Fifty-fifth Legislature

First Regular Session

House: JUD DPA 10-0-0-0 | 3rd Read 59-1-0-0

Senate: HHS DPA/SE 7-0-1-0 | 3rd Read 30-0-0-0

HB 2069: genetic testing; private property

NOW: genetic testing; requirements; data; enforcement

Sponsor:† Representative Roberts, LD 11

Senate Engrossed

The House Engrossed version of HB 2069 established ownership of genetic testing and the information resulting from genetic testing.

The Senate adopted a same-subject strike-everything amendment which prescribes disclosure, consent and security requirements for direct-to-consumer genetic testing companies.


Outlines requirements for disclosure and consent of genetic data for tests performed by a direct-to-consumer genetic testing company (company).


Current law defines genetic testing as a test of an individual's genes for health abnormalities. This definition does not include:

1)   Chemical, blood and urine analyses used in clinical settings for purposes other than to determine genetic traits; 

2)   Tests used in a criminal investigation; 

3)   HIV tests;

4)   Paternity tests; and 

5)   Tests used in biomedical research (A.R.S. ß 12-2801).

Genetic testing and information derived from it are privileged to the individual, confidential and may only be released to certain parties as authorized by state or federal law (A.R.S. ß 12-2802).

An insurer may not deny life or disability insurance because of a genetic condition. In order to require a genetic test, there must first be specific written informed consent from the subject of the test (A.R.S. ßß 20-448; 20-448.02).


1.   Requires a company to provide complete information about the companyís policies and procedures for genetic data, including:

a)   A privacy policy overview that includes information about the companyís collection, use and distribution of genetic data; and

b)   A publicly available privacy notice detailing the companyís collection and management of genetic data. (Sec. 1)

2.   Mandates a company must obtain a consumerís consent for collecting, using and disclosing the consumerís genetic data, including:

a)   Initial express consent describing the uses of the genetic data and who has access to the test results;

b)   Separate express consent for any of the following:

i.   Transfer of a consumerís genetic data to an individual other than a company vendor or service provider;

ii. Use of the genetic data beyond the purpose of the genetic testing product and inherent contextual uses;

iii.   Retention of a consumerís biological sample after the completion of the initial testing service;

c)   Informed consent to transfer or disclose a consumerís genetic data to a third party for research purposes; and†

d)   Express consent for marketing based on a consumerís genetic data or third-party marketing based on the consumer having ordered a genetic testing product or service. (Sec. 1)

3.   Stipulates that a company must require a valid legal process for disclosing genetic data to law enforcement or other government agency without the express written consent of the consumer. (Sec. 1)

4.   Requires a company to develop, implement and maintain a security program to protect a consumerís genetic data from improper access, use or disclosure. (Sec. 1)

5.   Mandates a company must create a process to allow a consumer to: a) access the consumerís genetic data; b) delete the consumerís account and genetic data; and c) have the consumerís biological sample destroyed. (Sec. 1)

6.   Stipulates that a company may only release genetic data to individuals as outlined in statute. (Sec. 1)

7.   Prohibits a company from disclosing a consumerís genetic data to:

a)   An entity offering health, life or long-term care insurance; or

b)   Any employer of the consumer (Sec. 1)

8.   Exempts the following from the provisions of this bill:

a)   Protected health information governed by federal privacy regulations;

b)   Biological samples or genetic data used for an individualís medical screening, diagnosis or treatment;

c)   An institution of higher learning or an entity owned or operated by an institution of higher learning. (Sec. 1)

9.   Permits the Attorney General to bring an action to enforce the above regulations regarding direct-to-consumer genetic testing companies and genetic data, and stipulates that a person who violates the regulations is subject to the following:

a)   A civil penalty up to $2,500 for each violation;

b)   Payment of actual damages caused to consumers by the violation; and

c)   Costs and reasonable attorney fees incurred by the Attorney Generalís office. (Sec. 1)

10.  Defines relevant terms. (Sec. 1)

11.  Entitles this legislation as the Genetic Information Privacy Act. (Sec. 2)



14.  ---------- DOCUMENT FOOTER ---------

15.  ††††††††††††††††† HB 2069

16.  Initials LC/AF/PN† Page 0 Senate Engrossed


18.  ---------- DOCUMENT FOOTER ---------