Question special

Before I read the NEJM perspective article, I hadn't really thought about how insurers/employers obtain genetic information. If you pressed me, I might have speculated that careless talk about your 23andme results around the water cooler might result in discrimination. After reading the article, I can see that I was not thinking very hard. As the authors note, "companies selling [life, disability, and long-term care insurance] may feel forced to test customers genetically in order to stratify customer risk."

Is this also the most likely way that health [not life] insurers and employers would obtain genetic information? What are some other foreseeable ways that a person's genetic data (tests ordered either by a clinician or direct to consumer) could move from place to place?

Bonus follow-up question: does GINA protect against uncontrolled sharing of genetic information, or just discrimination?