Founded in 2006, 23andMe has become the only major direct-to-consumer (DTC) genomics company left in the market. Initially, the DTC services they offered gave customers information about their ancestry as well as health — from likely drug sensitivities to predispositions to illness. But in November of 2013, the Food and Drug Administration (FDA) specifically targeted 23andMe with regulations that prevented them from offering any health data based on their testing. Since then, though they have abided by the FDA’s mandate here in the United States, the company has offered abridged versions of their previous health services to customers in Canada and the UK, with the blessings of regulators in those countries.

Thanks to the benefits of hindsight, the FDA’s decision to step into the regulatory waters surrounding 23andMe’s specific brand of DTC genomics services here in the US seems, in principle, like a good decision. Nonetheless, they went about doing so in a flawed way.

Taking a deontological standpoint, the FDA has assigned itself an absolute duty to ensure the “safety, efficacy, and security” of medical products thanks to the stated goals and responsibilities inherent in their continued existence as a regulatory body. Prior to November 2013, 23andMe consistently (and forcefully) advertised their genetic health information to potential users as accurate medical information that could benefit customers in planning for their future health needs, especially regarding sensitivities and reactions to specific medications. Unfortunately, though, according to the FDA, the company has not provided sufficient evidence to show that their claims have some sort of medical validity.

As such, the idea of FDA oversight of the company is valid. The actual methods that the Administration used to implement and justify that oversight in 2013, though, are tenuous at best. The FDA’s own definition of medical devices, for instance, in no way suggests that a webpage containing health information (regardless of that information’s validity or accuracy) can fall into the classification of a device. 23andMe’s presentation of that data in no way constitutes “an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article” — in other words, a device in and of itself — despite the fact that the company presented users’ health-related information in a way that obviously suggested its use in preventing and treating illness. The FDA’s move to block 23andMe’s distribution of health data by deeming it a medical device seems to misunderstand the the information presented to 23andMe customers at some level — it would only make sense if 23andMe had included it as a fundamental, structural part of the code for the company’s website (and thus turned their site eo ipso into a medical device). Since 23andMe did not, the FDA has no basis for classifying the element of the company’s personal genomics services they blocked as a medical device.

The conflict between these two ideas (that the FDA has a moral/organizational obligation to regulate 23andMe’s genomics testing services and that those services cannot seriously be called medical devices) leaves the FDA in a precarious position as it continues to block 23andMe’s health data. As such, a determined, ethical move seems necessary to resolve this issue in the best, most sound manner possible. Two options that seem both ethical and potentially effective are available to the FDA at present: asserting a right to oversee the process by which 23andMe derives the health information they provide to customers, or asserting a right to treat science-based information meant for health purposes as they currently treat devices.

The latter option might seem tempting to some at the FDA who want the organization to have a larger and more powerful role nationwide as the arbiter of good and bad in the medical context. Non-physician access to science-based medical information has only proliferated in recent years, meaning that pursuing that route of regulation would have profound and far-reaching consequences across the healthcare industry, potentially affecting everyone from WebMD to individual physicians or clinics. But despite those temptations, the FDA should avoid this route without specific Congressional approval for doing so. Simply put, taking that path would be too large of a divergence from current policy to stand up to legal and political scrutiny. And ultimately, such an overreach in this situation could prove deleterious for the FDA’s long-term regulatory abilities in cases where such regulation is actually warranted.

As such, the option of regulating 23andMe’s actual testing processes makes the most ethical (and also practical) sense. Those processes likely already involve tools that qualify as medical devices, meaning that the FDA would have had to approve them in the first place. It is only a small logical leap to go from regulating the design of a device to regulating its use, especially in the context of health and medicine. Doing so also continues to affirm the FDA’s commitment to helping the general public in the United States get accurate science-based information for the purposes of improving or maintaining their health. So with its deontological duty to move forward in some direction and the consequentialist warning not to proceed with regulation of the information itself, it seems that the absolute best option for the FDA in the case of 23andMe is to consider medical processes using medical devices as inherent enough in those devices to warrant their regulatory oversight.

Contact Johnathan Bowes at jbowes ‘at’ stanford.edu.