JD Key Consulting Logo
Signed Into Law
Signed June 20, 2025Effective 2025-06-20
HB4377

Regular Session

Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.

Government Affairs & Regulatory Compliance Analysis

HB4377: Government Affairs Overview

HB4377 mandates the retroactive destruction of all genetic material and deletion of genetic information collected under contract with the Department of Family and Protective Services (DFPS) for paternity testing. This legislation strictly impacts laboratories, data storage vendors, and diagnostic providers, requiring a complete purge of historical biological samples and raw genetic data by January 1, 2026, while permitting the retention of the final paternity result.

Rep. Denise Villalobos·House Bill·Regular Session

Critical
Medium Cost
Effective:2025-06-20
Business Impact

Who HB4377 Affects

This legislation has regulatory implications for the following Texas businesses and organizations:

Regulatory Priority: critical

Significant regulatory changes (effective 2025-06-20). Review with your legal and compliance teams to understand implications.

🏥

Healthcare

Affected business types:

  • Hospitals
  • Healthcare systems
  • Medical practices
  • Health insurance providers
View all healthcare legislation

Key Operational Considerations

  • 1DFPS Master Service Agreements: Expect immediate amendments from DFPS to incorporate mandatory destruction clauses.
  • 2IT & Data Management: IT teams must be trained to segregate "Genetic Information" (raw sequencing data) from "Test Results" (final reports). The former must be deleted; the latter may be retained.

Estimated Cost Impact

mediumModerate costs expected for implementation.

Enforcing Agencies

Need Government Relations Support?

JD Key Consulting provides government affairs and regulatory strategy services. We help businesses navigate Texas agencies, understand legislative impacts, and advocate for their interests.

Need Help Navigating This Legislation?

JD Key Consulting provides strategic guidance on Texas regulatory compliance and legislative impact for your business.

HB4377
Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.
Critical Urgency
Unanimous Passage
House Vote131 - 0
YEA
100% in favor131 voting
Senate Vote31 - 0
YEA
100% in favor31 voting
Cost Impact
Medium
Effective
2025-06-20
Enforcing Agencies
DFPS
Primary Author: Rep. Denise Villalobos
89th Texas Legislature
jdkey.com
01

Compliance Analysis

Key implementation requirements and action items for compliance with this legislation

Implementation Timeline

  • Effective Date: September 1, 2025
  • Compliance Deadline: January 1, 2026 (Hard deadline for the destruction of all historical samples and deletion of data).
  • Agency Rulemaking: DFPS is expected to issue guidance between September and December 2025 regarding verification standards for destruction and the specific definition of "promptly."

Immediate Action Plan

  • 1. Conduct Immediate Inventory: Launch a full audit to locate all physical DFPS-related biological samples and digital genetic datasets currently in your possession.
  • 2. Segregate Data: Configure IT systems to separate the "Result" (allowable retention) from the "Genetic Information" (mandatory deletion).
  • 3. Amend Vendor Contracts: Send notices to all downstream storage and IT vendors regarding the new statutory destruction requirement.
  • 4. Execute Historical Purge: Begin the systematic destruction of the backlog now to ensure completion before the January 1, 2026 hard deadline.
  • 5. Update Privacy Policies: Revise internal data retention policies to reflect that DFPS genetic data is now an exception to standard retention schedules.

Operational Changes Required

Contracts

  • DFPS Master Service Agreements: Expect immediate amendments from DFPS to incorporate mandatory destruction clauses.
  • Subcontractor Flow-Down: You must amend agreements with third-party storage facilities and IT cloud providers. You remain liable for samples held by your subcontractors; ensure their contracts explicitly require destruction upon your command.

Hiring/Training

  • IT & Data Management: IT teams must be trained to segregate "Genetic Information" (raw sequencing data) from "Test Results" (final reports). The former must be deleted; the latter may be retained.
  • Lab Operations: Staff must transition from a "store and archive" workflow to a "test and destroy" workflow. Implement a "kill switch" protocol to destroy physical samples immediately upon report finalization.

Reporting & Record-Keeping

  • Certificates of Destruction (COD): Implement auditable logs for physical sample destruction (date, time, method, officer).
  • Data Deletion Logs: IT systems must generate automated logs proving the permanent erasure of raw genetic data fields from servers and backups.
  • Audit Defense: Prepare for annual DFPS compliance attestations confirming no prohibited genetic material remains in your custody.

Fees & Costs

  • Retrospective Cleanup Costs: Budget immediately for the labor and disposal costs associated with identifying and destroying years of historical samples before January 1, 2026.
  • Revenue Impact: If your business model includes fees for long-term sample storage, this revenue stream is now illegal for DFPS cases.

Strategic Ambiguities & Considerations

  • Definition of "Promptly": The statute requires destruction "promptly" after the test purpose is accomplished but does not define a specific window (e.g., 24 hours vs. 30 days). Guidance: Adopt a policy of destruction within 30 days of reporting until rulemaking clarifies.
  • Backup Tapes: The law requires deletion of genetic information but does not explicitly address disaster recovery backups, which are difficult to scrub selectively. Guidance: Treat backup tapes as in-scope and consult IT legal counsel regarding "put beyond use" standards.
  • Verification Standards: It is currently unclear if DFPS will require video evidence of physical destruction or specific digital forensic standards (e.g., NIST guidelines) for data wiping.

Need Compliance Guidance on This Legislation?

JD Key Consulting specializes in Texas regulatory compliance strategy. Work directly with James Dickey—former Chairman of the Republican Party of Texas—to understand this bill's impact on your operations and develop an actionable compliance plan.

Schedule a Consultation

Information presented is for general knowledge only and is provided without warranty, express or implied. Consult qualified government affairs professionals and legal counsel before making compliance decisions.

02

Legislative Timeline

This bill's path through the Texas Legislature

Filed
Mar 11, 2025
Passed House
May 10, 2025
Passed Senate
May 25, 2025
Signed
Jun 20, 2025
Effective
Jun 20, 2025
TopicsFamilyFamily--child ProtectionHealthHealth--generalDnaPaternityFamily & Protective Services, Department of
03

House Authors

Rep. Denise VillalobosRepublican · Primary Author
Joint Authors

Senate Sponsor

Sen. Bob HallRepublican · Primary Sponsor

Bill Text(with markup)

View bill text in multiple formats on Texas Legislature website

Fiscal NoteView Original

Related Legislation

Explore more bills from this author and on related topics

More from Rep. Denise Villalobos

View all bills by Rep. Denise Villalobos

Related by Topic

View more Family legislation
Quick Reference

Frequently Asked Questions

Common questions about HB4377

Q

What does Texas HB4377 do?

HB4377 mandates the retroactive destruction of all genetic material and deletion of genetic information collected under contract with the Department of Family and Protective Services (DFPS) for paternity testing. This legislation strictly impacts laboratories, data storage vendors, and diagnostic providers, requiring a complete purge of historical biological samples and raw genetic data by January 1, 2026, while permitting the retention of the final paternity result.

Q

Who authored HB4377?

HB4377 was authored by Texas Representative Denise Villalobos during the Regular Session.

Q

When was HB4377 signed into law?

HB4377 was signed into law by Governor Greg Abbott on June 20, 2025.

Q

Which agencies enforce HB4377?

HB4377 is enforced by Department of Family and Protective Services (DFPS).

Q

How significant are the changes in HB4377?

The regulatory priority for HB4377 is rated as "critical". Businesses and organizations should review the legislation to understand potential impacts.

Q

What is the cost impact of HB4377?

The cost impact of HB4377 is estimated as "medium". This may vary based on industry and implementation requirements.

Q

What topics does HB4377 address?

HB4377 addresses topics including family, family--child protection, health, health--general and dna.

Q

What are the key dates for HB4377?

Key dates for HB4377: Effective date is 2025-06-20. Consult with legal counsel regarding applicability.

Q

Which Texas businesses are affected by HB4377?

HB4377 primarily affects healthcare providers and medical facilities. These businesses should review the legislation with their legal and compliance teams to understand potential impacts.

Need Strategic Guidance on This Legislation?

JD Key Consulting is an Austin, Texas-based government affairs firm led by James Dickey, former Chairman of the Republican Party of Texas. We specialize in Texas regulatory compliance and legislative strategy for data centers, energy, banking, and manufacturing.

Legislative data provided by LegiScanLast updated: January 11, 2026