The Web of Legal Protections for Participants in Genomic Research

Abstract

The identification and arrest of the Golden State Killer using DNA uploaded to an ancestry database occurred shortly before recruitment for the National Institutes of Health’s (NIH) All of Us Study commenced, with a goal of enrolling and collecting DNA, health, and lifestyle information from one million Americans. It also highlighted the need to ensure prospective research participants that their confidentiality will be protected and their materials used appropriately. But there are questions about how well current law protects against these privacy risks. This article is the first to consider comprehensively and simultaneously all the federal and state laws offering protections to participants in genomic research. The literature typically focuses on the federal laws in isolation, questioning the strengths of federal legal protections for genomic research participants provided in the Common Rule, the HIPAA Privacy Rule, or the Genetic Information Nondiscrimination Act. Nevertheless, we found significant numbers and surprising variety among state laws that provide greater protections than federal laws, often filling in federal gaps by broadening the applicability of privacy or nondiscrimination standards or by providing important remedies for individuals harmed by breaches. Identifying and explaining the protections these laws provide is significant both to allow prospective participants to accurately weigh the risks of enrolling in these studies and as models for how federal legal protections could be expanded to fill known gaps.

Introduction

GEDmatch, a DNA database and genealogical resource for “amateur and professional researchers and genealogists,”¹ played a critical role in law enforcement’s arrest of the notorious “Golden State Killer,” who had eluded police for decades.² Using DNA collected from crime scenes, police were able to identify relatives of the suspect that ultimately led to the suspect’s identification and arrest.³ In the months following the Golden State Killer arrest, law enforcement has begun to use this technique to identify suspects for other unsolved crimes.⁴

Despite the clear benefits to law enforcement and to families who have long sought answers to crimes committed years ago, law enforcement’s use of these genealogy databases has raised concerns.⁵ After all, the people who uploaded their DNA did not do so for this purpose. The publicity over this use of consumers’ DNA led direct-to-consumer genetic testing companies, including well-known companies like Ancestry and 23andMe, to clarify their privacy policies.⁶

Although the Golden State Killer case did not involve a research database, its implications for research are significant. Indeed, as recruitment for the NIH’s All of Us study commenced, with its goal of enrolling and collecting DNA and other health information from one million Americans, NIH director Francis Collins and project director, Eric Dishman, sought to reassure potential participants that their data would be safe.⁷ Collins emphasized the NIH’s efforts to protect participants’ confidentiality, including obtaining a Certificate of Confidentiality that protects against subpoenas or other legal demands for research data, as an important mechanism for “getting people comfortable” with sharing their information.⁸ While the All of Us Study and the Million Veterans Program⁹ are among the most ambitious research studies in terms of scale and scope, researchers already hold DNA and health data from a large number of Americans.¹⁰

Privacy concerns are not limited to DNA databases. In January 2018, Strava, a GPS tracking company, published an interactive map based on data accumulated through fitness trackers and mobile phones, which then revealed classified military and intelligence facilities of the United States and other western countries.¹¹ In March 2018, the New York Times reported that Cambridge Analytica¹² had used data involving millions of Facebook users for election analysis.¹³ These examples illustrate the massive amount of information that may be collected, analyzed, and used, not always in ways individuals intend.¹⁴

For research projects like the All of Us study that seek to harness a broad range of data, including DNA, health information, and data from wearable devices or mobile apps, adequately addressing these privacy concerns is critical to earn public trust in the research enterprise. But there are questions about how well current law protects against these privacy risks. The literature is replete with discussion of the limits of the federal laws, including the Common Rule, the Health Insurance Portability and Accountability Act (HIPAA) and its Privacy Rule, and the Genetic Information Nondiscrimination Act (GINA), that may protect participants of such large-scale, national genomic research studies.¹⁵ While state laws that provide greater protections may fill in these gaps, until now, there has been no comprehensive analysis of what those laws provide and how they might work together to protect research participants. We undertook an empirical study how the federal and state laws work together to create a “web of legal protections” and to understand the limits of the web in protecting participant interests in genome research.¹⁶ This paper reports key findings from that study.

Like most empirical studies, this article proceeds in four parts. Part I sets forth a framework to describe the potential risks and corresponding legal protections for participants in genomic research, organized conceptually into three stages: research entry, the release of information from research, and unwanted use of research information after release. Part I also summarizes what is known and also what is poorly understood about the nature and substance, as well as existing gaps, within the web of legal protections for participants in genomic research. Part II describes our research methods used in identifying federal and state statutes and regulations that form the web of protections for participants in genomic research. Part III organizes the results of the research, describing the web of protections in four conceptual categories: (a) human subjects research laws, (b) laws specific to genetic information, (c) medical privacy laws, and (d) disability discrimination laws. Of these, the second category of laws specific to genetic information are of particular relevance to participants of genomic research. Part IV synthesizes our research findings and sets forth our discussion of the significance of these findings for participants, researchers, institutional review boards, and policymakers.

I. Background: A Framework for Mapping the Web of Protections

Large-scale genomic research offers unprecedented opportunities to learn more about human health and disease. The technological advances enabling genomic research, however, have also created conditions where genomic data can never be truly anonymized. Despite adherence to data security measures designed to protect participant anonymity, investigators have demonstrated that it is possible to discover the identities of participants based on genomic data that had been considered “de-identified.”¹⁷ This unsettling development poses privacy risks to research participants that, if unaddressed, could undermine individuals’ willingness to participate in research.

Good research practice has required that participants’ personal information be kept confidential through technological security measures, such as firewalls or encryption and by limiting use of identifiers, either through coding or, when scientifically feasible, rendering the data anonymous by removing identifiers entirely.¹⁸ Indeed, much genetic research has proceeded without consent under regulatory guidance and exceptions that assume that research would present very little risk to participants if the researchers do not have access to or record overt identifiers, such as names, medical record, and social security numbers.¹⁹

The assumptions underlying these regulatory exceptions have been challenged by a number of provocative studies that have demonstrated that deidentified genomic data may be re-identified without breaching data security measures.²⁰ In response to the earlier of these studies, the NIH made a number of preemptive modifications to its policy for posting and accessing data contained in its genome-wide association study (GWAS) databases, including removing aggregate genotype data from public access, making them available only through a data access committee process.²¹ A 2013 study, however, described the ability to deduce individual identities even in the absence of a reference DNA sample, using only free, publicly accessible Internet resources, such as genetic genealogy databases.²² Although the inherent identifiability of genomic data has long been discussed,²³ this development adds urgency to the challenge of protecting genomic research participants’ privacy while also ensuring that the data they contribute can be used for the greatest societal good.²⁴

Although several federal laws provide protections to participants in genomic research, these laws also have known gaps. The federal laws include the Common Rule that regulates human subject research conducted or funded by the federal government,²⁵ the HIPAA Privacy and Security Rules that established minimum standards for protecting identifiable health information,²⁶ and GINA that prevents large employers and health insurers from discriminating based on genetic information.²⁷ Each of these laws establishes a minimum national standard but they are limited in their scope of protections. Although state laws that fall below these standards are preempted, state laws that exceed these standards must be followed.²⁸ Figure 1 graphically represents some of the primary federal protections and the known gaps in those protections. These will be presented in more detail throughout the paper.

Figure 1.

Together, these federal and state laws that fill in these known gaps work together to provide what we refer to as the “web of legal protections” for research participants.

Nevertheless, the strengths and weaknesses of the cumulative web of protections created by federal and state law are poorly understood by participants and even researchers engaged in genomic research.²⁹ At the same time, large-scale genomic research endeavors like the All of Us study (previously called The Precision Medicine Initiative) and the Million Veteran Program are each seeking to enroll a million individuals and gather genomic, health, and lifestyle data on an unprecedented scale.³⁰ Thus, we undertook this research to develop a fuller understanding of the web of legal protections applicable to this type of large-scale genomic research with the goals of better informing prospective participants about the extent and limitations of these protections and to provide insight into updates to the legal protections that may be needed to adapt to a rapidly evolving research environment.

The range of risks to participants in genomic research and their corresponding legal protections can be organized in a framework that follows the participant’s information through time, starting from the initial research consent to the possible uses of the data were they to be disclosed outside the research enterprise. The first stage in the framework involves protections at study entry found in laws governing human subjects research. The second stage relies on protections against information release out of the research context found in genetic and health information privacy laws. If the information nonetheless escapes the research context, the third stage addresses protections against use of the information by third parties, including laws prohibiting discrimination on the basis of genetic or other health information.

At the first stage, the primary research risks are that the participant’s data will be used for research purposes that the participant finds objectionable, such as to develop a commercialized product or in research that could be used in ways that could harm their identity or social group.³¹ The primary legal protections against this risk of harm are found in laws governing human subjects research. In particular are the Common Rule’s requirement for IRB review to minimize risks to participants (including assessment of confidentiality protections), as well as the requirement of informed consent, which protects participants by allowing them to decline to participate in the research if the risks of participation or the research purposes are objectionable.³² When research data is collected prospectively through interaction with the individual, as in the All of Us study, participants must consent to research participation.³³ However, their research data may be used for secondary research studies to which the participant does not specifically consent, through broad consent for future research³⁴ or through exceptions to the regulatory requirements, as described further below.³⁵ Similarly, data collected for clinical or other non-research purposes may be used without consent for research purposes under the same regulatory exceptions.³⁶

At the second stage, the primary risk is that the participant’s data will be released from the research context, either through a permitted or unauthorized disclosure. Such disclosure could result in a tangible harm, such as discrimination based on the information released, but unauthorized disclosure itself can be a dignitary harm stemming from the breach of the promise of confidentiality and the unwanted disclosure of information to others.³⁷ The primary legal protection against the privacy harms of disclosure are privacy laws, in particular the federal HIPAA Privacy and Security Rules and, with respect to compelled disclosures from research, Certificates of Confidentiality. The HIPAA Privacy Rule offers scant protection to participants in genomic research. First, the HIPAA Privacy Rule may not apply to researchers or biobanks if they are not HIPAA “covered entities” or “business associates.”³⁸ Furthermore, the Privacy Rule does not apply if the information has been de-identified under the terms of HIPAA, even if they are re-identifiable as demonstrated above.³⁹ Even if the Privacy and Security Rules were to apply to the researcher or biobank and the participant’s information, there are several exceptions where the data could be disclosed outside the research context without the individual’s authorization.⁴⁰ Of particular concern are compelled disclosures, where researchers may be subject to a legal demand by a court, administrative tribunal, or law enforcement to disclose an individual’s information pursuant to a court order, subpoena, warrant, or summons.⁴¹ Individuals’ information may be disclosed, without their knowledge, to law enforcement if they or a family member are identified as a potential criminal suspect.⁴² Certificates of Confidentiality, which apply to all NIH-funded research, are legal tools authorized by Congress that provide protection against compelled disclosure of sensitive, identifiable research data “in any Federal, State, or local civil, criminal, administrative, legislative, or other proceeding.”⁴³ Certificates of Confidentiality were developed precisely to protect against compelled disclosure.⁴⁴ Even with the uncertainty about the strength of its protection, legal counsel have been successful in using its authority to minimize production of research data and crafting protective orders when data are disclosed.⁴⁵

The protections afforded by HIPAA and Certificates are directed at specific holders of information, covered entities and their business associates and research institutions, respectively.⁴⁶ However, Certificates permit disclosures mandated by law.⁴⁷ And the federal Privacy Rule permits disclosure without individual authorization for purposes of government investigation, national security, mandatory reporting obligations, or public health.⁴⁸ Genetic or genomic data may also be returned to the individual,⁴⁹ placed in the individual’s health record,⁵⁰ breached or hacked, which also have implications as to whether and which privacy protections apply. Thus, our research identifies ways in which state laws may fill gaps in privacy protection available to genomic research participants under the federal HIPAA Privacy Rule and Certificates of Confidentiality.

At the third stage, the participant’s genomic and other data has been released outside the research context and there are risks that the information will be used against that individual to limit economic opportunities, such as employment or access to insurance.⁵¹ Other risks are that the information can be used for identity theft (including medical identity theft), that the individual will be targeted for unwanted marketing, or suffer embarrassment from having the information made public.⁵² The primary legal protections against these third-stage risks are laws that prohibit discrimination on the basis of genetic, genomic, or other health information, including the federal Genetic Information Nondiscrimination Act (GINA) and state laws that fill GINA’s gaps.⁵³ These laws prohibit third parties, such as employers or health insurers, from using genetic or other health information in discriminatory ways.⁵⁴ Nevertheless, GINA’s protections are limited—GINA only applies to employers with 15 or more employees, and it only applies to health insurers and not to life, disability, or long-term care insurers.⁵⁵ When they understand GINA’s limits and the possibility of genetic discrimination, prospective participants may actually avoid participating in research based on fears of discrimination in insurance or other opportunities.⁵⁶ Studies demonstrate that individuals avoid even clinically beneficial genetic tests over fear of misuse.⁵⁷ Though largely anecdotal, stories of misuse and unauthorized disclosure have understandably raised concerns that such fears will thwart the potential benefits of genomic research.⁵⁸

Given the known limits of federal legal protections, state laws can play a significant role in filling gaps in legal protections for research participants. But the extent, applicability, and variety of state laws that provide additional protections for genomic information are poorly understood. As stated by the Presidential Commission for the Study of Bioethical Issues:

Current U.S. governance and oversight of genetic and genomic data … do not fully protect individuals from the risks associated with sharing their whole genome sequence data and information. In particular, a great degree of variation exists in what protections states afford to their citizens regarding the collection and use of genetic data.⁵⁹

To address the uncertainty surrounding the patchwork of federal and state laws for acquiring, disclosing, and using genomic information, this project systematically catalogues and analyzes the ways in which state laws may fill known gaps in the federal protections for participants in genomic research. Though often overlooked, these state laws are significant for two reasons. First, they may provide substantive rights and stronger legal protections for participants who are subject to them, which may in turn affect descriptions of these protections and risks in the informed consent process. Second, they may offer models for how federal legal protections could be strengthened. The web of protections for participants in genomic research is what results when we analyze how state laws fill (or do not fill) the known gaps in federal legal baseline. The web of protections, taken together, offers genomic research participants uneven protections and highlights both the shortcomings of the federal laws, as well as a surprisingly robust degree of state action.

II. Methods

To identify laws that make up the “web of legal protections,” we conceptualized several different types of protections afforded by federal and state laws to participants in genomic research. These categories of laws correspond to the sequential framework described above. First, we considered the decision to choose to participate in genomic research and consent to genetic testing by researchers as a protection against the risks of research participation, namely objectionable research uses of the participant’s data. Second, we viewed genetic and health information privacy laws that limit disclosure of information – particularly when coupled with penalties for violation of those obligations – as the next layer of protection after information is obtained in research. The third and final layer of protections were laws that restrict access and use of participants’ information once it is released from the research context, and, thus, guard against third-party uses of the information against the participant’s interests.

Based on this 3-stage conceptualization, we identified several sets of laws that may provide protections to participants in genomic research. For stage one, we identified laws governing human subjects research and informed consent for genetic testing as the primary protections against objectionable research use of the participant’s information. For stage two, we focused on genetic and health information privacy laws as the main protections against the disclosure of data out of the research context. For stage three, we examined genetic discrimination laws and laws against unauthorized use of genetic information as the main protections against use of the data against the individual’s interests by third parties. In each of these sets, there were well-recognized, relevant federal laws.⁶⁰ These include the federal regulations governing human subjects protections (the Common Rule),⁶¹ the HIPAA Privacy Rule,⁶² Certificates of Confidentiality,⁶³ GINA,⁶⁴ the Americans with Disabilities Act (ADA),⁶⁵ the Affordable Care Act (ACA).⁶⁶ As noted in Part I, these federal laws establish a minimum standard, and all of them have known gaps. These laws also provide limited recourse for individuals who are harmed as a result of a breach. For example, an individual who suffers as a result of a breach in violation of HIPAA may bring a complaint to the United States Department of Justice’s Office of Civil Rights, but may not bring an individual claim against the entity who violated their HIPAA obligations.⁶⁷ Finally, while these federal laws preempt state laws that offer less protection than the federal law does, state provisions that exceed the federal standards must be followed.⁶⁸ Accordingly, we conducted searches to identify state laws that had provisions that added to the federal protections in some way.

We crafted formal search strategies to identify state laws for inclusion in our datasets.⁶⁹ These strategies were developed in consultation with our legal librarians to yield comprehensive, relevant search results, using the Boolean and full-text search capabilities available in legal databases, Westlaw and Lexis-Nexis. We searched only for enacted statutes and promulgated regulations in effect between January 1, 2015 and December 31, 2017. We did not include bills or proposed regulations that were pending at the time of our searches and had not taken effect. Because Westlaw proved to have richer resources for statutory and regulatory research than Lexis-Nexis, our searches were conducted either exclusively in Westlaw or in both Westlaw and Lexis-Nexis; no searches were conducted solely in Lexis-Nexis. In addition to these searches, we used the book browse feature to ensure we had all relevant parts of statute or regulation, as not all sections would contain our search terms. We also compared our results to lists of relevant laws that had been gathered by others to ensure completeness of our datasets.⁷⁰

We focused our analysis on laws that apply to how and when genetic testing may be conducted, protect the confidentiality of genetic information, and protect against uses of that information.⁷¹ Because our research focused on legal protections for participants in genomic research, we searched for laws that would apply to genetic information, tests, and biospecimens, and other health information used and held by researchers and biobanks. We also looked for laws protecting against unwanted use of genetic and other health information by employers, insurers, or “any person” if such information were to be disclosed, breached, hacked, or returned to the participant or their health care provider. There are numerous other laws—such as laws relating to use of genetic information in health care and operations (including licensure requirements of genetic counselors), in paternity or adoption scenarios, intestate succession, or regarding criminal law enforcement DNA databases—that we did not analyze as they are beyond the scope of our research question.⁷²

Research team members worked in pairs to conduct searches and select relevant laws across all 50 states and the District of Columbia for inclusion in the datasets. Initially, each pair conducted searches for their assigned dataset independently and determined whether to include or exclude the law according to defined set of inclusion/exclusion criteria.⁷³ The pair then compared their selections and any disagreements were resolved by discussion. If there were any lingering disagreements, a faculty member would make a final determination. Given the volume of laws we were encountering, we elected to limit the double searching to five states for comparison, with a check for consistency. Each member of the pair continued to review independently the list of search results to identify those laws for inclusion in the dataset and to compare them for agreement. We merged selections and sorted the data in Excel to allow for comparisons of all selections, rather than on a subset of the search results.

Once the searches for and section of relevant laws were complete, we proceeded to coding. We created a coding scheme that would capture both common provisions across the datasets (e.g., right and penalties), and provisions specific to particular datasets. The coding scheme was developed through a collaborative process within the team, during which we defined the different codes. Two independent coders coded each law in the qualitative software program NVivo.⁷⁴ The research team met regularly to reconcile coding of individual laws and further develop the codebook as coding proceeded. After coding, we compiled summary tables of the relevant coded sections to assess the strengths and weaknesses of the various types of laws analyzed and to identify exemplars of specific kinds of provisions for further exploration. We then used coding reports that contain textual provisions by code, to this deeper exploration of specific types of protections. When necessary, we referred back to the relevant law for context. Any interpretive questions were identified and discussed among the faculty members.

Although we sought to compile a comprehensive picture of the laws relevant to our research questions, there are limitations to our research. We can only provide a snapshot of the laws in place at the times of our searching. Laws may have changed, been repealed, or adopted since our searches. In addition, although we tested and refined our searches based on existing information about relevant laws, it is possible that there are laws that our search terms did not identify. Given our focus on the privacy of genomic or health data held by researchers, laws that might otherwise fall within the broader topics we considered were excluded as not applying to the genomic research context we were studying. Finally, other types of laws that we did not consider may have provisions that expand on the protections we discuss here.

III. Results: The Web of Legal Protections for Participants in Genomic Research

We found substantially more state activity in each of the areas than we expected, and the types of issues these laws address extend beyond those addressed by federal law in unanticipated ways. For example, although the literature tends to refer to only a handful of state laws regulating human subjects research,⁷⁵ we found that half the states have such laws. In addition, state laws are much more likely than federal laws to provide individuals with legal remedies for violations. Our findings from the different datasets follow.⁷⁶ The results of the 50-state searches for laws protecting participants in genomic research are organized below under each of the four datasets: (A) human subjects research laws; (B) laws specific to genetic testing and information; (C) medical privacy laws; and (D) disability discrimination laws. In addition, each section includes a brief description of the “baseline” of requirements set forth under applicable federal laws.

A. Human Subjects Research Laws

1. Federal Regulation of Human Subjects Research

The primary federal law addressing human subjects research is the Common Rule.⁷⁷ It applies to “all research involving human subjects conducted, supported, or otherwise subject to regulation by any Federal department or agency that takes appropriate administrative action to make the policy applicable to such research.”⁷⁸ The Common Rule generally requires that research studies are reviewed and approved by an Institutional Review Board (IRB), which must, among other things, ensure appropriate consent to research participation, risks are minimized and reasonable in relation to anticipated benefits, and selection of subjects is equitable.⁷⁹

Although the Common Rule requires consideration of confidentiality protections, when applicable, it does not have any specific provisions that protect research data.⁸⁰ Federal law authorizes protection of sensitive, identifiable research data from compelled disclosure through a mechanism called a “Certificate of Confidentiality.”⁸¹ Historically, the Secretary of Health and Human Services’ authority to issue Certificates was discretionary, whether the research was federally funded or not, and researchers had to apply for the protection.⁸² However, following the enactment of the 21^st Century Cures Act, the Secretary must issue Certificate protections to federally funded research.⁸³ In keeping with this change, the NIH will automatically issue a Certificate to any research it funds in which identifiable information is collected.⁸⁴ At this point, however, researchers who are not NIH-funded must still apply a Certificate of Confidentiality to protect research data from compelled disclosure.⁸⁵ This requires the researchers or their IRBs to be aware of Certificates and decide to apply. There is also the possibility that researchers who are not federally funded may not receive one, even if they do apply.⁸⁶ The revised Certificate statute includes a new provision permitting disclosures in compliance with federal, state, and local law (except for compelled disclosures), which may undermine the Certificate’s protections, although a new provision making research data inadmissible as evidence in legal proceedings may mitigate the effects of this exception.⁸⁷ Importantly, the revised Certificate statute explicitly provides that the protections against compelled disclosure apply to all copies of the data in perpetuity.⁸⁸ Accordingly, if biospecimens are shared with identifiers, the Certificate’s protections would apply to subsequent studies using the data. A research biobank protected by a Certificate would be obligated to refuse to disclose its data, including biospecimens, even in a case like the Golden State Killer scenario, where law enforcement seeks to solve a serious crime.⁸⁹

Research that involves prospective collection of biospecimens is subject to the Common Rule’s requirements for IRB review and participant consent.⁹⁰ Consent provides a mechanism for individuals to decide whether to participate in research after being told of the relevant benefits, risks, and potential harms of participating in the research. Included in the discussion of potential risks and harms is a description of the relevant legal protections that may prevent or mitigate these harms.⁹¹ The consent requirement protects participants because it allows an individual who is risk averse, is concerned about a specified risk, or feels particularly susceptible to a harm to choose not to consent and, thus, not to participate.

Under the revised Common Rule, consent requirements for research involving identifiable data, biospecimens, and whole genome sequencing must describe whether identifiers will be removed, whether biospecimens will be used for commercial purposes, whether the individual can expect to share in any profits, and whether clinically actionable results of genetic testing or genomic sequencing will be returned to the individual.⁹² A corollary to the right to consent to research participation is the right to withdraw.⁹³ In the context of biospecimens research, the right to withdraw might best be conceived of as a right to revoke consent to further use of the biospecimens.⁹⁴ There may also be some practical constraints on this right, permitting researchers to retain data already collected from the biospecimen and recognizing that it may not be possible to stop use of biospecimens that have been deidentified, whether they have been shared or not.⁹⁵ Assuming a participant’s data and specimens are collected appropriately pursuant to Common Rule requirements, there is no federal restriction preventing researchers or biobanks from storing and using such research data or specimens indefinitely. Although researchers may promise to destroy data and samples to the extent they can be identified as that participant’s if she withdraws consent, if the participant does not act, consent does not expire.⁹⁶ The researchers are not obligated to destroy the data and no expiration of consent by operation of law for continued future use of data and samples for research.⁹⁷

There are several gaps to the application of the Common Rule. First, the Common Rule applies only to “research” involving “human subjects,” as these terms are defined in the regulations.⁹⁸ Pursuant to Office for Human Research Protections (OHRP) guidance,⁹⁹ research involving only coded specimens does not constitute human subjects research if it meets certain conditions. These conditions include that the specimens were not collected specifically for the proposed research through interaction or intervention with a living individual and the investigator cannot readily ascertain the identity of the individuals whose specimens are used.¹⁰⁰ Accordingly, such research is not considered human subjects research and is not subject to the consent and IRB review requirements of the Common Rule. If specimen research is considered human subjects research, it still may be exempt from the Common Rule if it involves existing specimens that are either publicly available or the “information … is recorded by the investigator in such a manner that the identity of the human subjects cannot readily be ascertained, directly or through identifiers linked to the subjects …. .”¹⁰¹ While the IRB may, but is not required to, review the protocol to ensure it meets with the exemption, consent would not be required.¹⁰² Finally, human subjects research that does not fit the exemption for existing specimens may be conducted without consent if the researcher can demonstrate it is eligible for a waiver of the consent requirement.¹⁰³ Thus, with respect to secondary research with biospecimens, there are three ways that genomic research may be conducted without consent, and two ways that such research may be conducted without IRB review.¹⁰⁴

That the Common Rule does not extend to non-federally funded research is another well-recognized gap.¹⁰⁵ Although many institutions have voluntarily agreed to apply these regulations to all research conducted at their institutions in their “federalwide assurance,” some institutions have “unchecked the box” so that they are not required to apply the regulations to non-federally funded research.¹⁰⁶ Research conducted outside of institutions with a federalwide assurance and without federal funding would fall entirely outside the scope of the Common Rule’s protections.¹⁰⁷

Finally, the Common Rule does not provide a right of action nor corresponding remedies for individuals who are harmed as a result of violations of its provisions. While OHRP oversees compliance with the Common Rule and may respond to participant complaints, its enforcement actions are directed at researchers and their institutions.¹⁰⁸ Aggrieved individuals may bring state law tort claims, based, in part on the obligations enshrined in the regulations, however, there are many obstacles to a successful claim.¹⁰⁹

2. State Regulation of Human Subjects Research

Discussions about human subjects research in the literature almost exclusively focus on the federal regulations,¹¹⁰ with little mention of state human subjects protections laws, and then only a few well-known examples, in particular, California, Maryland, and New York.¹¹¹ However, we found that five states substantially expand upon the Common Rule’s protections in scope or substance for participants in genomic research, although they do so to a different extent. Other states close gaps in the Common Rule in a more incremental fashion.

There are four states – California,¹¹² Maryland,¹¹³ New York,¹¹⁴ and Virginia¹¹⁵ – that have laws that apply to human subjects research when the Common Rule does not, namely to non-federally funded research. However, even under these laws, some of the Common Rule’s gaps pertaining to secondary research persist. For example, California, Virginia, and New York permit secondary research without consent using specimens collected for other, non-research purposes.¹¹⁶ Maryland’s picture is more complex. It adopts the federal definition of “human subject,”¹¹⁷ but also explicitly applies federal Common Rule requirements to “all research using a human subject.”¹¹⁸ On its face, the latter provision seems to prevent research that meets one of the federal Common Rule’s exemptions from avoiding avoid the regulatory requirements. However, the Maryland Attorney General indicated that this was not the intention of the statute.¹¹⁹ Accordingly, if Maryland chooses to follow OHRP guidance that some secondary research with biospecimens is not human subjects research, this statute would not change how biospecimen research is treated.¹²⁰ Interestingly, New York limits who can conduct human subjects research to “researchers,” which are defined as medical professionals or those who an IRB deems qualified.¹²¹ By restricting who may conduct research, New York may further limit the number of human subjects who might otherwise fall outside the federal regulations.

Another approach taken by states expands on the Common Rule by applying broader legal protections to research in particular contexts or populations.¹²² These laws would apply to genomic research conducted in these settings or populations but would not apply more generally. In contrast, Oregon has specific provisions that apply to genetic research.¹²³ Although Oregon permits holders of genetic information to disclose it without consent for anonymous and coded research, Oregon law requires all genetic research to go to an IRB for “explicit prior approval or an explicit determination that the research is anonymous or otherwise exempt.”¹²⁴ This is more prescriptive than the federal approach, which recommends, but does not require, that institutions review potentially exempt research to confirm that determination.¹²⁵ In submitting the research to the IRB, Oregon requires researchers to “disclose to the IRB the intended use of human DNA samples, genetic tests or other genetic information for every proposed research project, even anonymous or otherwise exempt research.”¹²⁶ There is no exception for federally funded research. This requirement has significant implications, particularly for secondary use studies, as it requires IRB review for secondary research that the Common Rule permits to proceed without IRB review. These choices are deliberate, as Oregon’s law also notes that “these rules set state standards that are in addition to, and not intended to alter, any requirement under the Federal Common Rule or the Federal Privacy Rule.”¹²⁷ Oregon also imposes obligations on the recipient of a limited data set of genetic information, which may limit secondary research using that data set.¹²⁸

Although the Common Rule requires IRBs to consider confidentiality protections undertaken by the researcher, it does not have any specific provisions to protect research data, and the Certificate’s protections to not automatically extend to non-NIH funded research.¹²⁹ A few states fill these gaps by providing additional confidentiality protections to research data.¹³⁰ Most protective are Arkansas and Oklahoma; their laws protect the research records of subjects in “genetic research studies” from “subpoena or discovery” in civil (not criminal) lawsuits, except when “the information in the records is the basis of the suit.”¹³¹ Both of these laws apply broadly to all genetic research approved by an IRB or conducted in accordance with the Common Rule or the FDA regulations.¹³² Unlike the federal Certificate of Confidentiality, it does not depend on federal funding or require an application. However, because the Arkansas and Oklahoma protections rely on IRB approval or compliance with the federal regulations, they may not apply to secondary research when specimens are not identifiable because such research would not require IRB review under federal requirements. Louisiana provides that identifiable information held by researchers in public universities, medical schools, and colleges is not available for subpoena and is not discoverable.¹³³ This law provides similar protections to the Arkansas and Oklahoma laws, but it is not restricted to genetic research. On the other hand, Louisiana’s law only applies to research conducted at public institutions, a substantial limitation. Kentucky provides that identifiable research information is “confidential” and cannot be disclosed to someone outside the research team without consent, but it does not explicitly address subpoena or discovery.¹³⁴

Only California and Maryland discuss remedies for violation of human subjects protections obligations. California provides for civil damages, criminal fines, imprisonment, attorney’s fees, and court costs for conducting research without consent.¹³⁵ A researcher who negligently permits research without consent shall be liable to the subject for a minimum of $500 in damages and a maximum of $10,000, and willful failure to obtain consent is subject to minimum damages of $1,000 and a maximum of $25,000.¹³⁶ Maryland authorizes the Attorney General to seek injunctive of other relief “to prevent violations” of its human subjects research law.¹³⁷ It does not discuss remedies for the participants affected by any violations.

3. State genetics laws with implications for human subjects research

Several states require the individual’s written consent to retain genetic materials or information.¹³⁸ These provisions may be coupled with obligations to destroy samples that could limit future research using the biospecimens. For example, Delaware requires prompt destruction of genetic materials, except if needed for criminal or death investigations or proceedings, a court orders retention, the individual authorizes retention, or for “anonymous” research in which the identity of the individual is not disclosed.¹³⁹ New Jersey provides that “a DNA sample from an individual who is the subject of a research project shall be destroyed promptly upon the completion of the project or withdrawal of the individual from the project, whichever occurs first, unless the individual or the individual’s representative directs otherwise by informed consent.”¹⁴⁰ It also provides:

The DNA sample of an individual from which genetic information has been obtained shall be destroyed promptly upon the specific request of that individual or the individual’s representative, unless: (1) Retention is necessary for purposes of a criminal or death investigation or a criminal or juvenile proceeding; or (2) Retention is authorized by order of a court of competent jurisdiction.¹⁴¹

These laws suggest that that they would prohibit a researcher from deidentifying a specimen and continue to use it for research after withdrawal of consent, as permitted under the federal regulations.¹⁴² Texas requires destruction of genetic material after “the purpose for which [it] was obtained is accomplished unless” it was obtained for IRB approved research and retention is either required or authorized by the participant.¹⁴³

There are some common exceptions to the requirement for consent to retain genetic material. These primarily include: retention for public purposes, such as law enforcement (including criminal DNA databases), paternity determinations, newborn screening, by court order, or otherwise authorized by law.¹⁴⁴

Similar to the right to withdraw consent to participate in research, several states explicitly grant individuals the right to revoke an authorization to use or disclose genetic information. Louisiana law not only grants the right to an individual to revoke the authorization before disclosure, but it invalidates the authorization if used for any improper purpose.¹⁴⁵ Accordingly, any research use not covered by the original consent would invalidate the authorization and could subject researchers to penalties. Minnesota and Washington also grant the right of revocation.¹⁴⁶

Finally, a few states have specific provisions limiting the research use of genetic information, but these are limited to newborn spot specimens.¹⁴⁷ While they require researchers to return or destroy unused newborn spot specimens obtained from the state,¹⁴⁸ cutting off further secondary uses that might otherwise be permissible, these do not apply to materials originally obtained for research.¹⁴⁹

As this section demonstrates, a handful of states have laws that fill in some of the gaps in the federal laws governing human research protections. These include a handful of states that have laws that apply to human subjects research when the federal regulations do not, and one, Oregon, that has specifically requires IRB review for all genetic research, including some genetic research that would be exempt from IRB review under federal law. There are also a few states that have adopted specific confidentiality protections that extend beyond federal requirements. Finally, California provides for remedies, including minimum damages for subjects involved in research without their consent.

B. Laws Regarding Access, Use, and Disclosure of Genetic Information

1. Federal Genetic-Specific Laws

One of the main risks of participating in genomic research is that the genomic information will be released beyond the confines of the research study and be used against the individual.¹⁵⁰ The primary federal law addressing access, use, and disclosure of genetic information is GINA. Substantively, GINA prohibits employers and health insurers from requesting or requiring prospective or current employees or insureds to submit genetic information, undergo genetic testing, or reveal whether the individual or family member has undergone genetic testing.¹⁵¹ In this way, GINA prohibits employers and health insurers from accessing a person’s genetic information.¹⁵² GINA also limits how employers and health insurers may use and disclose genetic information that they may receive. Employers may not make hiring, termination, promotion, or other adverse employment decisions on the basis of genetic information or the fact that an employee or family member has undergone genetic testing.¹⁵³ Health insurers may not make underwriting decisions, such as whether to offer coverage or setting premiums, based on genetic information and may not require applicants or enrollees to undergo genetic testing or submit genetic information in connection with enrollment or underwriting.¹⁵⁴ This feature of GINA was incorporated into the Affordable Care Act’s federal requirements for health insurance plans, which prohibit making coverage determinations or setting premiums upon genetic information or upon health conditions.¹⁵⁵ Finally, GINA extends confidentiality protections to genetic information, defining genetic information as “protected health information” (PHI) under the HIPAA Privacy Rule, discussed below.¹⁵⁶ GINA also requires employers to keep any genetic information they may have about employees or applicants in separate, confidential medical file and prohibits disclosure of genetic information except for limited purposes.¹⁵⁷

GINA’s protections contain notable gaps. First, the employer provisions of GINA only apply to employers with 15 or more employees and therefore do not apply to the approximately 17 million people (almost 15% of all employees), who work in companies with less than 15 employees.¹⁵⁸ Second, GINA’s insurance provisions only apply to health insurers and do not apply to other forms of insurance, such as disability, life, or long-term care insurance. Given the aging population and the importance of these forms of insurance to provide financial security to a large and growing segment of the population (and their familial caregivers), GINA’s inapplicability to these other forms of insurance is a significant gap.¹⁵⁹

2. State Genetic-Specific Laws

Every state except Mississippi has a law that addresses genetic testing, privacy, or discrimination in some form.¹⁶⁰ Collectively, we refer to these laws as “genetic-specific laws.” In some cases, these laws are coextensive with federal protections under GINA, but we found a number of instances in which states go beyond the federal minimums, closing gaps in protection offered by federal law.

As a threshold question, we had to consider whether state laws that apply to genetic testing or information would apply to analyses conducted for research purposes. We found that these laws rarely explicitly apply to research.¹⁶¹ But they also rarely explicitly exclude research from their reach.¹⁶² When we did find genetic testing and information laws that excluded research, the exclusion applied only to research conducted under the Common Rule or FDA regulations.¹⁶³ A few laws do not explicitly limit their application to clinical purposes, but their use of the term “diagnose” suggests such a limitation.¹⁶⁴ These examples provide support for our interpretation that states with broad definitions that neither exclude research from their laws or nor define genetic information in terms of clinical uses may apply to research.¹⁶⁵ That some states exclude non-clinical types of genetic testing suggests that other states could exclude research should they desire.¹⁶⁶ Thus, unless a state law referencing genetic testing or genetic information specifically excluded research or explicitly limited applicability to clinical or diagnostic contexts, we concluded the law could apply to the genetic tests and information of participants in genomic research. There are two independent reasons for taking a broad view of these laws. First, identifying which genetic mutations are associated with specific diseases or conditions is one of the main purposes of genomic research,¹⁶⁷ even if the links are not yet confirmed. Second, in the context of whole genome sequencing, the information generated is likely to include genetic mutations whose associations with disease are known, as well as mutations of unknown significance.¹⁶⁸

Using these analytical frameworks, we found states’ legal activity in this category is substantial, both in volume and variety. A number of states have passed laws regulating genetic testing or information in ways that go beyond the federal requirements. Notably, state laws create substantive individual rights to control genetic information or assert claims for damages in the event genetic information is inappropriately used or disclosed. The results of our research into state laws specific to genetic information and testing are organized under the following subcategories: (a) laws requiring consent for genetic testing; (b) laws restricting access to or use of genetic information; (c) laws restricting disclosure of genetic information; and (d) laws creating individual rights regarding one’s own genetic information. The results are discussed in detail below.

a. Laws requiring consent to genetic testing

Ten states require written informed consent for genetic testing.¹⁶⁹ This is significant because there is no federal requirement for informed consent for genetic testing. While the Common Rule may require written informed consent for individuals to participate in research, including prospective collection of biospecimens for genomic research, it may not require a separate written consent for secondary research or genetic testing of biospecimens.¹⁷⁰ To the extent it applies to the research context at all, the HIPAA Privacy Rule’s authorization requirement does not apply to information that has been de-identified.¹⁷¹ Therefore, there may be instances where researchers genetically test specimens without seeking written informed consent or authorization from the individual. Moreover, because GINA prohibits employers and health insurers from requesting or requiring individuals to undergo genetic testing,¹⁷² GINA does not speak to whether written informed consent is required for genetic testing.

Most of the states’ statutes are written broadly to apply to “any person” (or “no person” when written in the negative) and thus include researchers in their scope.¹⁷³ In these states, researchers would have to obtain individual consent to conduct genetic testing on research specimens even if such research would not have required consent under federal law. Oregon’s law is unique in explicitly addressing consent for genetic research. It permits “anonymous” and “coded” research using specimens or genetic information if the individual consents to the specific research project, consents to genetic research generally, or was notified that her information may be used in such research and did not request that her information not be used.¹⁷⁴ Researchers likely prefer the last approach because it sets the default as permitting research use unless the individual objects. Research in choice architecture suggests that people are more likely to choose the default option.¹⁷⁵

Some of the state laws requiring written informed consent for genetic testing only apply to physicians or other health care providers and, therefore, may only apply to genomic research if it is conducted by physician-investigators.¹⁷⁶ Florida requires consent for genetic testing, without specifying that it must be written,¹⁷⁷ although in practice consent is likely done in writing.

Contrary to what is required under federal law, in many states, researchers would need to obtain consent, sometimes specific or written consent, to conduct genetic testing on samples from participants in genomic research. Given how broadly many of these statutes are written, it seems that consent would be required even for secondary research.

b. Laws limiting disclosure of genetic information

The primary federal law regulating the disclosure of health information, including genetic information, is the HIPAA Privacy Rule.¹⁷⁸ The HIPAA Privacy Rule includes genetic information in the definition of “health information,”¹⁷⁹ but the Privacy Rule is limited by its applicability only to HIPAA covered entities or their business associates.¹⁸⁰ The HIPAA Privacy Rule generally requires individual authorization to disclose identifiable health information, but there are several exceptions allowing for disclosure without authorization, such as for law enforcement purposes, pursuant to a court order or subpoena, or to public health or other governmental authorities.¹⁸¹ Significantly for participants in genomic research, the HIPAA Privacy Rule may have limited applicability to researchers or biobanks that gather, store, and use genomic data, particularly if those researchers receive the data directly from the participant rather than from health care provider that is covered by the Privacy Rule.¹⁸² To the extent that researchers and biobanks de-identify the information or data such as through the use of codes instead of individual identifiers, the HIPAA Privacy Rule’s protections would not apply.¹⁸³ Moreover, once genetic data escapes the realm of regulated institutional holders (to the extent they are covered entities or their business associates under HIPAA), either through return of results to the participant, breach, hacking, or permitted disclosure (e.g., subpoena or court order), the information is entirely beyond the reach of HIPAA. As noted above, GINA prohibits employers and health insurers from disclosing genetic information of employees, enrollees, or applicants.¹⁸⁴ This is an area where state laws are particularly significant—both in their number and in the substantive ways that states fill the gaps in protection left by GINA and HIPAA.

i. Consent to disclosure of genetic information

As noted above, the HIPAA Privacy Rule may not apply to the researcher, biobank, or any other subsequent holder of a participant’s genetic information. States broaden the privacy protection offered by requiring consent to disclosure beyond HIPAA covered entities. Sixteen states prohibit any person, including corporations and entities, who holds information obtained through genetic testing from disclosing the information without the individual’s consent, although some of these laws also have exceptions.¹⁸⁵ For example, Nevada provides “[i]t is unlawful to disclose or to compel a person to disclose the identity of a person who was the subject of a genetic test or to disclose genetic information of that person in a manner that allows identification of the person, without first obtaining the informed consent.”¹⁸⁶ These restrictions on disclosure would apply both to researchers and biobanks as well as third parties who may subsequently obtain individuals’ genetic information if it were to escape the confines of research.

In addition to these general prohibitions on disclosure of genetic information without consent applicable to any person, states also restrict specific entities from disclosing genetic information. Fifteen states restrict employers’ disclosure of genetic information.¹⁸⁷ Vermont restricts disclosure of genetic information to employers.¹⁸⁸ California restricts disclosure by insurers.¹⁸⁹

Should genetic information get into the individual’s medical record (such as through automatic placement of genomic information into the medical record or through the return of research results to the participant), Arizona’s and Washington’s statutes provide additional protections by imposing obligations on those seeking to access genetic information from providers through a subpoena or discovery request to provide opportunities to limit disclosures through protective order or other judicial mechanisms.¹⁹⁰

ii. Confidentiality protections for genetic information

Numerous states provide confidentiality protections for genetic information that extend beyond the protections offered to health information under federal or state laws regarding privacy of non-genetic health information. To the extent they impose a broad obligation upon holders of genetic information to maintain confidentiality of such information and refrain from disclosure, these state laws fill a gap in the HIPAA Privacy Rule by extending obligations beyond HIPAA covered entities¹⁹¹ to the researcher, the biobank, and any subsequent holder if the genetic data of research participants were to get out from the research context.

In some cases, the confidentiality protection is constructed so broadly that its scope is unclear. Examples include Arizona, Colorado, and Georgia,¹⁹² which declare genetic information “confidential” and “privileged” without specifying what that means.¹⁹³ Several states include general statements that genetic information is confidential and may only be disclosed with consent of the person tested.¹⁹⁴ The scope of these laws is unclear because they do not necessarily specify to whom the confidentiality obligation applies.

There are mechanisms, such as mandatory public health reporting requirements, that could allow information held by researchers to be disclosed to government officials. Many states do, however, extend confidentiality protections to genetic information held by government agencies and officials (such as public health departments, newborn screening programs, and disease registries) and may protect such information from state open records requests.¹⁹⁵ Such protections may provide some reassurance to research participants. However, there are a myriad of exceptions to confidentiality obligations of state or governmental holders of genetic information.¹⁹⁶

Several exceptions include those that participants would likely expect, such as disclosure to the person tested or their legally authorized representative, to medical providers or other medical personnel, for treatment or payment purposes, or when the person tested consents (typically in writing). Some states also allow disclosure to relatives for medical purposes if the person tested is deceased. However, other exceptions might surprise research participants, especially given their breadth. These include disclosures for public health purposes, newborn screening, abuse and neglect reporting, research, law enforcement (including identification of persons), paternity determinations, and to monitor legal compliance. There are also exceptions for quality improvement purposes, such as for peer review, utilization review and quality assurance, for health care operations, or other business operations. Other exceptions include: when the person tested brings a lawsuit or other complaint or genetic information is placed at issue in litigation or pursuant to a court order; as authorized or required by law; for marketing; and for due diligence in sale of business.

iii. Laws against compelled disclosure

The Golden State Killer case highlighted the value of genetic information for law enforcement in the identification of suspects.¹⁹⁷ Legal demands for genetic information could also stem from civil cases, such as family law disputes or personal injury matters.¹⁹⁸ While genomic research databanks may be particularly attractive for law enforcement or civil legal demands, any holder of genetic information could be subject to a legal demand, and federal laws generally do not shield holders other than researchers from having to comply.

No federal laws protect genetic information generally from compelled disclosure via court order or subpoena, although, as described above, federal law authorizing Certificates of Confidentiality and a handful of state laws may protect some research data from compelled disclosure.¹⁹⁹ To the extent the information holder is a covered entity, the HIPAA Privacy Rule permits disclosure of PHI without individual authorization to law enforcement to help identify a suspect or in response to a legal demand, such as a subpoena, court order, or warrant.²⁰⁰ For civil legal demands, the HIPAA Privacy Rule permits disclosure of PHI pursuant to a court order or subpoena without individual authorization if the covered entity receives evidence that there were reasonable efforts to notify the individual about the request to allow the individual to object and to seek a qualified protected order for the information from the court.²⁰¹

Several states more broadly shield any holders of genetic information from compelled disclosure. Texas protects any person against compelled disclosure of an individual’s genetic information without the individual’s consent.²⁰² Delaware, Illinois, Nevada, Oklahoma, and Oregon also provide broad protections for any holder of genetic information from compelled disclosure,²⁰³ but with more exceptions than the Texas law.²⁰⁴ These laws would arguably protect researchers and biobanks from compelled disclosure of genetic information pursuant to a subpoena, but they would also apply to other holders of the information if the information were to be released from the research context, such as through a return of research results to the individual or their physician or through breach or hacking. However, with the exception of Illinois, these laws do not protect researchers and biobanks from disclosing genetic information pursuant to a court order.

Utah’s law allowing for compelled disclosure of genetic information is much more restrictive. Such orders must limit disclosure to the parts “essential to fulfill the objective of the order” and to those persons who need access, as well as including other measures necessary to protect the individual.²⁰⁵ Illinois’ law is unique, declaring genetic information inadmissible in legal proceedings.²⁰⁶ This provision can protect an individual’s information from being used against them, even if the information is somehow disclosed.

In sum, state laws creating confidentiality protections for genetic information are significant in a couple ways. First, this is an area where the gap in federal protection could be significant if the research institution declines to extend HIPAA covered entity status to its researchers and biobanks. Moreover, subsequent holders of genetic information gathered through genomic research are not likely covered by the requirements of HIPAA. Nevertheless, the mere designation of genetic information as “confidential,” without more, may offer few substantive protections to the affected individual, particularly given the numerous exceptions to this general rule. But the second significant finding is that some states extend substantial protections against disclosure by the researchers or indeed any holder of genetic information, however obtained. Perhaps the most important of these are protections against compelled disclosure through subpoena for researchers or any other holder of genetic information.

c. Laws restricting access to or use of genetic information

As discussed above, GINA prohibits health insurers and employers with 15 or more employees from requiring, requesting, or conditioning approval or employment on the submission of genetic information. State laws can go beyond GINA’s requirements by extending the prohibitions on access to smaller employers, other types of insurance, or other non-employer or insurance entities.²⁰⁷ These legal protections are relevant to participants in genomic research because of the potential for genetic information to escape the confines of research use and be accessible to employers, insurers, or others who may have an interest in an individual’s genetic information. The primary ways that genetic information could be accessed from the research context are through inclusion of genomic information in the medical record,²⁰⁸ return of the results of genetic testing to the individual and their health care provider, authorized disclosure such as through subpoena or court order, breach, or hacking.

GINA also prevents the use of genetic information by employers in making employment decisions, including hiring, firing, promotions, and access to other benefits.²⁰⁹ GINA and the ACA prevent health insurers from using genetic information to determine eligibility, benefits, or premiums.²¹⁰ The gaps in GINA’s protections, described above, limit its applicability to employers with fewer than fifteen employees or other types of insurance providers, such as disability, life, or long-term care insurers. Although the HIPAA Privacy Rule generally requires authorization for use as well as disclosure of individually identifiable health information, it may have limited applicability to researchers, biobanks, and subsequent holders of research participants’ genetic information.²¹¹

States impose a variety of limits on analysis or use of genetic materials or information that apply beyond the limits of GINA or the HIPAA Privacy Rule. A few states broadly limit use of genetic information by any person without consent.²¹² The restrictions that states impose on analysis or use of genetic information are important to protecting research participants from the risk that genetic information generated in research could be used against them in the event that the information escapes the research context.²¹³

To address the concern that genetic information can be used to limit employment, insurance, and other opportunities, states have passed a variety of laws to fill GINA’s gaps by extending prohibitions on use of genetic information to a broader range of employers, other types insurers besides health insurance, and even other contexts.

i. Employment

Seventeen states apply prohibitions on employer access to or use of genetic information where GINA does not because they define employer to include those with less than 15 employees. As Table 1 illustrates, 11 of these applying to employers with only one employee, and the remainder apply to employers with up to five employees (Table 1).²¹⁴

Table 1.

Minimum employees to come under state discrimination laws	States
15	MD
5	CA, ID
4	NY
3	CT
2	IA, RI
1	AR, DC, MI, MN, OK, OR, UT, VT, VA, WA, WI
Unspecified	NH, SD

At least two states explicitly prohibit employers from obtaining consent to testing by offering employees a benefit.²¹⁵ These prohibitions contrast with GINA, which permits limited rewards or penalties in the context of voluntary wellness program.²¹⁶ Rhode Island, on the other hand, does not allow employees to waive protections with respect to genetic information.²¹⁷

ii. Insurance

Regarding access, four states go beyond GINA by applying restrictions on use of genetic information to insurance other than health insurance. Vermont prohibits all insurers – specifically including life, disability, and long-term care insurance – from using genetic information for underwriting, providing: “No policy of insurance offered for delivery or issued in this state shall be underwritten or conditioned on the basis of: (1) any requirement or agreement of the individual to undergo genetic testing; or (2) the results of genetic testing of a member of the individual’s family.”²¹⁸ Colorado and California restrict collection of genetic information by disability insurers, however, California’s law is limited to disability insurance for hospital, medical, and surgical expenses.²¹⁹ Colorado and Maryland restrict collection of genetic information by long-term care insurers.²²⁰

Regarding analysis and use of genetic information by insurers, a few states go beyond GINA and prohibit use of genetic information in disability insurance underwriting outright²²¹ or restrict its use in disability insurance underwriting unless its use is “based on sound actuarial principles or actual or reasonably anticipated claims experience.”²²² While the latter approach is less protective, it seems likely to provide some protections to research participants, as much of the genetic information from whole genome sequencing will be of uncertain clinical significance and many conditions are multifactorial and the relationships may not be known.²²³ Such genetic information is unlikely to provide the kind of actuarial justification to permit their use in underwriting. On the other hand, research involving whole genome sequencing may also generate information that has known clinical significance, and disability insurers would not be restricted from using that information in underwriting. Wyoming prohibits disability insurers from treating genetic information as a preexisting condition in the absence of a diagnosis of a condition related to genetic information.²²⁴ While this does not prohibit its use in underwriting, it does provide protection against denial of coverage should a claim arise.

A few states also prohibit use of genetic information²²⁵ or limit its use unless it is based in “sound actuarial principles”²²⁶ in long term care insurance. Only Vermont prohibits use of genetic information in underwriting for life insurance, although California and Maryland prohibit underwriting based on genetic carrier status.²²⁷ A few other states do restrict its use unless such use is based on “sound actuarial practice or actual or reasonably anticipated claim experience.”²²⁸

iii. Other

Though GINA’s prohibition on collecting or requesting genetic information does not extend beyond employers or health insurers, we found a number of states that expand prohibitions on use of genetic information beyond GINA to a range of other areas, such as housing, education, and financial transactions.²²⁹ Some prohibit discrimination based on genetic information to places of public accommodation, which is an expansive protection to a variety of business that offer services and products to the public.²³⁰

Iowa includes genetic information as part of “identification information” for purposes of its identity theft law.²³¹ Vermont explicitly limits putting some genetic specimens into criminal databases. This includes specimens “collected voluntarily,” suggesting that specimens collected with consent for research could not be placed into these databases.²³²

iv. Exceptions in state laws limiting use of genetic information

There are numerous exceptions to the state law restrictions imposed on analyzing or using genetic information described above.²³³ These not only may undermine or narrow the protections, but also make it more challenging to describe the protections to participants in genomic research.

For example, states may permit genetic information to be used without individuals’ knowledge or consent for paternity testing, newborn screening, law enforcement purposes, or criminal DNA banking.²³⁴ In addition, consistent with GINA (but typically not included in consent forms), states may permit employers to use genetic information for determination of bona fide occupational qualifications, workers’ compensation claims, and worker safety (e.g., to monitor toxic exposures).²³⁵

In sum, states extend GINA-type prohibitions on the collection, access, or requesting of genetic information to entities that are not subject to GINA to varying degrees. One-third of states provided GINA-type employment protections to employers with five or fewer employees. Only a few extended protections to non-health insurance and several states extend genetic discrimination protections beyond employment or insurance such as to housing or education, suggesting that affording such protections is possible. One fear often expressed about expanding GINA’s scope is that it would be economically unworkable to extend prohibitions on genetic discrimination to other contexts, including smaller employers, other forms of insurance, educational, or economic opportunities. While empirical study may yet reveal these provisions are largely symbolic and difficult to enforce, the fact that several states have expanded the scope of genetic anti-discrimination may suggest that such expansions are economically feasible.

d. Individual rights created

One of the primary ways states fill in gaps in the federal laws protecting participants in genomic research is to extend broader private rights to the individual. The federal laws offer few legal remedies or enforceable rights for individuals aggrieved by violations of these federal requirements; the Common Rule is silent as to remedies, there is no private right of action (right to sue) under the HIPAA Privacy Rule, although a violation could serve as evidence for a state tort claim,²³⁶ and GINA limits recovery.²³⁷ The enforcement mechanisms under these federal laws focus on administrative penalties rather than conferring individual causes of action. Thus, perhaps the most significant way that states expand upon the protections offered to participants in genomic research is to provide private rights of action and statutory remedies for violations of state laws limiting access, use, and disclosure of genetic information.

Aside from private enforcement, states may build upon the federal standards by offering individuals more specific rights to access and control their genetic information than offered under federal law, including rights to notification about what is done with the individual’s information, right to access information, right to request the destruction of the individual’s biospecimens or samples, or property rights in one’s genetic information. Given the focus of this project, we have only included laws that are written broadly enough that they could be interpreted to apply to research-related holders of genetic information.

i. Enforcement rights

State laws regarding access, use, or disclosure of genetic information distinguish themselves from their federal counterparts by providing remedies, penalties, or both for violations of their requirements. Twenty-six states create a private right of action for violation of their various genetic-specific laws.²³⁸ Eight states make violations of laws regarding genetic information a violation of the state’s unfair or deceptive trade practice statute.²³⁹ Unlike the Federal Trade Commission Act (FTCA),²⁴⁰ which may only be enforced by the FTC,²⁴¹ most state unfair trade practice laws permit private causes of action, allowing individuals to recover compensatory damages and attorneys’ fees, with some states also providing for punitive damages.²⁴² In contrast, other states only authorize state enforcement of their genetic-specific laws either through the attorney general’s office or through the appropriate state agency.²⁴³ Several of these state enforcement provisions impose civil or criminal fines or imprisonment for violations of the state’s genetic-specific laws.²⁴⁴ While state action can be an important mechanism for enforcing these laws and serve as a deterrent, they typically do not compensate individuals whose rights have been violated as civil or criminal fines are paid to the state, not the individual. In addition, where state enforcement is the only mechanism, aggrieved individuals may have no recourse against someone who has violated their rights if the state chooses not to act. Accordingly, a state law provision of a private right of action can be significant.

Importantly, eight states provide for statutory damages, that is, a minimum amount that may be collected in damages for a violation of the law (Table 2). The significance of statutory damages is that it obviates the need for the aggrieved individual to prove they were harmed or injured in some tangible way by the violation, it is sufficient to prove the violation occurred,²⁴⁵ which makes it easier to assert a claim for intangible or dignitary harms than it would be under an ordinary tort claim for damages, which requires proving an injury.²⁴⁶ For example, if a researcher or biobank were to disclose a participant’s genetic information without consent, under a statutory damages provision, the affected individual does not have to prove she suffered an economic or other tangible harm from the unlawful disclosure; if she can prove the violation, she is entitled to the statutory damages amount. If the aggrieved individual can demonstrate actual damages that are greater than the statutory damages, typically she may recover her actual damages.

Table 2.

State (code citation)	Damage amount
Alaska (Alaska Stat. Ann. § 18.13.020)	Actual damages + $5,000 (+ $100,000 if the violator profited from violation)
California (Cal. Civ. Code 56.17)	Negligent disclosure, civil penalty not to exceed $1,000 (paid to subject)
Colo. Rev. Stat. Ann. § 10-3-1104.6 & 10–3-1104.7	Greater of actual damages or $10,000 per violation
Illinois (410 Ill Comp. Stat. Ann. 513/1)	Greater of $2,500 or actual damages (negligent) OR Greater of $15,000 or actual damages (intentional or reckless)
Louisiana (La. Rev. Stat. Ann. 22:1023)	Greater of actual damages or $50,000 (negligent) Greater of actual damages or $100,000 (intentional)
Massachusetts (Mass. Gen. Laws. Ann. Ch. 151B § 4)	Actual damages (contract) or special damages not to exceed $1,000
New Hampshire (NH Rev. Stat. Ann. § 141-H:1 et seq)	Not less than $1,000 per violation
Oregon (Or. Rev. Stat. Ann. § 192.531 et seq)	Violations regarding retention or human subjects requirements (§§ 192.537 & 547) greater of actual damages or: $100 (inadvertent violation) $500 (negligent violation) $10,000 (knowing or reckless violation) $15,000 (knowing violation w/ fraudulent representation) $25,000 (knowing violation with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm) Violations regarding consent or disclosure requirements (§§ 535 and 539) greater of actual damages or: $1,000 (inadvertent violation) $5,000 (negligent violation) $100,000 (knowing or reckless violation) $150,000 (knowing violation w/ fraudulent representation) $250,000 (knowing violation with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm)

As Table 2 shows, the statutory minimum damages vary considerably, from a total award low of $1,000 to a high of $50,000 for negligent violations and a per violation low of $1,000 and high of $10,000. Nevertheless, provision of any level of statutory damages could be essential for enforcing the rights afforded by these statutes, as actual damages may be difficult to prove. Those states with per violation statutory minimum damages also may facilitate claims from multiple participants because of the ability to aggregate those claims and increase the value of the suit. In addition to statutory damages, several states authorize punitive damages,²⁴⁷ which may be imposed to deter the violator and others from engaging in similar behavior in the future. States also provide for equitable relief, or non-monetary remedies, which can be in addition to or instead of damages, as appropriate.²⁴⁸

Seventeen states also provide for attorneys’ fees²⁴⁹ and twelve provide for court costs.²⁵⁰ These provisions may encourage attorneys to undertake cases and, thus, make it more feasible for people to seek to redress violations under these laws. In contrast, some states provide for attorneys’ fees and costs for the prevailing party, which suggests that defendants could be eligible for attorneys’ fees and costs if the plaintiff does not establish the violation of the statute.²⁵¹ This adds an additional financial risk to bringing a lawsuit, which could serve as a deterrent to those who seek to enforce their rights under these laws.

ii. Right of notification

A couple of states require individuals to be notified about what is done with their genetic information. For example, Florida and New Jersey require any person who requests or performs genetic testing or analysis to notify the individual when genetic testing is performed or when the results of such genetic tests are obtained.²⁵² Florida also imposes an obligation to provide the results to the person’s physician, upon request, and to indicate whether the information was used to make a decision for “insurance, employment, mortgage, loan, credit, or educational opportunity.”²⁵³ Both states’ laws apply the notice requirement to “a person” who requires, requests, or receives the results of genetic testing. In keeping with our analytic approach discussed above,²⁵⁴ we interpret such broad statutes to potentially apply to researchers and biobanks because neither the statutory provision nor the definition of genetic testing is limited to clinical or diagnostic settings.

iii. Right to access information

The right to access one’s information is often viewed as providing individuals with more control over such information.²⁵⁵ Some participants seek full access to their genomic information.²⁵⁶ Nevertheless, in the context of genomic research, the right of access to one’s own genomic information, particularly findings of ambiguous clinical relevance, may also be viewed as creating risk rather than protecting participants from risk. There is considerable debate about the legality and ethics of returning individuals their genomic information, which could expose the individual to a number of risks, including psychological distress, familial disruption, unneeded medical intervention, and discrimination in insurance, employment or other economic opportunities.²⁵⁷

Federal human subjects research regulations under the Common Rule do not require that researchers provide participants with access to their information or data being held by researchers.²⁵⁸ To the extent the research institution designates researchers or biobanks as HIPAA covered entities or uses a HIPAA-covered laboratory, the HIPAA Privacy Rule requires covered entities to provide individuals with access to their health information (which includes genetic information) by request.²⁵⁹ And if that information escapes the research context and is obtained by employers labor organizations, GINA permits, but does not require, employers and labor organizations to disclose an individual’s genetic information to the individual employee or member at the written request of the individual.²⁶⁰

Although numerous states have provisions that grant individuals the right to access their own information, only Oregon’s law explicitly applies to research participants.²⁶¹ Several states are more broadly written, but grant the right of the person tested to get access to their genetic information.²⁶² Under Florida law, the person tested may request that “the information will be made available to his or her physician.”²⁶³ Other states’ laws refer to patients’ rights to access their own records, and, thus, may only apply to research participants who are also patients.²⁶⁴ In addition, some states limit the right to particular circumstances.²⁶⁵ Some of these states allow individuals to amend their genetic information.²⁶⁶ Washington’s law, which applies to medical information, including genetic information, similarly permits correction of information.²⁶⁷

The significance of these state laws is that, for researchers that are not HIPAA covered entities, these states may require researchers to allow participants to access their information where ordinarily the Common Rule and HIPAA would not require it. It also could limit the ability of such researchers to conduct research without giving participants the option to receive their genomic information. Although there are strong arguments for permitting research participants the right to access their information,²⁶⁸ the return of genomic research results to participants poses ethical²⁶⁹ and legal risks. The legal risks stem from the fact that once in the possession of the individual or their physician, genomic information is more apt to be accessed by others who may use the information in a discriminatory or malicious manner.²⁷⁰

iv. Right to destroy samples

Another type of control over one’s genetic information is the right to order that one’s genetic information be destroyed. In the research context, the right to destroy may prevent a health care provider from sharing genetic information with researchers, may prevent researchers who already have genetic information from conducting secondary research with that information or samples, or may prevent further disclosure of the information outside the research context, whether through legal or unauthorized means. Federal laws, including the Common Rule, GINA, and the HIPAA Privacy Rule, do not provide individuals a right to order the destruction of their genetic information by anyone who holds such information.²⁷¹

Oregon’s law requires destruction of a DNA sample held by “any person” upon the individual’s request, unless the information is required for criminal investigation purposes, retention is authorized by a specific court order, or it is for anonymous or coded research after notification or consent.²⁷² In addition, DNA samples used in non-anonymous research must be destroyed by researchers if the individual withdraws from the study, unless the individual consents to retention.²⁷³ New Jersey’s provisions are very similar to Oregon’s, although samples can only be retained for criminal investigation purposes, court order, or with consent.²⁷⁴ Nevada’s law generally provides that a person holding an individual’s genetic information must destroy it upon request.²⁷⁵ Other states limit this right to request destruction of genetic samples to specific circumstances, most commonly newborn screening registries.²⁷⁶

v. Property rights

Five states, Alaska, Colorado, Florida, Georgia, and Louisiana, provide that genetic information is the property of the individual. Alaska’s statute simply says that “a DNA sample and the results of a DNA analysis performed on the sample are the exclusive property of the person sampled or analyzed.”²⁷⁷ Colorado and Georgia refers to genetic information being “the unique property of the individual.”²⁷⁸ Florida provides that “the results of … DNA analysis, whether held by a public or private entity, are the exclusive property of the person tested.”²⁷⁹ Louisiana states that “genetic information is the property of the” applicant, insured, or enrollee.²⁸⁰

It is not clear what these statutes intend. Traditional property rights typically include the right to the use of and benefits from the property and the right to exclude others.²⁸¹ However, in one of the few cases involving one of these statutes, the federal district court found Florida’s property state law inapplicable to claims brought by biological specimen donors for conversion. It interpreted the statute as providing “only [ ] penalties for disclosure or lack of informed consent if a person is being genetically analyzed.”²⁸² More recently, however, courts have signaled a greater openness to considering claims based on an assertion of genetic property ownership.²⁸³ Thus, though courts had historically been reluctant to recognize individuals’ genetic property interests provided under state laws, the legal status of genetic property ownership is unsettled and may be shifting to a broader recognition of an individual property interest in their genetic information.²⁸⁴ If so, these state-level genetic property laws would potentially offer genomic research participants significantly greater control over their genetic information, including the right to exclude others from using the information, a broader right of access to the information, and remedies for unwanted uses.²⁸⁵

C. Medical Privacy Laws

1. Federal Medical Privacy Laws

As described above, the primary federal health information privacy laws are the HIPAA Privacy and Security Rules.²⁸⁶ Participants in genomic research are often generally aware of HIPAA’s privacy protections because of their interactions with the law in the clinical health care setting, but they may not be aware of HIPAA’s specific protections or its limitations. The HIPAA Privacy Rule generally prohibits covered entities²⁸⁷ and their business associates²⁸⁸ from using or disclosing PHI²⁸⁹ without individual authorization.²⁹⁰ The HIPAA Privacy Rule provides individuals the right to access their information, receive an accounting of disclosures, and request amendments or corrections to their PHI.²⁹¹ In addition, the HIPAA Security Rule imposes technical, physical, and organizational standards for covered entities and their business associates who handle PHI, such as encryption, facility access controls, and workforce security measures.²⁹²

The HIPAA Privacy Rule’s general prohibition on uses and disclosures of PHI by covered entities and business associates is subject to several exceptions whereby PHI may be disclosed without individual authorization or an opportunity to object. These exceptions include, among others, uses and disclosures for treatment, payment, or health care operations;²⁹³ as required by law; for public health purposes; for law enforcement purposes; about victims of abuse, neglect, or domestic violence; in response to a court order or subpoena in a judicial or administrative proceeding; for government inspection; for national security and intelligence purposes; and for research purposes if an IRB or Privacy Board waives authorization.²⁹⁴ Thus, even if a researcher or biobank is considered a covered entity and the research data were PHI, there are many circumstances under HIPAA where the researcher or biobank may use or disclose participants’ information without their authorization.

As noted above, HIPAA may have limited applicability to researchers and biobanks if they do not furnish health care services to the research participant or engage in covered transactions regarding such services, such as submitting a claim for payment.²⁹⁵ Although research institutions may elect to extend covered entity status beyond their clinical health care providers to researchers, they are not required to do so.²⁹⁶ Moreover, not all research data may be considered PHI if it is not created by a health care provider, health plan, or employer or it is not individually identifiable.²⁹⁷ For example, if a non-covered entity researcher collects data from participants directly or anonymizes the data, the HIPAA Privacy Rule would not apply.²⁹⁸ If the information were to exit the research context through a permitted disclosure or breach, HIPAA would not apply to third parties holding the information. In other words, HIPAA’s protections apply to specific entities and do not follow the health information once it leaves those entities’ hands.

In terms of violations and enforcement, the HIPAA Privacy Rule requires covered entities and their business associates to notify the affected individuals in the event of a breach of their unsecured (unencrypted) information.²⁹⁹ The HIPAA Privacy Rule only provides for enforcement by governmental authorities, who may seek civil or criminal penalties, depending on the severity of the violation.³⁰⁰ Notably, although individuals affected by a breach may file a complaint with the government, HIPAA does not provide individuals with a private cause of action or other mechanism to seek redress for violations.³⁰¹ In sum, due to its limited applicability, extensive exceptions, and limited remedies, the HIPAA Privacy Rule offers only limited protection to participants in genomic research. In fact, participants who are reassured by consent language referencing federal health information privacy laws may not fully understand how limited those protections are.

2. State Medical Privacy Laws

A multitude of state laws address medical privacy generally, with much duplication as states apply them to various types of health care providers, health insurers, and those businesses that support the health care system. These are generally consistent with the HIPAA Privacy Rule obligations as well as its limits and, thus, do not add to the scope of protections afforded to research participants. We therefore focused on state laws that extend health information privacy obligations beyond the HIPAA Privacy Rule, whether by imposing obligations on entities not covered by HIPAA, imposing obligations that go beyond those required by HIPAA, or providing affected individuals private remedies for violations or additional rights.

a. State laws imposing privacy obligations beyond HIPAA covered entities

Some states impose a broad obligation on “any person” to maintain confidentiality of medical or health information.³⁰² In other cases, states extend the confidentiality obligations to individuals to whom health information is disclosed,³⁰³ whereas other states impose confidentiality obligations on specific classes of persons who may not be HIPAA covered entities, such as employers,³⁰⁴ researchers,³⁰⁵ and other non-covered entities, including recipients of health information.³⁰⁶

Three states impose confidentiality and security obligations more broadly to all holders of personal information, which includes medical information.³⁰⁷ For example, Arkansas’s Personal Information Protection Act imposes confidentiality obligations on any person or business that “acquires, owns, or licenses personal information about an Arkansas resident.”³⁰⁸ These obligations require those holding personal information to take steps to secure the data, destroy it when it is no longer needed, and notify people of any breach.³⁰⁹

b. State laws imposing obligations beyond HIPAA

States often impose obligations on researchers or others that seek to access health information held by government agencies, such as public health authorities.³¹⁰ A few of these restrict researchers’ use of the information in particular ways, such as from secondary research or from reidentification of data.³¹¹ Many of the risks associated with the release of data from the research context are only possible if the data are identifiable or could be re-identified.³¹² Although genomic data stripped of other identifiers is not considered identifiable under the HIPAA Privacy Rule,³¹³ genomic data can itself be a tool for re-identification, particularly when matched with public genetic databases.³¹⁴ Texas broadly prohibits any person from re-identifying a person from their PHI, which would apply to researchers as well as other third parties attempting re-identification for any purpose.³¹⁵ This state law goes beyond the HIPAA Privacy Rule, which does not contain any prohibition on reidentification of data, but rather considers deidentified data not to be PHI, and therefore does not restrict the use or disclosure of deidentified information.³¹⁶ The federal Department of Health & Human Services has not altered the rules regarding deidentification of information with respect to genomic information, despite the fact that genomic information, even stripped of identifiers is inherently re-identifiable.

States may extend privacy protections beyond HIPAA by shielding identifiable health data from disclosure in response to a legal demand or from being admitted as evidence in a legal proceeding. In many cases, these additional protections only apply to information held by state agencies.³¹⁷ For instance, California does not permit government agencies to disclose personal data in response to a “subpoena, court order, or other compulsory legal process,” without first making reasonable “attempts to notify the individual to whom the record pertains.”³¹⁸ Such protections, including those making such government-held data inadmissible in a legal proceeding, could apply to data that is shared with researchers. For example, in authorizing researchers’ access to data contained in its Parkinson’s Disease Registry, California law makes explicit that the data, regardless of the holder, shall be protected from subpoena, discovery, or admission in any legal proceeding.³¹⁹

States may also impose stricter limits on commercial uses of health information. Although HIPAA prohibits covered entities and their business associates from selling, using, or disclosing PHI for marketing purposes without individual authorization,³²⁰ some states further restrict marketing and commercial uses of health information.³²¹

Finally, some states provide a greater right of access to health information when such information is in the form of laboratory test results. Although HIPAA provides individuals a right of access to their own health information from covered entities, genomic researchers, biobanks, and genetic laboratories may not be HIPAA covered entities.³²² A few states provide individuals a right to laboratory testing results, but these “rights” are primarily discussed in terms of health care providers’ obligations to patients.³²³ In contrast, Delaware provides that a medical laboratory “shall provide a copy” of laboratory results upon written request of the individual; “medical laboratory” is not defined.³²⁴ New Hampshire declares that medical information contained in the medical records of a hospital or other facility is the property of the patient, who is entitled to a copy upon request.³²⁵ States frequently create a right to access records, but this right typically is cast in terms of patients, and, thus, likely do not apply to research participants who are not also patients.³²⁶ States may also impose obligations on insurers toward insureds or applicants.³²⁷ A few states offer individuals a right to remove³²⁸ or amend information held by insurers or the state health information exchange.³²⁹ Some also provide an option from opting out of certain uses of information.³³⁰

c. State laws providing remedies and penalties beyond HIPAA

As noted above, one of the most significant ways that state laws close gaps in protections offered by the HIPAA privacy Rule is to offer individuals a private right of action for violations of state medical privacy laws. At least sixteen states authorize a statutory private right of action for breach of the state’s medical privacy laws.³³¹ This explicit right simplifies the case for recovery, compared to a tort cause of action that relies on the statute as evidence of the duty to maintain confidentiality, and renders it less susceptible to dismissal. A couple of these laws provide for statutory minimum damages or punitive damages, which as discussed earlier, means it may be easier for the individual to assert the claim without having to prove they were tangibly (e.g., economically) harmed by the violation, which may be difficult to establish for breaches of confidentiality.³³² Maryland does not provide a private right of action, but allows a patient to petition the State prosecutor to investigate an allegation that a “medical record has been inappropriately obtained, maintained, or disclosed.”³³³

Like HIPAA, states may impose criminal or civil penalties for failing to maintain confidentiality, although some states may require specific intent.³³⁴ Notably, HIPAA’s prohibitions and penalties do not apply to third parties who improperly access, use, or appropriate health information without authorization. A few states penalize those who acquire or use medical information without authorization through criminal laws against medical identity theft or other medical privacy violations.³³⁵ In some cases, these state laws that punish obtaining health information on false pretenses or misappropriation of health information only apply to data held by certain entities, such as government officials or health insurers, which may be less relevant to research participants.³³⁶

As noted above, the HIPAA Privacy Rule requires covered entities and their business associates to notify affected individuals (and the media if the breach affects more than 500 individuals in a state) of a breach.³³⁷ Breach notification must be provided within 60 days of the discovery of the breach and must include descriptions of breach, the information involved, the steps the individuals can take to protect themselves, contact information for the covered entity, and the steps the covered entity is taking to mitigate the breach.³³⁸ States may impose breach notification obligations beyond HIPAA’s by extending applicability to non-HIPAA covered entities and business associates. Wisconsin broadly imposes a requirement of breach notification on any “entity,” defined as “a person other than an individual, that … [c]onducts business in this state and maintains personal information in the ordinary course of business,” if the personal information of 1,000 individuals or more is disclosed without authorization.³³⁹ Virginia’s law applies to government funded entities, including public universities, that may not otherwise be covered by HIPAA.³⁴⁰ States that impose privacy obligations on holders of consumers’ “personal information” may also require breach notification.³⁴¹

Research participants may feel particularly reassured when HIPAA is invoked because the law is broadly recognized and synonymous with health information privacy in many peoples’ minds.³⁴² Thus, mention of the HIPAA Privacy Rule during a research consent process may provide an unrealistic and inaccurate sense of reassurance to prospective participants in genomic research. In fact, HIPAA provides limited protections, particularly against the risk that information will be used or disclosed outside the research context because of its broad exceptions and inapplicability to non-covered entities. More than other laws, HIPAA may be highly salient to research participants, but also subject to the broad misconception that its protections follow the data. State laws are thus significant to the extent they extend and fill in known gaps in the HIPAA Privacy Rule’s protection, which they do in three primary ways: by expanding privacy obligations to non-covered entities; by imposing stricter obligations beyond those required in the Privacy Rule; and by providing individuals with private remedies, including damages, for violations of state privacy requirements.

D. Disability Discrimination Laws

Were data to escape the research context, disability discrimination laws may provide some protection against the risk that the information will be used to limit an individual’s opportunities, such as employment. Disability discrimination laws,³⁴³ like the federal ADA and similar state statutes, generally protect those who have manifest conditions from discrimination, whereas GINA and state genetic discrimination laws apply only to pre-symptomatic genetic information.³⁴⁴ Although it may appear that disability discrimination laws would not afford protection to participants in genomic research, they do have a limited role, given how disability is defined under the laws. The ADA applies not only to physical or mental impairments that substantially limit a major life activity, but also to individuals who are “regarded as” having a disability.³⁴⁵ This protection focuses on the perception of the employer or other actor and does not require the individual to in fact have a disability.³⁴⁶ While undoubtedly more limited than genetic-specific protections, this protection can supplement genetic-specific protections, for example, by expanding protections beyond large employers and health insurers, as well as applying to non-genetic information collected as part of the research data.³⁴⁷

1. Federal Disability Discrimination Laws

As noted above, GINA and the ADA generally cover different ends of the disease spectrum, with GINA addressing discrimination based on pre-symptomatic genetic information and the ADA addressing manifest conditions.³⁴⁸ While it may arise infrequently, the ADA could provide protections beyond the large employers and health insurers GINA covers to the extent a participant is “regarded-as” disabled. In addition, states, which largely follow the ADA approach, can expand coverage to smaller employers. With these applications in mind, we describe the broad federal protections the ADA provides for people living with disabilities.³⁴⁹ The ADA protects people with disabilities from discrimination in employment, access to goods and services, and participating in State and local government programs.³⁵⁰ The ADA defines disability as “a physical or mental impairment that substantially limits one or more of the major life activities of such individual,” having a record of such an impairment, or being regarded as having such impairment.³⁵¹ These latter two provisions can be read to cover genetic information that has not manifested.³⁵² Unlike many of the other federal laws we considered, the ADA also provides individuals a mechanism for seeking redress for violations of the law.³⁵³ However, like GINA, the ADA only applies to employers with 15 or more employees,³⁵⁴ creating a significant gap in its protections. In addition, insurers may take disabilities into account in underwriting, as long as such decisions are actuarially justified, and not based on disability alone.³⁵⁵

There are several exceptions to both the ADA and state laws prohibiting discrimination on the basis of disability. These laws often do not apply to private clubs or accommodations owned or operated on behalf of a religious corporation, association or society, or other organization that is not open to the public. Employment discrimination laws typically have exceptions for bona fide occupational qualifications or to protect the safety and well-being of employees.

2. State Disability Discrimination Laws

State disability discrimination laws, like the ADA, tend to be generally applicable, but may have broader reach than the ADA.³⁵⁶ For example, many states have laws that prohibit employers from asking about or making employment decisions based on disability,³⁵⁷ but these laws may apply to more employers than the ADA does because of how employer is defined.³⁵⁸ As Table 3 shows, 21 states have discrimination laws that apply to more employers than the ADA does, and ten apply to employers with only one employee. These provisions, coupled with the GINA provisions, extend protections against discrimination in employment to smaller employers in 33 states, with 17 of these applying to only one employee.

Table 3.

Minimum employees to come under state discrimination laws	States
15	MD, NC, NV, TX, UT
12	WV
9	AR
8	KY
6	IN, MO, NH, OR
4	OH, PA
2	IA, CO, WY
1	HI, IL, NJ, ME, MT, MI, MN, ND, SD, WI
Unspecified	LA, VA

State disability discrimination laws apply to a number of areas beyond employment. For the most part, these are areas covered by the ADA, such as sale or rental of housing, financial transactions, education, by the state, or healthcare, as well as the broad “places of public accommodation,” used in the ADA and, thus, do not expand on its protections.³⁵⁹ However, states also have specific provisions regarding insurance that, given court interpretations of the ADA, may expand disability protections beyond the ADA.³⁶⁰ In particular, the provisions prohibiting discrimination based on disability in insurance generally in Oregon and Maryland, in disability insurance in California, and in life insurance in Illinois and New York expand on the genetic-specific prohibitions described supra. As a result of these state expansions, participants in the same research study could have more protections should their genetic information be used against them depending on where they live.

The ADA permits individuals to bring a claim when they are discriminated against. In addition to authorizing aggrieved individuals to bring claims,³⁶¹ states often also create commissions or other organizations for investigating claims and enforcing the rights afforded.³⁶² Some states also authorize minimum damage amounts, although these appear limited to discrimination in credit.³⁶³ Authorization for recovery of attorneys’ fees and costs is broader, but limited to only a few states.³⁶⁴ Others may impose fines.³⁶⁵ State employees or licensees may face disciplinary proceedings for discriminatory actions.³⁶⁶

State disability discrimination laws may afford additional protections when states lack genetic-specific laws, when they extend the protections to employers with fewer than fifteen employees, and when they extend the protections to insurers. These protections are not as robust as genetic-specific laws in this context because they apply only when a participant is “regarded-as” disabled on the basis of the genomic information revealed through the research. However, they provide additional protections than genetic-specific laws because they apply to non-genetic information collected in the study.

IV. Discussion

A. Key Findings of the Web of State Legal Protections: Volume and Variety

This project aimed to determine whether and how well state laws fill known gaps in federal laws that protect participants in genomic research. We embarked on this research knowing states had adopted their own laws that sometimes went beyond the floor established by federal laws such as the Common Rule, the HIPAA Privacy Rule, GINA, and the ADA, but we were surprised by the sheer quantity of state laws that we uncovered, even after limiting consideration to laws that expand on federal protection and apply to a large genomic research project, like the All of Us study. The quantity of state laws is striking, standing alone, as it points to the complexity of identifying what protections are afforded to research participants and communicating those protections effectively to participants.³⁶⁷

Applicable state laws are not just numerous, they are extremely variable. States expand on the substantive protections provided by federal laws in myriad ways. One significant shortfall in the federal laws is their limited scope of application; the Common Rule applies only to federally-funded or federally-conducted research, HIPAA applies only to covered entities and their business associates, and GINA applies only to health insurers and large employers. We found several instances where state laws broadened the scope of these protections. In the most dramatic cases, states would apply the protections, such as the requirements for consent for genetic testing or prohibitions on disclosure of genetic or health information, to any person.³⁶⁸ Thus, unlike the federal laws, the reach of these state legal protections did not depend on who sought or held the information.

In other instances, states explicitly expanded the scope of protections to a broader range of entities beyond those covered by comparable federal laws. In particular, state genetic and disability discrimination laws apply to much smaller employers than GINA’s or the ADA’s limit of fifteen-employees. In total, 33 states apply non-discrimination requirements to employers with fewer than 15 employees, and 17 of these states apply the requirements to employers with only one employee.³⁶⁹

There is also significant variation among states’ substantive legal protections. In the most notable cases, the state laws expand on the federal protections not just by degree, but in kind. For example, a few states also expand GINA’s protections beyond health insurance to long-term care and disability insurance, and even life insurance.³⁷⁰ In the area of human subjects research, a few states also have human subjects research laws that apply the Common Rule’s IRB review and consent requirements to contexts when the Common Rule would not. In particular, Oregon’s law requiring IRB review for even anonymous and deidentified genetic research is a dramatic departure from how such research is conducted under federal law. In the privacy context, Texas takes a completely different approach than the HIPAA Privacy Rule by prohibiting re-identification of any person from their PHI. The additional protection offered by this Texas law is particularly relevant to participants of genomic research now that it is technically possible to re-identify supposedly “de-identified” genomic information without access to identification codes or breaching data security.³⁷¹

Perhaps the most significant way that state laws differ from the federal laws is their explicit provision of enforcement rights for violations of the laws. The HIPAA Privacy Rule does not permit a private right of action, and the Common Rule is silent on the issue. GINA allows for a private right of action, but limits recovery. In practice, this means that an individual whose information is used or disclosed in violation of law has few options to seek redress if they are harmed. In contrast, a majority of states create a private right of action for violation of their various genetic-specific laws.³⁷² A number of states similarly create a private of right of action for breach of their medical privacy laws.³⁷³ Several states also provide for statutory minimum damages, attorneys fees, and court costs for breach of the genetic and medical privacy laws.³⁷⁴ Because injury as a result of breach may be difficult to prove, these provisions can make it feasible for an aggrieved participant to seek redress and for attorneys to take their cases. As a result, it also can create an incentive for holders of participants’ information to ensure compliance with those obligations.

State laws also create rights that are not afforded by the federal laws. For example, a couple of states require notification regarding what is done with their genetic information.³⁷⁵ Others provide a right to request destruction of genetic information.³⁷⁶ These provisions may afford participants more control over the use of the genomic materials than is provided under federal law or in other states. Finally, a handful of states declare genetic information to be the property of the person tested, which, as discussed above, could give participants significantly more control over their genomic research information if courts change course and begin to recognize these property rights.³⁷⁷

B. Implications for Researchers and Participants

As the foregoing suggests, there is no single “web of legal protections,” but rather multiple “webs of legal protections” that vary greatly depending on which state laws are implicated. This reality makes it challenging to convey accurately and concisely the risks, benefits, and protections afforded to research participants in a large-scale, national genomic research study.

1. Challenges in Developing the Study Consent Form

In a national study like the All of Us project, the multiplicity and variation of state laws mean some participants may have legal protections and rights that other participants do not. This raises challenging questions for IRB review and consent form drafting. How does the IRB appropriately assess the risk/benefit ratio for the study in the review process? And how does the consent form communicate the different protections afforded to participants? We consulted with such a study that sought to develop a common consent form. The attempt quickly bogged down on the question of which laws would apply. An attempt to adopt the laws of “most protective” state as a voluntary standard was quickly abandoned. While ethically appealing, there are two problems to this approach: first, as our analysis demonstrates, there is no single “most protective” state to follow, even if researchers and their institutions would be willing to voluntarily commit to protections that go beyond those required by federal law. Even when states expand on federal protections, their choices are not consistent. For example, each of the states presented in Table 4 have expanded on GINA’s restrictions on use of genetic information in insurance underwriting to disability, long-term care, and/or life insurance. However, none of these states have made the same choices.

Table 4.

State restrictions of use of genetic information in insurance underwriting
	CO	MD	VT
Disability
Long-Term Care
Life

Moreover, although Vermont has been very protective with respect to expanding GINA-like protections, it has not adopted some protections that other states have. In short, while its provisions against use of genetic information in insurance underwriting extend to disability, long-term care, and life insurance and to employment for employers with only one employee, and it also creates a private right of action, it did not create the statutory minimums that other states have. In addition, it does not have human subjects protections that fill in the Common Rule gaps. Thus, it is not possible, even in this limited context, to say that Vermont’s law is the most protective law.

The second challenge of trying to adopt a “most protective” common consent form is that in some instances researchers cannot extend substantive rights that are afforded by some states but not others. For example, researchers may wish to promise to protect the confidentiality of research data and not to disclose research information to anyone outside of the research team, even a subpoena. But unless the project has a Certificate, as authorized by federal law, or is taking place in one of the few states with laws that afford protection against subpoena, a researcher would not be able to fulfill that promise.

2. Determining the Choice of Law

A further implication for researchers and institutions is a choice of law question: which jurisdiction’s law applies in a large-scale study, where participants, researchers, and the biobank may all reside in different states? The rights and protections afforded to participants in a national study may differ depending on where they live, where their data or biospecimens are stored, or where the researcher is located. Researchers, institutions, and IRBs lack guidance on this choice of law question and may struggle to comply if the applicable law varies with each participant.

Given the variation in state laws and that no single consent form will comply with all states’ laws, a national, multi-site study may be tempted to ignore state laws and focus solely on complying with federal laws. However, ignoring state laws may not be legal or ethical. For example, Delaware law requires that consent for genetic testing disclose the right to results unless the individual directs otherwise.³⁷⁸ If Delaware law applies to participants who live in Delaware, the researcher may be required to researcher offer these participants their genomic sequencing results, even if the research protocol specifies, and federal law permits, that researchers would not return results of unknown clinical significance.

Alternatively, choice of law questions are often addressed by agreement, and consent forms potentially could specify which state’s laws applies, particularly if the law chosen is justifiable (for example, the researcher’s state). However, this option poses its own challenges, including how to describe in simple terms what a reasonable person would want to know about the implications of the law chosen, as required by the Common Rule. In addition, if the consent form’s choice of law resulted in an individual waiving their state-based rights, this may violate the Common Rule’s provision prohibiting exculpatory clauses in consent forms.³⁷⁹ Finally, because consent forms may not be considered binding contracts, their choice of law provisions may not be enforced in the same way as ordinary commercial contracts.³⁸⁰

Although answering the choice of law question is beyond the scope of this project, our research findings underscore the importance of answering the question. Without guidance, significant legal and ethical uncertainties result, including what information must be provided in the consent form, how long data may be stored, what rights participants retain throughout research, how often re-authorization must be sought to use participants’ data, whether data can or must be disclosed or re-identified, and what liabilities and obligations would flow if data are breached or misused.

3. State Laws as Models for Closing Gaps in Federal Legal Protections

Despite the complex picture presented by the various state laws, they provide valuable models of how the known gaps in federal legal protections may be closed. The state laws may provide an opportunity to test models that are the subject of intense policy debate. For example, GINA is often criticized for neglecting to extend genetic discrimination protection to life, disability, or long-term care insurance.³⁸¹ Opponents have argued that GINA cannot be feasibly extended to these other types of insurance without destroying the market for these products.³⁸² There are several states that could be used to test, empirically, whether extending GINA’s protections to other insurance products yields these results. Where state have extended protections beyond federal laws without incurring excessive costs, such “successful” state experiments may counsel expanding the federal protections accordingly. In other areas, such as the provision of private remedies, states may be better situated than the federal government to provide for these legal rights and protections, due to their traditional role and the relative competence of state jurists to enforce these protections. But even where state variation does not suggest adoption into the federal standards, it could serve as a model for encouraging other states to afford fuller protections to research participants and closing the gaps between states.

V. Conclusion

This article undertakes to map the web of legal protections across federal and state laws protecting the participants in large-scale genomic research. The scope, complexity, and variety of these state laws, ranging from privacy to anti-discrimination, is poorly understood. Yet, understanding the scope, strengths, and limits of these protections is particularly critical as enrollment commences in two federally-funded studies, the All of Us and Million Veteran studies, aiming to amass DNA, health, and lifestyle data on an unprecedented scale from millions of individuals. At the same time, the identification and arrest of the “Golden State Killer” using DNA uploaded to an ancestry database highlighted how DNA databanks of the scale of the All of Us and Million Veteran studies can be used for purposes that participants may find objectionable. These concerns about law enforcement use add to risks that information will be hacked or otherwise disclosed and then be used against the individual in insurance, employment, or identity theft. Without assurances of the privacy and limits on use of their information, research participants should rightly be concerned about the risks of participation.

This article is the first to consider comprehensively and simultaneously all the federal and state laws offering protections to participants in genomic research. The literature typically focuses on the federal laws in isolation, questioning the strengths of federal legal protections for genomic research participants provided in the Common Rule, the HIPAA Privacy Rule, or GINA. Nevertheless, we found significant numbers and surprising variety of state laws that provide greater protections than federal laws, often filling in federal gaps by broadening the applicability of privacy or nondiscrimination standards or by providing important remedies for individuals harmed by breaches. Identifying and explaining the protections these laws provide is significant both to allow prospective participants to accurately weigh the risks of enrolling in these studies and as models for how federal legal protections could be expanded to fill known gaps.

Appendix

1. Searches Conducted

All the searches were developed after some experimentation with different search terms. We include only the final searches that were used.

Human Subjects Research:

1. Search terms

   Multiple searches were performed, as follows:

   1. To identify state laws that particularly focused on consent for research, we conducted searches using advanced search (for statutes and regulations) for TE(“informed consent” and “DNA”) [the “TE” limiter was used to limit searches to Text (to avoid discussion only in annotations, as “research” frequently appears in unrelated areas), TE(“informed consent” and “genetic testing”); and TE(“informed consent” and “genetic information”). The goal was to use broad terms to ensure coverage, while using precise terms that apply to the concepts we are studying.
   2. To identify state laws that more generally discussed genomic research, we conducted searches using advanced search (for both statutes and regulations) for TE(“research and “genetic information”), TE(research and “genetic testing”), and TE(research and “DNA”). We also used the more general search “human subjects” w/5 research.

2. Exclusion criteria

   We excluded search results that did not apply to human subjects research, such as laws that cover state school curricula (about research), income tax incentives for certain research, law enforcement DNA databases and permissible testing of those databases, and licensure requirements (to the extent it only requires training in human subjects research). We also excluded laws that talk about genetic information and research, but not protections (e.g., plant and pesticide research). We also excluded laws that address regenerative medicine/stem cell research, as these laws address a very specific type of research that typically is not considered human subjects research and the oversight mechanism is not generally applicable. We also excluded laws that addressed genetic privacy or consent to genetic testing (rather than research) because, while related, they are not research-specific and will be addressed in separate datasets.

Genetic Testing:

1. Search terms

   Consent w/10 (genetic! Or genom! Or DNA or biospecimen or “blood specimen”)

   adv: TE(“informed consent” and “DNA”)

   adv: TE(“informed consent” and “genetic testing”)

   adv: TE(“informed consent” and “genetic information”)

2. Exclusion criteria

   We excluded laws that did not pertain to the research context. For example, we excluded laws that addressed genetic testing in the criminal context (arrest, conviction), pertained only to paternity testing, or solely addressed admissibility in court proceedings.

Genetic Privacy:

1. Search terms

   Adv: TI(genetic genom! DNA) TE((gene genetic genom! DNA) AND (privacy confidential! disclos!))

   Note: Three secondary sources were used as a reference: 1) a collection of state statutes on “Privacy” available from the National Human Genome Research Institute (available at http://www.genome.gov/PolicyEthics/LegDatabase/pubsearch.cfm); (2) a 50-state survey of state genetic privacy laws by the American Health Lawyers Association (available at http://www.healthlawyers.org/SiteCollectionDocuments/50state_chart_final.pdf); and (3) a Westlaw 50 state survey, Maintaining Privacy of Health Information, 0100 SURVEYS 7 (Oct. 2013)

2. Exclusion criteria – Applicable to Genetic Privacy and Health Information Privacy Laws

   We focused on identifying those state health information privacy laws that create private rights of action or extend requirements beyond HIPAA covered entities and business associates. So we excluded state laws from our analysis that simply duplicated or were less stringent than the HIPAA Privacy Rule. To further limit the dataset to those that are relevant to the privacy of genomic or health data held by researchers that was the subject of our inquiry, we used the following exclusion criteria:

   • Communicable diseases, injuries, etc.: The primary category are laws that protect the privacy/confidentiality of health information that is unlikely to pertain to information collected from genomic research because it doesn’t involve genetic information. For example, all laws that apply to communicable diseases (STDs, TB, HIV), injuries, drug testing results, immunization records, etc. can be excluded. Continue to include laws that protect health information generally as well as information that may have some genetic component (mental health information, cancer registries).
   • Utilization review laws, independent or external review – exclude laws that require these entities to maintain confidentiality.
   • Provider-specific confidentiality obligations: Laws setting forth a general obligation to maintain confidentiality of health records for particular types of health care providers or facilities (e.g., nurses, genetic counselors, home health, assisted living, nursing homes, hospice, behavioral health, etc.) unless it is accompanied by a manner of private enforcement for violation (e.g., private cause of action, damages, etc.) - if it has private enforcement mechanism, include. Also include laws that set forth specific requirements for maintaining privacy/retention/patient access/authorization, etc. that may be different from HIPAA’s.
   • Rules of evidence, forensic DNA databases, and other law enforcement uses of genetic or health information. However, include laws that implicate the obligation of health care providers or others to provide genetic information pursuant to subpoena or court order.
   • Laws related to disclosure or privacy and confidentiality of patient records in the context of disciplinary or licensing actions against health care professionals.
   • Laws that pertain to child protective services, adoption, custodial disputes, domestic violence, paternity disputes.
   • Laws that address intestate succession, probate, establishment of heirs.

Health Information Privacy:

1. Search terms

   Adv: (TE((health medical) /s (information data record)) /30 (privacy confidential! disclos!) & “any person” & (penalty! or crim! ((right cause) /2 action)))

2. Exclusion criteria - see Genetic Privacy (above)

Genetic Discrimination:

1. Search terms

   (discrimin! or refus! or deny or denial) w/25 (genet! or genom!)

   Note: in conducting our test searches, we discovered that some of the laws included on the NHGRI list did not include the word discrimination. This search was constructed to capture those laws, as well as laws that explicitly discuss discrimination.

2. Exclusion criteria

   We excluded laws that did not apply to the research context we were interested in. Example of such laws that our searches captured include laws regulating genetic counselors as a profession (not genetic discrimination), laws that pertained only to prenatal diagnoses, paternity laws, and laws that addressed genetically modified organisms.

General Disability Discrimination:

1. Search terms

   adv: TE(discrimin! or refus! or deny or denial) and TI(disab!)

2. Exclusion criteria

   Given the focus of our research, we focused on laws that specifically mentioned disability that could be interpreted as applying to discrimination based on genetic information for a condition that was not yet manifest. We excluded laws that pertained only to physical disabilities, and we also excluded broad civil rights or discrimination laws that did not mention disability.

   Despite these restrictions, we still identified vast quantities of laws that were not likely to go beyond the federal floor HIPAA sets. Accordingly, we did not include these in the final analysis.

2. Common exceptions to obligations/restrictions

Legend

C = Exceptions to confidentiality obligations

A = Exception to analysis or use restrictions

R = Exceptions to retention

	As authorized or required by law	Court order	Criminal DNA banking	For abuse or neglect reporting	For criminal databases	For determination of bona fide occupational qualifications	For due diligence in sale of business	For genealogy of deceased	For health care operations or other business operations	For law enforcement	For marketing	For newborn screening	For paternity determinations	For payment	For peer review	For public health purposes	For purposes of providing disability accommodations	For research	For treatment	For worker safety (e.g., monitor toxic exposures)	For workers’ compensation claims	If approved by an IRB or Ethics committees	Legally Authorized representative	Litigation where genetic information is at issue	Medical providers	Person tested	To blood relatives of decedent for medical purposes	To identify deceased individuals	To monitor legal compliance or eligibility	When person tested brings a lawsuit or other complain	With consent
Ariz. Rev. Stat. Ann. § 12–2801 et seq.									C			C						C				C	C	C	C	C					C
Cal. Civ. Code § 56.17																													C
Cal. Code Regs. Tit. 10 § 2218.20	C																														C
Cal. Code Regs. Tit. 22 §126055																C			C
Cal. Health & Safety Code § 124975 et seq																		C
Cal. Ins. Code §10123.35																													C
Code Ark. R. 016.14.2–1078																	C												C
Colo. Rev. Stat. Ann. § 10-3-1104.6 & 1104.7										C			C			C		C
Colo. Rev. Stat. Ann. § 13-64-502																								C
D.C. Code § 2–1401.03						A														A	A
D.C. Mun. Regs. Tit. 4 § 509						A														A	A
Del. Code Ann. Tit. 16, § 1205	C	C								C		C	C														C	C	C		C
Del. Code Ann. Tit. 16, § 1202										C		C	C					C										C
Del. Code Ann. Tit. 16, § 1203		R			R					R			R					R
Fla. Stat. Ann. § 760.40			A							A			A
Ga. Code Ann. § 33-54-1 et seq.										C
Idaho Code Ann. § 398301 et seq.																				A				C
225 III. Comp. Stat. Ann. 135:90										C															C					C	C
410 III. Comp. Stat. Ann. § 50:3	C			C					C					C	C				C				C			C
410 III. Comp. Stat. Ann. 513:1 et seq.						A			C	A		C	C, A	C	C				C	A	A		C		C	C
lowa Admin. Code r. 641–4.3(136A) & 4.7(136A)																		C					C		C				C
lowa Code Ann. § 729.6										c		C	C					C		A	A							C
37 La. Admin. Code Pt. XIII, 415										R			R																		C
La. Rev. Stat. Ann. 22:1023										C		C	C					C										C
La. Rev. Stat. Ann. 23:368		C
La. Rev. Stat. Ann. 23368						A																				C
La. Rev. Stat. Ann. 23368	C																	C		A									C
Mass. Gen. Laws Ann. Ch. 111, § 70G										C															C
Md. Code Regs. 10.10.13.15																		C
Me. Rev. Stat. Tit. 22 § 1711-C																			C
Me. Rev. Stat. tit. 24-A, § 2215		C					C		C	C	C			C	C	C		C	C										C		C
Mich. Comp. Laws Ann. § 37.1202																				A
Minn. Stat. Ann. § 62V.06	C	C																								C			C
Mo. Ann. Stat. § 191.317																C									C						C
Mo. Ann. Stat. § 375.1300 et seq.	C					A										C		C										C			C
Mont. Admin. R. 2.21.6615		C														C		C											C
Mont. Code Ann. § 33–18.902										C		C	C															C
N.C. Gen. Stat. Ann. § 130A-131-.17																		C
N.D. Cent. Code Ann. § 23–01.3–02 - 07										C						C		C
N.D. Cent. Code Ann. § 25-16-07		C						C		C													C				C
N.D. Legis H.B. 1108 (2015) 2015 North Dakota Laws H.B. 1108		C								C				C					C				C		C		C
N.H. Rev. Stat. Ann. § 141-H:1 et seq.										A		A	A							A	A
N.J. Stat. Ann. § 10:5–43 et seq.		C, R		C	R					C, R		C	C, R			C		C, R									C	C
N.M.Stat. Ann. § 24-21-1		R			R					C, R		C						C, R	C					C				C
N.Y. Civ. Rights Law § 79–1		C										C						C
N.Y. Exec. Law § 296						A												C		A	A									C
N.Y. Pub. Health Law § 2733																		C
Neb. Rev. Stat. § 48–236																				A
Nev. Rev. Stat. Ann. § 629.101 et seq.		C, R							R	C, R		C	C	R		C		C	R								C	C
Okla. Admin. Code 310:550-19-1																C		C	C
Okla. Stat. Ann. Tit. 36 § 3614.3										C			C											C
Okla. Stat. Ann. Tit. 36 § 3614.1														C				C
Or. Admin. R. 582-030-0010	C	C
Or. Rev. Stat. Ann. § 192.531 et seq.		R							R	C, R		C, R	C	R				C	R								C	C
Or. Rev. Stat. Ann. § 192.581						A
R.I. Gen. Laws Ann. § 27-18-52,52.1 § 27-19-44, 44.127-20-39,39.127-41-53,53.1																		C
R.I. Gen. Laws Ann. § 5–37.3–4									C	C					C	C		C	C		A			C
S.C. Code Ann. § 38-93-10 etseq.	C	C											C					C									C	C
S.C. Code Ann. § 44-37-30																		C	C
S.C. Code Ann. Regs. 61–80																		C
S.D. Admin. R. 20:06:39:46-.46 & 49 20:06:40:29 et seq.														C				C
S.D. Codified Laws § 60-2-20										C
Tenn. Code Ann. § 68-5-506																C
Tex. Health & Safety Code Ann. § 33.011 et seq.	C	C							C	C						C			c												C
Tex. Ins. Code Ann. § 546.001 et seq.		C, R					C			C		R	C					C, R									C	C	C		R
Tex. Labor Code Ann. § 21.401 et seq.		C, R								C		R	C					C, R									C	C	C		R
Tex. Occ. Code Ann. § 58.001 et seq.		C, R								C		R	c					C, R									C	C	C		R
Utah Code Ann. § 26-45-101 et seq.		C							C					C						A				C					C
Va. Code Ann. § 32.1–69																		C
Va. Code Ann. § 38.2–3450														C				C
Va. Code Ann. § 40.1–28.7:1										C
Vt. Stat. Ann. Tit. 18, § 9332			A							A		A	A					C										C
Wash. Rev. Code Ann. § 70.02.005 et seq.	C									C				C		C		C	C										C		C
Wis. Stat. Ann. § 111.372																				A	A
Wis. Stat. Ann. § 253.12																		C	C				C			C			C
Wyo. Stat. Ann. § 26-19-107														C					C
Wyo. Stat. Ann. § 26-29-306														C					C