Washington State

House of Representatives

Office of Program Research

BILL

ANALYSIS

Innovation, Technology & Economic Development Committee

HB 2485

This analysis was prepared by non-partisan legislative staff for the use of legislative members in their deliberations. This analysis is not a part of the legislation nor does it constitute a statement of legislative intent.

Background:

Direct-to-consumer genetic testing companies

Direct-to-consumer genetic testing companies are private companies that market personal genetic testing to consumers as a method of learning more about consumers' heritage and health. To obtain a genetic test, a consumer sends a small biological sample (usually saliva) to a genetic testing company and receives a report based on the company's analysis of the consumer's genetic material. Typically, no health care provider is involved in this process. A genetic report by direct-to-consumer genetic testing companies may include information about a consumer's ancestry, certain traits, such as taste preferences or aversions, and genetic predisposition to various diseases.

Regulation related to genetic information

No federal or state law directly regulates direct-to-consumer genetic testing companies.

Federal and state laws protect genetic information as part of an individual's health care information and prohibit health carriers from establishing rules for eligibility, including continued eligibility, based on the genetic information of the individual or the individual's dependent.

Federal law prohibits the use of genetic information to discriminate in employment decisions and restricts employers from asking for or buying genetic information. Washington state law prohibits employers from requiring employees or prospective employees to provide genetic information or submit to screening for genetic information as a condition of employment or continued employment.

Washington Consumer Protection Act

The Consumer Protection Act (CPA) prohibits unfair methods of competition and unfair or deceptive practices in the conduct of any trade or commerce. A private person or the Attorney General may bring a civil action to enforce the provisions of the CPA. A person or entity found to have violated the CPA is subject to treble damages and attorney's fees.

Summary of Bill:

Specific obligations relating to collection, use, or disclosure of consumers' genetic data are imposed on direct-to-consumer genetic testing companies.

"Direct-to-consumer genetic testing company" or "company" means an entity that offers consumer genetic testing products or services directly to consumers without requiring the involvement of a health care provider.

"Genetic data" means any data, regardless of its format, that concerns a consumer's genetic characteristics. "Genetic data" does not include de-identified data, which means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer, and that is subject to administrative and technical measures to prevent reidentification, public commitment not to reidentify, and contractual obligations prohibiting reidentification.

A direct-to-consumer genetic testing company must provide clear and complete information regarding the company's policies and procedures for collection, use, or disclosure of genetic data and obtain a consumer's consent in order to collect, use, or disclose the consumer's genetic data. At a minimum, a company must obtain:

initial express consent;
separate express consent for transferring or disclosing genetic data to third parties other than vendors and service providers;
informed consent when genetic data is used, transferred, or disclosed for research purposes; and
express consent for marketing based on genetic data or a consumer having purchased a genetic testing product or service.

Valid legal process is required in order to disclose genetic data to law enforcement without a consumer's express consent.

A direct-to-consumer genetic testing company must implement and maintain a comprehensive security program to protect genetic data against unauthorized access or use, and to provide a process for a consumer to:

access the consumer's genetic data;
correct or amend inaccurate genetic data or other personal information;
specify how long the consumer's genetic data and biological sample may be retained by the company;
delete the consumer's account and genetic data; and
request and obtain the destruction of the consumer's biological sample.

A direct-to-consumer genetic testing company is prohibited from disclosing a consumer's genetic data to any entity offering health insurance or life insurance, or to any employer of the consumer.

A violation of these provisions is enforceable under the state Consumer Protection Act and subject to a civil penalty of up to $2,500 per violation in actions brought by the Attorney General. A consumer may bring a civil action to recover actual damages, but not less than statutory damages of $2,500 per violation. A court must award costs and reasonable attorney's fees to a prevailing plaintiff.