- Letter from the Committee on Energy and Commerce of the United States House of Representatives–May 19, 2010
- Letter from the Committee on Energy and Commerce of the United States House of Representatives–June, 14, 2010
June 28, 2010
Hon. Henry A. Waxman, Chairman House Committee on Energy and Commerce 2125 Rayburn House Office Building Washington, DC 20515-6115
Hon. Bart Stupak, Chairman Subcommittee on Oversight and Investigations 2125 Rayburn House Office Building Washington, DC 20515-6115
Hon. Joe Barton, Ranking Member House Committee on Energy and Commerce 2125 Rayburn House Office Building Washington, DC 20515-6115
Hon. Michael C. Burgess, Ranking Member Subcommittee on Oversight and Investigations 2125 Rayburn House Office Building Washington, DC 20515-6115
Re: June 14, 2010 letter request to Anne Wojcicki, President, 23andMe, Inc.
Dear Chairman Waxman, Ranking Member Barton, Chairman Stupak and Ranking Member Burgess:
On June 14, 2010, you sent a letter request to Anne Wojcicki, President of 23andMe, Inc. (“23andMe” or “the Company”), seeking information related to a June 8, 2010 announcement by the Company relating to a number of customer DNA samples. While we are in the process of producing responsive documents, the Company would like to take this opportunity to explain the incident. At the outset, we understand that a representative of the laboratory processing and analysis company that 23andMe uses will meet with you this week and will certainly be in the best position to discuss the issues that occurred within their facility. Our description of events at the laboratory is limited to 23andMe’s own understanding of what happened there.
I. How 23andMe’s Collection of Customer DNA Samples and NGI’s Processing and Analysis Operate
Preliminarily, we thought it would help to provide a step-by-step explanation of how 23andMe operates with respect to the collection of customer DNA samples and their processing and analysis by the Company’s third-party laboratory vendor, the National Genetics Institute (“NGI”) a wholly owned subsidiary of the Laboratory Corporation of America.
First, customers visit the 23andMe website and purchase one of three products for personalized genetic testing. 23andMe then sends to each customer a kit to collect a DNA sample, including a vial for saliva marked with a unique barcode, from which customer DNA will be extracted and analyzed by NGI. The customer deposits a sample of saliva in the vial and then sends it directly to NGI. The Company uses the unique barcode on each saliva collection vial to track and distinguish each customer’s unique data while maintaining customer privacy.
NGI is a Clinical Laboratory Improvement Amendments Program-certified laboratory that
provides advanced clinical genetics testing services for blood screening, medical testing, and clinical research. Licensed as a clinical laboratory provider by both state and federal agencies, NGI participates in a number of approved quality control programs, and holds active Biologics Licenses from the U.S. Food and Drug Administration for screening of plasma for blood borne infectious agents. It also provides advanced genetic testing services to physicians, hospitals, and clinics and has supported numerous pharmaceutical and biotechnology companies in the clinical development of new infectious disease and oncology therapies. (see http://www.ngi.com/services/index.asp). We understand NGI complies with strict professional, regulatory, and corporate quality-assurance standards. 23andMe employees and consultants do not participate in the processing and analysis of data at NGI, although we rely on the data returned.
Upon receipt of the saliva samples, NGI logs them by their assigned bar codes into NGI’s system, and then processes them through “amplification,” extracting the customers’ DNA from their saliva samples. Each customer’s DNA is then placed by pipette into an assigned slot contained on a well plate. The well plates used by NGI for testing of 23andMe customer samples are 5”x7”, and contain 96 slots to allow for the processing of up to 96 customer DNA samples per plate. These well plates are then inserted into Illumina-platform equipment for analysis of nearly 600,000 data points that 23andMe provides to its customers.
After NGI completes the analysis, the collected data for each sample is linked to its accompanying bar code, and NGI electronically sends the data encrypted to 23andMe through a secure FTP site. A single electronic file contains the data from one well plate. Upon receiving this data, 23andMe matches each barcode to the customer it belongs to, and then uploads the data from each barcode to the customer’s individual account. Finally, 23andMe sends emails to its customers notifying them that their data are loaded and ready for viewing.
II. Factual Background of the June 2010 Incident
In brief, the June 2010 incident was caused by the human error of one of NGI’s certified technicians accidentally and wrongly inverting one well plate, which contained 96 customer DNA samples, nine of which failed processing by 180 degrees. This led to the Company’s receipt of incorrect results, which were then transmitted to customers. However, 23andMe responded rapidly to the problem, advised consumers of the problem, removed the inaccurate results in less than 24 hours, and provided those impacted with their correct results within six (6) days. While 23andMe takes the incident seriously, the Company rapidly resolved it. Since the incident, both 23andMe and NGI have further strengthened their quality control systems to avoid any further such problems.
The aforementioned inversion of the well plate by 180 degrees caused NGI’s computer to assign DNA information to incorrect barcodes, as the slots were assigned to barcodes in the computer before plate insertion. I note that the plate inversion could have happened in any such lab for any such tests coming from any hospital, doctor’s office, or other NGI client — it was not a problem uniquely related to 23andMe samples. Unfortunately, NGI did not detect the error before it transmitted the erroneous electronic data file from the inverted plate to 23andMe. The Company received the NGI-generated, faulty data and uploaded it to each customer’s individual account and emailed those customers that their data was available. Customers received these emails between 6 and 9 p.m. on the evening of June 1.
Early in the morning of June 2, 23andMe’s Director of Engineering, Alex Khomenko, checked his email and was alerted that several 23andMe customers had apparently received inaccurate genetic reports. For example, in at least one instance, a customer had received genetic data indicating that the customer was the wrong sex. That same morning, Mr. Khomenko contacted the Company’s Customer Service Manager, Michelle Klucsor, who said she had received similar customer complaints via email.
To identify what happened, Mr. Khomenko ran a program covering 100% of the samples received from NGI on June 1. This program provided the names (which the customers provided when signing up with 23andMe) and sex (which the lab identified in its DNA analysis) of these customers. He then compared a customer’s name against the lab-identified sex of the customer. He noticed that, in some instances, the gender of a customer’s name (for example, “Sarah”) did not match the sex (for example, “male”) contained in the lab report. He compiled a list of all such inconsistencies. Mr. Khomenko then reviewed the original electronic files sent from NGI on June 1, 2010 and determined that all of the inconsistencies stemmed from a single electronic file, and, thus, he concluded, from one well plate.
As Mr. Khomenko conducted his investigation, 23andMe alerted NGI of the error. NGI also conducted its own investigation. Around 1 pm on June 2, 2010, 23andMe concluded that the data from the single file containing 87 customer data sets contained inaccuracies and began the process of removing this data from the accompanying accounts. During this period, 23andMe continued discussions with NGI. At approximately 4 pm on June 2, 2010 — less than 24 hours after customers had received the incorrect data — 23andMe deleted the erroneous data from the affected customers’ databases and sent emails to each affected customer alerting them of the error.
On June 5, NGI confirmed that its investigation had concluded that the issue stemmed from an error on a single well plate. NGI’s investigation showed that the well plate had been inverted, causing the inaccurate customer data. NGI had reprocessed the data of all impacted customers while its investigation was ongoing. NGI re-ran the entire plate from both the amplified DNA samples and the original saliva samples provided by the customers. In doing so, NGI was able to confirm the accuracy of the updated data. 23andMe was able to upload correct reports into the affected customers’ accounts on June 8, 2010.
III. Steps Taken by 23andMe and NGI to Ensure No Future Errors
Since this incident, NGI has informed 23andMe that NGI has taken steps to help ensure that such errors do not recur. Specifically, 23andMe understands that NGI has modified the physical shape of its well plates to prevent them from being inverted in the machine that conducts the analysis. Attached please find a photograph of the old well plate and one of the newly-designed well plates that are now in use.
For its part, 23andMe has implemented improved quality-control procedures to double-check the accuracy of NGI’s returned lab results before providing them to customers. For the period of June 8 through June 23, 23andMe cross-referenced a customer’s name (which 23andMe predicts to be either male or female based on traditional name use) with the customer’s sex information pulled from lab data. Doing so allowed 23andMe to identify potential errors, where the gender of a customer’s name is inconsistent with lab-identified sex data for that customer.
Starting June 24, 23andMe implemented a similar quality check with additional data. As of June 10, 2010, 23andMe has been collecting customer date of birth and sex information pursuant to requirements that NGI is following. 23andMe’s new process cross-references this customer-provided sex data with that generated by the lab data. Potential errors will be flagged where there are inconsistencies.
We look forward to speaking with you further about this issue. If you have any questions in the meantime, please call me at (202) 339-8523.
Michael J. Madigan Joshua P. Galper Stephanie Maya Cowles