Regulon — WV-HB-5034 · WV HB 5034 (Genomic Privacy)

WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

The Attorney General has sole authority to enforce this article on behalf of the State of West Virginia and may investigate allegations, initiate civil enforcement actions, and recover civil penalties. A private right of action is also available to a legal resident of West Virginia who is a patient or research subject and who is harmed by the storage or use of their genome sequencing data in violation of the act.

Private Right of Action

private right of action is also available to a legal resident of West Virginia who is a patient or research subject and who is harmed by the storage or use of their genome sequencing data in violation of the act.

Penalties

AG enforcement: actual damages, costs, reasonable attorney fees, and $2,500 per violation of any provision. AG may also recover investigative costs, witness fees, and deposition expenses. Private right of action: the greater of actual damages or statutory damages not to exceed $5,000 per violation, plus court costs and reasonable attorney's fees. Private action requires that the plaintiff be 'harmed by' the violative storage or use.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

W. Va. Code § 16-5EE-1

Short title; Purpose and Legislative Policy

(a)–(c) This article shall be known as the "West Virginia Genomic Information Privacy Act of 2026." (b) The purpose of this act is to ensure that a medical facility, research facility, company, entity or nonprofit organization subject to this chapter does not provide any foreign adversary access to the genetic information of residents of this state. (c) The public policy of West Virginia is to: (1) Oppose the collection and analysis of genomic information by a foreign adversary or for use by a foreign adversary; and (2) Support sanctions the United States Department of Commerce or the United States Department of Defense imposes on a medical facility, research facility, company, or nonprofit organization engaged in the collection and analysis of genomic information for use by a foreign adversary.

Section 1 establishes the short title of the act as the "West Virginia Genomic Information Privacy Act of 2026" and sets out the legislative purpose: to prevent foreign adversaries from accessing the genetic information of West Virginia residents. The section declares West Virginia's public policy of opposing collection and analysis of genomic information by or for foreign adversaries and supporting federal sanctions against entities engaged in such activities.

W. Va. Code § 16-5EE-2

Definitions

As used in this article, unless the context clearly indicates otherwise, the following definitions apply: (1) "Biological sample" means any human material known to contain DNA, including tissue, blood, urine, or saliva. (2) "Company" means a sole proprietorship, organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, or limited liability company that exists to make a profit. The term includes a wholly owned subsidiary, majority-owned subsidiary, parent company, or affiliate of those entities or business associations. (3) "Consumer" means an individual who is a resident of this state. (4) "DNA" means deoxyribonucleic acid. (5) "Domicile" means the country in which: (A) A company or nonprofit organization is formed, incorporated, or registered and headquartered; (B) A company's or nonprofit organization's affairs are primarily conducted; or (C) The majority of the company's ownership shares are held. (6) "Entity" means a partnership, corporation, association, or public or private organization of any character that: (A) Offers consumer genetic testing products or services directly to a consumer; or (B) Collects, uses, or analyzes genetic data. (7) "Express consent" means a consumer's affirmative response to a clear, meaningful, and prominent notice regarding the collection, use, or disclosure of genetic data for a specific purpose. (8) "Foreign adversary" has the meaning assigned by 15 C.F.R. Section 791.4. (9) "Genetic data" means: (A) Any data, regardless of format, concerning a consumer's genetic characteristics. (B) The term includes but is not limited to: (i) Raw sequence data that result from sequencing all or a portion of a consumer's extracted DNA; (ii) Genotypic and phenotypic information obtained from analyzing a consumer's raw sequence data; and (iii) Self-reported health information regarding a consumer's health conditions that the consumer provides to an entity that the entity: (I) Uses for scientific research or product development; and (II) Analyzes in connection with the consumer's raw sequence data. (10) "Genetic testing" means: (A) A laboratory test of a consumer's complete DNA, regions of DNA, chromosomes, genes, or gene products to determine the presence of genetic characteristics of a consumer; or (B) An interpretation of a consumer's genetic data. (11) "Genome sequencer" means any device or platform used to conduct genome sequencing, resequencing, or isolation or other genome research. (12) "Genome sequencing" means any method used to determine the identity and order of nucleotide bases in the human genome. (13) "Governmental agency" means an executive, legislative, or judicial agency, department, board, commission, authority, institution, or instrumentality of the federal government or of a state or of a county, municipality, or other political subdivision of a state. (14) "Human genome" means the set of DNA found in human cells. (15) "Medical facility" means a facility licensed or registered by a state or federal agency to provide health care services that receives any state funding, including pass-through federal money provided to a state agency for grant awards. (16) "Person" means an individual, partnership, corporation, association, business, business trust, or legal representative of an organization. (17) "Processor" means a person that processes genetic data on behalf of an entity pursuant to a contract between the entity and the processor that prohibits the processor from retaining, using, or disclosing the genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, as applicable, for any purpose other than for the specific purpose of performing the services specified in the contract. (18) "Software" means computer programs and related equipment used for genome sequencing or the operation, control, analysis, research, or other functions of genome sequencers. (19) "Third party" means a person other than the consumer, entity, or processor.

Section 2 provides nineteen definitions for terms used throughout the act. Key defined terms include Entity (the primary covered party — any organization offering consumer genetic testing or collecting, using, or analyzing genetic data), Consumer (a West Virginia resident), Genetic data (broadly defined to include raw sequence data, genotypic and phenotypic information, and self-reported health data analyzed in connection with raw sequence data), Express consent (affirmative response to a clear, meaningful, and prominent notice), and Foreign adversary (incorporated by reference to 15 C.F.R. § 791.4).

W. Va. Code § 16-5EE-3

Exceptions

(a)–(d) Protected health information that is collected by a covered entity or business associate as those terms are defined in 45 CFR, parts 160 and 164, if separate informed consent related to the collection, use, and dissemination of genetic data is obtained from the consumer, parent, guardian, or power of attorney, and the covered entity or business associate follows the policies under this article; (b) An entity when it is engaged only in collecting, using, or analyzing genetic data or biological samples in the context of research as defined in 45 CFR 164.501 conducted with the express consent of an individual and in accordance with: (i) The federal policy for the protection of human research subjects under 45 CFR, part 46, the good clinical practice guideline issued by the international council for harmonization of technical requirements for pharmaceuticals for human use; or (ii) The United States food and drug administration policy for the protection of human subjects under 21 CFR, parts 50 and 56; or (c) Uses by a governmental agency. (d) Beginning January 1, 2027, any collection, storage, use, or dissemination of genetic data by a governmental agency must be performed in accordance with a specific state law or executed through a search warrant.

Section 3 carves out four categories from the act's general coverage: (a) HIPAA-covered entities and business associates, provided they obtain separate informed consent for genetic data and follow the act's policies; (b) entities engaged only in research conducted under the Common Rule or FDA human-subjects protections with express consent; (c) governmental agencies (with a prospective requirement effective January 1, 2027, that government use of genetic data must be authorized by specific state law or a search warrant); and (d) governmental agency uses generally.

W. Va. Code § 16-5EE-4

Consumer genetic data; privacy notice; consent; access; deletion; destruction

Deployer

(1) 1 Provide clear and complete information regarding the entity's policies and procedures for the collection, use, or disclosure of genetic data by making available to a consumer: (A) A high-level privacy policy overview that includes basic, essential information about the entity's collection, use, or disclosure of genetic data; and (B) A prominent, publicly available privacy notice that includes, at a minimum, information about the entity's data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices for genetic data;

(2) 2 Obtain initial express consent from a consumer, parent, guardian, or power of attorney for the collection, use, or disclosure of the consumer's genetic data that: (A) Clearly describes the entity's use of the genetic data that the entity collects through the entity's genetic testing product or service; (B) Specifies the categories of individuals within the entity that have access to test results; and (C) Specifies how the entity may share the genetic data;

(4) 3 If the entity engages in any of the following, obtain a consumer's: (A) Separate express consent for: (i) The transfer or disclosure of the consumer's genetic data or biological sample to any third party other than the entity's processors, including the name of the third party to which the consumer's genetic data or biological sample will be transferred or disclosed with the consumer's express consent; (ii) The use of genetic data beyond the primary purpose of the entity's genetic testing product or service and inherent contextual uses; or (iii) The entity's retention of any biological sample provided by the consumer following the entity's completion of the initial testing service requested by the consumer; (B) Informed express consent for transfer or disclosure of the consumer's genetic data to third party persons for: (i) Research purposes; or (ii) Research conducted under the control of the entity for the purpose of publication or generalizable knowledge; and (C) Express consent for: (i) Marketing to a consumer based on the consumer's genetic data; (ii) Marketing by a third-party person to a consumer based on the consumer having ordered or purchased a genetic testing product or service. Marketing does not include the provision of customized content or offers on the websites or through the applications or services provided by the entity with the first-party relationship to the consumer; or (iii) Sale or other valuable consideration of the consumer's genetic data.

(5) Comply with the provisions of §46A-7-101 et seq. of this code requiring a valid legal process for disclosing genetic data to law enforcement or any other government agency without a consumer's express consent;

(6)–(6)(A) 4 Develop, implement, and maintain a comprehensive security program to protect a consumer's genetic data against unauthorized access, use, or disclosure; and (A) Provide a process for a consumer to: (i) Access the consumer's genetic data; (ii) Delete the consumer's genetic data; (iii) Revoke any consent provided by the consumer; and (iv) Request and obtain the destruction of the consumer's biological sample.

(7) 5 Genetic data and biometric samples of West Virginia residents collected in the state may not be stored within the territorial boundaries of any country currently sanctioned in any way by the United States office of foreign asset control or designated as a foreign adversary under 15 CFR 7.4(a). Genetic data or biometric data of West Virginia residents collected in the state may only be transferred or stored outside the United States with the consent of the resident.

Section 4 is the core consumer-protection provision. It imposes a suite of obligations on entities that collect, use, or analyze genetic data: publishing a privacy notice and high-level privacy policy overview; obtaining initial express consent for collection with specified disclosures; obtaining separate express consent for third-party transfers, secondary uses, sample retention, research disclosures, and marketing; maintaining a comprehensive security program; providing consumers with access, deletion, consent-revocation, and biological-sample destruction rights; and prohibiting storage of genetic data within sanctioned or foreign-adversary countries absent consumer consent for overseas transfer.

Compliance actions 5 items

Entities must provide consumers with clear and complete information about the entity's policies and procedures for the collection, use, or disclosure of genetic data, including: (1) a high-level privacy policy overview covering basic, essential information about genetic data collection, use, and disclosure; and (2) a prominent, publicly available privacy notice covering, at minimum, data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices for genetic data.

D-01.1

Entities must obtain initial express consent from the consumer, parent, guardian, or power of attorney before collecting, using, or disclosing the consumer's genetic data. The consent must: (1) clearly describe the entity's use of the genetic data collected through the genetic testing product or service; (2) specify the categories of individuals within the entity that have access to test results; and (3) specify how the entity may share the genetic data.

D-01.8

Entities must obtain separate express consent from the consumer for each of the following: (1) transferring or disclosing genetic data or biological samples to any third party other than the entity's processors, including disclosure of the named third-party recipient; (2) using genetic data beyond the primary purpose of the genetic testing product or service; (3) retaining biological samples after completing the initial testing service; (4) transferring genetic data to third parties for research purposes or publication (informed express consent required); and (5) marketing to the consumer based on genetic data, third-party marketing based on the consumer's purchase of genetic testing, or sale of the consumer's genetic data for valuable consideration.

D-01.8

Entities must develop, implement, and maintain a comprehensive security program to protect consumer genetic data against unauthorized access, use, or disclosure. Entities must also provide consumers with a process to: (1) access their genetic data; (2) delete their genetic data; (3) revoke any consent previously provided; and (4) request and obtain the destruction of their biological sample.

D-01.2

Entities must not store genetic data or biological samples of West Virginia residents within the territorial boundaries of any country sanctioned by the United States Office of Foreign Asset Control or designated as a foreign adversary under 15 CFR 7.4(a). Genetic data or biometric data of West Virginia residents may only be transferred or stored outside the United States with the consent of the resident.

D-01.4

W. Va. Code § 16-5EE-5

Disclosure; when prohibited; when express consent required

Deployer

(a) The disclosure of genetic data pursuant to this article must comply with all state and federal laws for the protection of privacy and security.

(b) 6 Notwithstanding any other provisions in §16-5EE-4 of this code, an entity may not disclose a consumer's genetic data to any entity offering health insurance, life insurance, or long-term care insurance, or to any employer of the consumer without the consumer's express consent.

Section 5 imposes two additional disclosure restrictions. First, all genetic data disclosures must comply with applicable state and federal privacy and security laws. Second, entities are categorically prohibited from disclosing a consumer's genetic data to health insurers, life insurers, long-term care insurers, or employers without the consumer's express consent — a heightened protection against discrimination-prone disclosures.

Compliance actions 1 item

Entities must not disclose a consumer's genetic data to any entity offering health insurance, life insurance, or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.

D-01.5

W. Va. Code § 16-5EE-6

Prohibited use of certain genome sequencers and genome sequencing technologies

Deployer

7 A medical facility, research facility, company, entity or nonprofit organization subject to this chapter may not use a genome sequencer or software produced by or on behalf of: (1) A foreign adversary; (2) A state-owned enterprise of a foreign adversary; (3) A company or nonprofit organization domiciled within the borders of a country that is a foreign adversary; or (4) An owned or controlled subsidiary or affiliate of a company or nonprofit organization domiciled within the borders of a country that is a foreign adversary.

Section 6 prohibits any medical facility, research facility, company, entity, or nonprofit organization from using genome sequencers or software produced by or on behalf of a foreign adversary, a state-owned enterprise of a foreign adversary, or any company or nonprofit domiciled in a foreign adversary country (including subsidiaries and affiliates). This is a supply-chain restriction on genomic analysis equipment and software.

Compliance actions 1 item

Medical facilities, research facilities, companies, entities, and nonprofit organizations must not use any genome sequencer or software produced by or on behalf of a foreign adversary, a state-owned enterprise of a foreign adversary, a company or nonprofit organization domiciled in a foreign adversary country, or any subsidiary or affiliate of such an entity.

—

W. Va. Code § 16-5EE-7

Prohibited sale of genomic information in bankruptcy or reorganization

Deployer

8 A medical facility, research facility, company, or nonprofit organization subject to this chapter may not sell or otherwise transfer genomic sequencing data of residents of this state as part of a bankruptcy proceeding or pursuant to a plan of reorganization under Chapter 11 of the United States Bankruptcy Code (11 U.S.C. Section 1101 et seq.) to: (1) A foreign adversary; (2) A state-owned enterprise of a foreign adversary; (3) A company or nonprofit organization domiciled within the borders of a country that is a foreign adversary; or (4) An owned or controlled subsidiary or affiliate of a company or nonprofit organization domiciled within the borders of a country that is a foreign adversary.

Section 7 prohibits the sale or transfer of genome sequencing data of West Virginia residents as part of a bankruptcy proceeding or Chapter 11 reorganization plan to any foreign adversary, state-owned enterprise of a foreign adversary, or entity domiciled in or affiliated with a foreign adversary country. This prevents genomic data from being transferred to foreign adversaries through corporate insolvency transactions.

Compliance actions 1 item

Medical facilities, research facilities, companies, and nonprofit organizations must not sell or transfer genome sequencing data of West Virginia residents to a foreign adversary, a state-owned enterprise of a foreign adversary, or any entity domiciled in or affiliated with a foreign adversary country as part of a bankruptcy proceeding or Chapter 11 reorganization plan.

—

W. Va. Code § 16-5EE-8

Requirements for genomic information storage

Deployer

(a) 9 A medical facility, research facility, company, entity, or nonprofit organization subject to this chapter may not store any genome sequencing data of a resident of this state at a location within the borders of a country that is a foreign adversary.

(b) 10 A medical facility, research facility, company, or nonprofit organization subject to this chapter that stores genome sequencing data of residents of this state, including storage of genome sequencing data through a contract with a third-party data storage company, shall ensure the security of the genome sequencing data using reasonable encryption methods, restriction on access, and other cybersecurity best practices.

(c) 9 A medical facility, research facility, company, or nonprofit organization subject to this chapter shall ensure genome sequencing data of residents of this state, other than open data, is inaccessible to any person located within the borders of a country that is a foreign adversary.

(d) This section does not apply to the storage of genome sequencing data by a medical facility, research facility, company, or nonprofit organization subject to this chapter that is collected as part of a clinical trial or other biomedical research study subject to, or conducted in accordance with, 28 C.F.R. Part 202.

Section 8 imposes genomic data storage requirements. Entities must not store genome sequencing data within the borders of a foreign adversary country. Entities storing such data — including through third-party data storage providers — must use reasonable encryption, access restrictions, and cybersecurity best practices. Genome sequencing data must be inaccessible to any person located within a foreign adversary country. A narrow exception exists for clinical trials and biomedical research conducted in accordance with 28 C.F.R. Part 202.

Compliance actions 2 items

Covered entities must not store genome sequencing data of West Virginia residents at any location within the borders of a country that is a foreign adversary, and must ensure that such data (other than open data) is inaccessible to any person located within the borders of a foreign adversary country. An exception exists for data collected as part of a clinical trial or biomedical research study conducted in accordance with 28 C.F.R. Part 202.

—

Covered entities that store genome sequencing data of West Virginia residents — including through third-party data storage contracts — must ensure the security of that data using reasonable encryption methods, restriction on access, and other cybersecurity best practices.

—

W. Va. Code § 16-5EE-9

Required annual certification of compliance

Deployer

(a) 11 Not later than December 31 of each year, a medical facility, research facility, company, or nonprofit organization subject to §16-5EE-1 et seq. shall certify to the attorney general that the facility, company, or organization is in compliance with this chapter.

(b) 11 An attorney representing a medical facility, research facility, company, or nonprofit organization subject to this chapter shall submit the certification required under Subsection §16-5EE-8(a).

Section 9 requires annual compliance certification to the Attorney General. By December 31 of each year, each covered medical facility, research facility, company, or nonprofit organization must certify compliance with the entire chapter. The certification must be submitted by the entity's attorney.

Compliance actions 1 item

By December 31 of each year, each covered medical facility, research facility, company, or nonprofit organization must certify to the Attorney General that it is in compliance with the West Virginia Genomic Information Privacy Act. The certification must be submitted by an attorney representing the entity.

R-02.4

W. Va. Code § 16-5EE-10

Enforcement

(a)–(f) The Attorney General may investigate an allegation of a violation of this chapter and has the sole authority to enforce this article on behalf of the State of West Virginia. (b) The attorney general may bring an action to recover the civil penalty imposed under this section. (c) The Attorney General may initiate a civil enforcement action against a person for violation of this article. (d) In an action to enforce this article, the Attorney General may recover: (1) Actual damages to the consumer; (2) Costs; (3) Reasonable attorney fees; and (4) $2,500 for each violation of any provision of §16-5EE-1 et seq. of this code. (e) The attorney general shall deposit a civil penalty collected under this section in the state treasury to the credit of the general revenue fund. (f) The attorney general may recover reasonable expenses incurred in obtaining a civil penalty under this section, including court costs, reasonable attorney's fees, investigative costs, witness fees, and deposition expenses.

Section 10 vests the Attorney General with sole enforcement authority to investigate and bring civil enforcement actions for violations. Available remedies include actual damages to consumers, costs, reasonable attorney fees, and a $2,500 civil penalty per violation. Civil penalties are deposited in the state treasury general revenue fund. The Attorney General may also recover investigative costs, witness fees, and deposition expenses.

W. Va. Code § 16-5EE-11

Private cause of action

(a)–(b) A legal resident of this state who is a patient or research subject of a medical facility, research facility, company, or nonprofit organization subject to this chapter and who is harmed by the storage or use of the patient's or subject's genome sequencing data in violation of this chapter may bring an action against the facility, company, or organization that violated this chapter and is entitled to obtain: (1) The greater of: (A) Actual damages; or (B) Statutory damages in an amount not to exceed $5,000 for each violation; and (2) Court costs and reasonable attorney's fees. (b) An action under this section may be brought in the county in which the plaintiff resides.

Section 11 creates a private right of action for West Virginia residents who are patients or research subjects harmed by the violative storage or use of their genome sequencing data. Plaintiffs may recover the greater of actual damages or statutory damages up to $5,000 per violation, plus court costs and reasonable attorney's fees. Venue lies in the county of the plaintiff's residence. The private action requires proof of harm — the plaintiff must be 'harmed by' the violative conduct.

W. Va. Code § 16-5EE-12

Legal Applicability of West Virginia Genomic Information Privacy Act of 2026

(a)–(b) Except as provided by Subsection (b) of this section, the change in law made by this Act applies only to a cause of action that accrues on or after the effective date of this Act. A cause of action that accrues before the effective date of this Act is governed by the law in effect on the date the cause of action accrued, and the former law is continued in effect for that purpose. (b) West Virginia Code §16-5EE-12, as added by the West Virginia Genomic Information Privacy Act of 2026, applies only to a bankruptcy filing that occurs on or after the effective date of this Act.

Section 12 provides temporal applicability rules. The act applies only to causes of action accruing on or after the effective date. The bankruptcy transfer prohibition (which the section cross-references as §16-5EE-12, likely intending §16-5EE-7) applies only to bankruptcy filings on or after the effective date. Former law continues to govern pre-effective-date causes of action.

W. Va. Code § 16-5EE-13

Effective Date

The West Virginia Genomic Information Privacy Act of 2026 shall take effect July 1, 2026.

Section 13 establishes the effective date of the act as July 1, 2026.

Data Controls Data sale restrictions · deidentification

6 items

D-01.1