BILL ANALYSIS                                                                                                                                                                                                    Ó




                   Senate Appropriations Committee Fiscal Summary
                            Senator Kevin de León, Chair


          SB 222 (Padilla) - Genetic information: privacy.
          
          Amended: January 14, 2014       Policy Vote: Judiciary 4-3
          Urgency: No                     Mandate: Yes
          Hearing Date: January 23, 2014                          
          Consultant: Jolie Onodera       
          
          SUSPENSE FILE. 
          
          
          Bill Summary: SB 222 would enact the Genetic Information Privacy  
          Act, which would prohibit any person, as defined, from  
          obtaining, analyzing, retaining, or disclosing genetic  
          information without the written authorization of the individual  
          to whom the information pertains, as specified. This bill would  
          specify the information that must be included in the  
          authorization. This bill would also establish civil and criminal  
          penalties for violations of the bill's provisions, as specified.  
          This bill would provide for the exemption of certain individuals  
          from the aforementioned prohibitions and penalties.

          Fiscal Impact: 
                 Increased central research and hospital administrative  
               costs in the range of $30 million to $40 million (General  
               Fund) per year to the University of California (UC) system.  
               Potential loss of research funding of an unknown, but  
               potentially significant amount in the millions of dollars  
               annually.
                 Annual costs of $350,000 to $400,000 (General Fund) to  
               the California Correctional Health Care Services for  
               increased administrative workload.
                 Potential annual court costs in the range of $25,000 to  
               $75,000 (General Fund) for every 50 limited or unlimited  
               civil filings per year for violations of the Act. Potential  
               annual court costs of $25,000 (General Fund) for every 50  
               new misdemeanor fillings per year for violations of the  
               Act. 
                 Non-reimbursable local costs for enforcement offset to a  
               degree by fine revenue. 

          Background: Existing federal and state laws offer various  
          protections for genetic testing. However, in recent years,  








          SB 222 (Padilla)
          Page 1


          concerns have been raised over direct-to-consumer (DTC) genetic  
          testing that allows consumers to submit genetic samples in order  
          to test for genetic disorders, identify ancestral links, or  
          participate in research studies. 

          A 2010 report by the U.S. Government Accountability Office (GAO)  
          entitled "Direct-to-Consumer Genetic Tests: Misleading Test  
          Results are Further Complicated by Deceptive Marketing and Other  
          Questionable Practices," identified 10 egregious examples of  
          deceptive marketing, including claims made by four companies  
          that a consumer's DNA could be used to create personalized  
          supplements to cure diseases. Further, the GAO's fictitious  
          consumers received test results that were misleading and of  
          little or no practical use. For example, the GAO's donors often  
          received disease risk predictions that varied across the four  
          companies, indicating that identical DNA samples yielded  
          contradictory results. 
          Proposed Law: This bill would establish the Genetic Information  
          Privacy Act, as follows: 
             Provides that genetic information is protected by the right  
             of privacy pursuant to Article I of Section I of the  
             California Constitution. 
             Provides for definitions of the following terms:  
             deidentified data, DNA sample, genetic characteristic,  
             genetic information, genetic service, genetic test, and  
             person.
             Prohibits any person from collecting, storing, analyzing, or  
             disclosing genetic information without the written  
             authorization of the individual to whom the information  
             pertains. 
             Sets forth both civil and criminal penalties, as follows: 
              o     Any person who negligently violates these provisions  
                shall be assessed a civil penalty not to exceed $1,000  
                plus court costs, as determined by the court, to be paid  
                to the individual. 
              o     Any person who willfully violates these provisions  
                shall be assessed a civil penalty of $1,000 to $5,000 plus  
                court costs, as determined by the court, to be paid to the  
                individual. 
              o     Any person who willfully or negligently violates these  
                provisions and the violation results in economic, bodily,  
                or emotional harm to the individual, is guilty of a  
                misdemeanor punishable by a fine not to exceed $10,000. 
              o     In addition to any assessed civil penalties, a person  








          SB 222 (Padilla)
          Page 2


                who commits a violation of these provisions shall be  
                liable to the person for all actual damages, including  
                damages for economic, bodily, or emotional harm which is  
                proximately caused by the act. 
              o     Provides that each violation is a separate and  
                actionable offense.
             Requires the written authorization, other than for  
             persons/entities otherwise authorized, as specified, to  
             satisfy all of the following requirements:
              o     Be written in plain language and be in a typeface no  
                smaller than 14-point type.
              o     Be dated and signed by the individual to whom the  
                information pertains or a person authorized to act on  
                behalf of the individual. 
              o     Specify the types of persons authorized to disclose  
                information about the individual. 
              o     State the name or functions of the persons or entities  
                authorized to receive the information. 
              o     Specify the purposes for which the information is  
                being collected.
              o     Specify the length of time the authorization shall  
                remain valid.
              o     Advise the person signing the authorization of the  
                following:
                   §          The right to control the use, or revoke  
                     authorization at any time, of his or her genetic  
                     information. 
                   §          Whether his or her information will remain  
                     identifiable or whether measures will be taken to  
                     make the information nonidentifiable.
                   §          That the genetic information and sample  
                     provided will be destroyed upon achieving that  
                     purpose.
                   §          The right to receive a copy of the  
                     authorization.
                 Requires any person who collects, stores, analyzes, or  
               discloses the genetic information to comply with the  
               following: 
                  o         The person may not use the genetic information  
                    for any purpose other than the purpose authorized by  
                    the individual to whom the information pertains.
                  o         Once the purpose authorized has been  
                    fulfilled, the individual's genetic information and  
                    DNA sample shall be destroyed. 








          SB 222 (Padilla)
          Page 3


                  o         The person shall permit an individual to  
                    revoke an authorization signed at any time. 
                  o         The person shall provide an individual who has  
                    signed an authorization with a copy of that  
                    authorization upon request. 

          Provides that genetic information may be collected, stored,  
          analyzed, or disclosed without authorization for the following  
          cases, provided the information is only for the specified  
          purposes indicated, and any other use would be subject to the  
          authorization:
                 A law enforcement official or correctional officer in  
               the execution of his or her official duties consistent with  
               existing law. 
                 A hospital, laboratory, or physician carrying out  
               court-ordered tests for genetic information.
                 A licensed health care professional, as defined, in a  
               medical emergency. 
                 A coroner or medical examiner in the execution of his or  
               her official duties consistent with existing law. 
                 Any screening of newborn infants required by state or  
               federal law.
                 If the information is in the form of deidentified data,  
               as defined.
                 By any person covered by and required to comply with  
               HIPAA, CMIA, Insurance Code, and federal regulations.

          Related Legislation: SB 1267 (Padilla) 2012 was similar to this  
          measure but included fewer exceptions to the release of genetic  
          information as well as different definitions for various terms.  
          This bill was held on the Suspense file of this committee.

          SB 559 (Padilla) Chapter 261/2011 prohibits discrimination under  
          the Unruh Civil Rights Act and Fair Employment and Housing Act  
          on the basis of genetic information. 

          SB 482 (Padilla) 2009 would have specifically provided that  
          companies providing direct-to-consumer genetic testing are not  
          clinical laboratories and are therefore not subject to  
          requirements for those entities. This bill was referred but not  
          heard in the Senate Committee on Judiciary.

          Staff Comments: The University of California (UC) estimates the  
          provisions of this bill could increase central research and  








          SB 222 (Padilla)
          Page 4


          hospital administrative costs in the range of $40 million  
          (General Fund) per year. These costs would result from the  
          increased workload associated with obtaining authorizations for  
          research not covered by the exceptions enumerated in this bill.  
          To the extent researchers/doctors would be required to obtain  
          additional authorization for biosamples and data from research  
          studies that under federal regulations would be determined to be  
          exempt or not human subject research, significant costs could be  
          incurred. 

          In addition, to the extent the use of existing biobanks could  
          require re-consent from thousands of individuals to use the  
          samples for another analysis or purpose could potentially cost  
          in the millions of dollars. According to the University of  
          California, San Francisco (UCSF) Participant Recruitment and  
          Study Management Service, the calculated per patient cost to  
          re-consent is $216. The UCSF Helen Diller Family Comprehensive  
          Cancer Center biorepository contains over 250,000 individual  
          specimens from approximately 14,000 individuals patients  
          covering various disease areas. Re-consent for the individuals  
          at this center alone would cost in excess of $3 million. Given  
          the UC operates five comprehensive cancer centers, costs  
          associated with re-consenting materials system-wide would likely  
          be much greater. The UC indicates there would also be additional  
          costs to obtain consent when disclosing genetic information to  
          state entities not covered by an exception listed in the  
          provisions of this bill. 

          Representatives from UC also indicated concern that the  
          provisions of this bill could place UC at a competitive  
          disadvantage for public and private research grants. UC received  
          $2.8 billion in federal research funding alone in Fiscal Year  
          2011-12. To the extent research involving biosamples and data  
          could become more difficult to conduct, sponsors could be  
          compelled to look to other states to conduct research. To the  
          extent the provisions of this bill result in even a small  
          percentage reduction in these awards, a loss of millions of  
          dollars in research funding brought into the state could result.  


          The California Correctional Health Care Services (CCHCS) has  
          also indicated the provisions of this bill will result in  
          increased administrative workload costs of $350,000 to $400,000  
          (General Fund) associated with reviewing inmate medical records  








          SB 222 (Padilla)
          Page 5


          prior to disclosure to entities other than those exempted in the  
          bill. 

          This bill establishes both civil and criminal penalties for  
          violations of the written authorization requirements of the  
          bill. To the extent the provisions of this bill result in  
          additional actions brought for violations of the Act, additional  
          costs to the courts could result. Based on information from the  
          GAO report, genetic tests range from $299 to $999 per test. As a  
          result, it is assumed that most filings would be limited civil  
          filings (claims under $25,000), however, to the extent the bill  
          provides for the payment of damages for economic, bodily, or  
          emotional harm, in addition to the fine, the number of unlimited  
          civil filings could also increase. The cost for 50 new limited  
          or unlimited civil filings would increase costs to the courts in  
          the range of $25,000 to $75,000 (General Fund) per year.  
          Assuming 50 new misdemeanor filings per year (which equates to  
          less than one filing per county per year), would increase court  
          costs by approximately $25,000 (General Fund) per year.

          Recent author amendments: 
                 Revise the definition of "DNA sample" and "genetic  
               characteristic" and delete the definitions for "genetic  
               information" and "genetic service."
                 Replace references to "genetic information" throughout  
               the bill with "DNA sample."
                 Specify that a laboratory that performs a genetic test  
               shall be deemed to be in compliance with constitutional  
               rights to privacy if the laboratory believes, in good faith  
               and in the absence of knowledge to the contrary, that a  
               written consent by the individual to whom the DNA sample  
               pertains is valid.
                 Inadvertently delete the consumer protection provisions  
               that require the written authorization to advise the person  
               signing the authorization of his or her right to revoke  
               authorization at any time, and as to whether his or her  
               information will remain identifiable or whether measures  
               will be taken to make the information non-identifiable.
                 Add additional exemptions to the requirement for a  
               written authorization to include a pharmaceutical company,  
               a licensed health care professional, a provider of health  
               care, and an investigator within an institution, as  
               specified.









          SB 222 (Padilla)
          Page 6