Legislative Blog
J.B. Williams, J.D.
HB 2545 - DNA protections in Texas
A Blog about 88th Legislature Laws
A Bit of Background
The following backgrounds help summarize the author's views on both the general topic: Texas and more specifically 88th Legislature Laws as it relates to that topic.
Brief Summary of Texas
Texas is truly a Republic. There are a multitude of items that to modify the state constitution must be modified. So there are times when Constitutional amendments are on the voting ballots. While I sometimes abhor the wording, the concept that all of those legally able to vote in Texas must vote on the change is a good one. And bills in Texas are generally short, making it easier for everyone to understand.
Summary of 88th Legislature Laws
The blogs here will discuss the laws passed by Congress and signed into law, as well as those, passed by Congress and approved by the voters to become law. There are a multitude of laws and each time I post blogs I will notate here the current effective date if it is different from prior blogs. I am currently posting bills that took effect immediately - those bills total 336. I am currently posting regarding larger bills, so each blog covers a single bill.
Blog Summary
HB 2545 - Genetic Testing Companies and DNA rights.
HB 2545 - DNA protections in Texas
Published: 2024-09-13
HB 2545
Genetic Testing Companies and DNA rights
Genetic data means data concerning an individual's characteristics. It does not include deidentified data. It includes:
- raw sequence data dreived from sequencing all or a portion of extracted DNA;
- genotypic and phenotypic information obtained from analyzing raw sequence data;
- health information regarding the health conditions an individual self-reports and that are used for scientific research or product development and analyzed in connection with raw sequence data
This applies to companies that offer products or services directly to residents of Texas or that collects, uses, or analyzes genetic data that:
- results from the company's products or services and
- was provided to the company by an individual resident of Texas rather than through a health care provider
It does not apply to a company collecting, using, or analyzing genetic data or biological samples for research conducted in accordance with:
- federal policy for the protection of human subjects;
- good clinical practice guidelines issued by the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use; or
- the US FDA policy for protection of human subjects
It does not apply to a company that has genetic data protected by health information collected by a covered entity under HIPAA. It does not apply to an institute of higher education or private institution of higher education. It does not apply to an entity offering genetic testing products or services through a health care provider. It does not apply to collection, use or analysis of genetic date by health care providers.
An individual retains a property right in and the right to exercise exclusive control over the biological sample, including any results, when it is provided to a direct-to-consumer genetic testing company. This includes the right to request it's destruction.
A direct-to-consumer genetic testing company must implement procedures to ensure data is not associated with a particular person and publicly commit to maintaining and using the data in deidentified form. They must refrain from making any attempt to identify individuals using the deidentified data. Any contracts with other entities must include legally enforceable contractual obligations prohibiting attempts to identify individuals using the deidentified data.
Companies must have publicly available high-level privacy policies and prominent privacy notices. These must include information about the company's data collection, consent, use, access, disclosure, transfer, security, retention and deletion practices. Before collecting, using, or disclosing data the company must disclose information that clearly described the use of the data; the persons who have access to test results; and the manner in which it will share the data. They must also provide the individual a process to access their genetic data (creating a means of possible breaches of data); delete their account and genetic data; and destroy or require destruction of their sample.
Express consent must be given to transfer or disclose to another entity; use the data for other than the primary purpose of the company; or retain the sample following completion of initial testing services requested. Informed consent must be given for transfer or disclosure for research purposes or research conducted under the company's control. Express consent is also required for marketing by the company or marketing by a third party.
The individual genetic data may not be released to law enforcement or government body unless the company obtains express written consent or there is a warrant or another valid legal process for release.
A violation creates a civil penalty in an amount not to exceed $2,500 for each violation. The attorney general may bring an action to recover the civil penalty, and recover reasonable attorney's fees and court costs in doing so.
I have been amazed for years about the number of individuals willing paying to provide genetic samples to non-medical entities to acquire information. First, because I have wandered about the release of this data and it's use. So often releases are so vague and overly broad, that I've thought the entities could use this data (themselves or through selling) for so much for so long. Second, because I question the means by which they determine what the data means. I know I read many years ago about how a particular company was making the determination of heritage. It sounded more like those who paid first and provided what they knew about their heritage (as in what they heard or thought they knew) was being used to 'set the stage' for heritage. So the sooner you got in the more likely you were 'right'. The later you got in the more your data was forced into the existing mold. I'm sure there were some things they used that were 'known' but it seriously sounded like the first were building the database of knowledge. Which literally means nothing. But then again, I was highly suspicious of the companies motives.
It's nice to see a state setting out rules for keeping data deidentified. Of course there are other federal laws. The one I find most chilling is the required collection of DNA for entry into a federal system when an individual is found guilty of a federal qualifying charge. The fact that DNA is being stored and is accessible for look-up in a system to me is horrifying. I understand the prinicple behind it, if you commit an offense of battery they collect the data. If one is later committed, they can run DNA to see if prior offenders committed the new offense. But I still find it horrifying. Every time I see an crime drama where they request DNA from victims, or families of victims, to exclude them I think this seems insane. If they used it for that particular crime and destroyed it, but the shows always make it seem like it is then forever in a searchable database. A database I certainly hope to never be entered into.
Webpage created by and for J.B. Williams, J.D. - all rights reserved