The Sky is Falling for Personal Genomics! Oh, nevermind. It’s just a cease & desist letter from the FDA to 23andMe.

FDA v LDTGenomics Law Report has paid close attention to the FDA’s potential regulation of laboratory developed tests (or LDTs) over the years. We have decided to address the most recent development – a cease and desist letter sent by the FDA to 23andMe – in two posts — by Jennifer Wagner and by John Conley.

A brief background for the newcomers

23andMe, Inc. was founded in 2006. Its personal genomics service launched in 2007 and was named Time Magazine’s Invention of the Year in 2008. Just before the Thanksgiving holiday in 2009, 23andMe split its all-in-one service into two separate editions for ancestry and health and raised its price. The following year, just before the 2010 Thanksgiving holiday, 23andMe scratched its business model with separate health and ancestry editions in favor of a return to the all-in-one service with a new mandatory annual subscription fee. By June 2011, the company boasted 100,000 users and in late 2012 lowered its price to $99 to aim for one million users. Recently, 23andMe ramped up its marketing, launching its very first TV ad campaign called “Portraits of Health” in August 2013.

Company’s run-ins with the FDA

On June 10, 2010, the company—along with several other direct-to-consumer (DTC) providers—received a cease & desist letter from the FDA. A full two years later, on July 30, 2012, the company touted it was the first of its kind to begin seeking FDA approval (i.e., 510(k) clearance) for its Personal Genome Service® (PGS). Reportedly, the FDA unsuccessfully sought additional information from 23andMe to no avail and had not heard from the company in six months. (Misha Angrist colorfully and aptly described the gist of the letter here). On November 22, 2013, 23andMe was issued a second cease & desist letter from the FDA, which indicated that the agency considered 23andMe’s pending 510(k) submissions to be withdrawn.

What’s all the fuss?

The FDA took the position in the 2010 cease & desist letter that 23andMe’s PGS (1) was a medical device under section 201(h) of the Food, Drug, & Cosmetic Act, 21 U.S.C. 321(h) and (2) was not a laboratory developed test (LDT). The FDA reiterated this assertion in the 2013 cease & desist letter. Moreover, the 2013 letter indicates the FDA classifies the 23andMe PGS as a Class III device under §513(f) of the FDCA (i.e., a medical device with the highest level of risk making it so dangerous that it cannot be allowed on the market before it has been approved).

So is 23andMe’s Personal Genome Service® a medical device or simply information or “know how”? And if a medical device, is it really a high risk, Class III medical device? The question as to whether the intended use is medical must come first. If the answer is no, the FDA has no authority to weigh the level of risk that may be involved in the service provided.

As mentioned previously by Dan Vorhaus, the FDA is relying upon §201(h) of the FDCA, which defines a medical device subject to the FDA’s authority as one “intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease…” So, if a device is not intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, it is not within FDA’s purview.

The Terms of Service to which 23andMe and its users have contractually agreed state,

“…23andMe Services are for research, informational, and educational use only. We do not provide medical advice.…As a result of the current state of genetic knowledge and understanding, our Services are for research, informational, and educational purposes only. The Services are not intended to be used by the customer for any diagnostic purpose and are not a substitute for professional medical advice. You should always seek the advice of your physician or other health care provider with any questions you may have regarding diagnosis, cure, treatment, mitigation, or prevention of any disease or other medical condition or impairment or the status of your health.”

A potential snag for 23andMe is its advertising—on its website and in its recent TV campaign—which seemingly contradicts the Terms of Service by emphasizing potential uses beyond research, education, and information. Do the terms of service keep the PGS out of FDA’s reach such that the advertising statements can be considered simple, acceptable puffery (a determination which, by the way, would be reviewable by FTC and attorneys general with their authority to provide consumer protection from unfair and deceptive trade practices)? Moreover, who decides the “intended use” to get the product or service through the FDA’s regulatory door when a product or service has multiple intended uses or when the parties (the provider and user) disagree on its intended use?

But inconsistencies are not just a problem for 23andMe. They plague the FDA in this area too. Because the FDA has been ignoring personal genetic/omic analyses for ancestry (e.g., DNA, LLC uses the same basic chip as 23andMe, Inc. as part of their ancestry analysis), the spit kit itself cannot be used as the basis for claiming the PGS service is within FDA oversight of “medical devices.” Some have said that the FDA has no interest in regulating return of raw data results, interpretations for ancestry purposes, or traits like earwax. Yet on what basis is that decision being drawn and by whom? Certainly “intended use” cannot be so broadly interpreted as to catch every product or service possibly related to one’s health with the FDA’s net. This will raise corollary questions about the boundaries of the practice of medicine [To read more about why generating and reading genotypes is not the practice of medicine, see Item 5 in my letter to the FDA in 2011]. The FDA is not regulating fitness devices and apps (such as the FitBit and Fuelband). In addition to the preliminary jurisdictional question, a big problem for the FDA exercising authoritative muscles with 23andMe and other personal genomics providers is that they do not have clear or established rules.

What regulatory game does the FDA want to play?

For years the FDA has been trying to figure out just what to do with genetic and genomic technologies. The FDA’s proposed efforts in 2006 to regulate in vitro diagnostic multivariate index assays (or IVDMIAs) in 2007 failed, and, in 2010, the FDA signaled its interest in abandoning narrow regulation of IVDMIAs in favor of broadly regulating LDTs. Congressional hearings were held in July 2010, but little tangible policy progress has been made. (See Jeffrey Gibbs’ discussion of the costs of FDA regulation of LDTs.) In March 2011, the FDA held a two-day public meeting to discuss DTC tests, such as the PGS provided by 23andMe. No formal rulemaking has yet been provided to let entrepreneurs know just what game the regulatory agency wants scientific entrepreneurs to play. As Hank Greely aptly blogged, “We’ve all been waiting . . . and waiting . . . and waiting . . . for long-promised draft FDA guidance (or regulations) on regulating genetic tests. Rumor has it that the FDA thought they were done in mid-2012.” In 2011 RUO/IUO draft guidance was issued for research use only and investigation use only in vitro diagnostics (IVDs). In August 2013—the same month that 23andMe launched is new ad campaign—members of Congress pressured the Obama administration to release draft guidance for the regulation of LDTs. There has not yet been a response. The only word we’ve received thus far is the notice from the FDA published in the Federal Register on November 25, 2013 about the distribution of in vitro diagnostic products labeled RUO/IUO “to remind manufacturers that RUO and IUO labeling must be consistent with the manufacturer’s intended use of the device.” (Coincidentally, it is a useful reminder that 23andMe uses such an RUO/IUO IVD provided by Illumina in its service.)

The FDA authority to regulate LDTs and specifically DTC services is in dispute. Even the suggestion from the FDA commissioner in June 2013 that FDA draft guidance on regulation of LDTs was forthcoming prompted fierce opposition from the American Clinical Laboratory Association. It is my interpretation that the FDA lacks authority to regulate DTC genetic tests as medical devices, including 23andMe’s Personal Genome Service®, and that limiting access to genomic information—either by restricting receipt of results to a doctor’s office or unduly delaying new products and services from coming to market—would be an unfortunate misstep. Notwithstanding my interpretation, it is noteworthy that the FDA has recently approved MiSeqDx platform by Illumina, so it would be unfair to criticize the FDA by implying it is wholly unwilling to provide clearances for genetic/genomic technologies.

For further reading on FDA oversight of genetic tests and an overview of premarket review of medical devices, see

What will 23andMe do next?

So far the response from 23andMe has been plain vanilla. In a blog post and email to consumers, the company did not show its cards as to its plans other than to say, “The FDA is an important partner for 23andMe and we will be working hard to move forward with them.” Should 23andMe decide to fight FDA jurisdiction at this stage, FDA advocates will point to 23andMe’s inconsistent actions. For example, why would 23andMe seek CLIA registration if its service were not intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease? CLIA-registered laboratories are facilities performing analyses “for the purpose of providing information for the diagnosis, prevention, or treatment of any disease or impairment of, or the assessment of the health of, human beings” (CLIA, 42 USC §263a). But 23andMe has said it is not performing the analysis for diagnosis, prevention, or treatment. 23andMe’s attempts to play an ill-suited regulatory game may come back to bite them in the corporate butt. Did 23andMe implicitly affirm FDA jurisdiction generally when it began the process to obtain 510(k) approval? I don’t think so, but the argument could be raised nonetheless. And what’s the deal with the ad campaign? Was it intended to be an act of aggression, an act to snub the FDA after years of cooperation? Those of us outside of the company just don’t have enough information to know whether silence and ramping up marketing was a deliberate decision to disregard the FDA or whether something else is going on.

At the end of the day, does it really matter?

The public has bigger pulls on their attention and money than the regulation of genetic/omic services like 23andMe, so ultimately I don’t see huge public outcry forthcoming. And while some people are arguing that the SNP-era is ending—Yes, yes, ok. We get it. Whole genome sequencing is the new hotness—SNP-based analysis will continue to be used and provide valuable information. Some people say it will signal the end of personal genomics and that, if we’re interested, we should rush to buy kits while we can. I’m not convinced the sky is falling…yet.

Where do we point fingers and, more importantly, should we?

Proactive policymaking and clear communication of expectations is essential (we all understand that it is hard to hit a moving or invisible target). So who dropped the ball for the past quarter century? Fingers can be pointed in many directions. Sure, Congress can be blamed for not delegating clear oversight authority for genetic and genomic technologies to any administrative agency. That omission means that administrative agencies can only act by forcing the products or services into preexisting categories under which the agencies do have control. In practice this means that the agencies have plausible deniability to ignore responsibilities (“sorry, that’s not our job”) while simultaneously enjoying de facto authority to meddle in other areas (“we’ll take that regulatory power, thank you very much”). It’s hard to argue that fingers should not also then be pointed at the FDA (responsible for enforcing the Food, Drug, and Cosmetic Act or FDCA), the Center for Medicare and Medicaid Services (responsible for enforcing the Clinical Laboratory Improvement Amendments or CLIA), and the Federal Trade Commission (responsible for enforcing the Federal Trade Commission Act or FTCA) for not coordinating a clear strategy of complementary, non-duplicative oversight and for delaying policy guidance. Professional scientific organizations could share the blame by not taking sufficient efforts to educate legislative and regulatory bodies about genetic/omic technologies, initiate the development of an oversight framework, and subsequently lobby for its implementation. While we are at it, let’s point fingers at ourselves for not demanding better.

The current 23andMe and FDA brouhaha should serve as a loud wake-up call to all of us. What are our policy priorities? What kind of society do we want to foster? Is the infrastructure designed in the early 20th century flexible enough to handle the problems and dangers of 2013 and beyond, or is it time to take policymaking seriously and develop a new, new deal for the new millennium? There are many fundamental and multifaceted questions that we must ask ourselves that are not limited to genetic and genomic technologies. We must think through the various levels upon which constraints on any science and technology could be targeted (e.g., on the act itself, on the actors, on the subjects, and on the purposes/goals for the acts).

One of the critical questions is what approach is appropriate when dealing with the integration of scientific technologies into society: precautionary/paternalism, libertarian/individualistic, or something else? The precautionary principle or approach prevents delivery of products and services until innovators and entrepreneurs are able to demonstrate that their products and services are safe. Such hard paternalism overrules the individual’s perspectives (e.g., which range the full spectrum from risk-avoiding to risk-seeking) with the collective’s perspective of what risk is acceptable. The default setting can be viewed as a barrier to entry (or a constraint on individual autonomy). By contrast, a libertarian approach would prevent government interference with access to products and services until it is proven that the products and services are not safe. Such a perspective overrules the collective in favor of individual autonomy. The default setting can be viewed as a barrier to regulation (or a general constraint on government authority). Yet we must acknowledge that this is a spectrum of perspectives and approaches, not a dichotomy. Scientists who speak out against the precautionary approach are often accused of being opposed to regulation. That’s not necessarily the case. For example, a moderate wait-and-see approach permits delivery of products and services while allowing government interference to monitor, collect data, evaluate, and reassess whether existing safeguards sufficiently mitigate risks of harms. If speculated harms actually materialize and are not adequately addressed by other remedies (e.g., civil actions in torts, contracts, professional malpractice, etc.), at that point we can engage in informed data-driven policymaking and decide what additional safeguards (or modifications to existing safeguards) are warranted. Proactive policymaking does not require a precautionary approach but, rather, a deliberate approach to manage risks.

We have six years of experience with 23andMe specifically, so what do we know? What data are available to inform policymaking at this stage? Are the hypothetical and actual harms sufficient to justify redirection of existing political resources to that area? If the current US population is 317 million people and assuming 23andMe’s customer base reaches its goal of one million people, that would be a policy priority for a very small fraction (just ~0.32%) of the population (the company had 400,000 genotyped users as of September 2013, which would be just ~0.13% of the US population). Do we anticipate that there will be a surge in demand sufficient to justify overlooking the tiny segment of society that the proposed regulatory mechanisms would address? Leila Jamal has asked recently in a thoughtful post, what will we gain or lose by regulating 23andMe? Perhaps to mitigate the problems so many fear by allowing widespread access to genomic information we prioritize education to improve our society’s ethical and scientific literacy.

A second critical question involves our civil rights and liberties: to what extent is our society respecting and acknowledging an individual’s right to access information about themselves and, potentially, about their health? To what extent should parties (e.g., 23andMe and its users) be permitted to determine their own contractual terms, including waivers of regulatory or statutory protections specifically involving an individual’s health decisions? The medicalization of our genomes and obstacles to access to and sharing of that information are contrary to numerous human rights principles, including

The Universal Declaration of Human Rights (UDHR)

Article 27 (1): “Everyone has the right to participate in…and to share in scientific advancement and its benefits.”

The International Covenant on Civil and Political Rights (ICCPR)

Article 19(2): “Everyone shall have the right …to seek, receive and impart information and ideas of all kinds, regardless of frontiers…through any other media of his choice.”

The International Covenant on Economic, Social, and Cultural Rights (ICESCR)

Article 15. 1: “The States Parties to the present Covenant recognize the right of everyone… (b) To enjoy the benefits of scientific progress and its applications…”

First amendment freedom of speech and expression could be a very big part of how an FDA v. 23andMe battle would play out, should 23andMe (or perhaps even its customers) choose to fight. Expect to see many more conversations about the democratization of science and healthcare, with individuals (research participants, patients, and customers) fighting for access to data and demanding data sharing options. Also expect to see a renewal of conversations about whether interpreting an individual’s genomic information is the practice of medicine or whether licensure of the genetics/omics profession would be a potentially valuable self-policing alternative to governmental oversight by ensuring that those providing genetic/omic services for a fee (regardless of setting) are using reasonable methods and judgment and receiving adequate continuing education.

For further reading on the reactions to the FDA’s cease & desist letter to 23andMe, see