HB4377

Regular Session

Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.

CriticalImmediate action required

Medium Cost

Effective:2025-06-20

Enforcing Agencies

Department of Family and Protective Services (DFPS)

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

Effective Date: September 1, 2025
Compliance Deadline: January 1, 2026 (Hard deadline for the destruction of all historical samples and deletion of data).
Agency Rulemaking: DFPS is expected to issue guidance between September and December 2025 regarding verification standards for destruction and the specific definition of "promptly."

Immediate Action Plan

1. Conduct Immediate Inventory: Launch a full audit to locate all physical DFPS-related biological samples and digital genetic datasets currently in your possession.
2. Segregate Data: Configure IT systems to separate the "Result" (allowable retention) from the "Genetic Information" (mandatory deletion).
3. Amend Vendor Contracts: Send notices to all downstream storage and IT vendors regarding the new statutory destruction requirement.
4. Execute Historical Purge: Begin the systematic destruction of the backlog now to ensure completion before the January 1, 2026 hard deadline.
5. Update Privacy Policies: Revise internal data retention policies to reflect that DFPS genetic data is now an exception to standard retention schedules.

Operational Changes Required

Contracts

DFPS Master Service Agreements: Expect immediate amendments from DFPS to incorporate mandatory destruction clauses.
Subcontractor Flow-Down: You must amend agreements with third-party storage facilities and IT cloud providers. You remain liable for samples held by your subcontractors; ensure their contracts explicitly require destruction upon your command.

Hiring/Training

IT & Data Management: IT teams must be trained to segregate "Genetic Information" (raw sequencing data) from "Test Results" (final reports). The former must be deleted; the latter may be retained.
Lab Operations: Staff must transition from a "store and archive" workflow to a "test and destroy" workflow. Implement a "kill switch" protocol to destroy physical samples immediately upon report finalization.

Reporting & Record-Keeping

Certificates of Destruction (COD): Implement auditable logs for physical sample destruction (date, time, method, officer).
Data Deletion Logs: IT systems must generate automated logs proving the permanent erasure of raw genetic data fields from servers and backups.
Audit Defense: Prepare for annual DFPS compliance attestations confirming no prohibited genetic material remains in your custody.

Fees & Costs

Retrospective Cleanup Costs: Budget immediately for the labor and disposal costs associated with identifying and destroying years of historical samples before January 1, 2026.
Revenue Impact: If your business model includes fees for long-term sample storage, this revenue stream is now illegal for DFPS cases.

Strategic Ambiguities & Considerations

Definition of "Promptly": The statute requires destruction "promptly" after the test purpose is accomplished but does not define a specific window (e.g., 24 hours vs. 30 days). Guidance: Adopt a policy of destruction within 30 days of reporting until rulemaking clarifies.
Backup Tapes: The law requires deletion of genetic information but does not explicitly address disaster recovery backups, which are difficult to scrub selectively. Guidance: Treat backup tapes as in-scope and consult IT legal counsel regarding "put beyond use" standards.
Verification Standards: It is currently unclear if DFPS will require video evidence of physical destruction or specific digital forensic standards (e.g., NIST guidelines) for data wiping.

Need Help Understanding Implementation?

Our government affairs experts can walk you through this bill's specific impact on your operations.

Schedule Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

Legislative Timeline

This bill's path through the Texas Legislature

TopicsFamily Family--child Protection Health Health--general Dna Paternity Family & Protective Services, Department of

Official Analysis

View HRO Analysis View All Bill Documents

BILL ANALYSIS

C.S.H.B. 4377

By: Villalobos

Human Services

Committee Report (Substituted)

BACKGROUND AND PURPOSE

The bill author has informed the committee that the Department of Family and Protective Services (DFPS) may collect genetic material, such as DNA samples, in certain child welfare cases--particularly for the purpose of establishing paternity; however, the long-term retention of this sensitive genetic data after its original purpose has been fulfilled may pose risks to individual privacy, especially when the data is unrelated to any ongoing investigation or legal matter. The bill author has further informed the committee that without clear statutory guidelines, there is uncertainty around how long genetic material and related information can be stored, how it may be used in the future, and whether individuals have any control over their genetic data once submitted. C.S.H.B. 4377 seeks to protect the privacy rights of individuals involved in child welfare cases and prevent misuse of or unauthorized access to sensitive personal data by ensuring that genetic material and genetic information collected solely for paternity determination is not retained indefinitely by DFPS.

CRIMINAL JUSTICE IMPACT

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.H.B. 4377 amends the Human Resources Code to require the Department of Family and Protective Services (DFPS) and any testing laboratory used by DFPS to promptly destroy any genetic material and delete any genetic information obtained from an individual for the purpose of a genetic test after the purpose for which the sample was obtained is accomplished. The bill requires DFPS and a testing laboratory to retain the results of a genetic test. The results of a genetic test are confidential under statutory provisions relating to the confidentiality of DFPS information.

C.S.H.B. 4377 defines the following terms:

·"genetic information" as information related to the genetic characteristics of an individual or the individual's family that is derived from the results of a genetic analysis;

·"genetic material" as blood or another specimen that contains DNA;

·"genetic test" as an analysis of an individual's genetic material to determine paternity; and

·"testing laboratory" as any entity DFPS contracts with for the provision of laboratory services, including genetic testing.

C.S.H.B. 4377 requires DFPS and any testing laboratory used by DFPS, not later than January 1, 2026, to destroy all genetic material and delete genetic information as required by the bill's provisions.

EFFECTIVE DATE

September 1, 2025.

COMPARISON OF INTRODUCED AND SUBSTITUTE

While C.S.H.B. 4377 may differ from the introduced in minor or nonsubstantive ways, the following summarizes the substantial differences between the introduced and committee substitute versions of the bill.

Whereas the introduced required DFPS to promptly destroy any genetic material and delete any genetic information obtained from an individual for the purpose of determining paternity after the purpose for which the sample was obtained is accomplished, the substitute requires DFPS and any testing laboratory used by DFPS to promptly destroy any genetic material and delete any genetic information obtained from an individual for the purpose of a genetic test after the purpose for which the sample was obtained is accomplished.

The substitute includes the following provisions absent from the introduced:

·a requirement for DFPS and a testing laboratory to retain the results of a genetic test;

·a provision establishing that the results of a genetic test are confidential under statutory provisions relating to the confidentiality of DFPS information; and

·provisions defining the terms "genetic test" and "testing laboratory."

While both the introduced and substitute require DFPS, not later than January 1, 2026, to destroy all genetic material and delete genetic information as required by the bill's provisions, the substitute expands the applicability of the requirement to any testing laboratory used by DFPS.

House Authors

Rep. Denise VillalobosRepublican · Primary Author

Joint Authors

Senate Sponsor

Sen. Bob HallRepublican · Primary Sponsor

Bill Text(with markup)

H.B. No. 4377

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

	AN ACT
	relating to the retention of certain genetic material and genetic
	information by the Department of Family and Protective Services.
	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
	SECTION 1. Subchapter C, Chapter 40, Human Resources Code,
	is amended by adding Section 40.084 to read as follows:
	Sec. 40.084. RETENTION OF GENETIC MATERIAL AND GENETIC
	INFORMATION. (a) In this section:
	(1) "DNA" means deoxyribonucleic acid.
	(2) "Genetic information" means information related
	to the genetic characteristics of an individual or the individual's
	family that is derived from the results of a genetic analysis.
	(3) "Genetic material" means blood or another specimen
	that contains DNA.
	(4) "Genetic test" means an analysis of an
	individual's genetic material to determine paternity.
	(5) "Testing laboratory" means any entity the
	department contracts with for the provision of laboratory services,
	including genetic testing.
	(b) Except as provided by Subsection (c), the department and
	any testing laboratory used by the department shall promptly
	destroy any genetic material and delete any genetic information
	obtained from an individual for the purpose of a genetic test after
	the purpose for which the sample was obtained is accomplished.
	(c) The department shall retain the results of a genetic
	test. The results of a genetic test are confidential under Section
	40.005.
	SECTION 2. Not later than January 1, 2026, any testing
	laboratory used by the Department of Family and Protective Services
	shall destroy all genetic material and delete genetic information
	as required by Section 40.084, Human Resources Code, as added by
	this Act.
	SECTION 3. This Act takes effect September 1, 2025.

LEGISLATIVE BUDGET BOARD
Austin, Texas

FISCAL NOTE, 89TH LEGISLATIVE REGULAR SESSION


April 21, 2025

TO:	Honorable Lacey Hull, Chair, House Committee on Human Services

FROM:	Jerry McGinty, Director, Legislative Budget Board

IN RE:	HB4377 by Villalobos (Relating to prohibiting the retention of certain genetic material and genetic information by the Department of Family and Protective Services.), As Introduced

Estimated Two-year Net Impact to General Revenue Related Funds for HB4377, As Introduced: a negative impact of ($5,694,581) through the biennium ending August 31, 2027.

General Revenue-Related Funds, Five- Year Impact:

Fiscal Year	Probable Net Positive/(Negative) Impact to General Revenue Related Funds
2026	($5,694,581)
2027	$0
2028	$0
2029	$0
2030	$0

All Funds, Five-Year Impact:

Fiscal Year	Probable Savings/(Cost) from General Revenue Fund 1	Probable Savings/(Cost) from GR Match For Medicaid 758	Probable Savings/(Cost) from Federal Funds 555
2026	($5,643,652)	($50,929)	($508,440)
2027	$0	$0	$0
2028	$0	$0	$0
2029	$0	$0	$0
2030	$0	$0	$0

Fiscal Analysis

The bill would require the Department of Family and Protective Services (DFPS) to destroy any genetic material and delete any genetic information obtained from an individual for the purpose of determining paternity after the purpose for which the sample was obtained is accomplished. The bill would require all genetic material and information be destroyed by January 1, 2026.

Methodology

According to the agency, DNA or genetic information exists in digital (typically stored in imaged documents uploaded into DFPS systems), and physical hard-copy records. Since the bill requires the information be destroyed, DFPS assumes records would need to be digitized to properly destroy the information. DFPS stated that 5,280 boxes of records would need to be digitized. Once that occurs, an IT solution will remove the DNA or genetic information.

The agency had already planned to digitize all records in 24 months and negotiated an estimated cost of $700,000 in All Funds with the third party conducting the work. Due to the mandated deadline of January 1, 2026, the imaging process must be completed within four months instead of the original timeline of 24 months. Therefore, DFPS assumes to process 5,280 boxes at an accelerated processing rate, compressing the timeline by a factor of six, would result in an estimated cost of $4,200,000 in All Funds in fiscal year 2026.

DFPS also assumes IT solution tools can support this project to identify genetic information within documents in DFPS systems, such as the Information Management Protecting Adults and Children in Texas (IMPACT) system, and validate that only genetic content is removed. This analysis assumes to implement the IT solution tool into the IMPACT system, 1.0 System Analyst V Contacted Full-Time Equivalent would be needed in fiscal year 2026 to complete 2,510 hours of work.

Technology

Technology costs to implement the IT solution are estimated to be $1,960,210 million in All Funds in fiscal year 2026.

Local Government Impact

No fiscal implication to units of local government is anticipated.

Source Agencies:

530 Family and Protective Services, Department of

LBB Staff:

JMc, NPe, ER, AN, NV

Related Legislation

Explore more bills from this author and on related topics

Frequently Asked Questions

Common questions about HB4377

What does Texas HB4377 do?

HB4377 mandates the retroactive destruction of all genetic material and deletion of genetic information collected under contract with the Department of Family and Protective Services (DFPS) for paternity testing. This legislation strictly impacts laboratories, data storage vendors, and diagnostic providers, requiring a complete purge of historical biological samples and raw genetic data by January 1, 2026, while permitting the retention of the final paternity result. Implementation Timeline Effective Date: September 1, 2025 Compliance Deadline: January 1, 2026 (Hard deadline for the destruction of all historical samples and deletion of data).

Who authored HB4377?

HB4377 was authored by Texas Representative Denise Villalobos during the Regular Session.

When was HB4377 signed into law?

HB4377 was signed into law by Governor Greg Abbott on June 20, 2025.

Which agencies enforce HB4377?

HB4377 is enforced by Department of Family and Protective Services (DFPS).

How urgent is compliance with HB4377?

The compliance urgency for HB4377 is rated as "critical". Businesses and organizations should review the requirements and timeline to ensure timely compliance.

What is the cost impact of HB4377?

The cost impact of HB4377 is estimated as "medium". This may vary based on industry and implementation requirements.

What topics does HB4377 address?

HB4377 addresses topics including family, family--child protection, health, health--general and dna.

Legislative data provided by LegiScanLast updated: November 25, 2025

Need Strategic Guidance on This Bill?

Need help with Government Relations, Lobbying, or compliance? JD Key Consulting has the expertise you're looking for.