Relating to genetic information security for residents of this state; providing a civil penalty; providing a private cause of action.

Contracts

• Cloud & Storage MSAs: Must be amended to explicitly guarantee that Texas resident genomic data is never stored in, or accessible from, a "Foreign Adversary" nation (currently China, Russia, Iran, North Korea).
• Vendor Procurement: New purchase agreements for lab equipment must include warranties of origin and ownership structure to ensure manufacturers are not owned or controlled by prohibited entities.
• M&A/Bankruptcy: Asset purchase agreements must disclose restrictions on selling genomic data to foreign entities.

Hiring/Training

• Legal Designation: Unlike standard compliance reports, the annual certification must be submitted by an attorney. You must engage outside counsel or formally designate an in-house attorney to assume this specific liability.
• IT Security: IT staff require immediate training on implementing strict IP blocking and Access Control Lists (ACLs) to geofence data from prohibited jurisdictions.

Reporting & Record-Keeping

• Annual Certification: A mandatory filing to the OAG by December 31 each year, certifying compliance with Chapter 174.
• Hardware Audit Trail: Maintain a permanent log of country-of-origin and ownership for all sequencers and sequencing software.
• Data Residency Verification: Documentation proving physical server locations for all cloud-stored genomic data.

Fees & Costs

• "Rip and Replace" Costs: High capital expenditure risk. There is no grandfather clause; prohibited equipment owned prior to the effective date must be decommissioned.
• Litigation Reserves: The law creates a private cause of action with $5,000 statutory damages per violation, creating immediate class-action exposure.
• Civil Penalties: $10,000 per violation payable to the State.