Florida DNA Privacy Protection Act
HB 833 was introduced to the Florida House of Representatives in February 2021 and signed by the Governor in June. HB 833 applies to DNA samples taken from a person in Florida and regulates the use, retention, disclosure or transfer by any person of another person’s DNA samples or analysis. HB 833 amended Florida’s previous Genetic Privacy Act, s. 760.40, FS, to require that a person whose DNA is extracted give “express consent” for a specified use of their genetic information. Under the previous law, the analysis of a person’s DNA without their informed consent was a first degree offense; however, according to HB 833, illegal use may be a crime, depending on the provision of the law violated. In addition, HB 833 declares that the genetic information of the person from which it is extracted is the “exclusive property” of that person to be tested. Although HB 833 imposes significant criminal penalties on those who violate it, there are a number of exceptions (eg the Health Insurance Portability and Accountability Act (“HIPAA”)).
HB 833 isn’t the only change to genetic privacy protections recently made in Florida. In July 2020, Florida adopted HB 1189 which extended existing protections prohibiting the use of genetic information by health insurers to long-term care and life insurers, including those that issue disability insurance policies. More specifically, HB 1189 prohibits these insurers from canceling, limiting, denying or deferring premium rates on the basis of genetic information. In addition, HB 1189 prohibits insurers from requiring or soliciting genetic information or test results, or from using a consumer’s decision as to whether to take action related to genetic testing “for any purpose. insurance ”.
Additional DTP Genetic Privacy Laws and Bills
Earlier this year, Utah adopted SB 227, the Genetic Information Privacy Act, which places restrictions on DTC genetic testing companies, requiring specific privacy notices, security processes to protect consumer data, and a consumer’s ability to access and delete their own data personal genetics. Similar to Florida’s HB 833, Utah’s SB 227 contains a requirement that DTC genetic testing companies obtain express consent for the collection, use, or disclosure of consumer genetic data. In addition, SB 227 specifically creates data anonymization requirements, including that the company in possession of the data imposes specific measures to ensure that the data cannot be re-identified and “enters into a legally enforceable contractual obligation that prohibits a recipient of the data to attempt to re-identify the data.
Arizona also recently adopted HB 2069, the Genetic Information Privacy Act, which went into effect last week on September 29. HB 2069 also focuses on DTP genetic testing companies and is similar to Utah’s SB 227 in many ways (for example, initial consent must be obtained to collect and use genetic data, followed by some separate explicit consents for purposes other than initial use), but not all (for example, standard depersonalization genetic data).
The California State Legislature has passed SB 41, its own DNA Protection Act, which has many of the same consent, privacy, and security mechanisms as the laws in Utah and Arizona. The bill is currently on the governor’s desk for signature. SB 41 creates its own de-identification standard similar to that created in Utah’s SB 227. Additionally, SB 41 requires a DTC genetic testing company to comply with revocation of a consumer’s consent and to destroy a consumer’s biological sample within 30 days of revocation. SB 41 is almost identical to a bill the governor vetoed last year over concerns about interference with the communication of COVID-19 test results to public health authorities. However, SB 41 attempts to address the governor’s concerns by providing an exception for diagnostic testing of a specific disease as long as the genetic information obtained through that diagnostic test is treated as medical or protected information.
Landscape and Federal Genetic Privacy Efforts
Current federal protections for genetic privacy derive from several laws, including HIPAA, the 2008 Genetic Information Non-Discrimination Act, and the Federal Trade Commission’s ability to bring actions against “unfair trade practices.” Or ‘misleading’. However, these laws do not cover all forms of genetic testing that a consumer may undertake, including DTP genetic testing. There have been recent attempts to pass federal legislation to protect Americans’ personal health data. In January 2021, Senators Amy Klobuchar and Lisa Murkowski presented S.24, the Personal Health Data Protection Act, which aims to broadly protect personal health data not covered by HIPAA. Under section 24, “personal health data” includes “genetic information. . . which relates to the past, present or future health or physical or mental state of an individual which identifies the individual or in respect of which there is a reasonable basis to believe that the information can be used to identify the individual ”and indicates that the DTP genetic testing services are covered as“ services ”under the bill. However, to date, since its introduction, S.24 has been referred to the US Senate Committee on Health, Education, Work, and Pensions, but it has not budged otherwise.