Chapter 678 Oregon Laws 2005

AN ACT

SB 1025

Relating to genetic privacy; creating new provisions; amending ORS 192.531, 192.535, 192.537 and 192.547; and declaring an emergency.

Be It Enacted by the People of the State of Oregon:

SECTION 1. ORS 192.531 is amended to read:

192.531. As used in ORS 192.531 to 192.549:

(1) “Anonymous research” means scientific or medical genetic research conducted in such a manner that any DNA sample or genetic information used in the research is unidentified.

(2) “Blanket informed consent” means that the individual has consented to the use of the individual’s DNA sample or health information for any future research, but has not been provided with a description of or consented to the use of the sample in genetic research or any specific genetic research project.

(3) “Blood relative” means a person who is:

(a) Related by blood to an individual; and

(b) A parent, sibling, son, daughter, grandparent, grandchild, aunt, uncle, first cousin, niece or nephew of the individual.

(4) “Clinical” means relating to or obtained through the actual observation, diagnosis or treatment of patients and not through research.

(5) “Coded” means identifiable only through the use of a system of encryption that links a DNA sample or genetic information to an individual or the individual’s blood relative. A coded DNA sample or genetic information is supplied by a repository to an investigator with a system of encryption.

(6) “Deidentified” means lacking, or having had removed, the identifiers or system of encryption that would make it possible for a person to link a DNA sample or genetic information to an individual or the individual’s blood relative, and neither the investigator nor the repository can reconstruct the identity of the individual from whom the sample or information was obtained. Deidentified DNA samples and genetic information must meet the standards provided in 45 C.F.R. 164.502(d) and 164.514(a) to (c).

(7) “Disclose” means to release, publish or otherwise make known to a third party a DNA sample or genetic information.

(8) “DNA” means deoxyribonucleic acid.

(9) “DNA sample” means any human biological specimen that is obtained or retained for the purpose of extracting and analyzing DNA to perform a genetic test. “DNA sample” includes DNA extracted from the specimen.

(10) “Genetic characteristic” includes a gene, chromosome or alteration thereof that may be tested to determine the existence or risk of a disease, disorder, trait, propensity or syndrome, or to identify an individual or a blood relative. “Genetic characteristic” does not include family history or a genetically transmitted characteristic whose existence or identity is determined other than through a genetic test.

(11) “Genetic information” means information about an individual or the individual’s blood relatives obtained from a genetic test.

(12) “Genetic privacy statutes” means ORS 192.531 to 192.549, 659A.303 and 746.135 and the provisions of ORS 659A.300 relating to genetic testing.

(13) “Genetic research” means research using DNA samples, genetic testing or genetic information.

(14) “Genetic test” means a test for determining the presence or absence of genetic characteristics in an individual or the individual’s blood relatives, including tests of nucleic acids such as DNA, RNA and mitochondrial DNA, chromosomes or proteins in order to diagnose or determine a genetic characteristic.

(15) “Health care provider” has the meaning given that term in ORS 192.519.

[(15)] (16) “Identifiable” means capable of being linked to the individual or a blood relative of the individual from whom the DNA sample or genetic information was obtained.

[(16)] (17) “Identified” means having an identifier that links, or that could readily allow the recipient to link, a DNA sample or genetic information directly to the individual or a blood relative of the individual from whom the sample or information was obtained.

[(17)] (18) “Identifier” means data elements that directly link a DNA sample or genetic information to the individual or a blood relative of the individual from whom the sample or information was obtained. Identifiers include, but are not limited to, names, telephone numbers, electronic mail addresses, Social Security numbers, driver license numbers and fingerprints.

(19) “Individually identifiable health information” has the meaning given that term in ORS 192.519.

[(18)] (20) “Obtain genetic information” means performing or getting the results of a genetic test.

[(19)] (21) “Person” has the meaning given in ORS 433.045.

[(20)] (22) “Research” means a systematic investigation, including research development, testing and evaluation, designed to develop or contribute to generalized knowledge.

[(21)] (23) “Retain a DNA sample” means the act of storing the DNA sample.

[(22)] (24) “Retain genetic information” means making a record of the genetic information.

[(23)] (25) “Unidentified” means deidentified or not identifiable.

SECTION 2. ORS 192.535 is amended to read:

192.535. (1) A person may not obtain genetic information from an individual, or from an individual’s DNA sample, without first obtaining informed consent of the individual or the individual’s representative, except:

(a) As authorized by ORS 181.085 or comparable provisions of federal criminal law relating to the identification of persons, or for the purpose of establishing the identity of a person in the course of an investigation conducted by a law enforcement agency, a district attorney, a medical examiner or the Criminal Justice Division of the Department of Justice;

(b) For anonymous research or coded research conducted [after notification or with consent pursuant to] under conditions described in ORS 192.537 (2), after notification pursuant to section 5 of this 2005 Act or pursuant to ORS 192.547 (7)(b);

(d) As permitted by rules of the Department of Human Services for newborn screening procedures;

(e) As authorized by statute for the purpose of establishing paternity; or

(f) For the purpose of furnishing genetic information relating to a decedent for medical diagnosis of blood relatives of the decedent.

(2) Except as provided in subsection (3) of this section, a physician licensed under ORS chapter 677 shall seek the informed consent of the individual or the individual’s representative for the purposes of subsection (1) of this section in the manner provided by ORS 677.097. Except as provided in subsection (3) of this section, any other licensed health care provider or facility must seek the informed consent of the individual or the individual’s representative for the purposes of subsection (1) of this section in a manner substantially similar to that provided by ORS 677.097 for physicians.

(3) A person conducting research shall seek the informed consent of the individual or the individual’s representative for the purposes of subsection (1) of this section in the manner provided by ORS 192.547.

(4) Except as provided in ORS 746.135 (1), any person not described in subsection (2) or (3) of this section must seek the informed consent of the individual or the individual’s representative for the purposes of subsection (1) of this section in the manner provided by rules adopted by the Department of Human Services.

(5) The Department of Human Services may not adopt rules under subsection (1)(d) of this section that would require the providing of a DNA sample for the purpose of obtaining complete genetic information used to screen all newborns.

SECTION 3. ORS 192.537 is amended to read:

192.537. (1) Subject to the provisions of ORS 192.531 to 192.549, 659A.303 and 746.135, an individual’s genetic information and DNA sample are private and must be protected, and an individual has a right to the protection of that privacy. Any person authorized by law or by an individual or an individual’s representative to obtain, retain or use an individual’s genetic information or any DNA sample must maintain the confidentiality of the information or sample and protect the information or sample from unauthorized disclosure or misuse.

(2)(a) A person may use an individual’s DNA sample or genetic information that is derived from a biological specimen or clinical individually identifiable health information for anonymous research or coded research only if the individual:

(A) Has granted informed consent for the specific anonymous research or coded research project;

(B) Has granted consent for genetic research generally; [or]

(C) Was notified in accordance with section 5 of this 2005 Act that the [sample or genetic information] individual’s biological specimen or clinical individually identifiable health information may be used for anonymous research or coded researchand the individual did not, at the time of notification, request that the [sample] biological specimen or clinical individually identifiable health information not be used for anonymous research[.] or coded research; or

(D) Was not notified, due to emergency circumstances, in accordance with section 5 of this 2005 Act that the individual’s biological specimen or clinical individually identifiable health information may be used for anonymous research or coded research and the individual died before receiving the notice.

(b) Paragraph (a) of this subsection does not apply to biological specimens or clinical individually identifiable health information obtained before the effective date of this 2005 Act if an institutional review board operating under ORS 192.547 (1)(b) meets the requirements described in ORS 192.547 (7)(b).

[(b) The Department of Human Services shall adopt rules to implement paragraph (a) of this subsection after considering similar federal regulations.]

(3) A person may not retain another individual’s genetic information or DNA sample without first obtaining authorization from the individual or the individual’s representative, unless:

(a) Retention is authorized by ORS 181.085 or comparable provisions of federal criminal law relating to identification of persons, or is necessary for the purpose of a criminal or death investigation, a criminal or juvenile proceeding, an inquest or a child fatality review by a multidisciplinary child abuse team;

(b) Retention is authorized by specific court order pursuant to rules adopted by the Chief Justice of the Supreme Court for civil actions;

(c) Retention is permitted by rules of the Department of Human Services for identification of, or testing to benefit blood relatives of, deceased individuals;

(d) Retention is permitted by rules of the Department of Human Services for newborn screening procedures; or

(e) Retention is for anonymous research or coded research conducted after notification or with consent pursuant to subsection (2) of this section or section 5 of this 2005 Act.

(4) The DNA sample of an individual from which genetic information has been obtained shall be destroyed promptly upon the specific request of that individual or the individual’s representative, unless:

(b) Retention is authorized by specific court order pursuant to rules adopted by the Chief Justice of the Supreme Court for civil actions; or

(c) Retention is for anonymous research or coded research conducted after notification or with consent pursuant to subsection (2) of this section or section 5 of this 2005 Act.

(5) A DNA sample from an individual that is the subject of a research project, other than an anonymous research project, shall be destroyed promptly upon completion of the project or withdrawal of the individual from the project, whichever occurs first, unless the individual or the individual’s representative directs otherwise by informed consent.

(6) A DNA sample from an individual for insurance or employment purposes shall be destroyed promptly after the purpose for which the sample was obtained has been accomplished unless retention is authorized by specific court order pursuant to rules adopted by the Chief Justice of the Supreme Court for civil, criminal and juvenile proceedings.

(7) An individual or an individual’s representative, promptly upon request, may inspect, request correction of and obtain genetic information from the records of the individual.

(8) Subject to the provisions of ORS 192.531 to 192.549, and to policies adopted by the person in possession of a DNA sample, an individual or the individual’s representative may request that the individual’s DNA sample be made available for additional genetic testing for medical diagnostic purposes. If the individual is deceased and has not designated a representative to act on behalf of the individual after death, a request under this subsection may be made by the closest surviving blood relative of the decedent or, if there is more than one surviving blood relative of the same degree of relationship to the decedent, by the majority of the surviving closest blood relatives of the decedent.

(9) The Department of Human Services shall coordinate the implementation of this section.

(10) Subsections (3) to (8) of this section apply only to a DNA sample or genetic information that is coded, identified or identifiable.

(11) This section does not apply to any law, contract or other arrangement that determines a person’s rights to compensation relating to substances or information derived from an individual’s DNA sample.

SECTION 4. Sections 5 and 8 of this 2005 Act are added to and made a part of ORS 192.531 to 192.549.

SECTION 5. (1) A health care provider that is a covered entity as defined in ORS 192.519 (2)(c) and that obtains an individual’s biological specimen or clinical individually identifiable health information shall notify the individual that the biological specimen or clinical individually identifiable health information may be disclosed or retained by the provider for anonymous research or coded research.

(2) A health care provider that is not a covered entity as defined in ORS 192.519 (2)(c) and that obtains an individual’s biological specimen or clinical individually identifiable health information may notify the individual that the biological specimen or clinical individually identifiable health information may be disclosed or retained by the provider for anonymous research or coded research.

(3) A health care provider described in subsection (1) of this section shall provide a notice to the individual describing how the biological specimen or clinical individually identifiable health information may be used and allowing the individual to request that the specimen or information not be disclosed or retained for anonymous research or coded research. The notice must contain a place where the individual may mark the individual’s request that the specimen or information not be disclosed or retained for anonymous research or coded research before returning the notice to the health care provider.

(4) The notice described in subsection (3) of this section:

(a) Must be given no later than when the provider obtains an individual’s biological specimen or clinical individually identifiable health information; and

(b) May be given at the same time and in the same manner as the notice of privacy practices required under the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164.

SECTION 6. ORS 192.547 is amended to read:

192.547. (1)(a) The Department of Human Services shall adopt rules for conducting research using DNA samples, genetic testing and genetic information. Rules establishing minimum research standards shall conform to the Federal Policy for the Protection of Human Subjects, 45 C.F.R. 46, that is current at the time the rules are adopted. The rules may be changed from time to time as may be necessary.

(b) The rules adopted by the Department of Human Services shall address the operation and appointment of institutional review boards. The rules shall conform to the compositional and operational standards for such boards contained in the Federal Policy for the Protection of Human Subjects that is current at the time the rules are adopted. The rules must require that research conducted under paragraph (a) of this subsection be conducted with the approval of the institutional review board.

(c) Persons proposing to conduct anonymous research, coded research or genetic research that is otherwise thought to be exempt from review must obtain from an institutional review board prior to conducting such research a determination that the proposed research is exempt from review.

(2) A person proposing to conduct research under subsection (1) of this section, including anonymous research or coded research, must disclose to the institutional review board the proposed use of DNA samples, genetic testing or genetic information.

(3) The Department of Human Services shall adopt rules requiring that all institutional review boards operating under subsection (1)(b) of this section register with the department. The Advisory Committee on Genetic Privacy and Research shall use the registry to educate institutional review boards about the purposes and requirements of the genetic privacy statutes and administrative rules relating to genetic research.

(4) The Department of Human Services shall consult with the Advisory Committee on Genetic Privacy and Research before adopting the rules required under subsections (1) and (3) of this section, including rules identifying those parts of the Federal Policy for the Protection of Human Subjects that are applicable to this section.

(5) Genetic research in which the DNA sample or genetic information is coded shall satisfy the following requirements:

(a)(A) The subject has granted informed consent for the specific research project; [or]

(B) The subject has consented to genetic research generally[.]; or

(C) The DNA sample or genetic information is derived from a biological specimen or from clinical individually identifiable health information that was obtained or retained in compliance with ORS 192.537 (2).

(b) The research has been approved by an institutional review board after disclosure by the investigator to the board of risks associated with the coding.

(A) Not derived from individual identifiers;

(B) Kept securely and separately from the DNA samples and genetic information; and

(d) Data is stored securely in password protected electronic files or by other means with access limited to necessary personnel.

(e) The data is limited to elements required for analysis and meets the criteria in 45 C.F.R 164.514(e) for a limited data set.

(f) The investigator is a party to the data use agreement as provided by 45 C.F.R. 164.514(e) for limited data set recipients.

(6) Research conducted in accordance with this section is rebuttably presumed to comply with ORS 192.535 and 192.539.

[(7) In cases in which informed consent is required by either ORS 192.535 or the Federal Policy for the Protection of Human Subjects, samples collected before June 25, 2001, with blanket informed consent for research may be used for genetic research without specific informed consent, but samples obtained after June 25, 2001, must have specific informed consent from the individual for genetic research.]

(7)(a) Notwithstanding ORS 192.535, a person may use a DNA sample or genetic information obtained, with blanket informed consent, before June 25, 2001, for genetic research.

(b) Notwithstanding ORS 192.535, a person may use a DNA sample or genetic information obtained without specific informed consent and derived from a biological specimen or clinical individually identifiable health information for anonymous research or coded research if an institutional review board operating under subsection (1)(b) of this section:

(A) Waives or alters the consent requirements pursuant to the Federal Policy for the Protection of Human Subjects; and

(B) Waives authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164.

(c) Except as provided in subsection (5)(a) of this section or paragraph (b) of this subsection, a person must have specific informed consent from an individual to use a DNA sample or genetic information of the individual obtained on or after June 25, 2001, for genetic research.

(8) Except as otherwise allowed by rule of the Department of Human Services, if DNA samples or genetic information obtained for either clinical or research purposes is used in research, a person may not recontact the individual or the individual’s physician by using research information that is identifiable or coded. The Department of Human Services shall adopt by rule criteria for recontacting an individual or an individual’s physician. In adopting the criteria, the department shall consider the recommendations of national organizations such as those created by executive order by the President of the United States and the recommendations of the Advisory Committee on Genetic Privacy and Research.

(9) The requirements for consent to, or notification of, obtaining a DNA sample or genetic information for genetic research are governed by the provisions of ORS 192.531 to 192.549 and the administrative rules that were in effect on the effective date of the institutional review board’s most recent approval of the study.

SECTION 7. No later than January 1, 2006, the Department of Human Services shall adopt rules to implement section 5 of this 2005 Act after considering the federal Health Insurance Portability and Accountability Act privacy regulations, 45 C.F.R. parts 160 and 164. The rules shall include but need not be limited to the form, readability and content of the notice required under section 5 of this 2005 Act.

SECTION 8. Notwithstanding ORS 192.535 and 192.537 (2), a person may use an individual’s DNA sample or genetic information that is derived from a biological specimen or clinical individually identifiable health information for anonymous research or coded research if the individual was deceased when the individual’s biological specimen or clinical individually identifiable health information was obtained.

SECTION 9. Section 5 of this 2005 Act and the amendments to ORS 192.531, 192.535, 192.537 and 192.547 by sections 1, 2, 3 and 6 of this 2005 Act become operative on July 1, 2006.

SECTION 10. This 2005 Act being necessary for the immediate preservation of the public peace, health and safety, an emergency is declared to exist, and this 2005 Act takes effect on its passage.

Approved by the Governor July 29, 2005

Filed in the office of Secretary of State July 29, 2005

Effective date July 29, 2005

__________