Facilities would restrict genetic equipment and data access

Medical and research facilities would have to stop using covered genetic sequencers and software and replace them with allowed equipment and software. The rule covers Montana medical facilities and research facilities, including facilities that receive state funding, provide health care, or conduct human-genome research. The ban covers equipment and software made in or by a foreign adversary, its state-owned enterprise, or a company based or controlled there. A facility may request reimbursement from the state treasurer for replacement costs. A reimbursement request must include purchase orders made at least 90 days before the act's effective date. The prohibition and replacement requirement would apply when the act takes effect; the text does not state a separate deadline for replacement.

Entities storing genetic sequencing data would have to keep it in the United States and protect it with security measures. The rules cover medical facilities, research institutions, and other companies or entities that store genetic sequencing data, including through outside storage companies. Open data is excluded from the remote-access restriction. People's written approval would be required before their non-open genetic sequencing data is remotely accessed from outside the United States. Covered entities would have to use reasonable encryption, access limits, and other cybersecurity best practices. The storage, access, and security rules would apply when the act takes effect; no separate end date is stated.

Covered facilities and research institutions would have to submit attorney-backed compliance certifications, and violations could lead to fines and damages. Medical facilities and research institutions must certify compliance; fines apply to prohibited sequencing or analysis and knowing storage outside the United States; affected patients and research subjects may seek damages. The first certification would be due by December 31 after the act takes effect, with annual certifications afterward. Missing the certification deadline would constitute perjury under the bill. Violations of the equipment rule would carry a $10,000 fine for each unique genome-sequencing or analysis instance. Knowing storage of genetic sequencing data outside the United States would carry a $10,000 fine for each violation, and affected patients or research subjects could recover at least $5,000 per unique use of their genomic information. The fines would be enforceable beginning on the first day of the first full fiscal year after the act takes effect.