On February 14, 2024, Nebraska enacted a genetic privacy law (LB 308) regulating direct-to-consumer (“DTC”) genetic testing companies. The law is one of a flurry of bills regarding DTC genetic testing that have been introduced in several states since the beginning of 2024, following the enactment of several DTC genetic testing laws in 2023, such as in Virginia.
Nebraska’s DTC Genetic Privacy Law
LB 308 applies to companies that meet the definition of a DTC genetic testing company, which is defined as “an entity that (a) offers consumer genetic testing products or services directly to a consumer, or (b) collects, uses, or analyzes genetic data that resulted from a direct-to-consumer genetic testing product or service and was provided to the company by a consumer.”
Such companies will be required to comply with various obligations similar to those in other DTC genetic privacy laws, including (a) providing a written public privacy about the company’s collection, use, and disclosure of genetic data; (b) obtaining consent for collection, use, and disclosure of genetic data, including for initial testing, transferring genetic data, and non-exempt research; (c) obtaining consent to retain the consumer’s biological sample; and (d) providing certain data subject rights (e.g., access, deletion) to consumers, among other requirements.
The law exempts certain types of data and activities from its purview. The definition of “genetic data” in LB 308 exempts de-identified data that meets a statutory standard. Protected health information (“PHI”) collected by a covered entity or business associate subject to Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, “HIPAA”) is also exempt. Additionally, under LB 308 the definition of a DTC genetic testing company does not include an entity “solely engaged in collecting, using, or analyzing genetic data or biological samples in the context of research, as defined in [HIPAA], conducted in accordance with” the federal Common Rule, International Conference on Harmonization Good Clinical Practice (“ICH GCP”) Guideline, or 21 C.F.R. parts 50 and 56.
A violation of LB 308 is subject to a civil penalty of $2,500 per violation “in addition to actual damages incurred by the consumer” and costs and fees incurred by the Attorney General. LB 308 is expected to go into effect July 18, 2024.
DTC Genetic Privacy Bills Introduced in Other States This Session
DTC genetic testing bills have been introduced in several other states this session, including SB 284 in Indiana, HB 5110 in West Virginia, and HB 21 in Alabama. While these laws are similar to LB 308, they are not identical. Like LB 308, each of these bills does not apply to de-identified genetic data and contains exemptions for certain research activities, HIPAA regulated entities, and/or PHI held by a HIPAA-regulated entity. Also like LB 308, these bills would require genetic testing companies to (a) provide access to its privacy policy; (b) obtain consent for certain uses of consumers’ genetic data; and (c) obtain consent for retention of any biological sample, among other requirements.