Skip to Content
U.S. National Institutes of Health
Last Updated: 03/05/10

Analysis of State Laws

I. Health and Medical Information

Preserving the privacy and confidentiality of an individual’s medical or health information is a legal obligation in most states.15 The limits on the use of patient information vary widely among states, but health providers, employers, and insurers who obtain an individual’s health information are generally required to restrict its release.16

Research on human tissue samples and associated data requires that researchers comply with state laws governing access to and use of medical information, since tissue specimens are usually considered “health care information” or “patient information.” This is true even though specimens (like X rays, radiographic films, tracings, etc.) were not traditionally considered part of the medical record. In certain states, the definition of health care information specifically references tissue samples as part of health information. For example, North Dakota has one of the broadest definitions of protected health information, including the following definition of identifiable medical, genetic, or demographic information:

“Any fluid or tissue samples collected from an individual, diagnostic and test results, whether oral or recorded in any form or medium, which…relates to the past, present, or future physical or mental health or condition of an individual, including individual cells and their components; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (2)(a) Identifies an individual; or (b) With respect to which there is a reasonable basis to believe that the information can be used to identify an individual.”

While state laws often restrict the use of medical or health information, exceptions to the rules against disclosure are commonly made for releases of information to law enforcement authorities for determination of paternity, or to scientists for research purposes. These “research exceptions” often permit disclosures of health information, and even genetic information,17 without the requirement to obtain individual permission when the data are anonymous, when the patient is not identified, or when an IRB has approved the research.

The exceptions are common, but they are not identical or uniform. More than half of the states have research exceptions in their medical records laws permitting disclosures to scientific researchers without specific individual consent under certain conditions.18 The conditions differ from state to state; however, they all reflect the underlying notion that if individual privacy is protected, the use of tissue samples by researchers is valid and ethical.19

Alaska uses a common method of prohibiting most disclosures of health information, while permitting disclosures for research when patient privacy is protected:

“For research that is subject to federal law and regulations protecting the rights and welfare of research participants; or (B) using health information that protects the confidentiality of participants by coding or encryption of information that would otherwise identify the patient.”

At the other end of the spectrum, a few states (e.g., Vermont), have enacted patients’ rights laws requiring informed consent and notice when hospital patients are also subjects of human research studies. Others, like Maryland,20 Oregon,21 and Minnesota,22 specify the form and content of the patient authorization required for disclosure of health information. Minnesota imposes perhaps the strictest restrictions on disclosures, establishing an elaborate mechanism for releases of patient information, even for research purposes. Minnesota law states that health records may be released to an external researcher solely for purposes of medical or scientific research, and only as follows:

“(1) Health records generated before January 1, 1997, may be released if the patient has not objected or does not elect to object after that date; (2) for health records generated on or after January 1, 1997, the provider must: (i) disclose in writing to patients currently being treated by the provider that health records, regardless of when generated, may be released and that the patient may object, in which case the records will not be released; and (ii) use reasonable efforts to obtain the patient’s written general authorization that describes the release of records in item (i), which does not expire but may be revoked or limited in writing at any time by the patient or the patient’s authorized representative.23

Connecticut passed a highly detailed statute pertaining to veterans’ health information and access to clinical health care information that specifies the process for requesting, providing, examining, and retaining tissue slides and pathology blocks. Connecticut law requires that patients or their designated health provider have the right to examine slides with their retained tissue, and specifies procedures for requesting, safeguarding, cutting, and returning tissue slides.24

II. Genetic Information

In addition to the restrictions on uses of “medical information” that can affect research on tissue specimens and data, many states20 have placed specific restrictions on “genetic tests” and the collection or disclosure of “genetic information.”25 These statutes can affect tissue research activities depending on the specificity of the definitions of “genetic test” or “genetic information,” and whether the definitions include analysis of the components of a gene (even for molecular testing in which hereditary conditions are not being studied), in addition to the more commonly understood description of a genetic test as referring to a test that involves familial or hereditable conditions.

Among the states that regulate the conduct of genetic tests or the acquisition of genetic information, twenty-one allow research uses of genetic information under specified conditions, usually when patient identities are protected.26 This approach distinguishes the clinical and research uses of tissue and data, freeing research activities from certain limits on usage as long as protections exist.

Delaware, Nevada, New Jersey, New York, and Oregon have laws requiring researchers to obtain individual informed consent in order to retain “genetic information.” If this informed consent is not obtained, or if an individual directs that the specimen be destroyed, this might conflict with the need to retain specimens for quality-assurance purposes.

One example of a statute that distinguishes between research and clinical data is in the Massachusetts statute describing “genetic information” as information that is gathered from a clinical or diagnostic test of DNA, RNA, or other genetic components:

“The term genetic information shall not include any information about an identifiable person that is taken: (1) as a biopsy, autopsy, or clinical specimen solely for the purpose of conducting an immediate clinical or diagnostic test that is not a test of DNA, RNA, mitochondrial DNA, chromosomes or proteins.27

Many statutes contain language similar to that found in a Nebraska law which excludes from the definition of “genetic test” regulated by the statute any activities undertaken as part of biomedical research:

“Genetic test does not include a routine physical examination or a routine analysis, including a chemical analysis, of body fluids unless conducted specifically to determine the presence, absence, or mutation of a gene or chromosome. Genetic test does not include a procedure performed as a component of biomedical research that is conducted pursuant to the federal Common Rule under 21 C.F.R. Parts 50 and 56 and 45 C.F.R. Part 46 as such regulations existed on September 1, 2001.28

Conversely, some states use broad definitions of “genetic test” that do not exclude research from their scope. Louisiana, New Hampshire, New Mexico, Oregon, and Iowa all use broad definitions of “genetic test,” similar to the definition in the following Louisiana statute, which may restrict the ability of researchers to use tissue samples:

“Genetic test means any test for determining the presence or absence of genetic characteristics in an individual, including tests of nucleic acids, such as DNA, RNA, and mitochondrial DNA, chromosomes, or proteins in order to diagnose or identify a genetic characteristic.29

New York law protects the confidentiality of records of genetic tests. “Biological samples” are described as “any material part of the human body or of discharge therefrom known to contain DNA, including but not limited to tissue specimens, blood, or urine.”30 This law imposes very strict requirements for informed consent and retention of samples for limited periods, but the law permits the conduct of research on anonymous samples, pursuant to a research protocol approved by an IRB, when the identity of the individuals is protected. Arkansas and Oklahoma utilize similar statutes that permit the use of excess surgical and diagnostic tissue (and blood) for genetic research or other research studies as long as patient privacy is assured.31

Michigan and Nebraska have identical statutes for the conduct of genetic tests, which impose a strict requirement to obtain informed consent from individuals that incorporates a statement of future uses of the sample, who will have access to the sample, etc.32 Both states permit research without informed consent when research is conducted pursuant to federal regulations. South Carolina similarly imposes strict limits on the conduct of genetic tests for clinical purposes, but permits the use of samples and information for research purposes when patient identities are not disclosed.33 South Dakota demands that informed consent documents include specific provisions including who will have access to the samples.34 South Dakota does not permit releases of information for research without informed consent.

New Jersey imposes some of the strictest limits on the use of samples for research purposes in its Genetic Privacy Act.35 Among other things, the Act requires the destruction of samples used in genetic research upon completion of the project, unless individual informed consent is obtained. However, the Act also states that this section only applies to information that can be tied to an individual or his family, implying that it only applies to identifiable information. Similarly, Texas does not allow indefinite retention of samples taken for clinical tests, but does allow their retention for research purposes.36

In some states, different definitions of “genetic test” are found in several laws in the same state. For example, Arizona addresses genetic testing in two separate state statutes: one that covers genetic tests in general (in the statutes governing Courts and Civil Proceedings),37 and another in the laws regulating the provision of insurance,38 using a different definition of “genetic test” in each statute. The definition of “genetic test” in the insurance statute is more restrictive, limiting the use of information from clinical tests.

To date, state statutes have not addressed ownership of tissue samples. However, individual ownership of “genetic information” has been declared by four states: Colorado,39 Florida,40 Georgia,41 and Louisiana.42 These statutes have not been tested to examine their validity or scope,43 but they reflect the effort to exert individual control over one’s genetic material in the face of insurers, employers, and commercial entities that seek to obtain genetic information.

For the purposes of research using tissue, the statutes addressing ownership could prove problematic if interpreted literally since such an interpretation would restrict the ability of researchers to use the “personal property” of another. However, note that of the four states that deem genetic information to be “owned” by the individual, three of them (Colorado, Georgia, and Louisiana) permit the use of “genetic information” for research purposes when the identity of the individual is not disclosed. Thus, while these provisions appear restrictive, they permit the use and retention of genetic information for research purposes when the data are anonymous.

III. State Laws on Human Subject Protection

New York, Virginia, California, and (most recently) Maryland impose additional requirements on the conduct of human subjects research beyond those set forth in federal regulations.

Maryland44 and Virginia45 extend the provisions of the Common Rule requiring informed consent from subjects (or a waiver of the requirement to obtain informed consent) and independent ethical review by an IRB or other qualified entity to all human subjects research, regardless of the funding source. In addition, the Maryland law provides for public access to the minutes of IRB meetings, with confidential information redacted if necessary. California mandates that informed consent be obtained from participants in research; however, no independent scientific review is required.

New York state public health statutes include an explicit requirement to obtain informed consent and to review research for studies not otherwise covered by the federal regulations.46 New York’s law on human subject protection exempts from the definition of human research “biological studies exclusively utilizing tissue or fluids after their removal or withdrawal from a human subject in the course of standard medical practice, or for epidemiological investigations.” By explicitly exempting tissue taken exclusively for research purposes, and excess surgical or diagnostic tissue, New York permits the use of tissue samples in research without the attendant requirements for specific informed consent and review of the research.

Many states have enacted some form of a patients’ bill of rights,47 some of which require that written informed consent be obtained to participate in research, or that informed consent be documented.48 Of these, only New York explicitly excludes tissue research from the restrictions of the statute.