FAY SHAULSON—On October 1, 2021, H.B. 833, also known as the Protecting DNA Privacy Act, went into effect in Florida. The Act heightens current protections of genetic information by clarifying the extent to which individuals own their genetic information and establishing separate criminal penalties for each instance of intentional collection, retention, maintenance, disclosure, submission, analysis, or sale of an individual’s DNA without his or her express consent. H.B. 833 will significantly impact physicians who commonly use DNA testing in their practices. Now, even the routine collection or submission of a patient’s DNA sample will first require a patient’s express consent, lest a physician be subject to a felony.
DNA is the key to an individual’s most private health information. It contains the biological blueprint that makes each species unique and can disclose one’s ancestry and potential for future diseases. However, DNA is unsecured, susceptible to theft, and can be easily solicited from vulnerable individuals not thinking about the consequences of its dissemination. The recent proliferation of the availability of genetic testing, especially through direct-to-consumer options, increases the potential for third parties to access and use private genetic information. Marvel Entertainment chairman Ike Perlmutter and his wife provide a recent example of how easily DNA theft can occur. They allege that their DNA was stolen and tested when it was collected, without their consent, from water bottles and materials they had touched during a deposition at a lawyer’s office.
Under Florida’s previous law, analyzing a person’s DNA without his informed consent was a first-degree misdemeanor. H.B. 833, however, makes such unlawful use a potential felony, depending on the provision of the law violated. Third-degree felonies in Florida are punishable by up to five years in prison, a $5,000 fine, and five years of probation. Second-degree felonies are punishable by up to 15 years in prison, 15 years of probation, and a $10,000 fine.
Additionally, while Florida Courts have previously held that property rights in blood and tissue evaporate once the sample is voluntarily given to a third party, the Act proclaims the genetic information of the person from whom it is extracted to be the “exclusive property” of that person to control. The Act defines “exclusive property” as a person’s right “to exercise control over his or her DNA sample and any results of his or her DNA analysis with regard to the collection, use, retention, maintenance, disclosure, or destruction of such sample or analysis results.”
This is not the first time Florida has addressed DNA privacy concerns. In June 2020, Florida enacted H.B. 1189, making it the first state to enact a DNA privacy law that prohibits life, disability, and long-term care insurance companies from asking for or obtaining one’s private genetic information. H.B. 1189 also prohibits insurers from canceling, limiting, denying, or varying premium rates based on genetic information. The law is more protective than the federal Genetic Information Non-discrimination Act, which bars health insurers from accessing genetic testing results when assessing rates or coverage but does not apply to life insurance, disability, or long-term care companies. As Florida House Speaker Chris Sprowls noted, H.B. 1189 made Florida “the leader in the nation in protecting our residents and our citizens’ genetic information.”
The Protecting DNA Privacy Act does provide for certain exceptions. For example, the Act’s restrictions do not apply to police detectives who collect DNA during criminal investigations and family law courts that order DNA tests to establish paternity. Additionally, the Act does not apply to a DNA sample, a DNA analysis, or the results of a DNA analysis when used for specified purposes. These purposes include medical diagnosis and conducting quality assessment, improvement activities, and treatment of a patient when express consent for clinical laboratory analysis of the DNA sample was obtained by the health care practitioner who collected the DNA sample or when performed by a clinical laboratory certified by the Centers for Medicare and Medicaid Services. These exceptions will likely assist health care providers who use DNA samples for routine purposes, since they will only need to obtain a patient’s initial express consent for DNA analysis to analyze that DNA sample or use it for the other enumerated purposes above. Obtaining express consent requires physicians to explain to the patient how his DNA sample will be collected, used, retained, and maintained and how the results of the DNA analysis will be used. This information can be written in a document signed by the patient, stating the patient’s express intent to allow for the collection or analysis for the specified purposes.
Physicians should be alerted, however, of one provision in the Protecting DNA Privacy Act that may inadvertently affect their practices. Subsection (5) of the Act makes it “unlawful for a person to willfully, and without express consent, sell or otherwise transfer another person’s DNA sample or the results of another person’s DNA analysis to a third party, regardless of whether the DNA sample was originally collected, retained, or analyzed with express consent.” Because the Act defines “DNA sample” as “any human biological specimen from which DNA can be extracted or the DNA extracted from such specimen,” subsection (5) effectively makes physicians transferring medical waste to a disposal facility or sending laundry to an outside cleaning service a second-degree felony. The Florida Medical Association has recommended that physicians incorporate a sample consent form that considers this prohibition into their practices while it works to clarify the law and remove this inadvertent requirement during the next legislative session.
Florida has passed some of the toughest criminal penalties in the nation to protect against DNA theft and misuse in recognition of society’s vulnerability to DNA thievery, leading the way for other states to follow suit. Health care providers and other businesses should assess their current consent processes for the analysis and collection of DNA samples from individuals in Florida and modify them, as necessary, to comply with the Act.
