BILL ANALYSIS
-------------------------------------------------------------------
|Hearing Date:April 27, 2009 |Bill No: SB |
| |482 |
-------------------------------------------------------------------
SENATE COMMITTEE ON BUSINESS, PROFESSIONS
AND ECONOMIC DEVELOPMENT
Senator Gloria Negrete McLeod, Chair
Bill No: SB 482Author:Padilla
As Amended:April 14, 2009Fiscal: Yes
SUBJECT: Biological data analysis services: regulation.
SUMMARY: Establishes requirements for entities providing post-CLIA
bioinformatics, as defined. Requires entities providing post-CLIA
bioinformatics, as defined, that provides customers with FDA-approved
or FDA-exempt biological specimen kits to have a contractual
relationship with a clinical laboratory for the receipt and processing
of a customer's biological specimens. Makes other provisions relating
to privacy, notice, and consent requirements.
Existing law:
1)Defines the following terms:
a) Biological specimen as any material that is derived from the
human body.
b) Clinical laboratory sciences as any of the sciences or
scientific disciplines used to perform a clinical laboratory test
or examination.
c) Clinical laboratory test or examination as the detection,
identification, measurement, evaluation, correlation, monitoring,
and reporting of any particular analyte, entity, or substance
within a biological specimen for the purpose of obtaining
scientific data which may be used as an aid to ascertain the
presence, progress, and source of a disease or physiological
condition in a human being, or used as an aid in the prevention,
prognosis, monitoring, or treatment of a physiological or
pathological condition in a human being, or for the performance of
nondiagnostic tests for assessing the health of an individual.
SB 482
Page 2
d) Clinical laboratory as any place used, or any establishment or
institution organized or operated, for the performance of clinical
laboratory tests or examinations or the practical application of
the clinical laboratory sciences. That application may include
any means that applies the clinical laboratory sciences.
2)Establishes the federal Clinical Laboratory Improvement Amendments of
1988 (CLIA) to regulate all laboratory testing.
3)Provides for the licensing and regulation of clinical laboratories
and various laboratory personnel by the State Department of Public
Health (DPH).
4)Requires DPH whenever it determines that a new category of license is
necessary, either to direct a laboratory, or to perform clinical
laboratory tests or examinations, as specified, to adopt regulations
identifying the license category or modification, the education,
training, and examination necessary to obtain the license.
5)Requires that a clinical laboratory performing clinical laboratory
tests or examinations classified as of moderate or of high complexity
under CLIA to obtain a clinical laboratory license.
6)Provides that the offer, delivery, receipt, or acceptance by any
person licensed under the Healing Arts Division of the Business
and Professions Code and the Chiropractic Initiative Act (
including but not limited to physicians, podiatrists, osteopaths,
psychologists, acupuncturists, optometrists, dentists, and
chiropractors) of any rebate, refund, commission, preference,
patronage, dividend, discount, or other consideration, whether
monetary or otherwise, as a compensation or inducement for
referring patients, clients, or customers to any person,
irrespective of any membership, proprietary interest or ownership
in or with any person to whom these patients, clients, or
customers are referred is unlawful.
7)States that a violation of item # 6), above, is a public offense
and is punishable upon a first conviction by imprisonment in the
county jail for not more than one year, or by imprisonment in the
state prison, or by a fine not exceeding $50,000, or by both
imprisonment and a fine. Specifies that a second or subsequent
conviction is punishable by imprisonment in the state prison or
by imprisonment in the state prison and a fine of $50,000.
8)Establishes the federal Health Insurance Portability and
SB 482
Page 3
Accountability Act to, among other things, regulate the use and
disclosure of certain information by covered entities, as
specified.
9)Defines genetic characteristics as any of the following:
a) Any scientifically or medically identifiable gene or
chromosome, or combination or alteration thereof, that is
known to be a cause of a disease or disorder in a person or
his or her offspring, or that is determined to be associated
with a statistically increased risk of development of a
disease or disorder, and that is presently not associated with
any symptoms of any disease or disorder.
b) inherited characteristics that may derive from the
individual or family member, that are known to be a cause of a
disease or disorder in a person or his or her offspring, or
that are determined to be associated with a statistically
increased risk of development of a disease or disorder, and
that are presently not associated with any symptoms of any
disease or disorder.
This bill:
1) Makes findings and declarations on the need to create a new
regulatory scheme for postproduction data interpretation distinct
from the clinical laboratory regulatory scheme.
2) Defines the following terms:
a) Algorithm is a set of calculations, computations, rules, or
other bioinformatics processes transparently based on
peer-reviewed, published scientific literature and publicly
available data that is performed upon a customer's biological data
set.
b) Biological data is data that are produced from the performance
of clinical laboratory science, as defined, within a clinical
laboratory, including, but not limited to, the results of a
clinical laboratory test, as specified. Biological data include
results of derivations of an individual's biological data produced
by post-CLIA bioinformatics services that are presented to, and
maintained on behalf of, an individual.
SB 482
Page 4
c) Customer is any person 18 years of age or older who purchases
or consents to post-CLIA bioinformatics services for himself or
herself or for a dependent or other individual for whom the
customer has legal authority to consent.
d) Entity includes a natural person.
e) Individually identifiable information is information about an
individual customer collected from that individual, including any
of the following:
i) A first and last name.
ii) A home or other physical address, including street name and
name of a city or town.
iii) An e-mail address.
iv) A telephone number.
v) A social security number.
vi) Any other identifier that permits the physical or online
contacting of a specific individual.
vii) Information concerning a user that an Internet Website or
online service collects online from the user and maintains in
personally identifiable form in combination with an identifier
described in this subdivision.
f) Post-CLIA bioinformatics services is the postproduction
interpretation, by means of an algorithm, of biological data.
3) Requires an entity providing post-CLIA bioinformatics services
that provides customers with FDA-approved biological specimen
collection kits or biological specimen collection kits exempt from
FDA approval, as specified, but does not receive or handle biological
specimens, to have a contractua l relationship with a licensed
clinical laboratory for the receipt and processing of a customer's
biological specimens. Allows an entity to receive biological data
obtained somewhere else by a customer even if such entity did not
provide biological specimen collection kits to customers.
4) Requires an entity providing post-CLIA bioinformatics services
to disclose to its customers the CLIA certification status of any
clinical laboratory with which the entity has a contractual
SB 482
Page 5
relationship.
5) Prohibits any entity providing post-CLIA bioinformatics services
from being subject to the requirements for clinical laboratories set
forth in existing law.
6) Requires, when an entity providing post-CLIA bioinformatics
services receives a request from a customer to delete the customer's
full biological data set, the entity's privacy administrator to
acknowledge that request within 5 business days of receiving the
request. Requires an entity, within 30 business days following the
acknowledgment, to irreversibly delete all links between the
customer's biological data and his or her individually identifiable
information.
7) Specifies that deleted biological data may not be used by an
entity providing post-CLIA bioinformatics services for any reason.
Allows for biological data that has been included in data sets for
research purposes prior to the date an entity acknowledges a request
by a customer to delete his or her data to be used to support those
research efforts only if any and all links between the customer's
biological data and individually identifiable information has been
irreversibly deleted, but may not be used for subsequent research
efforts .
8) Requires an entity providing post-CLIA bioinformatics services
to designate an individual with a PhD or Master's degree in
bioinformatics, statistical genetics, biostatistics, or statistics
with a biological or medical specialization to be responsible for
approving algorithms and documentation thereof and to serve as the
point of contact for questions pertaining to the algorithm. Requires
the designated individual to approve documentation of the following:
a) The algorithm and any material changes to the algorithm.
b) The transparent description of the validity of biological data
sets and how to perform the algorithm on a biological data set,
including references to peer-reviewed, published scientific
literature and publicly available data used in the algorithm,
along with an explanation of why these references were chosen.
Requires the transparent description and any updates to be
provided annually to the DPH.
9) Requires an entity providing post-CLIA bioinformatics services
to have an external physician advisory board, which shall provide
guidance on the interpretation or presentation of analyses to
SB 482
Page 6
customers. Requires that at least one member of the board be
licensed to practice medicine in California.
10) Prohibits an entity providing post-CLIA bioinformatics services
from advising a customer regarding medical or clinical treatment or
services.
11)Requires an entity providing post-CLIA bioinformatics services to
maintain and make available to the public the following information
and update it on a regular basis:
a) A description of the algorithm used for interpretation of
customers' biological data.
b) Descriptions of the criteria for inclusion in the algorithm of
data from scientific studies.
c) Scientific references for background data, evidence,
assumptions, and claims made in the development of the algorithm
or the presentation of interpretations to customers.
12)Requires, in addition to the internal proficiency testing required
of clinical laboratories with California clinical laboratory licenses
or CLIA certification, an entity providing post-CLIA bioinformatics
services to implement a proficiency testing procedure independent of
the clinical laboratory, to be utilized at least every six months, to
monitor and ensure integrity of sample processing and data flow or
management. States that outcomes of internal proficiency testing
will be proprietary.
13)Requires an entity providing post-CLIA bioinformatics services to
do the following:
a) Maintain the privacy of all biological data consistent with its
privacy policies and all requirements of state and federal law.
b) Disclose its privacy policies to potential and existing
customers.
c) Take all reasonable steps necessary to prevent the release of
individually identifiable information without explicit consent
from a customer.
d) Present its interpretation of biological data directly to its
customers. Requires that if the interpretation is presented over
the Internet, access to interpretations be password-protected and
SB 482
Page 7
encrypted.
14)Requires the customer receiving biological data or an
interpretation of that biological data shall be provided with, and
consent to, at a minimum, all of the following prior to the
performance of post-CLIA bioinformatics services :
a) A description of the limitations of service.
b) Clear and conspicuous notice of either of the following:
i) As a condition of the provision of post-CLIA bioinformatics
services, that the customer's de-identified biological data sets
may be used for research purposes, as specified.
ii) That the customer must consent to use of the customer's
de-identified biological data sets for research purposes,
subject to the requirements in this bill.
c) A privacy policy.
d) A procedure for allowing the customer to obtain a copy of his
or her full biological data set.
e) A procedure for allowing the customer to request deletion of
his or her full biological data set.
15)Requires an entity providing post-CLIA bioinformatics services to
store biological data in a manner that, if breached, is designed to
prevent disclosure of individually identifiable information.
16)Prohibits an entity providing post-CLIA bioinformatics services
that utilizes biological data received to perform research functions
from doing either of the following:
a) Release an individual customer's biological data set to any
third party without explicit consent from the individual customer.
b) Make any attempt to identify an individual customer's
biological data set through the use of other known data such as
physical characteristics, ancestry, disease state, or specific
biological markers.
c) Requires an entity providing post-CLIA bioinformatics services
to undertake annual external audits of data security procedures,
which shall be subject to review by the DPH at the entity's
SB 482
Page 8
principal place of business.
17)Requires an entity that provides post-CLIA bioinformatics services
that is subject to a business transaction that affects the nature or
solvency of the entity, such as a merger, acquisition by another
company, or sale of all or a portion of its assets, to notify every
customer in advance of that transaction by e-mail and provide
prominent notice on its Internet Website of any such change in
ownership or control of the customer's personal information.
Requires an acquiring company or merger agreement to uphold the
material terms of the entity's privacy obligations to its customers,
including honoring requests for account deletion.
18)States that all biological data derived from post-CLIA
bioinformatics services shall be considered to contain genetic
characteristics, as specified.
19)Requires an entity providing post-CLIA bioinformatics services,
upon a customer's request, to provide information regarding the
availability of genetic counselors or physicians and surgeons or
other genetic experts.
20)Requires an entity providing post-CLIA bioinformatics services to
be subject to existing law provisions governing referrals, as
specified.
FISCAL EFFECT: Unknown. This bill has been keyed "fiscal" by
Legislative Counsel.
COMMENTS:
1.Purpose. According to 23&Me , the Sponsor of this measure, scientific
research has advanced the understanding of how an individual's
genetic measure may play a role in the risk of developing certain
diseases. It points out that the technology used in this research
has become available to the general consumer, and several personal
genomics companies in California now allow consumers to access their
personal genetic information and understand it in the context of
recent scientific advances. According to the Sponsor, entities that
handle personal genetic information generated at a CLIA-certified
laboratory but do not receive biological specimens or generate the
genetic information are not clinical laboratories and should not be
subjected to clinical laboratory requirements. It also points out
that it is necessary to ensure that when consumers obtain their
genetic information, privacy protections are in place. Genetics
SB 482
Page 9
testing offered directly to the consumer should have more rigorous
standards because they provide clients with their personal genetic
makeup.
2.Background.
a) Direct-to-Consumer Genetic Testing. According to the National
Library of Medicine of the National Institutes of Health (NIH) ,
traditionally, genetic tests have been available only through
healthcare providers such as physicians, nurse practitioners, and
genetic counselors. Health care providers order the appropriate
test from a laboratory, collect and send the samples, and
interpret the test results. Direct-to-consumer genetic testing
refers to genetic tests that are marketed directly to consumers
via television, print advertisements, or the Internet. This form
of testing, also known as at-home genetic testing, provides access
to a person's genetic information without the involvement of a
physician or insurance company. If a consumer chooses to purchase
a genetic test directly, the test kit is mailed to the consumer
instead of being ordered through a doctor's office. The test
typically involves collecting a DNA sample at home, often by
swabbing the inside of the cheek, and mailing the sample back to
the laboratory. In some cases, the person must visit a health
clinic to have blood drawn. Consumers are notified of their
results by mail or over the telephone, or the results are posted
online. In some cases, a genetic counselor or other health care
provider is available to explain the results and answer questions.
NIH further points out that the price for this type of at-home
genetic testing ranges from several hundred dollars to more than a
thousand dollars. The growing market for direct-to-consumer
genetic testing may promote awareness of genetic diseases, allow
consumers to take a more proactive role in their health care, and
offer a means for people to learn about their ancestral origins.
At-home genetic tests, however, have significant risks and
limitations. Consumers are vulnerable to being misled by the
results of unproven or invalid tests. Without guidance from a
health care provider, they may make important decisions about
treatment or prevention based on inaccurate, incomplete, or
misunderstood information about their health. Consumers may also
experience an invasion of genetic privacy if testing companies use
their genetic information in an unauthorized way. This NIH
publication also states that more research is needed to fully
understand the benefits and limitations of direct-to-consumer
genetic testing.
According to a September 2007 article published on the American
SB 482
Page 10
Journal of Human Genetics , proponents of direct-to-consumer
genetic testing cite benefits that include increased consumer
access to testing, greater consumer autonomy and empowerment, and
enhanced privacy of the information obtained. Critics have
pointed to the risks that consumers will choose testing without
the adequate context of counseling, will receive tests from
laboratories of dubious quality, and will be misled by unproven
claims of benefit.
The Government Accountability Office (GAO) in 2006 published a
report based on its investigation on the legitimacy of claims that
genetic tests provide consumers with the information needed to
tailor their diet and exercise programs to address genetically
determined health risks. The GAO, as part of this investigation,
purchased from four websites genetic kits, and found that
consumers were misled by predictions that are medically unproven
and so ambiguous that they do not provide meaningful information
to consumers. The Federal Trade Commission has also published a
fact sheet on genetic testing and warns consumers to be skeptical
about claims made by such companies.
b) DPH Cease and Desist Letter. On June 2008, the DPH sent a
cease and desist letter to companies performing genetic testing
without licensure or physician order, including 23&Me, the Sponsor
of this bill. In its letter, DPH indicated that clinical
laboratories or those receiving biological specimens for the
purpose of performing a clinical laboratory test or examination
must possess laboratory license or registration. Furthermore, the
letter stated that companies offering genetic testing are in
violation of existing law which prohibits the offering of a
clinical laboratory test directly to the consumer without a
physician order. Genetic testing companies were directed to
submit a plan on how to prevent further violation of California
state laboratory law. In its response to DPH, 23&Me indicated
that the tests it offered were educational and informational,
rather than clinical. However, DPH pointed that that it believes
23&Me and other similar entities identifies, evaluates, correlates
and reports results of biological specimen which may be used as an
aid in the prognosis, monitoring, or treatment of a physiological
or pathological condition of a person, and as such are to be
considered clinical laboratories subject to clinical laboratory
law. 23&Me indicated that in an effort to continue operating, it
accepted such determination by the DPH and obtained a clinical
laboratory license.
c) American College of Medical Genetics Guidelines. The American
SB 482
Page 11
College of Medical Genetics , recognizing that there is an
increasing availability of genetic testing, has posted on its
Internet Website minimum requirements for any genetic testing
protocol. The requirements include the following:
i) A knowledgeable professional should be involved in the
process of ordering and interpreting a genetic test.
ii) The consumer should be fully informed regarding what the
test can and cannot say about his or her health.
iii) The scientific evidence on which a test is based should be
clearly stated.
iv) The clinical testing laboratory must be accredited by CLIA,
the state and/or other applicable accrediting agencies.
v) Privacy concerns must be addressed.
d) Other States. According to the Genetics & Public Policy Center
at the Johns Hopkins University, many states, including Alaska,
Arkansas, Delaware, District of Columbia, Indiana, Iowa, Kansas,
Louisiana, Minnesota, Mississippi, Missouri, Montana, Nebraska,
New Mexico, North Carolina and Ohio permit direct-to-consumer
testing because state laws on these states are silent regarding
such tests.
e) Anti-Kickback and Anti-referral statutes. Longstanding policy
relating to the prohibitions against receiving payments or some
other form of compensation for referring patients for health care
services has been embodied in Section 650 of the Business and
Professions Code and Section 445 of the Health and Safety Code
since the early 1990's. These provisions were enacted to protect
consumers from unnecessary healthcare costs and to ensure medical
professionals make judgments about rendering services uninfluenced
by their own financial interests. Both Congress and California
enacted legislation to protect against unnecessary or unreasonably
costly referrals by physicians and other health professionals to
facilities in which they had a financial interest and where the
health care practitioner could profit based on the volume of
referrals made . Federal and state law took the form of specific
prohibitions against referrals where certain specified financial
interests of the referring practitioner were involved. This bill
requires that an entity providing post-CLIA bioinformatics
services to have a contractual relationship with a licensed
clinical laboratory for the receipt and processing of a customer's
SB 482
Page 12
biological specimens and subjects entities providing post-CLIA
bioinformatics services to these anti-referral statutes.
2.Arguments in Support. Supporters, including Genentech and various
individuals, state that this bill enacts regulatory standards for
biological data analysis services to ensure quality, transparency,
and consumer protection. They state that the current regulatory
framework is not appropriate for companies that provide genetic
information directly to consumers. They indicate that entities that
provide storage and presentation of genetic information on consumers'
behalf do not receive biological specimens or generate the genetic
information are not clinical laboratories and should not be subject
to clinical laboratory requirements.
3.Concerns. The American Civil Liberties Union (ACLU) has sent a
letter expressing concerns about this bill. ACLU has proposed
convening a series of stakeholder meetings to discuss and make
recommendations regarding the regulation of direct-to-consumer
genetic testing. ACLU also proposes several drafting
recommendations, including language dealing with privacy, quality
standards, and consent requirements.
4.Policy Comments.
a) Regulatory scheme . This bill as currently drafted does not
include a regulatory scheme for post-CLIA bioinformatics entities.
For example, it is unclear which state entity would have
enforcement and licensing, if applicable, authority over such
entities. As this bill moves forward, the author may want to
consider amending this bill to include a regulatory framework.
b) Privacy . The bill contains several provisions relating to
privacy of data, including a requirement that a customer's consent
may be obtained before the release of any individual information.
With the recent practice by insurance companies rescinding the
health plans of thousands of Californians for pre-existing
condition or other reasons, the author may want to consider
language to ensure that individual data will not be released to
health plans or health insurers. In addition, consumers should be
able to opt-out of the release of data for research purposes.
Lastly, the author may want to consider setting parameters for
employees of post-CLIA bioinformatics entities that handle
biological data sets to ensure integrity of the information.
c) Clinical laboratory requirements . SB 482 would require a
post-CLIA bioinformatics entity to have a contractual relationship
SB 482
Page 13
with a licensed clinical laboratory for the receipt and processing
of a customer's biological specimens. However, it is unclear if
this licensed clinical laboratory must be a laboratory licensed by
the DPH. The author may wish to clarify his intent.
NOTE : Double-referral to Rules Committee second.
SUPPORT AND OPPOSITION:
Support:
23&Me (sponsor)
Genentech
various individuals
Opposition:
None on file as of April 21, 2009
Consultant:Rosielyn Pulmano