Texas 2023 - 88th Regular

Texas House Bill HB2545 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New	Differences
1	1	H.B. No. 2545
2	2
3	3
4	4	AN ACT
5	5	relating to an individual's genetic data, including the use of that
6	6	data by certain genetic testing companies for commercial purposes
7	7	and the individual's property right in DNA; authorizing a civil
8	8	penalty.
9	9	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
10	10	SECTION 1. Subtitle A, Title 11, Business & Commerce Code,
11	11	is amended by adding Chapter 503A to read as follows:
12	12	CHAPTER 503A. DIRECT-TO-CONSUMER GENETIC TESTING COMPANIES; RIGHTS
13	13	REGARDING DNA
14	14	Sec. 503A.001. DEFINITIONS. In this chapter:
15	15	(1) "Biological sample" means a material part of the
16	16	human body, or a discharge or derivative part of the body, including
17	17	tissue, blood, urine, or saliva that is known to contain DNA.
18	18	(2) "Deidentified data" means data not reasonably
19	19	linked to and that cannot reasonably be used to infer information
20	20	about an identifiable individual.
21	21	(3) "Direct-to-consumer genetic testing company"
22	22	means an entity that:
23	23	(A) offers genetic testing products or services
24	24	directly to individuals as consumers of those products or services;
25	25	or
26	26	(B) collects, uses, or analyzes genetic data
27	27	that:
28	28	(i) results from a direct-to-consumer
29	29	genetic testing product or service; and
30	30	(ii) an individual rather than a health
31	31	care provider provides to the entity.
32	32	(4) "DNA" means deoxyribonucleic acid.
33	33	(5) "Express consent" means an individual's
34	34	affirmative response to a clear and meaningful notice regarding the
35	35	collection, use, or disclosure of genetic data for a specific
36	36	purpose.
37	37	(6) "Genetic data" means any data, regardless of
38	38	format, concerning an individual's genetic characteristics. The
39	39	term:
40	40	(A) includes:
41	41	(i) raw sequence data derived from
42	42	sequencing all or a portion of an individual's extracted DNA;
43	43	(ii) genotypic and phenotypic information
44	44	obtained from analyzing an individual's raw sequence data; and
45	45	(iii) health information regarding the
46	46	health conditions that an individual self-reports to a company and
47	47	that the company:
48	48	(a) uses for scientific research or
49	49	product development; and
50	50	(b) analyzes in connection with the
51	51	individual's raw sequence data; and
52	52	(B) does not include deidentified data.
53	53	(7) "Genetic testing" means a laboratory test of an
54	54	individual's complete DNA, regions of DNA, chromosomes, genes, or
55	55	gene products to determine the presence of the individual's genetic
56	56	characteristics.
57	57	(8) "Person" means an individual, partnership,
58	58	corporation, association, business, or business trust or the legal
59	59	representative of an organization.
60	60	Sec. 503A.002. APPLICABILITY. (a) This chapter applies to
61	61	a direct-to-consumer genetic testing company that:
62	62	(1) offers its products or services to individuals who
63	63	are residents of this state; or
64	64	(2) collects, uses, or analyzes genetic data that:
65	65	(A) results from the company's products or
66	66	services; and
67	67	(B) was provided to the company by an individual
68	68	who is a resident of this state rather than by or at the direction of
69	69	a health care provider.
70	70	(b) This chapter does not apply to:
71	71	(1) an entity only when they are engaged in
72	72	collecting, using, or analyzing genetic data or biological samples
73	73	in the context of research, as defined by 45 C.F.R. Section 164.501,
74	74	that is conducted in accordance with:
75	75	(A) the federal policy for the protection of
76	76	human subjects (45 C.F.R. Part 46);
77	77	(B) the good clinical practice guidelines issued
78	78	by the International Council for Harmonisation of Technical
79	79	Requirements for Pharmaceuticals for Human Use (ICH); or
80	80	(C) the United States Food and Drug
81	81	Administration policy for the protection of human subjects (21
82	82	C.F.R. Parts 50 and 56);
83	83	(2) genetic data that is protected health information
84	84	collected by a covered entity or business associate, as defined by
85	85	45 C.F.R. Part 160, subject to the privacy, security, and breach
86	86	notification rules under the Health Insurance Portability and
87	87	Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.);
88	88	(3) an institution of higher education or a private or
89	89	independent institution of higher education, as those terms are
90	90	defined by Section 61.003, Education Code;
91	91	(4) an entity when the entity is offering genetic
92	92	testing products or services through a health care provider; or
93	93	(5) the collection, use, or analysis of genetic data
94	94	by a health care provider.
95	95	Sec. 503A.003. EXCLUSIVE PROPERTY RIGHT IN DNA;
96	96	CONFIDENTIALITY. An individual has a property right in, and
97	97	retains the right to exercise exclusive control over, the
98	98	individual's biological sample that is provided to or used by a
99	99	direct-to-consumer genetic testing company and the results of
100	100	genetic testing or analysis conducted on the individual's DNA by a
101	101	direct-to-consumer genetic testing company, including to the
102	102	collection, use, retention, maintenance, disclosure, or
103	103	destruction of the sample or results. The results of the genetic
104	104	testing of an individual's DNA are confidential and may not be
105	105	disclosed to another person without the individual's express
106	106	consent.
107	107	Sec. 503A.004. REQUIREMENTS FOR CERTAIN USES OF
108	108	DEIDENTIFIED DATA. (a) Except as otherwise provided by this
109	109	chapter or other law, a direct-to-consumer genetic testing company
110	110	that possesses an individual's deidentified data shall:
111	111	(1) implement administrative and technical measures
112	112	to ensure the data is not associated with a particular individual;
113	113	and
114	114	(2) publicly commit to maintaining and using data in
115	115	deidentified form and refraining from making any attempt to
116	116	identify an individual using the individual's deidentified data.
117	117	(b) If a direct-to-consumer genetic testing company shares
118	118	an individual's deidentified data with another person, the company
119	119	shall enter into a legally enforceable contractual obligation
120	120	prohibiting the person from attempting to identify an individual
121	121	using the individual's deidentified data.
122	122	Sec. 503A.005. REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE
123	123	OF GENETIC DATA AND BIOLOGICAL SAMPLE. (a) A direct-to-consumer
124	124	genetic testing company shall:
125	125	(1) develop, implement, and maintain a comprehensive
126	126	security program to protect an individual's genetic data against
127	127	unauthorized access, use, or disclosure; and
128	128	(2) make publicly available:
129	129	(A) a high-level privacy policy overview that
130	130	includes basic, essential information about the company's
131	131	collection, use, or disclosure of genetic data; and
132	132	(B) a prominent privacy notice that includes
133	133	information about the company's data collection, consent, use,
134	134	access, disclosure, transfer, security, retention, and deletion
135	135	practices.
136	136	(b) Before collecting, using, or disclosing an individual's
137	137	genetic data, a direct-to-consumer genetic testing company shall
138	138	provide to the individual information about the company's
139	139	collection, use, and disclosure of genetic data the company
140	140	collects through a genetic testing product or service, including
141	141	information that:
142	142	(1) clearly describes the company's use of the genetic
143	143	data;
144	144	(2) specifies the persons who have access to test
145	145	results; and
146	146	(3) specifies the manner in which the company may
147	147	share the genetic data.
148	148	(c) A direct-to-consumer genetic testing company shall
149	149	provide a process for an individual to:
150	150	(1) access the individual's genetic data;
151	151	(2) delete the individual's account and genetic data;
152	152	and
153	153	(3) destroy or require the destruction of the
154	154	individual's biological sample.
155	155	Sec. 503A.006. REQUIRED CONSENT. (a) A direct-to-consumer
156	156	genetic testing company engaging in any of the following activities
157	157	must obtain:
158	158	(1) an individual's separate express consent for:
159	159	(A) the transfer or disclosure of the
160	160	individual's genetic data to any person other than the company's
161	161	vendors and service providers;
162	162	(B) the use of genetic data for a purpose other
163	163	than the primary purpose of the company's genetic testing product
164	164	or service; or
165	165	(C) the retention of any biological sample
166	166	provided by the individual following the company's completion of
167	167	the initial testing service requested by the individual;
168	168	(2) an individual's informed consent in accordance
169	169	with guidelines for the protection of human subjects issued under
170	170	45 C.F.R. Part 46, for transfer or disclosure of the individual's
171	171	genetic data to a third party for:
172	172	(A) research purposes; or
173	173	(B) research conducted under the control of the
174	174	company for the purpose of publication or generalizable knowledge;
175	175	and
176	176	(3) an individual's express consent for:
177	177	(A) marketing by the company to the individual
178	178	based on the individual's genetic data; or
179	179	(B) marketing by a third party to the individual
180	180	based on the individual's ordering or purchasing of a genetic
181	181	testing product or service.
182	182	(b) For purposes of Subsection (a), "marketing" does not
183	183	include providing customized content or offers to an individual
184	184	with whom a direct-to-consumer genetic testing company has a
185	185	first-party relationship on the company's Internet website or
186	186	through an application or service provided by the company to the
187	187	individual.
188	188	Sec. 503A.007. PROHIBITED DISCLOSURES. (a) A
189	189	direct-to-consumer genetic testing company may not disclose an
190	190	individual's genetic data to a law enforcement entity or other
191	191	governmental body unless:
192	192	(1) the company first obtains the individual's express
193	193	written consent; or
194	194	(2) the entity or body obtains a warrant or complies
195	195	with another valid legal process required by the company.
196	196	(b) A direct-to-consumer genetic testing company may not
197	197	disclose, without first obtaining an individual's written consent,
198	198	the individual's genetic data to:
199	199	(1) an entity that offers health insurance, life
200	200	insurance, or long-term care insurance; or
201	201	(2) an employer of the individual.
202	202	Sec. 503A.008. CIVIL PENALTY. (a) A direct-to-consumer
203	203	genetic testing company that violates this chapter is liable to
204	204	this state for a civil penalty in an amount not to exceed $2,500 for
205	205	each violation.
206	206	(b) The attorney general may bring an action to recover a
207	207	civil penalty imposed under Subsection (a) and to restrain and
208	208	enjoin a violation of this chapter. The attorney general may
209	209	recover reasonable attorney's fees and court costs incurred in
210	210	bringing the action.
211	211	SECTION 2. The changes in law made by this Act apply only to
212	212	genetic information obtained on or after the effective date of this
213	213	Act.
214	214	SECTION 3. This Act takes effect September 1, 2023.
215	215	______________________________ ______________________________
216	216	President of the Senate Speaker of the House
217	217	I certify that H.B. No. 2545 was passed by the House on April
218	218	28, 2023, by the following vote: Yeas 144, Nays 0, 2 present, not
219	219	voting; and that the House concurred in Senate amendments to H.B.
220	220	No. 2545 on May 17, 2023, by the following vote: Yeas 146, Nays 0,
221	221	1 present, not voting.
222	222	______________________________
223	223	Chief Clerk of the House
224	224	I certify that H.B. No. 2545 was passed by the Senate, with
225	225	amendments, on May 15, 2023, by the following vote: Yeas 31, Nays
226	226	0.
227	227	______________________________
228	228	Secretary of the Senate
229	229	APPROVED: __________________
230	230	Date
231	231	__________________
232	232	Governor