BILL ANALYSIS Ó Senate Appropriations Committee Fiscal Summary Senator Kevin de León, Chair SB 222 (Padilla) - Genetic information: privacy. Amended: January 14, 2014 Policy Vote: Judiciary 4-3 Urgency: No Mandate: Yes Hearing Date: January 23, 2014 Consultant: Jolie Onodera SUSPENSE FILE. Bill Summary: SB 222 would enact the Genetic Information Privacy Act, which would prohibit any person, as defined, from obtaining, analyzing, retaining, or disclosing genetic information without the written authorization of the individual to whom the information pertains, as specified. This bill would specify the information that must be included in the authorization. This bill would also establish civil and criminal penalties for violations of the bill's provisions, as specified. This bill would provide for the exemption of certain individuals from the aforementioned prohibitions and penalties. Fiscal Impact: Increased central research and hospital administrative costs in the range of $30 million to $40 million (General Fund) per year to the University of California (UC) system. Potential loss of research funding of an unknown, but potentially significant amount in the millions of dollars annually. Annual costs of $350,000 to $400,000 (General Fund) to the California Correctional Health Care Services for increased administrative workload. Potential annual court costs in the range of $25,000 to $75,000 (General Fund) for every 50 limited or unlimited civil filings per year for violations of the Act. Potential annual court costs of $25,000 (General Fund) for every 50 new misdemeanor fillings per year for violations of the Act. Non-reimbursable local costs for enforcement offset to a degree by fine revenue. Background: Existing federal and state laws offer various protections for genetic testing. However, in recent years, SB 222 (Padilla) Page 1 concerns have been raised over direct-to-consumer (DTC) genetic testing that allows consumers to submit genetic samples in order to test for genetic disorders, identify ancestral links, or participate in research studies. A 2010 report by the U.S. Government Accountability Office (GAO) entitled "Direct-to-Consumer Genetic Tests: Misleading Test Results are Further Complicated by Deceptive Marketing and Other Questionable Practices," identified 10 egregious examples of deceptive marketing, including claims made by four companies that a consumer's DNA could be used to create personalized supplements to cure diseases. Further, the GAO's fictitious consumers received test results that were misleading and of little or no practical use. For example, the GAO's donors often received disease risk predictions that varied across the four companies, indicating that identical DNA samples yielded contradictory results. Proposed Law: This bill would establish the Genetic Information Privacy Act, as follows: Provides that genetic information is protected by the right of privacy pursuant to Article I of Section I of the California Constitution. Provides for definitions of the following terms: deidentified data, DNA sample, genetic characteristic, genetic information, genetic service, genetic test, and person. Prohibits any person from collecting, storing, analyzing, or disclosing genetic information without the written authorization of the individual to whom the information pertains. Sets forth both civil and criminal penalties, as follows: o Any person who negligently violates these provisions shall be assessed a civil penalty not to exceed $1,000 plus court costs, as determined by the court, to be paid to the individual. o Any person who willfully violates these provisions shall be assessed a civil penalty of $1,000 to $5,000 plus court costs, as determined by the court, to be paid to the individual. o Any person who willfully or negligently violates these provisions and the violation results in economic, bodily, or emotional harm to the individual, is guilty of a misdemeanor punishable by a fine not to exceed $10,000. o In addition to any assessed civil penalties, a person SB 222 (Padilla) Page 2 who commits a violation of these provisions shall be liable to the person for all actual damages, including damages for economic, bodily, or emotional harm which is proximately caused by the act. o Provides that each violation is a separate and actionable offense. Requires the written authorization, other than for persons/entities otherwise authorized, as specified, to satisfy all of the following requirements: o Be written in plain language and be in a typeface no smaller than 14-point type. o Be dated and signed by the individual to whom the information pertains or a person authorized to act on behalf of the individual. o Specify the types of persons authorized to disclose information about the individual. o State the name or functions of the persons or entities authorized to receive the information. o Specify the purposes for which the information is being collected. o Specify the length of time the authorization shall remain valid. o Advise the person signing the authorization of the following: § The right to control the use, or revoke authorization at any time, of his or her genetic information. § Whether his or her information will remain identifiable or whether measures will be taken to make the information nonidentifiable. § That the genetic information and sample provided will be destroyed upon achieving that purpose. § The right to receive a copy of the authorization. Requires any person who collects, stores, analyzes, or discloses the genetic information to comply with the following: o The person may not use the genetic information for any purpose other than the purpose authorized by the individual to whom the information pertains. o Once the purpose authorized has been fulfilled, the individual's genetic information and DNA sample shall be destroyed. SB 222 (Padilla) Page 3 o The person shall permit an individual to revoke an authorization signed at any time. o The person shall provide an individual who has signed an authorization with a copy of that authorization upon request. Provides that genetic information may be collected, stored, analyzed, or disclosed without authorization for the following cases, provided the information is only for the specified purposes indicated, and any other use would be subject to the authorization: A law enforcement official or correctional officer in the execution of his or her official duties consistent with existing law. A hospital, laboratory, or physician carrying out court-ordered tests for genetic information. A licensed health care professional, as defined, in a medical emergency. A coroner or medical examiner in the execution of his or her official duties consistent with existing law. Any screening of newborn infants required by state or federal law. If the information is in the form of deidentified data, as defined. By any person covered by and required to comply with HIPAA, CMIA, Insurance Code, and federal regulations. Related Legislation: SB 1267 (Padilla) 2012 was similar to this measure but included fewer exceptions to the release of genetic information as well as different definitions for various terms. This bill was held on the Suspense file of this committee. SB 559 (Padilla) Chapter 261/2011 prohibits discrimination under the Unruh Civil Rights Act and Fair Employment and Housing Act on the basis of genetic information. SB 482 (Padilla) 2009 would have specifically provided that companies providing direct-to-consumer genetic testing are not clinical laboratories and are therefore not subject to requirements for those entities. This bill was referred but not heard in the Senate Committee on Judiciary. Staff Comments: The University of California (UC) estimates the provisions of this bill could increase central research and SB 222 (Padilla) Page 4 hospital administrative costs in the range of $40 million (General Fund) per year. These costs would result from the increased workload associated with obtaining authorizations for research not covered by the exceptions enumerated in this bill. To the extent researchers/doctors would be required to obtain additional authorization for biosamples and data from research studies that under federal regulations would be determined to be exempt or not human subject research, significant costs could be incurred. In addition, to the extent the use of existing biobanks could require re-consent from thousands of individuals to use the samples for another analysis or purpose could potentially cost in the millions of dollars. According to the University of California, San Francisco (UCSF) Participant Recruitment and Study Management Service, the calculated per patient cost to re-consent is $216. The UCSF Helen Diller Family Comprehensive Cancer Center biorepository contains over 250,000 individual specimens from approximately 14,000 individuals patients covering various disease areas. Re-consent for the individuals at this center alone would cost in excess of $3 million. Given the UC operates five comprehensive cancer centers, costs associated with re-consenting materials system-wide would likely be much greater. The UC indicates there would also be additional costs to obtain consent when disclosing genetic information to state entities not covered by an exception listed in the provisions of this bill. Representatives from UC also indicated concern that the provisions of this bill could place UC at a competitive disadvantage for public and private research grants. UC received $2.8 billion in federal research funding alone in Fiscal Year 2011-12. To the extent research involving biosamples and data could become more difficult to conduct, sponsors could be compelled to look to other states to conduct research. To the extent the provisions of this bill result in even a small percentage reduction in these awards, a loss of millions of dollars in research funding brought into the state could result. The California Correctional Health Care Services (CCHCS) has also indicated the provisions of this bill will result in increased administrative workload costs of $350,000 to $400,000 (General Fund) associated with reviewing inmate medical records SB 222 (Padilla) Page 5 prior to disclosure to entities other than those exempted in the bill. This bill establishes both civil and criminal penalties for violations of the written authorization requirements of the bill. To the extent the provisions of this bill result in additional actions brought for violations of the Act, additional costs to the courts could result. Based on information from the GAO report, genetic tests range from $299 to $999 per test. As a result, it is assumed that most filings would be limited civil filings (claims under $25,000), however, to the extent the bill provides for the payment of damages for economic, bodily, or emotional harm, in addition to the fine, the number of unlimited civil filings could also increase. The cost for 50 new limited or unlimited civil filings would increase costs to the courts in the range of $25,000 to $75,000 (General Fund) per year. Assuming 50 new misdemeanor filings per year (which equates to less than one filing per county per year), would increase court costs by approximately $25,000 (General Fund) per year. Recent author amendments: Revise the definition of "DNA sample" and "genetic characteristic" and delete the definitions for "genetic information" and "genetic service." Replace references to "genetic information" throughout the bill with "DNA sample." Specify that a laboratory that performs a genetic test shall be deemed to be in compliance with constitutional rights to privacy if the laboratory believes, in good faith and in the absence of knowledge to the contrary, that a written consent by the individual to whom the DNA sample pertains is valid. Inadvertently delete the consumer protection provisions that require the written authorization to advise the person signing the authorization of his or her right to revoke authorization at any time, and as to whether his or her information will remain identifiable or whether measures will be taken to make the information non-identifiable. Add additional exemptions to the requirement for a written authorization to include a pharmaceutical company, a licensed health care professional, a provider of health care, and an investigator within an institution, as specified. SB 222 (Padilla) Page 6