depending on how an NSP is managed, the state agency or laboratory that stored the residual blood spots may not be considered a ‘covered entity’, under HIPAA, removing whatever flimsy protections may have applied.⁹⁹

Even where residual blood spots from NSPs are covered by HIPAA, the Privacy Rule permits law enforcement to access PHI (i) if permitted by state law; (ii) in compliance with a court order or subpoena or in response to a summons issued by a court officer for a grand jury; or (iii) in response to an administrative subpoena or written investigative demand made by law enforcement.¹⁰⁰ Notably, these sections permit disclosures but do not require them. The covered entity may refuse to provide PHI if law enforcement does not have a legal order or warrant.

Existing HIPAA regulations only create a minimal hurdle for law enforcement officials to overcome to access otherwise protected PHI without violating HIPAA. Their requests just must be for information that ‘is relevant and material to a legitimate law enforcement inquiry… specific and limited in scope to the purpose for which the information is sought; and… [d]e-identified information could not reasonably be used’.¹⁰¹ The scope of this language has not been fully vetted by the courts, so it is unclear whether it places any meaningful limits on what police can ask for and receive. Health care professionals may also incorrectly understand this exception as requiring disclosure rather than merely permitting it. There is mounting concern that cozy relationships between covered entities and law enforcement lead to frequent warrantless data sharing under HIPAA’s law enforcement exception.¹⁰²

In addition, trial courts have interpreted these HIPAA exceptions to suggest that they preempt common law or constitutional privacy requirements.¹⁰³ Where a disclosure is permitted under HIPAA, some courts treat it as permissible under the Fourth Amendment.¹⁰⁴ However, this is an error because the Privacy Rule only speaks to a narrow context and was never meant to preempt preexisting privacy rights.¹⁰⁵

Patients likely have even less privacy protection than the law provides, given the widespread confusion about what HIPAA permits rather than requires. And even if an entity is covered by HIPAA, it is not required to publicly report disclosures to law enforcement. So, we do not know how often PHI is given to the police without a warrant.¹⁰⁶

Many Americans misunderstand the scope and protections of HIPAA. But even when it does apply, they likely do not appreciate how easy it is for the police to access their PHI without a warrant. This poses great concerns when people submit genetic data to private DTC companies. But it is even more pernicious when they think they are working with a health care provider or hospital.

Newborn screening programs are governed by state law, so residual blood spots may have additional protections depending on where a person is born. At least twenty-one states restrict law enforcement access to the blood spots in the state’s NSP.¹⁰⁷ On the other hand, some states expressly permit law enforcement access, while others do not have an articulated policy, leaving it open to judicial interpretation.¹⁰⁸

In this last section, we outlined the various ways that the Fourth Amendment and HIPAA provide insufficient protection for clinical genetic samples. Given that parents do not give explicit consent to law enforcement use of blood spots, police likely need a warrant to search these databases under Carpenter, unless there is a statute that explicitly permits their ability to search for this purpose. And, if the state permits law enforcement access or if law enforcement makes a written request, HIPAA permits but does not require disclosure. In the next section, we will explore why these insufficient protections matter.

IV.A. Why Does This Matter?

When police access clinical genetic data without a warrant, it can harm the physician–patient relationship by encouraging medical mistrust. Medical mistrust is defined as the ‘overall suspicion of the health care system and beliefs that health care providers and organizations may act contrary to patients’ best interests’.¹⁰⁹ Medical mistrust has been found to lead patients to not take prescribed medication, obtain cancer screenings,¹¹⁰ or get vaccinated.¹¹¹ This mistrust is understandably higher for people of color, such as Native Americans,¹¹² and Latinx and Black people, who have experienced significant medical racism and bias.¹¹³

The mistrust that is engendered when physicians cooperate with the police might also lead parents to be less likely to agree to have their infants screened for genetic disorders if they do not want the police using the samples for non-clinical reasons. If parents opt out of the program, this could then lead to their not being able to treat or prevent their infant’s fatal illnesses. This has negative implications for public health because continued participation in NSPs is essential to continuing to mitigate preventable genetic disorders.¹¹⁴

If patients worry that their NSP data could be accessed by law enforcement, they might feel betrayed by their medical team. This could make them less trusting of nurses and doctors generally, as now the health care team is seen as a mere extension of the carceral state. This is especially likely for marginalized communities who have been disproportionately targeted by the police. If doctors, nurses, and public health agencies appear to be colluding with cops in turning over biospecimens that were collected in hospitals, then this could make patients much more reluctant to provide voluntary samples for testing or research. And even more concerning, people may be wary of seeking health care generally, as access to NSPs might just the tip of the iceberg of police accessing private medical records. As one scholar put it, medical mistrust can ‘trigger nothing short of a public health crisis’.¹¹⁵

Public trust in US institutions, including health care and law enforcement, is at all-time lows.¹¹⁶ Distrust in medicine is beginning to be explored as a social determinant of health (SDOH).¹¹⁷ By viewing the co-option of health care by law enforcement as an SDOH, we can appropriately evaluate the health impacts on communities of color who already experience significant health disparities.

When law enforcement even appears to be comingling with health care, this can negatively impact people’s view of medicine, as the two ought to and do have very different ethical and legal norms Health care depends on the voluntary, autonomous consent of patients, and law enforcement adopts a much more surreptitious and authoritarian model. There are individual and population-based concerns about blurring the provision of health care with the prosecution of crime—namely, that patients will not tell their doctors critical information or will not visit the doctor at all. To preserve trust in medicine, policymakers must clarify when and how law enforcement can access things like residual blood spots obtained in a health care setting by nurses and physicians.

V. OUR STUDY

V.A. Background Studies

Researchers have explored whether people support law enforcement’s use of DTC genetic data to prosecute crime.¹¹⁸ In general, those surveyed are supportive of the IGG methodology when the crime is serious (such as murder or rape) or to identify anonymous remains.¹¹⁹ Support for IGG tends to drop off when the police use DTC databases to prosecute non-violent crimes like theft.¹²⁰

However, there is no research on the public attitudes toward police use of public health databases, like NSPs, or other types of clinical genetic information. Given the different consumer expectations and ethical and legal norms around clinical genetics in health care settings, we sought to understand whether the public supports the forensic use of clinical or public health genetic databases to the same extent as samples uploaded to a private DTC company. With the background of the patchwork of insufficient privacy protections, we can now turn to the study we conducted.

V.B. Study Design and Methodology

In a pre-registered¹²¹ between-subjects experiment, we asked lay people about their attitudes regarding forensic, investigative use of clinical and public health genetic databases.¹²² In keeping with prior findings, we hypothesized that participants would think about these uses instrumentally and would be more likely to support the forensic use of clinical genetics and NSP data in cases of serious, violent crimes that led to a conviction. We also hypothesized that participants would support the unconsented-to use of clinical genetics data to confirm suspected incest and that people of color would be less trusting of police use of forensic genetics and find these uses of clinical and public health data more ethically and legally troubling.

Participants were recruited online through Prolific Academic, where we sought a representative sample of the US population. We did obtain a geographically and racially diverse sample, though the mean income of our participants was slightly higher than the US average.¹²³ Fortunately, when participants were randomly sorted into their conditions, the resulting subgroups maintained roughly the same age, gender, income, and education diversity as the entire sample. Seven participants were excluded after a basic attention check, leaving us with a total of [N = 323] participants.

Participants were randomly sorted into one of five experimental conditions, where they read just one case about the use of clinical genetic information in a criminal investigation. Each group read detailed background information on the type of genetic information at issue (stimuli and all data on file with authors, to be shared in a Supplement). They were then asked whether they supported this use of genetics, found it ‘troubling’ or ‘creepy,’ and why. We specifically asked about whether they found it ‘creepy’ because that word was frequently used in the press coverage of IGG.¹²⁴ Participants were also asked Likert-scaled questions as to what extent they were bothered by the lack of informed consent, privacy, and potential Fourth Amendment violations. They were also asked about the extent to which they had trust in the police or in health care providers along with various other demographic questions.

The experimental conditions into which these participants could be sorted varied on two axes: the underlying crime being investigated and whether it led to a prosecution. In four conditions, participants read a vignette where police accessed the state’s NSP without a warrant. They did so to confirm the identity of a suspect in a cold case by comparing crime scene DNA to the residual blood spot of the suspect’s daughter. Participants were then told what an NSP is and how the blood spots were obtained, used, and stored. They were told why the police accessed the NSP. The four conditions involved (i) a murder investigation that led to a conviction, (ii) a rape investigation that led to a conviction, (iii) a rape investigation that did not lead to a conviction, or (iv) a jewelry theft that led to a conviction. We included the third condition to test whether attitudes towards forensic use depended on whether the investigation was successful in leading to a conviction. Our hypothesis was that lay people would support this use less through a type of hindsight bias, even though the police could not possibly know whether the prosecution would lead to a conviction at the time of the warrantless search.

The fifth group of participants read about an entirely different criminal investigation, based on a reported case.¹²⁵ In this condition, participants read about an infant who was born to a 14-year-old mother. The baby presented with skin lesions and blisters that appeared to be a rare genetic skin disorder, but the physicians were not sure. The medical team ran a genetic panel to test for the suspected skin disorder. This test confirmed the infant had the skin disorder, epidermolysis bullosa. But the genetic test results also suggested that the infant’s parents were close relatives. Without the mother’s informed consent, doctors ran a second genetic test only to confirm that the infant’s father was also his grandfather (the birth mother’s father). Participants then read that the doctors turned the genetic test results over to the police for investigation of incest, which given the birth mother’s age would be child abuse.

We included the fifth condition to determine how people thought about law enforcement use of clinical genetic data in a case involving an ongoing crime with identified victims and potential perpetrators, as opposed to a cold case with John Does. We were interested in understanding whether support for the use of clinical data in investigative forensic genetics changed depending on how and why the genetic sample was obtained and whether support varied based on the level of trust an individual has in law enforcement or health care providers. The subsequent section identifies our hypotheses and explains our findings for these five conditions (4 NSP cases and 1 case of a genetic test for suspected incest).

V.C. Findings

1. Do Lay People Find These Uses Troubling, and Are There Differences Between the Cases?

Participants were randomly sorted to read only one of the five vignettes. They were then asked a series of questions about what they had read. First, they were asked to indicate simply whether they found the use ‘troubling’ with the options being yes/no/unsure. The results suggested that participants thought about the two general types of cases very differently.

That is, participants found it much more troubling when the police searched the NSP, no matter which crime was being investigated, as compared to when they ordered a genetic test to confirm incest. Specifically, for those who read the vignette about suspected incest, 80.3% found the police use of genetics not to be troubling, with 16.7% saying they needed more information or were unsure, and only 3% finding it troubling. By comparison, when participants read the vignette where the police unsuccessfully searched the NSP to find someone suspected of sexual assault, only 18.8% found it not to be troubling, with 17.2% saying they were unsure or needed more information, and 64.1% found it troubling. This underscores the importance of the outcome. Success rates appear to matter quite a bit to the reasonableness of the search in the eyes of laypeople. And, even in the vignette where the police were investigating a murder, only 38.5% of participants said they did not find it troubling, with 43% finding it troubling and 18.5% being unsure. The high percentage of people who were unsure might be due to their only hearing about this forensic use of NSPs for the first time. Thus, in our sample participants found it much less troubling when the police used the clinical genetic sample to confirm incest. Data are graphed in Fig. 1.

We next asked whether participants found the forensic practice they read about ‘creepy.’ We used this word in particular because several journalists described IGG in this way when it was first discussed in 2018. Participants were more likely to find the NSP use to be ‘creepy’ when the investigation was for a property crime (4.48), a sexual assault (4.08), sexual assault with no conviction (4.45), or murder (4.29) when compared to participants who read about the ordering of a genetic test to confirm incest (2.24), p < 0.001 for all comparisons. Thus, our study confirmed our hypothesis (see Fig. 2). Participants’ ratings of creepiness were associated with the purpose of the search, with participants finding the search less creepy when it was done to confirm incest.

2. Should This Use Require a Warrant?

We next asked whether participants thought that the police should be required to get a warrant before searching the NSP for a relative’s DNA. We informed participants on the basics of obtaining a warrant. Specifically, they read that the Fourth Amendment requires the police to apply to a judge for a warrant to search things or areas where people have a reasonable expectation of privacy.¹²⁶ Warrants are supposed to only be issued upon ‘probable cause’, which is a common-sense assessment of whether the totality of the circumstances is sufficient to warrant a reasonable police officer to believe that evidence bearing on that offense will be found in the place to be searched.¹²⁷ It is possible participants did not fully grasp what is required to obtain a warrant, but this puts them in good company with many Fourth Amendment scholars, who have lamented its slippery and multiple standards.¹²⁸ The police did not obtain a warrant in any of our study conditions.

Likert responses were again scaled to the severity of the crime. Participants were much more likely to say that a warrant is not required when the search is to prosecute a murder (4.94) than when prosecuting a theft (5.62) (see Fig. 3). Historically, whether we have a reasonable expectation of privacy relates to the type of police intrusion from the search—based on the location and the type of data—and not on whether law enforcement is investigating a more serious crime. While a minority of courts have argued for such an instrumental interpretation of the Fourth Amendment, where the reasonableness of the privacy violation and the facts required for probable cause are balanced against the potential social harm from not doing the search,¹²⁹ others have criticized this interpretation as permitting ex post rationalizations by police.¹³⁰ And the Supreme Court has formally declined to adopt this sort of utilitarian ‘balancing test’ because the Fourth Amendment privacy protections would ‘too easily disappear’ if police officers were allowed to balance multiple circumstances in different cases, after the fact.¹³¹

Despite this official view, Fourth Amendment scholars recognize that there are certain search practices—such as those requiring bodily intrusion—that typically require ‘more than the usual quantum of probable cause’, given their extreme intrusiveness.¹³² Thus, while the Court has not formally adopted an instrumental view of the Fourth Amendment, in practice, lower courts recognize that the greater the privacy violation, the greater the need for a warrant and more facts to support probable cause. The intuitions of our participants that the justifiability of the privacy violation depended on the gravity of the crime being investigated therefore have some purchase in the Fourth Amendment case law. But it remains controversial as to how much judges should take the gravity of the crime into account when analyzing whether a warrant should have been issued. But, in any case, participants in our sample were more likely to think that a warrant was not needed to search NSPs if the police were investigating a murder, compared to a theft.

We gave participants space to provide explanations for their answers. To get a sense of how participants were reasoning through this, we will provide some illustrative examples of their responses. Those who were troubled by the police use of NSPs provided lengthier responses. Someone who read about police searching the NSP to investigate sexual assault said: ‘The use of newborn screening cards seems to exploit a loophole to acquire DNA evidence. Since attaining these cards doesn’t require a judge to sign off on a warrant like usual, law enforcement is clearly using this loophole to get around standard legal procedure’. Another set of responses focused on the private nature of health care data: ‘The newborn screening card has information about that newborn and possibly the relatives. That is part of their health information. Health information should be private and not accessible to anyone without a warrant’. For those who were more supportive of the police having access to the NSP without a warrant, a representative quote read ‘I think this is a good idea. I also feel that there is no problem and comfortable of using it’. Another quote focused on the difficulty of prosecuting sexual assaults: ‘I would be completely fine with [not obtaining a warrant] if parents were informed that the blood spot might be used in this way in the future until the child turns 18. I am also fine with requiring that blood spots be taken in a state. Too many rapes go unprosecuted.’

There were also participants who were ambivalent. A representative quote indicating ambivalence said:

‘I am torn. In one way, I think it’s good to be able to definitively find evidence to convict criminals, especially rapists and murderers. We should do everything we can to prosecute those people and find justice for victims. However, knowing that the state stores those cards without obtaining consent and that they can be accessed by police without a warrant is troubling. Police should have probable cause before being allowed access to medical records’.

The open-text responses reassured us that the participants understood the stimuli and the tradeoffs between privacy and prosecuting crime. The participants who read about the case of suspected incest were not asked about obtaining a warrant because in that condition the medical team turned over the genetic test to law enforcement.

VI. SHOULD HEALTH CARE FACILITIES NEVER DISCLOSE PATIENT DATA TO LAW ENFORCEMENT?

Next, we report on participants’ views of whether health care facilities should ever disclose patients’ data to law enforcement. Interestingly, despite this question being about patient data generally, we see a significant effect of condition. Participants who read about the police using clinical genetic data to investigate incest (consanguinity) were more likely to think there were circumstances where police did not need a warrant to obtain patient information. A representative quote from our open-ended text responses captures this: ‘I think it is good because it catches a pedophile and horrible man, who shouldn’t be around his daughter or any children. His daughter is a victim and way too young to have kids and is a child herself.’ Thus, the visceral reaction to the harm to the child, and the desire to prevent ongoing abuse, might make some people think that failing to obtain informed consent of the birth mother was justified. Participants’ support for the police accessing this clinical genetic information is not necessarily based on a hindsight bias, as there was good evidence in this condition that an ongoing crime needed to be halted.

This difference between the consanguinity and the collective NSP conditions was significant (p < 0.01 for all comparisons) (see Fig. 4). The NSP conditions triggered stronger views about the police never having warrantless access to patients’ data. Thus, participants’ views on the permissibility of disclosing patients’ information to the police may depend on the use and may be impacted by the examples given. Similar results were found when participants were asked whether they trusted law enforcement to have access to the data (see Fig. 5), with more participants reporting they trusted the police to access genetic information to confirm incest.

VII. SHOULD PATIENTS BE TOLD IF DATA WILL BE USED BY LAW ENFORCEMENT?

Finally, we asked whether the consent process for obtaining the genetic samples should include notice to the patient that their data might be used by law enforcement. This question was included because most of the public outcry against IGG had to do with the fact that the donor of the genetic sample never consented to its forensic use. We hypothesized that participants would demand better informed consent procedures in the NSP conditions because physicians do not need to obtain consent before investigating suspected child abuse. However, after pre-registering our hypothesis we also wondered whether participants might demand greater consent procedures in the clinical context because the confirmatory test had no public health benefit and was conducted only to investigate abuse. Our findings confirmed our pre-registered hypothesis, with there being a significant difference (p < 0.001) between participants saying patients must be told of forensic use of NSPs and far fewer saying patients must be told of genetic tests to confirm incest (see Fig. 6). Perhaps these findings stem from the public understanding of mandatory reporting laws or from the utilitarian desire to stop ongoing abuse. Importantly, if both parents had to consent to the confirmatory genetic tests, the abusive grandfather/father could try to thwart the investigation by putting pressure on the birth mom/daughter. Further, as a helpful reviewer pointed out, the privacy intrusion is necessarily different in this case, as the suspected criminal and the victim are in the same genetic family.

We cannot be sure of the main reason, but there was a very clear difference between the consanguinity condition and the NSP conditions, with more participants stating that the latter required notification of forensic use during the consent process. Representative quotes from the open-text questions referred to the importance of consent and how it might even permit forensic uses downstream:

‘I don’t necessarily think that the law enforcement’s use of newborn screening cards is bad. However, I think not informing the parents that the screening cards are stored and could potentially be used by law enforcement is bad. I think a lot of severe crimes in the future or past may require the use of screening cards. But consent is key’.

Another representative response stated ‘I think it’s bad because of the lack of transparency from the hospitals and law enforcement. The parents should be able to consent to whether or not the blood sample should be kept and stored and then potentially used by law enforcement.’ While there were participants who indicated in the Likert data that consent was not required, there were few explanations of this view in the open-text responses.

VIII. FINDINGS IN CONTEXT

Our major hypotheses regarding our dependent variables were confirmed, but our hypothesis regarding the role of race and trust in the police was not. Participants were more likely to say that the police needed a warrant when the crime being investigated was theft, as compared to murder. However, they also found that the NSP searches across the board more troubling and creepier than obtaining a new genetic sample to confirm incest. The open-text responses following the Likert-scored questions indicated that people felt that the privacy rights of suspects are diminished when the crime being investigated is either more serious and violent, or when there is ongoing abuse that could be halted. For example, one participant stated that ‘[i]n this case it is child abuse, and he may continue doing what he is doing. To do nothing would be wrong. He is stripping these children of a normal life. I believe in cases like this is justified in using genetic testing.’

Others continued the utilitarian perspective, focusing on the idea that if you do not commit any crimes, you have nothing to hide, stating that ‘In my opinion, the benefits to society outweigh the loss of privacy. In this case, it was just a theft, but the screening cards could help find murderers in the future as well. Also, I do not foresee myself or my future children committing any major crimes in my life, so I wouldn’t really care.’ Another said ‘It’s extremely important to protect minors involved in incest. And this may be the only way they can get help easily.’ While others worried about not just this government use of NSPs but other perhaps more nefarious uses: ‘The thought of a government entity being able to collect and story my DNA is disturbing. What comes next? Don’t they have enough information about me already?’ This type of response reflects a concern that commentators have called ‘function creep’, where law enforcement goals bleed into those of medicine and health care, ‘to gain easier access to medical research DNA databases for forensic purposes.’¹³³ And finally, some expressed ambivalence: ‘I just need to think more about it. I know as an infant I had the heel prick but never thought about it. There are so many other markets being used to track people. I am just not sure what I think yet’.

We expected demographic indicators like race or gender with police to correlate with certain responses (eg that because data suggest that people color trust the police less, this would translate into their being less comfortable with the forensic use of genetics across the board). However, we did not find this in our research. Race and gender did not have any significant association with the variables we measured (all p > 0.05.) There were also no significant interaction effects of race and trust in the police on whether the forensic use of genetics was deemed to be troubling or creepy. These results went against our pre-registered hypotheses.

One reason for the null effects of race might be that as compared to the racially discriminatory ‘stop and frisk’ policies of the last few decades,¹³⁴ the police search of genetics databases feels less aggressive and physically intrusive. Or, it might be that forensic databases are perceived to be less racially charged and racially biased than traditional policing practices, so relative to the status quo, there is more support for their use. If people have experience with CODIS, which contains forensic DNA samples from state agencies and is maintained by the Federal Bureau of Investigations (FBI), they might also know that the FBI database over-samples people of color¹³⁵ because it is populated through discriminatory state police processes and arrests. Thus, for this group, the use of an NSP might be perceived to be less racially discriminatory than CODIS.¹³⁶ Yet another alternative is that people just have not heard about these forensic uses of genetics and so do not perceive them to be a big threat as they seem too remote. Future studies could explore these possibilities in greater detail. It would be helpful to better understand why people of color or those who distrust cops were less likely to support the police use of genetics. Many participants in our sample did not find the searches to be troubling, based purely on the breach of the donor’s privacy. Instead, they thought about the privacy and consent concerns in a utilitarian way. That is, whether searching a genetics database troubled lay people or required a warrant depended on why it was being searched. This is interesting, as it permits a kind of instrumentalism that justifies the privacy breach depending on the use. If the government was investigating a serious violent crime or an ongoing case of child abuse, participants were much more likely to support the warrantless searches.

Indeed, very few participants thought it was creepy for the police to obtain a genetic sample from the birth mom, without her consent, to investigate suspected incest. This search was much more violative than the bloodspot procurement for the NSP, as it required an additional genetic sample to be obtained with no clinical purpose. And yet, for some reason, participants were much more accepting of this warrantless use. Perhaps the idea that an innocent person’s DNA could silently serve as an incriminating witness disturbs people.¹³⁷ Or, it might just be that in the consanguinity condition, there was ongoing abuse that participants wanted to be stopped, and they saw forensic testing as a means of achieving this. Responses from participants suggested that they did think it was significant that obtaining the birth mother’s genetic sample could stop ongoing abuse.

These findings are exciting and somewhat surprising from a legal perspective, as some might argue that the privacy breach occurs independent of the reason or the success of the prosecution. Most legal scholars do not think our enumerated, constitutional rights should be subjected to a cost–benefit analysis based on the utility of the violation. But our lay participants thought it was more acceptable for the police to violate people’s privacy if it was to investigate a serious, or ongoing crime. They were also more likely to say that when the crime was incest or murder, it was less critical to obtain advance consent for this forensic use.

As scholars before have noted, this utilitarian analysis of privacy protection permits hindsight bias and ex post justification and is inconsistent with the way we tend to analyze other enumerated constitutional rights. Of course, just because lay people have these utilitarian intuitions, it does not mean that courts interpreting the Fourth Amendment must follow suit. But as other scholars have argued ‘empirical data about the public’s privacy concerns surrounding law enforcement’s collection of and access to genetic data should be an integral consideration in judicial determinations of how these activities should be regulated by the Constitution’.¹³⁸ This suggests that our empirical findings should be given some weight in analyzing what is ‘reasonable’ under the Fourth Amendment and whether the public has expectations of privacy. Even so, the Supreme Court has refused to interpret the Fourth Amendment in such an obviously outcome-oriented way.

IX. LIMITATIONS OF OUR STUDY

There are a few limitations of our study. Firstly, participants had to read a significant amount of text. While we presented images to help explain NSPs and genetic testing, it was dense and demanded participant attention. Participants were online and therefore unable to ask questions about NSPs. That said, our open-ended responses suggest that participants understood the legal issues, our vignettes, and the variables we were testing. However, as the survey was conducted online, we cannot be sure that participants fully grasped what it means to require a warrant, what that entails, and the ordinary Fourth Amendment protections. We also cannot know how participants would think about these forensic uses in real cases, which would involve many more personalizing details and facts that might make their responses different. Given these limitations, we take our findings to represent more of an intuitive sense of lay people’s views on the privacy and consent violations inherent in these forensic uses of genetic databases.

X. RECOMMENDATIONS

The utilitarian trends we saw in our findings do not suggest that all participants thought about the searches in the same way. Large numbers still found the search of the NSP to investigate murder unacceptable, with many more finding the search troubling and creepy if done to investigate a sexual assault or theft (especially if it did not result in a conviction). And a small number of participants also found it creepy and troubling that doctors would obtain a genetic sample from the birth mother to confirm incest, without a warrant or her consent. The extent to which courts should consider lay people’s perspectives in any of this is a fascinating question. Of course, under current Fourth Amendment and HIPAA case law, they need not take any of our findings into account. However, our results do shed some light on what may count as a reasonable expectation of privacy.

While there’s certainly a public interest in solving crime, there is also a strong public interest in public health and health care. NSPs are just one example of a public health initiative that requires participants to provide sensitive health data to the government to accomplish its programmatic goals. However, most public health programs are only effective if people participate.

At this point, the public awareness about police use of NSPs is likely quite low. If more cases like the one from New Jersey make the news, more parents may choose to opt their children out of critical public health screening. Even if parents approve of forensic uses to solve murder, they might be worried about the government unilaterally granting itself rights to search the databases for whatever uses it desires, including nefarious ones. If that ‘function creep’ happens, their children could suffer negative, preventable, health consequences if a genetic condition goes undetected.

On a deeper and more systemic level, studies show that trust in US institutions, including both law enforcement and health care, is quite low.¹⁰⁹ To preserve and increase public trust, policymakers must address when and how law enforcement can access residual blood spots, as well as genetic data from other clinical and public health sources. The more the public comes to see the blood or tissue that they provide in a health care setting as accessible to the police without a warrant, the more the goals of medicine will be blurred with the goals of prosecuting crime. This is a huge problem.

Studies already demonstrate that distrust in medicine leads people to refuse important treatments and preventative care, which is compounded for racial minorities.¹³⁹ Indeed, over-policing is a social determinant of health. Trust in medicine needs to be improved, and the way to do this is not to blend the authoritarian ethics of policing with the much more autonomy-promoting and collaborative goals of health care.

As it is, the law enforcement exceptions to HIPAA make it too easy for the police to have easy access to patient’s protected health information. One way to erect better boundaries between law enforcement and health care goals is for Congress to amend HIPAA, to remove the many exceptions that turn HIPAA into a sieve, and merely require written requests rather than warrants. This would require a simple majority in the House of Representatives and the Senate.

Otherwise, the Office for Civil Rights could also submit a notice of proposed rulemaking, to revise the HIPAA implementing regulations, within the limits of the Congressional text. This has already occurred in the context of reproductive rights. In April 2024, a final rule was issued that prohibits disclosure of reproductive care to the police, if used to prosecute an abortion in one state, that was lawful in the state where it occurred.¹⁴⁰ The same process could be replicated but in a broader way to prohibit police from accessing PHI without a warrant.

If the police want to access someone’s private health information to prosecute a crime, they should have to get a warrant from a judge upon a finding of probable cause. They should not be able to take advantage of the fact that an innocent person’s DNA could lead them to their suspect—an innocent person who effectively has no Fourth Amendment remedies. Short of this, states should require explicit informed consent to forensic uses of the blood spot data. The passive, blanket consent that parents provide when being admitted to the labor and delivery department is insufficient. Given the amount of predictive data in our genomes, ethical norms of informed consent and data stewardship require NSPs to do more than assume that parents consent to secondary uses, simply by agreeing to have their newborn screened for genetic disease.

As forensic genetic methodologies continue to evolve, the line between health care and law enforcement data grows increasingly blurred. Our study reveals a public grappling with the complex trade-offs between solving crimes and protecting privacy, often favoring a utilitarian approach that prioritizes catching violent criminals over safeguarding genetic data. However, this stance risks undermining the very foundations of our health care system and constitutional protections.

The unchecked use of clinical genetic databases by law enforcement threatens to erode public trust in health care institutions, potentially discouraging individuals from seeking necessary medical care or participating in crucial public health initiatives like newborn screening programs. This is particularly concerning for marginalized communities already struggling with medical mistrust and over-policing.

To address these challenges, we propose three key reforms:

1. Congress should amend HIPAA to eliminate law enforcement exceptions, requiring police to obtain a warrant before accessing any protected health information, including genetic data. Requiring probable cause and a warrant still permits law enforcement access to private medical information when investigating crimes but only upon a showing of probable cause. This will prevent intrusive fishing expeditions and reinforce the boundaries between health care and law enforcement.

2. State legislatures should mandate explicit parental consent for newborn screening programs and any secondary use of residual blood spots, including law enforcement purposes. The risks to privacy and medical trust are too great to permit unconsented uses for purposes that are wholly unrelated to public health.

3. State legislatures should permit parents to have their child’s NSP bloodspot and data destroyed after screening. Participation in public health programs should not be conditioned on forfeiting medical privacy in ways that cannot be foreseen at the time of consent. This helps to reinforce the boundaries between the goals of law enforcement and public health and encourage participation in the screening program without forcing parents to concede their child’s genetic privacy.

These proposed reforms would help restore the boundary between health care and policing, ensuring that genetic information shared for medical purposes remains protected and off-limits from law enforcement. They would align legal protections with public expectations of privacy in sensitive health data. It also ensures that people will be able to see their doctor when they need to, and have whichever tests performed that are clinically indicated, without fear that their protected health information makes it way to the police, without a warrant. If the investigative need for the medical information is great, police can follow normal protocols for obtaining a warrant. In the balance between prosecuting crime and protecting patients, prosecutorial goals should not obviously always triumph.

The power of genetic information to solve crimes is undeniable, but so too is its potential for misuse. By implementing these proposed reforms, we can better harness the benefits of this technology while preserving the ethical foundations of health care and respecting the individual choices of parents and individuals. In an era of incredibly low trust in health care, the last thing we need is for people to associate their providers with the carceral system. The norms of medical ethics promote autonomy and consent much more than the prosecutorial goals of criminal justice. The future of genetic privacy—and public trust in health care—depends on threading the needle carefully and demanding greater informed consent and privacy protection for sensitive genetic data obtained in clinical settings. If the police want to access sensitive, private genetic information, they should have to get a warrant and make their case before a magistrate judge. It is time to block the ‘backdoor’ warrantless access through relatives’ DNA that is contained in a private medical record or a public health database.

FUNDING

This article was made possible through funding from the Utah Center for Excellence in ELSI Research (UCEER). UCEER is supported by the National Human Genome Research Institute of the NationalInstitutes of Health (NIH) under Award Number RM1HG009037. The content of this Article is solely the responsibility of the author and does not necessarily represent the official views of the NIH.

DISCLAIMER

The subject matter and content of this article do not reflect the position of the Utah Attorney General or the Office.

Footnotes