OurGenes Study - UHN, Toronto

[Debra Turnbull]

One of PAN's working groups was asked to take a look at the following consent materials and provide feedback. This is an electronic consent form worth sharing.

The comments below were those received by members of the group:

By signing this authorization (“Authorization”), I authorize University Health Network to disclose my genetic and DNA information, including my whole exome sequence, biological sample, test results, and genetic test orders; and my demographic information, including my name, date of birth, sex assigned at birth, and contact information (collectively, “My Information”) to Helix to collect, use, disclose, and retain for the purposes of providing genetic insights, analyses, and products which I request or purchase; managing and providing services in connection with the Helix platform; and identifying research opportunities or products, for which I may be eligible or that may be of interest to me, and to contact me about those research opportunities or products.

This paragraph clearly states that you give away your rights for them to produce a product for sale - with profits going to them and not you. You are giving away your genetic information to a commercial, for-profit organization for their benefit. TCPS2 will not protect you in this case.

I further authorize Helix to combine My Information with any other demographic, genetic, or health information it has about me for the purposes described in this Authorization and to retain My Information as long as necessary for these purposes. I understand that once My Information has been disclosed, it may be subject to redisclosure and federal privacy laws may no longer protect My Information. However, Helix will not further disclose My Information without my authorization unless required or permitted to do so under applicable law.

"As long as necessary" is at their discretion and you will not know how long that is: 10 years, 25 years? we don't know.

"Subject to redisclosure" means you give them the right to ship your genetic data to the U.S. Canada's and Ontario's privacy laws can not stop this. There is no legal protection if you agree.

If you click that ACCEPT button - you are agreeing to everything that they are proposing.
........................
Other comments received by members were:

• ...this gives them additional rights on top of the UHN consent form, which was already an awful lot.  And the wording of their revocation is written in such a way that the only thing it revokes is their obligation to return info to UHN, it won't stop them retaining any info they've received (which is both your genome and your medical record), creating products with it or sharing it with others. It's one of most mercenary and exploitative authorizations I've yet seen, but given the fact that they're a profit-driven US org, that doesn't really surprise me.
  ....................

• I find it interesting that the authorisation form does not fully take into account patient privacy and safety. The consent form allows very broad sharing of sensitive genetic information, including whole‑exome data and personal details, without clearly limiting how that information can be used or combined with other data Helix already holds. This creates unnecessary risk, especially since the form also states that federal privacy laws may no longer protect the data once it is shared. This itself is of grave concern to me as a patient.

Patients are told their information may be kept “as long as necessary,” but this phrase is vague and could allow indefinite retention of highly sensitive genetic material. In addition, while authorisation is revokable, the form makes it clear that revocation does not stop Helix from continuing to use data already received. This limits meaningful control by the patients. The consent also does not explain the real‑world risks of combining genetic data with demographic information, such as likelihood of increased re‑identification.

Finally, clicking “Accept” immediately signs the authorization, but given the sensitivity of genetic data, patients would benefit from clearer explanations of risks and stronger safeguards before agreeing.

I believe that adding limits on secondary use, defining retention periods, improving revocation rights, and providing clearer explanations of privacy risks would significantly improve patient protection and trust.
...........................................

*It raises questions for me as to whether UNH fully understands what the concerns are with regards to sharing information with a US company. Particularly the comments that federal privacy laws may no longer offer protection.
..............................................

• It sounds like Helix uses a third party for the actual genetic testing.

When your results are ready, you will be able to login using your secure username and
password. The results will tell you if any variants were found in one of the tested genes
related to the three conditions. Helix works with a clinical laboratory as a service provider to assist with genetic interpretations and confirmatory testing to generate your FH results. The name of the interpretation laboratory will be on your report.

Who are they? Where are they?
What can they use your genetic information for?
I would want Helix to share the security agreements between Helix and the third party.
......................................

• once your data has crossed into the U.S., the Patriot Act can be used to access you DNA profile. Remember, the wing-nut in the White House will use any tool at his disposal. Your DNA profile can be exposed to any nefarious actors.