SAN FRANCISCO -- You probably know where your Social Security card, birth certificate and other sensitive information is being stored, but what about your genetic material? If you or your child was born in California after 1983, your DNA is likely being stored by the government, may be available to law enforcement and may even be in the hands of outside researchers, CBS San Francisco's Julie Watts reports.

Like many states, California collects bio-samples from every child born in the state. The material is then stored indefinitely in a state-run biobank, where it may be purchased for outside research.

State law requires that parents are informed of their right to request the child's sample be destroyed, but the state does not confirm parents actually get that information before storing or selling their child's DNA.

Get Breaking News Delivered to Your Inbox

CBS station KPIX has learned that most parents are not getting the required notification. And the DNA may be used for more than just research.

In light of the Cambridge Analytica-Facebook scandal and the use of unidentified DNA to catch the Golden State Killer suspect, there are new concerns about law enforcement access, and what private researchers could do with access to the DNA from every child born in the state.

The Lifesaving Test

It all begins with a crucial and potentially lifesaving blood test.

The Newborn Genetic Screening test is required in all 50 states, and is widely believed to be a miracle of modern medicine.

Nearly every baby born in the United States gets a heel prick shortly after birth. Their newborn blood fills six spots on a special filter paper card. It is used to test baby for dozens of congenital disorders that, if treated early enough, could prevent severe disabilities and even death.

It's estimated that newborn screening leads to a potentially life-saving early diagnosis each year for 5,000 to 6,000 children nationwide.

The California Department of Public Health reports that from 2015-2017 alone, the Newborn Screening test diagnosed 2,498 babies with a "serious congenital disorder that, if left untreated could have caused irreparable harm or death."

But, unless you or your child is diagnosed with one of these disorders, the test is often lost in the fog of childbirth.

KPIX randomly selected six new moms and asked what they knew about their child's genetic test.

Three of the moms remembered the heel prick, while the other three say they think they knew about the test. But, like most parents, none knew what happened to their baby's leftover blood spots after the test.

They were shocked when KPIX reporter Julie Watts explained it to them.

Your rights after the test

The lab generally only needs a few of the blood spots for the baby's own potentially lifesaving genetic test. They use to collect five blood spots total from each child in California, they've now increased that to six.

Some states destroy the blood spots after a year, 12 states store them for at least 21 years.

California, however, is one of a handful of states that stores the remaining blood spots for research indefinitely in a state-run biobank.

Even though the parents pay for the lifesaving test itself, the child's leftover blood spots become property of the state and may be sold to outside researchers without the parent's knowledge or consent.

"I just didn't realize there was a repository of every baby born in the state. It's like fingerprints," new mom Soniya Sapre responded.

Amanda Feld, who had her daughter 15 months ago, was concerned in light of recurring data breaches. "We know that companies aren't very good at keeping data safe. They try," she said.

New mom Nida Jafri chimed in, "There should be accountability and transparency on what it's being used for."

"Blood is inherently or intrinsically identifiable,"added Sapre.

Some states allow parents to opt-in or give informed consent before they store the child's sample.

In California, however, in order to get the potentially lifesaving genetic test for your child, you have no choice but to allow the state to collect and store the remaining samples.

You do have the right to ask the biobank to destroy the leftovers after the fact, though the agency's website states it "may not be able to comply with your request."

You also have the right to find out if your child's blood spots have been used for research, but you would have to know they were being used in the first place and we've discovered that most parents don't.

Samples used to save more lives

Dr. Fred Lorey, the former director of the California Genetic Disease Screening Program, explained that blood spot samples are invaluable to researchers.

"They're important because these samples are needed to create new testing technology," Lorey said.

He explained that they're primarily used to identify new diseases and improve the current tests, ultimately saving more babies

With nearly 500,000 births a year, California's biobank is, by far, the largest and is crucial for research nationwide.

According to the Department of Public Health, more than 9.5 million blood spot samples have been collected since 2000 alone. The state has stored blood spots since 1983.

As a result, California can now test newborns for more than 80 different disorders, more than any other state. The standard panel nationwide is around 30 disorders.

But researchers with the California Genetic Disease Screening Program aren't the only ones with access to samples stored in the biobank.

Blood spots are given to outside researchers for $20 to $40 per spot.

Regulations require that the California Genetic Disease Screening Program to be self-supporting.

"It has to pay for itself," Lorey noted. Allowing outside researchers to buy newborn bloodspots helps to recoup costs.

According to biobank records, the program sold about 16,000 blood spots over the past five years, totaling a little more than $700,000. By comparison, the program reported $128 million in revenue during the last fiscal year alone, mostly generated by the fees parents pay for the test. Parents are charged around $130 on their hospital bill for the Newborn Screening Test itself.

Making money off your DNA

But while the state may not be making money off your child's DNA, Lorey admitted that there is the potential for outside researchers to profit off your child's genetic material.

"Do any of those studies result in something that the company can make money from?" reporter Julie Watts asked Lorey in a recent interview. "Could they create a test or treatment that they ultimately profit from?"

"Theoretically, yes," Lorey admitted. "I'm not aware of any cases that that's happened because virtually all, not all, of these researchers that have made requests are scientific researchers."

He explained that researchers who request the spots must meet specific criteria. Their studies must first be approved by a review board. They're also supposed to return or destroy remaining blood spot samples after use.

However, privacy advocates point to the Cambridge Analytica-Facebook scandal where third-party researchers were supposed to destroy data, but instead used it for profit – and untimely to attempt to influence a presidential election.

Watts pressed Lorey on that point.

"So there is no possibility a researcher may request blood spots for a specific research experiment … but then keep blood spots without the department's knowledge to be used for other purposes?" she asked.

"I want to say no" he said. "But I'm not ready to say no because I know how humans can be sometimes."

"De-identified DNA"

However, Lorey stressed that the blood spots cards, stored in the state biobank, are "de-identified." There is no name or medical information on the card, just the blood spots and a number.

Lorey explained the identifying information is stored in a separate building and after a few years is microfiched so it's not even kept on a server. Samples do need to be re-identified for various reasons, but Lorey says, in those cases, parents are notified.

And to be clear, he stressed, there is also no genome database. The state does not sequence or extract the DNA from the blood spots collected, although a researcher might, depending on the study.

Privacy advocates, like Consumer Watchdog's Jamie Court insist DNA is inherently identifiable.

"There is no such thing as de-identified DNA," Court said. "The very nature of DNA is that it identifies you and your genetic code specifically."

Court points to the recent case of the Golden State Killer. Investigators used public ancestry sites to identify a murder suspect using decades-old unidentified DNA from a crime scene.

And we've learned, researchers aren't the only ones with access to the blood spots.

Law enforcement access

A public records request revealed coroners often use blood spots to identify bodies, and at least one parent requested blood spots to prove paternity.

Law enforcement also can — and does — request identified blood spots. We found at least five search warrants and four court orders, including one to test a child's blood for drugs at birth.

According to the Department Of Public Health, "Only a court order can provide a third-party (including law enforcement) access to an identified stored specimen without parental consent."

"I think the storage of DNA for purposes other than medical research without informed consent clearly is violating a duty and a trust that the state has to the public," Court said. "What are they trying to hide?"

State law says parents should know – but they don't

According to the Department of Public Health, it's not hiding anything. The agency points to page 13 of the Newborn Screening brochure which does disclose that the blood spots are stored.

"In addition to being available on the Internet in multiple languages, healthcare providers give the brochure to parents prenatally and at birthing centers and hospitals," the Department of Public Health stated.

We asked the six new moms to bring in all the paperwork they collected from the hospital. Only one of the six women actually had the required newborn screening pamphlet and she admitted that between delivering a baby and learning to raise a tiny human, she hadn't found the time to flip to page 13.

"I feel like that's something that should have been discussed with us in person, not on whatever page in a document," another new mom, Lesley Merritt, responded.

Argelia Barcena added that they were not told the pamphlet was crucial or mandatory reading material. "I saw it as reference material, to refer to if needed, they dont tell you 'you must read it,'" she pointed out.

Keep in mind new parents are generally sent home with folders full of paperwork including a variety of medical testing forms and pamphlets with information ranging from breastfeeding and vaccines, to sudden infant death and CPR.

"Everyone who came into our room gave us another pamphlet," New Mom Amanda Feld pointed out.

In the case of the Genetic Screening Pamphlet, the moms agreed they wouldn't have thought it was relevant to read after the fact unless their child was actually diagnosed.

And they're not alone. We conducted an exclusive Survey USA news poll of parents with kids born in California over the past five years.

While a majority of parents reported that they did know about the life-saving test, three-quarters said they didn't know the state would store the leftover blood spots indefinitely for research, and two-thirds weren't sure they ever got the newborn screening information.

When we read the six moms that portion of page 13 that disclosed the blood spots could be used for outside research, they noted that it's not clear the blood spots are stored indefinitely, available to law enforcement, nor that using blood spots for "department approved studies" means giving them to outside researchers." P.13 states:

"Are the stored blood spots used for anything else? Yes. California law requires the NBS program to use or provide newborn screening specimens for department approved studies of diseases in women and children, such as research related to identify-ing and preventing disease."

Lorey helped draft previous versions of the pamphlet. He agreed that the portion on page 13 "could be clarified," but he said he believed the information included provides "adequate disclosure."

He was surprised, however, when Watts showed him all the forms she was sent home from the hospital with and he acknowledged it could be difficult for parents to digest it all while also learning to care for a newborn.

He was also surprised to see the version of the newborn screening brochure that Watts was given.

Instead of the required 14-page pamphlet with the storage disclosure on page 13, she had a one page, tri-fold hand-out with no mention of storage, or a parent's right to opt out of it. Instead there was a web link where parents could go "For more information…"

Required disclosure

State regulations say that parents are supposed to get the full 14 page pamphlet twice, once before their due date, and again in the hospital before the heel prick test.

But in practice, most parents say they didn't even see the pamphlet until after the test, if they got it at all.

While the state says it "distributes more than 700,000 copies of the booklets to health providers each year," it admits that it doesn't track whether doctors are giving them out. It also does not confirm parents are informed of their rights to opt out of storage before storing or selling the child's DNA.

Federal law

Under federal law, blood spots are currently defined as human subjects, and therefore require informed consent for federal research. But, that doesn't apply to private researchers, and even that protection is about to expire when a new federal policy, known as the Common Rule, takes effect this year.

Following strong opposition from the research community, proposed protections for unidentified bio-specimens were stripped from the final rule. This means researchers won't need consent to use de-identified blood spots, and, in some cases, can even use identified blood spots without consent.

It's ultimately up to each state to develop their own policies on disclosure. Parents in Texas successfully sued the state, ultimately forcing their biobank to destroy samples taken for research without consent or disclosure.

State law

In California, the newborn screening law doesn't actually authorize the state to store a child's leftover blood spots after the test, or give it to outside researchers, it only authorizes the life-saving genetic test itself.

However, the newborn screening law does say that state may store samples of the mother's prenatal blood, which is taken early in the pregnancy, but only if the mother opts in.

Parents don't get to opt in to storing their baby's DNA however and that was not decided by voters or lawmakers.

While the newborn screening law was enacted by the state legislature, the authorization to store every child's DNA and sell it to researchers is actually in a separate regulation enacted by the Director of California Department of Public Health. It says that a child's "blood specimen and information," collected during a test paid for by the child's parents, becomes "property of the state."

"Any tissue sample that is given in a hospital or any medical facility, once it's given, is no longer your property," Lorey explained. "You can agree with that or disagree with that, but it happens to be the law."

In 2015, former California Assemblyman Mike Gatto introduced a law that would have initially made both the test and storage opt-in. It was strongly opposed by the powerful hospital and research lobbies, and after several revisions, it died in the Senate Health Committee.

Health advocates said their primary opposition at the time was due to the fact that Gatto's bill would have made both the test and storage opt in, and since the test itself is crucial to saving lives, they said the test should not be optional.

Researchers, on the other hand, oppose letting parents opt in to the storage too because they believe they would get fewer samples if parents had a choice.

But, that doesn't seem to be the case in California.

Calif. moms opt in to prenatal

Along with newborn blood spots, the California Genetic Disease Screening Program also tests mothers' blood in the first and second trimesters, and they're allowed to opt in.

About 90 percent of pregnant women do opt in to letting the state store their own blood for research. And, unlike the newborn screening test, a majority of moms said they do remember the disclosures and pamphlets about their own genetic test, because they got them early in the pregnancy.

Eighty four percent of parents surveyed said they think they should get information about their child's genetic screening at the same time they learn about their own. That would give them time — several months without the distraction of a newborn — to process the information and understand their rights before the child is born.

Many said they also should have the right to opt out of storage before their child's DNA is stored, or at least give informed consent before it is sold for research.

The problem with opting in

Critics of the opt-in option point to Texas. Following a lawsuit by parents, the biobank was forced to destroy blood spots that were taken without consent to store them for research. Now Texas allows parents to opt-in to storage.

When the potentially life-saving screening test is given in Texas, a storage consent form with a matching ID number is given to the parents to take home from the hospital and review. Blood spots are not stored in the biobank unless parents sign and return the consent form. As a result, a significant percentage of samples are destroyed.

Critics note that many parents never return the form, likely in part due to the distractions of a new baby.

Ultimately, that hurts the biobank and researchers because they get fewer samples, and more importantly, fewer samples from certain communities.

This means that research performed with those samples may not be valid for the entire population. In contrast, research performed with samples from California's biobank is considered very strong and applicable to all babies.

A Calif. opt-in solution

Parents and advocates we spoke with in California would like to see the informed consent given out early in the pregnancy, long before the due date, which may lead to a higher opt-in rate than in Texas.

An opt-in early in the pregnancy would require a system in place to match the mothers' consent forms, collected in the first trimester, with the babies' blood spots, collected months later by hospital staff.

Lorey said California already has a similar matching system in place for the prenatal genetic test so it does seem feasible.

Court believes parents should have the right to opt-in before their baby's genetic material is collected and stored indefinitely by the state, though that would be fought hard by the powerful hospital and research lobbies in Sacramento.

"Informed consent basically means we should know what we're donating a sample for," Court said. "If hospitals and the medical complex is so concerned that if we knew that we might not donate our samples, than we absolutely need to know what they're doing with them because it suggests there is a purpose beyond what we know."

Meanwhile, a majority of parents surveyed said they would have opted-in to storage if given the chance.

Additionally, they said they're more likely to destroy their child's sample now than they would have been if they had been notified of their rights to begin with.

Both the California Hospital Association and the March of Dimes, which opposed previous legation that would have allowed parents to opt-in, say they are now open to improving the way the state informs parents that their child's samples will be stored and "may be used to advance research."

However, neither has an official position on allowing parents to opt-in to storage.

Short of an opt-in, Court said he thinks there should at least be a tracking mechanism to ensure every parent is getting complete and accurate information about the storage early in the pregnancy, before the DNA samples are stored.

Since state law already requires prenatal doctors to provide the information, Court notes, it wouldn't be a stretch to require they also get a signature from moms, allowing the state to track whether or not parents are actually getting the information.

What next?

So the questions remain: Should parents have the right to know that their child's DNA will be stored indefinitely in a state-run biobank and may be available to law enforcement? Should the state have to confirm that parents are informed of their rights before it stores and sells the child's DNA? Who has the power to make that happen?

Karen Smith, appointed by Governor Brown, is the current Director of the Department of Public Health. She has the power to adopt new regulations.

Though, for a more permanent fix, lawmakers in Sacramento would need to pass new legislation.

We've shared our findings with several state lawmakers on the Assembly Privacy Committee. Many were shocked to learn that the state was storing DNA samples from every baby born in the state and selling them to outside researchers without parents' knowledge or consent.

So far, however, none have shown any interest in giving parents the right to opt out of storage before the child is born, or even requiring the state to confirm parents are informed before storing their baby's blood indefinitely.