2025 · Regular session · House bill
HB130
The Texas Genomic Act of 2025 restricts certain genome-sequencing equipment, software, data storage and bankruptcy-related data transfers connected to foreign adversaries.
Official caption: Relating to genetic information security for residents of this state; providing a civil penalty; providing a private cause of action.
Official report lists House author(s): Bonnen, Orr, Hefner. This does not identify sponsors or amendment drafters.
Bill explanation published · Version and amendment review scope is stated below · Individual amendment records may not be separately annotated.
Bill highlights
Selected points from the published explanation. Follow each point to its source-linked context; conditions and limits may matter.
- The Texas Genomic Act of 2025 restricts certain genome-sequencing equipment, software, data storage and bankruptcy-related data transfers connected to foreign adversaries.
- Who is covered: The law applies to medical facilities, research facilities, companies and nonprofit organizations conducting research on or testing of genome sequencing or the human genome in Texas.
- Equipment and software: Covered entities cannot use genome sequencers or associated software produced by or on behalf of a foreign adversary, its state-owned enterprise, a company/nonprofit domiciled in an adversary country, or an owned/controlled subsidiary or affiliate of such a company/nonprofit.
- Storage and access—with a specific research exception: Covered entities generally cannot store Texas residents' genome-sequencing data inside an adversary country.
- Bankruptcy sales and annual certification: Covered entities cannot sell or otherwise transfer Texans' genomic-sequencing data to the listed adversary-linked recipients as part of bankruptcy or a Chapter 11 reorganization plan.
- Two different civil remedies: A violator is liable to the state for $10,000 per violation.
What does it do?
The Texas Genomic Act of 2025 restricts certain genome-sequencing equipment, software, data storage and bankruptcy-related data transfers connected to foreign adversaries. It also requires annual compliance certification and allows state enforcement and lawsuits by harmed Texas patients or research subjects. It does not prohibit all foreign medical research or all overseas data storage. Final law; official history.
Who is covered. The law applies to medical facilities, research facilities, companies and nonprofit organizations conducting research on or testing of genome sequencing or the human genome in Texas. Its defined “medical facility” is licensed/registered to provide health care and receives state funding, including specified pass-through federal funds. The separately listed companies, research facilities and nonprofits are not all made subject to that funding condition. “Foreign adversary” comes from the federal Commerce regulation, 15 CFR 791.4(a), rather than a new Texas-only list. The company/nonprofit “domicile” definition reaches specified formation/headquarters, primary-business and majority-shareholding connections. Final law, Sections 174.002–.003; official 2025 federal regulation, Section 791.4.
Equipment and software. Covered entities cannot use genome sequencers or associated software produced by or on behalf of a foreign adversary, its state-owned enterprise, a company/nonprofit domiciled in an adversary country, or an owned/controlled subsidiary or affiliate of such a company/nonprofit. The definitions reach genome sequencing, resequencing, isolation and other genome research, and software used for sequencer operation, analysis and related functions. This is a use restriction, not just a rule for future purchases. Final law, Sections 174.002 and .005.
Storage and access—with a specific research exception. Covered entities generally cannot store Texas residents’ genome-sequencing data inside an adversary country. They must use reasonable encryption, access restrictions and other cybersecurity best practices, including when a third party stores the data. Non-open data must be inaccessible to people located in an adversary country; the open-data wording is an exception to that access requirement, not a blanket exemption from every duty. The entire storage section does not apply to storage of data collected as part of a clinical trial or other biomedical study “subject to, or conducted in accordance with,” 28 CFR Part 202. That federal data-security regime contains its own conditions and exceptions; HB130 does not exempt every research project merely because it is called research. The exception does not erase the separate equipment, certification or bankruptcy-transfer provisions. Final law, Section 174.007; official 2025 federal rules, Part 202.
Bankruptcy sales and annual certification. Covered entities cannot sell or otherwise transfer Texans’ genomic-sequencing data to the listed adversary-linked recipients as part of bankruptcy or a Chapter 11 reorganization plan. Separately, an attorney representing each covered entity must submit its compliance certification to the Texas attorney general by December 31 each year. Anyone may notify the attorney general of a violation or potential violation; the attorney general may investigate. Final law, Sections 174.006 and .008–.009.
Two different civil remedies. A violator is liable to the state for $10,000 per violation. The attorney general may sue in Travis County or a county where part of the violation occurred, recover reasonable enforcement expenses, and deposit recovered penalties in General Revenue. A separate lawsuit is available to a Texas resident who is a patient or research subject and is harmed by unlawful storage or use of that person’s genome-sequencing data. The statutory recovery is the greater of actual damages or statutory damages of up to $5,000 per violation, plus court costs and reasonable attorney fees; $5,000 is not an automatic payment to everyone whose data was involved. The patient/subject may sue in their home county. The law makes two existing exemplary-damages provisions inapplicable to these suits; that is not a promise of an additional punitive award. Final law, Sections 174.010–.011; referenced damages provisions.
Timing. The law took effect September 1, 2025. Its changes generally apply only to causes of action accruing on or after that date, with prior law preserved for older claims. The bankruptcy-transfer provision applies only to bankruptcy filings on or after that date. Final law, Sections 2–3.
What changed along the way?
House committee substitute: the introduced version would have barred access to non-open data by people anywhere outside the United States unless the attorney general approved a limited exception. The substitute instead restricted access from adversary countries and removed that permission process. It also expressly allowed patient/subject lawsuits in the plaintiff’s home county. Introduced text; House substitute.
One indexed floor amendment: Bonnen’s House second-reading amendment 1, adopted April 29, made two changes. It recast the purpose as preventing covered entities from providing a foreign adversary access, rather than referring to entities acting on an adversary’s behalf gaining access. It also replaced a requirement to store all covered data in the United States with a ban on storage in adversary countries. Both instructions survive in the final text. Amendment index and disposition; complete amendment; engrossed text.
Senate substitute: added the bankruptcy-transfer restriction, its filing-date limit, and the clinical-trial/biomedical-study exception to the storage section. These are committee-substitute changes, not a separately indexed Senate floor amendment. The Senate text and final law have the same policy provisions, and the House concurred; no conference version is indexed. Senate substitute; Senate amendment packet; version index.
For the full amendment record, open the official amendment index.
Official bill versions
Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.
Who could benefit—and who could bear the costs?
Potential benefits: Texans whose genetic data is handled by covered entities gain restrictions intended to reduce adversary access, state enforcement and a remedy if unlawful storage/use harms them. The law does not demonstrate that every genetic-data risk is eliminated or that every patient has a valid claim.
Burdens and trade-offs: affected laboratories, health-care and research entities may need to change equipment, software, storage providers or access arrangements, maintain security controls and pay for attorney-submitted certifications. The bankruptcy rule can restrict eligible buyers of data assets. Civil penalties, litigation and recoverable enforcement expenses add exposure for violations. The final law leaves room for non-adversary overseas storage and qualifying biomedical-research storage, but the eligibility of a particular arrangement depends on the facts and applicable rules.
Fiscal estimate: the May 20 final fiscal note anticipates no significant state or local fiscal implication and assumes implementation-related costs or revenue effects are insignificant. All earlier indexed notes reach the same broad conclusion. That governmental estimate does not price private equipment replacement, legal fees, lost asset value or patient harm. HB130 does not itself appropriate money, and the estimate is not a guarantee that every regulated entity incurs no cost. Final fiscal note.
Review boundary: checked history, all five policy versions, the sole indexed amendment and both instructions, the Senate packet, six fiscal notes and the relevant Texas/federal references. This is an explanation of the enacted requirements, not a current audit of a laboratory, manufacturer, foreign-country list, bankruptcy case or clinical-study exemption.
Official sources
- Bill history and latest recorded action
- Bill versions, analyses and fiscal notes
- Action history and votes
- Amendment index
Catalog report retrieved 2026-10-25. Check the official record for corrections or later changes.