Significant Changes for Wyoming Genetic Privacy Law; More May Be on the Horizon for New York, Arizona, and New Hampshire

May 17, 2018

By: Linda A. Malek and Nora Lawrence Schmitt

In recent months, several significant legislative developments have occurred on the state level regarding the protection afforded to individual genetic information. Four states in particular have introduced or enacted legislation that will have an impact on such protection, as discussed more fully below.

On March 16, 2018, Wyoming enacted a bill that, with limited exceptions, requires any person or entity conducting genetic analysis in Wyoming to obtain informed consent before collecting, testing, retaining, or disclosing an individual’s genetic data. The bill specifies that informed consent must include a description of the genetic analysis that will be performed, as well as how the analysis or resulting genetic information will be used; how any genetic information will be retained or disclosed; an individual’s rights regarding his or her genetic data, including the right to inspect, correct, and obtain genetic information about himself or herself; and the right to request its destruction, subject to certain limitations. Last year, despite general support for the informed consent requirement, an earlier iteration was vetoed by Governor Matthew Mead due to an amendment that substantively altered the bill.

Businesses that perform genetic testing on specimens derived from Wyoming will need to consider whether revisions to their informed consent procedures and privacy policies will be necessary in light of this new law.

New York, Arizona, and New Hampshire may also see changes to their genetic privacy laws in the near future.

Specifically, New York Assemblyman Steven Otis introduced a bill on December 22, 2017 that would amend the New York General Business Law to prohibit direct-to-consumer genetic testing companies from distributing a consumer’s DNA profile without first removing all identifying information from the consumer’s DNA profile or receiving the consumer’s consent. The bill would also require all direct-to-consumer genetic testing companies to create and maintain a privacy policy which includes, at a minimum, a statement that any consumer DNA samples will not be further distributed to a third party without the consumer’s consent, or without the prior removal of all identifying information. While New York law currently prohibits the disclosure of genetic testing information without the written informed consent of the person to whom such genetic test relates, the proposed legislation expressly calls out the obligations of direct-to-consumer genetic testing companies in this regard. If the proposed bill is enacted, businesses that conduct direct-to-consumer testing on specimens derived from New York will need to review their informed consent procedures and privacy policies to ensure compliance with the new consent requirements. As of May 17, 2018 the bill is in the Consumer Affairs and Protection Committee for further consideration.

Arizona Representative Michelle Udall introduced a bill on January 22, 2018 that would expand the list of persons or entities to whom genetic testing information may be released without a subject’s express consent, and would amend existing exceptions to the current informed consent requirements. Under the proposed legislation, the list of persons or entities to whom genetic information could be released without an individual’s express consent would be expanded to include recipients such as the health insurance carrier of the person tested and any entity responsible for the payment of a health care provider’s charges, provided the entity uses the genetic information only for payment purposes. Additionally, the proposed legislation would amend existing exceptions to the informed consent requirements to allow the release of genetic testing information without informed consent to any agent or employee of a health care provider who is providing care to the person tested, and to a third party providing services to a health care provider or clinical laboratory, as long as the third party enters into an agreement to protect the confidentiality of the genetic testing in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). If the proposed bill is enacted, businesses that conduct genetic testing on specimens derived from Arizona may need to update their informed consent procedures and privacy policies to reflect the expanded list of individuals to whom genetic information may be released without express consent. These businesses may also need to enter into agreements with third parties to whom they release genetic information, in order to ensure the information is protected in accordance with the law. As of May 17, 2018 the bill is pending further action in the Arizona House of Representatives.

Finally, the New Hampshire House of Representatives passed a bill on March 21, 2018, that, if enacted, would grant individuals a property interest in their physical DNA samples and would place significant limitations on how an individual’s genetic information and physical DNA samples could be used by third parties who collect such material under informed consent. While New Hampshire law currently requires written informed consent for the performance of genetic testing, the proposed legislation would add a new section to the state’s genetic testing law that explicitly provides for an individual’s reasonable expectation of privacy in his or her genetic information as well as a property interest in his or her physical DNA samples. Additionally, the proposed law would limit the use of genetic information or physical DNA samples to only a specific purpose set out in the informed consent form, and would require that any genetic information or physical DNA samples be destroyed and permanently deleted once the specific purpose is accomplished. Our understanding is that the bill’s sponsor intends to permit the use and retention of DNA samples or genetic information for future research provided individuals receive an explicit and accurate description of how and for what purposes their information will be used, retained, or disclosed, and affirmatively opt-in to such use, retention, or disclosure. If the proposed bill is enacted, businesses that collect genetic information and/or DNA samples from individuals in New Hampshire will have to tailor their informed consent forms to clearly address the specific purposes for which such information will be used and, moreover, will have to be prepared both to limit their use of such genetic information or DNA to those purposes and to permanently delete the sample and destroy the related information upon completion of the stated purpose. Affected businesses will also have to ensure they are using affirmative, opt-in consent if requesting the use, retention, or disclosure of genetic information and/or DNA samples for research purposes. As of May 17, 2018 the bill has been taken under advisement by the New Hampshire Senate Judiciary Committee.

For more information on how these legislative developments may impact your business, contact Healthcare Department Chair Linda Malek at (212) 554-7814.

PDF File View as PDF