23andMe offers to connect users’ DNA data with medical records | STAT

What Prostate Cancer Patients Really Need to Know

Genomics & Privacy

A new announcement promises to combine your DNA data with your health records. Here's why it's far less useful — and far more complicated — than it sounds for men managing prostate cancer.

IPCSG Newsletter · Patient Education Article | Reading time: ~12 minutes

Bottom Line Up Front (BLUF)

On May 20, 2026, 23andMe announced a partnership with HealthEx to let customers link their electronic medical records to their genetic profiles, calling it a "360-degree view" of personal health. For most prostate cancer patients, this offer falls significantly short on the science and carries real privacy concerns.

The core problem: The genetic information that guides modern prostate cancer decisions — mutations in BRCA2, ATM, PALB2, CHEK2, HOXB13, mismatch repair genes, and others — requires comprehensive next-generation DNA sequencing. 23andMe uses a different and more limited technology called SNP genotyping that checks selected positions in your DNA but does not sequence entire genes. The result is a test that can miss the vast majority of clinically actionable variants. Adding your doctor's visit records to an incomplete genetic test does not fix the underlying limitation.

Privacy is the other concern: 23andMe is not a HIPAA-covered entity. The company emerged from a turbulent 2025 bankruptcy, a major 6.9-million-person data breach, and a $30 million settlement. Uploading your complete medical history — diagnoses, labs, medications — into a platform without healthcare-grade legal protections deserves serious thought before you click "Connect."

What to do instead: If you have prostate cancer and have not had clinical-grade germline genetic testing, talk to your oncologist or a certified genetic counselor about a proper multigene panel through a CLIA-certified laboratory. That is the test that actually guides treatment choices and may help your family members as well.

What 23andMe Announced — and What It Actually Does

On May 20, 2026, 23andMe Research Institute — the nonprofit entity that now operates the 23andMe consumer genetics platform — announced a partnership with a startup called HealthEx.^[1] The plan: allow 23andMe customers to import their electronic medical records directly into their 23andMe profile, creating what the company calls a "360-degree view" of personal health. The feature will use the federal Trusted Exchange Framework and Common Agreement (TEFCA), a government interoperability standard, to pull in real-world data such as blood lab results and medical history from your healthcare providers.^[2]

The company is also developing an AI-written "23andMe Health Summary" that will synthesize your genetics, medical records, labs, and lifestyle survey data into personalized recommendations. This feature is currently in beta testing.^[1]

On its face, this sounds useful: combining DNA data with actual medical history could theoretically help catch patterns that neither source could identify alone. For prostate cancer management specifically, however, the promise falls apart at the first critical question — what kind of genetic data does 23andMe actually generate?

The Fundamental Limitation: Genotyping Is Not Sequencing

This distinction is not a technicality. It is the difference between a useful clinical tool and a test that can give you false reassurance.

When your oncologist or a genetic counselor orders a germline genetic test for prostate cancer risk, they typically order a multigene next-generation sequencing (NGS) panel. This technology reads the actual sequence of DNA letters across the entire length of genes such as BRCA1, BRCA2, ATM, PALB2, CHEK2, and HOXB13. These genes collectively have thousands of known pathogenic (disease-causing) variants — plus new ones discovered regularly.

23andMe uses a technology called SNP (Single Nucleotide Polymorphism) genotyping. Rather than reading the full sequence of a gene, a SNP array checks specific, pre-selected positions in your genome — essentially answering yes/no questions about positions already known to be relevant.^[3] 23andMe's FDA-authorized BRCA1/BRCA2 report — even after a 2023 expansion — checks 44 selected variants out of the more than 1,000 known pathogenic variants in those two genes.^[4]

As Dr. Mary-Claire King — the researcher who first discovered BRCA1 in 1990 — put it bluntly when 23andMe first received FDA authorization for this type of test: "SNP genotyping is no way to carry out mutation detection for genes like BRCA1 and BRCA2. SNP genotyping is not sequencing."^[5]

⚠ What a "Negative" 23andMe Result Does Not Mean

If you tested negative on 23andMe's BRCA1/BRCA2 report, that result does not rule out a pathogenic BRCA variant. The FDA's own language on this test states explicitly: "The test should not be used as a substitute for seeing your doctor for cancer screenings or counseling on genetic and lifestyle factors."^[5]

A man who carries a clinically significant BRCA2 deletion, frameshift, or splice-site mutation not among the 44 checked variants would receive a "no variants detected" result from 23andMe while still carrying a mutation that dramatically raises his risk and could qualify him for PARP inhibitor therapy.

Why Germline Genetics Matters So Much in Prostate Cancer Right Now

The last decade has transformed prostate cancer from a disease managed almost entirely by PSA levels, Gleason score, and scan results into one in which your personal genetic makeup — both in the tumor itself and inherited in every cell — increasingly determines your treatment options, surveillance strategy, and family members' risk. Understanding this context makes clear how high the stakes are for accurate genetic testing.

What the NCCN, ASCO, and ESMO Now Recommend

The National Comprehensive Cancer Network (NCCN) guidelines — the standard-setting authority for cancer care in the United States — were significantly updated in Version 2.2026 (published February 2026). NCCN now recommends germline multigene testing for all men with high- or very-high-risk localized prostate cancer, all men with regional or metastatic disease, and men with a diagnosis combined with family history or ancestry patterns (including Ashkenazi Jewish descent) associated with hereditary risk.^[6,7]

The minimum gene panel recommended by NCCN includes: BRCA1, BRCA2, ATM, PALB2, CHEK2, MLH1, MSH2, MSH6, and PMS2.^[8] Additional genes such as HOXB13 and TP53 are often included based on clinical context. Both ASCO and ESMO reinforced in 2025 that genetic testing is no longer a specialty add-on — it is standard of care across the disease continuum.^[9]

How Mutations in These Genes Change Treatment

Gene	Elevated PCa Risk?	Treatment Implication	Detected by 23andMe?
BRCA2	Yes — OR ~5.8×^[10]	PARP inhibitor eligibility (olaparib, rucaparib, niraparib); annual PSA screening from age 40	Partial — 44 of 1,000+ variants
BRCA1	Yes — OR ~5.5×^[10]	PARP inhibitor eligibility; cascade testing for family	Partial — selected variants only
ATM	Yes — OR ~2.2–3.8×^[10,11]	PARP inhibitor eligibility; PSA screening from age 40 may be considered	Not clinically covered
PALB2	Yes (emerging evidence)	PARP inhibitor eligibility; genetic counseling for family	Not clinically covered
CHEK2	Moderate — OR ~1.9×^[11]	Heightened surveillance; family counseling	Not clinically covered
HOXB13	Yes — OR ~4.1×^[11]	Elevated familial risk; surveillance decisions	Not clinically covered
MLH1/MSH2/MSH6/PMS2 (Lynch syndrome)	MSH2 especially — OR ~3.6×^[11]	Immunotherapy eligibility (pembrolizumab); colorectal/other cancer surveillance	Not clinically covered

The practical impact of these mutations is substantial. A man with metastatic castration-resistant prostate cancer and a pathogenic BRCA2 mutation may be eligible for PARP inhibitor therapy, which has demonstrated meaningful improvements in progression-free survival in the PROfound trial (median overall survival 19.1 vs. 14.7 months in the BRCA/ATM arm).^[9] For Lynch syndrome carriers, pembrolizumab (Keytruda) — an immunotherapy — is an option. These are not minor considerations; they can meaningfully change a man's treatment trajectory.

ℹ The Two Types of Genetic Testing in Prostate Cancer

Germline testing — a blood or saliva sample that reveals mutations you were born with, inherited from a parent, and potentially passed to your children. This is what NCCN guidelines require and what 23andMe attempts (incompletely) to address.

Somatic (tumor) testing — performed on prostate tissue, biopsy samples, or circulating tumor DNA from blood, revealing mutations that arose in the cancer itself. Important for treatment decisions in metastatic disease. 23andMe does not perform this type of testing at all.

Both are often needed. Research shows that germline-only testing misses nearly half of BRCA1/2 alterations detectable in the tumor, while somatic-only testing misses 8-17% of inherited pathogenic variants.^[9] This is why leading oncologists recommend concurrent germline and somatic testing in metastatic prostate cancer.

The Turbulent History of 23andMe's Data: What You Need to Know

For prostate cancer patients considering uploading their medical records to 23andMe, the company's recent history is directly relevant. This is not a cautionary tale about a hypothetical future problem — it is a documented record of what has already happened to sensitive genetic information in the consumer market.

October 2023

23andMe disclosed a data breach in which a hacker accessed approximately 6.9 million user accounts through a technique called "credential stuffing" — using passwords stolen from other websites. The exposed data included ancestral information, health predispositions, and family connection data.^[12]

March 2025

23andMe filed for Chapter 11 bankruptcy protection after years of falling revenues and a failed acquisition attempt. The company held genetic data on more than 15 million customers when it entered bankruptcy — a novel and deeply unsettling situation that privacy and legal experts said existing law was unprepared to handle.^[13,14]

July 2025

The U.S. Bankruptcy Court for the Eastern District of Missouri approved the sale of 23andMe's assets — including the genetic database — to TTAM Research Institute, a nonprofit created and controlled by 23andMe's own founder and former CEO Anne Wojcicki, for $305 million. Several states, including California, challenged the sale citing genetic privacy laws; all challenges were ultimately overruled.^[15]

January 2026

A $30 million class action settlement for the 2023 data breach received final court approval. Eligible customers who submitted claims by the February 17, 2026 deadline may receive between $100 and $10,000, plus five years of genetic monitoring services — though payment timeline remains uncertain due to ongoing bankruptcy proceedings.^[16]

May 2026

Now operating as 23andMe Research Institute under TTAM, the company announces the HealthEx partnership — inviting customers to connect their full medical records to the existing genetic profile database.^[1,2]

The Legal Protections Gap

Many patients understandably assume that health data is protected by the Health Insurance Portability and Accountability Act (HIPAA). This is a reasonable assumption — and an incorrect one when it comes to consumer genetic testing companies. HIPAA applies to healthcare providers, health plans, and their business associates. Direct-to-consumer (DTC) genetic testing companies like 23andMe are not classified as HIPAA-covered entities.^[17]

The Genetic Information Nondiscrimination Act (GINA) offers some protection — it prohibits health insurers and employers from using genetic information to discriminate. But GINA does not regulate how DTC companies store, use, or transfer that information.^[18] There is no federal law that comprehensively protects genetic data held by consumer companies, a gap highlighted in congressional testimony and a September 2025 commentary in the journal Science.^[19]

⚠ What Uploading Your Medical Records Would Mean

The proposed 23andMe–HealthEx integration would, if you opt in, connect your complete electronic medical record — potentially including your prostate cancer diagnosis, treatment history, PSA labs, pathology reports, medications, and specialist visit notes — to a platform that is not HIPAA-covered and that has already experienced a significant data breach affecting millions of users.

This does not mean the platform will be breached again. It means you should make an informed choice, not an inadvertent one. The HealthEx integration will require active opt-in consent — but patients who remember giving consent to 23andMe in 2015 or 2020 may not be thinking carefully about what the company's ownership structure looks like today.

Side-by-Side: Consumer DTC Testing vs. Clinical Germline Testing

23andMe (DTC Genotyping)

SNP array — checks selected pre-defined positions
BRCA1/BRCA2: covers 44 of 1,000+ known variants
Does not test ATM, PALB2, CHEK2, HOXB13 for clinical reporting
Does not test mismatch repair (Lynch syndrome) genes
Results not intended for medical decisions per FDA labeling
Not HIPAA-covered; governed by company privacy policy
No genetic counseling included
A "no variants detected" result may be false reassurance

Clinical Multigene NGS Panel

Next-generation sequencing of complete gene sequences
BRCA1/BRCA2: detects full spectrum of pathogenic variants
Tests all NCCN-recommended genes: ATM, PALB2, CHEK2, HOXB13
Includes mismatch repair genes (MLH1, MSH2, MSH6, PMS2)
Results intended and used for clinical decision-making
Performed by CLIA-certified laboratories
Genetic counseling typically included or accessible
Negative result is meaningfully informative across tested genes

Leading clinical laboratories offering comprehensive prostate cancer germline panels include Myriad Genetics (myRisk), Invitae, GeneDx, and Ambry Genetics, among others. These tests are ordered through your oncologist or a genetic counselor and typically covered by insurance when NCCN criteria are met. The test is a simple blood or saliva sample — no different procedurally from a 23andMe kit — but the analysis behind it is fundamentally different.

Can Combining Medical Records Add Any Value?

To be fair to 23andMe's concept: the theoretical idea of integrating genetics with longitudinal clinical data is scientifically legitimate and has genuine research value. Large population studies — like the UK Biobank, the NIH's All of Us Research Program, and 23andMe's own internal research database — have produced important insights by combining both types of information at scale.^[11]

The concern for individual prostate cancer patients is not that the data combination is inherently useless — it is that the consumer-facing product rests on an incomplete genomic foundation. An AI health summary built on a SNP array that misses most actionable variants, combined with your lab results, will not tell you that you are a candidate for olaparib. Only a clinical test designed and validated for that purpose can do that.

There is also the "false completeness" risk: a man who has done 23andMe and sees a reassuring AI Health Summary may be less likely to ask his oncologist about clinical germline testing — precisely the test he actually needs. The consumer genetics industry has a documented history of this concern, with patient advocacy organizations such as FORCE (Facing Our Risk of Cancer Empowered) noting ongoing confusion in online communities between DTC results and clinical-grade testing.^[5]

💡 A Note on Research Participation

23andMe's research database has contributed to legitimate scientific publications, and the company's partnership with HealthEx has potential value for population-level biomedical research — understanding how genetic variants interact with real-world health trajectories at scale. If you are motivated by contributing to research rather than personal clinical guidance, that is a different conversation. But be clear-eyed about which purpose you are serving, and weigh the privacy trade-off accordingly.

What Prostate Cancer Patients Should Actually Do

✓ Action Checklist

Have you had clinical germline testing? If you have been diagnosed with prostate cancer — especially intermediate, high-risk, or metastatic disease — ask your oncologist whether you meet NCCN criteria for germline multigene panel testing. This is now standard of care for many patients.
Request a referral to genetic counseling. A board-certified genetic counselor will help you choose the right panel, interpret results, and understand what findings mean for your family members. Your oncologist can provide a referral, or you can find a counselor at findageneticcounselor.nsgc.org.
Ask about somatic tumor testing if you have metastatic disease. Your oncologist should discuss tumor genomic profiling (Guardant360, FoundationOne, or similar) to identify somatic mutations that may qualify you for PARP inhibitors, immunotherapy, or other targeted treatments.
If you are already a 23andMe customer and considering the HealthEx integration: understand that 23andMe is not a HIPAA-covered entity. Consider what medical information you are comfortable uploading to a non-clinical platform and whether that provides value worth the privacy trade-off.
Don't confuse 23andMe results with clinical germline testing. A negative 23andMe result does not mean you don't carry a clinically significant mutation. If your oncologist recommends testing, complete it through a clinical laboratory regardless of any prior 23andMe results.
Consider deleting your 23andMe data if you have concerns about the post-bankruptcy ownership situation and do not wish to participate in the research database. 23andMe and TTAM state users can delete their data at any time; the process is available through your account settings.

The Bottom Line

23andMe's HealthEx announcement is not without merit as a vision for integrated personal health management. The idea of connecting genetic context with clinical history has genuine scientific promise at the research level. But for prostate cancer patients making real treatment decisions in 2026, the product as described does not deliver on its marketing.

The genetic testing that matters for prostate cancer — the testing that determines PARP inhibitor eligibility, Lynch syndrome screening needs, family member risk, and PSA surveillance intensity — requires comprehensive next-generation sequencing of a validated clinical gene panel. 23andMe's SNP genotyping platform, however polished its AI health summary becomes, is not that test. Adding your medical records to an incomplete genomic foundation does not make it complete.

Prostate cancer has entered a genuinely precision era. The tools that medicine has developed — comprehensive germline panels, somatic tumor profiling, PARP inhibitors, immunotherapy for MMR-deficient cancers — are real and available. Getting access to those tools starts with the right test, ordered through the right channel, with proper clinical context and genetic counseling. That is the "360-degree view" that actually moves the needle for men living with this disease.

Verified Sources and Citations

All sources verified as of May 20, 2026. Clinical guidelines reflect NCCN Version 2.2026 and ASCO/ESMO 2025 updates.

[1] Herper, M. "23andMe offers to connect users' DNA data with medical records." STAT News, May 19, 2026. https://www.statnews.com/2026/05/19/23andme-healthex-to-connect-dna-data-with-health-records/
[2] Globe Newswire / 23andMe Research Institute. "23andMe Partners with HealthEx to Connect Medical Records with Your DNA for the Future of Personalized Medicine." Press Release, May 20, 2026. Via The Manila Times / GlobeNewswire
[3] 23andMe Customer Care. "About the 23andMe Health Service." https://customercare.23andme.com/hc/en-us/articles/115013683107
[4] 23andMe Investor Relations. "23andMe Granted New FDA Clearance to Report Additional BRCA Variants." August 31, 2023. https://investors.23andme.com/news-releases/news-release-details/23andme-granted-new-fda-clearance-report-additional-brca
[5] Genomeweb / 360Dx. "Oncology Community Sees Potential for Patient Harm in FDA OK of 23andMe BRCA Test." https://www.360dx.com/molecular-diagnostics/oncology-community-sees-potential-patient-harm-fda-ok-23andme-brca-test
[6] NCCN Guidelines Insights. "Genetic/Familial High-Risk Assessment: Breast, Ovarian, Pancreatic, and Prostate, Version 2.2026." Journal of the National Comprehensive Cancer Network, 24(2), February 2026. https://jnccn.org/view/journals/jnccn/24/2/article-p2.xml
[7] Myriad Genetics. "Using Prostate Cancer Gene Testing to Guide Treatment Decisions: Insights as We Head into 2026." October 2025. https://myriad.com/myriad-genetics-blog/using-prostate-cancer-gene-testing-to-guide-treatment-decisions
[8] NCI/PDQ. "Genetics of Prostate Cancer: Table 2 — Indications for Prostate Cancer Genetic Testing." https://www.ncbi.nlm.nih.gov/books/NBK65784/table/CDR0000299612__1845/
[9] Paller, C.J. (presenter). "Germline and Somatic Genetic Testing in Advanced Prostate Cancer: Practical Considerations and Challenges." ESMO 2025 Conference Highlights. UroToday, October 21, 2025. https://www.urotoday.com/conference-highlights/esmo-2025/esmo-2025-prostate-cancer/164181
[10] Darst, B.F. et al. "Rare Germline Pathogenic Variants Identified by Multigene Panel Testing and the Risk of Aggressive Prostate Cancer." PMC, PMC8036662. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8036662/
[11] Hoffman-Andrews, L. et al. "Germline Testing for Prostate Cancer Patients: Evidence-Based Evaluation of Genes Recommended by NCCN Guidelines." PMC, PMC12278705. https://pmc.ncbi.nlm.nih.gov/articles/PMC12278705/
[12] Security.org. "23andMe Data Breach: What Was Exposed, Who Was Affected, and What Happens to Your DNA Now." Updated March 2026. https://www.security.org/identity-theft/breach/23andme/
[13] Harvard Kennedy School / Mossavar-Rahmani Center. "23andMe's Bankruptcy Raises Concerns About Privacy in the Era of Big Data." May 2025. https://www.hks.harvard.edu/centers/mrcbg/programs/growthpolicy/23andmes-bankruptcy-raises-concerns-about-privacy-era-big-data
[14] Gerke, S., Jacoby, M.B., Cohen, I.G. "The precarious future of consumer genetic privacy." Science, 389(6765): 1092–1094, September 11, 2025. https://www.science.org/doi/10.1126/science.adz7229
[15] Foley Hoag LLP. "23andMe Bankruptcy Update: How the Proceedings Highlight Best Practices for Handling and Transferring Genetic Data." July 18, 2025. https://foleyhoag.com/news-and-insights/publications/alerts-and-updates/2025/july/
[16] AllAboutLawyer.com. "23andMe Class Action Lawsuit Settlement, $30M Payout Approved." March 2026. https://allaboutlawyer.com/23andme-class-action-lawsuit-settlement-30m-payout-approved
[17] EPIC (Electronic Privacy Information Center). "Somebody Spilled the Genes: 23andMe's Downturn Highlights Insufficient Privacy and Data Security Safeguards for Consumer Genetic Data." https://epic.org/somebody-spilled-the-genes-23andmes-downturn
[18] Claremont Journal of Law and Public Policy. "Genes, Ownership, and Privacy: Why HIPAA Should Be Expanded to Direct-to-Consumer Genetic Information Companies." 2025. https://claremontlawjournal.sites.pomona.edu/?p=418
[19] TechPolicy.Press. "The 23andMe Collapse Exposes the Cracks in Genomic Data Governance." December 23, 2025. https://www.techpolicy.press/the-23andme-collapse-exposes-the-cracks-in-genomic-data-governance/
[20] Stout, L.A. et al. "Clinically significant germline pathogenic variants are missed by tumor genomic sequencing." NPJ Genomic Medicine, October 13, 2023. PMC10575977. https://www.ncbi.nlm.nih.gov/pmc/articles/PMC10575977/
[21] Giri, V.N. et al. "Implementation of Universal Germline Genetic Testing Into Standard of Care for Patients With Prostate Cancer: The Time Is Now." JCO Oncology Practice, 2025. https://ascopubs.org/doi/10.1200/OP-24-00626
[22] Public Citizen. "House Must Update Bankruptcy Code in Wake of 23andMe DNA Data Sale." November 1, 2025. https://www.citizen.org/article/house-must-update-bankruptcy-code-in-wake-of-23andme-dna-data-sale/

Search This Blog

Informed Prostate Cancer Patient Support

23andMe's New Medical Records Feature: Look Before You Click