# Genomics Data Security Act: Plain Language Summary

This bill creates new rules to protect your genetic information from being stolen, hacked, or misused. Right now, when you take a DNA test through companies like ancestry services or get genetic testing at a doctor's office, there aren't strong federal laws specifically protecting that data. This bill would change that by requiring companies and healthcare providers who handle your genetic information to follow strict security standards, report data breaches quickly, and face penalties if they fail to protect your information.

The bill affects anyone who has had genetic testing done—whether through direct-to-consumer DNA kits, medical tests ordered by doctors, or research studies. It would require these organizations to use strong encryption, limit who can access your genetic data, and notify you within a specific timeframe if your information gets compromised. Companies would also need to have plans in place for what to do if a breach happens, rather than figuring it out after the fact. If a company violates these rules, they could face fines and legal consequences.

The practical impact is that your genetic information would get similar protections to what already exists for other sensitive health data under federal law. You'd have more control over who sees your DNA information and would be alerted faster if something goes wrong. For companies handling genetic data, this means investing in better security systems and staff training, which could increase costs but would make your information safer. This is particularly important because genetic information is permanent—unlike a password you can change, you can't get new DNA if yours is exposed.

Genomics Data Security Act

Rubio, Marco

Genomics Data Security Act This bill establishes requirements and otherwise directs the National Institutes of Health (NIH) to take actions to address national security concerns in genomic and other research. Specifically, the bill prohibits the use of NIH funds by any Chinese company (or its subcontractors or subsidiaries). This includes companies (1) over which the Chinese government, a Chinese national, or an entity organized under Chinese law exercises control; or (2) in which the Chinese government has a substantial interest. It also requires, as a condition of certification, that clinical laboratories that have access to U.S. health data disclose ties to the Chinese government. In addition, the NIH must incorporate national security issues in its strategic plan and report annually on any improperly disclosed, vetted, or approved ties that NIH-funded researchers have to foreign governments. Furthermore, the Department of Health and Human Services must establish a working group to update the NIH's Genomic Data Sharing Policy with respect to intellectual property, national security, and privacy concerns.