Arizona's Genetic Testing Privacy Law: A.R.S. 12-2802, Title 20 Consent and the Consumer Testing Chapter

Privileged to the Person Tested

Arizona's genetic privacy rules are scattered across three titles of the Revised Statutes. The core is A.R.S. § 12-2802, one of four sections in Title 12, Chapter 19, headed "Genetic Testing," within the title on courts and civil proceedings. Its first sentence states that genetic testing and information derived from it "are confidential and considered privileged to the person tested." Release is then limited two ways: "as authorized by state or federal law," with the HIPAA privacy standards at 45 CFR parts 160 and 164, subpart E, named expressly, or to one of ten recipients.

The section pairs "confidential" with "privileged" and builds its release list around the person tested, not around the institution holding the record. HIPAA's privacy standards are written into the sentence as a named source of authority for release.

Who 12-2802 Reaches

Different subsections address different actors. Subsection C speaks to everyone: "A person shall not disclose or be compelled to disclose the identity of any person on whom a genetic test is performed or the results of a genetic test in a manner that allows identification of the person tested" except to the subsection A recipients. Subsection G then binds whoever receives results lawfully: other than the person tested, a recipient "shall not disclose the test results to any other person" unless the article provides otherwise.

Consent to the test itself is a narrower rule. Section 12-2803(C) stops a health care provider from conducting a genetic test without first obtaining written informed consent from the person or an authorized representative, apart from the situations in 12-2802(A)(4), (7) and (9). Subsection A of that section adds parental or guardian consent for testing an unemancipated minor, outside the newborn screening program. Section 12-2804 closes the public records route, exempting genetic testing information held by a state agency or local health authority from inspection.

Three Definitions of a Genetic Test

Each title writes its own definition, and the differences decide which rule a given test falls under.

Research is the sharpest contrast. Section 12-2801(1)(b)(v) removes tests "given for use in biomedical research," while the insurance definition has no such exclusion on its face.

The Ten Permitted Recipients

• The person tested
• Anyone specifically authorized in writing by that person or the person's health care decision maker
• The health care decision maker, defined in 12-2801 to include a parent of a minor
• A researcher, for medical research or public health purposes, under applicable research rules or where the sample provider's identity is withheld from the person collecting and conducting the research
• A third person approved by a human subjects or ethics committee, for people subject to an Arizona cancer registry
• A provider caring for the person tested, and that provider's agents and employees
• A provider that handles a deceased donor's body part or semen or ova for artificial insemination
• A provider conducting utilization review, peer review or quality assurance under the listed statutes
• An authorized federal, state or county health department agent for listed programs, among them newborn screening and the birth defects registry
• A provider's or laboratory's legal representative, to obtain legal advice

The list does not name employers or insurers. Paragraph 2, the written authorization route, depends on the person tested or that person's health care decision maker. A pathologist may order and perform testing for a patient and receive the results under subsection B.

Subpoenas, Deaths and Medical Records

Subsection D routes a subpoena for genetic testing information to § 12-2294.01(E), the medical records provision under which a provider may file an objection, after which the patient or the patient's attorney becomes responsible for asserting or waiving any privilege. If the court is asked to order production, it "shall take all steps necessary to prevent the disclosure or dissemination of that information."

After death, release follows § 12-2294(D), the rule for a deceased patient's records, with one change: the person "may deny, release or limit release of the genetic testing results by adopting a provision in a testamentary document." Subsection E otherwise takes genetic testing information in a medical record out of the general medical records article, except as 12-2802 provides.

Insurance Rules in Title 20

Subsection I preserves Title 20's own rules on genetic information. Section 20-448.02(A) prohibits ordering or requiring a genetic test without specific written informed consent of the subject, unless otherwise authorized or required by this state or federal law, and states that the written consent "shall be in a form prescribed by the director." The section's confidentiality clause makes results privileged and confidential and links back: except as authorized in 12-2802, they may not be released without express consent of the subject or a person authorized to consent for that person. A 2019 act, Laws 2019, chapter 250, amended both 12-2802 and 20-448.02. The current form itself was not located for this post.

Section 20-448 addresses underwriting outcomes. Subsection D bars an insurer from refusing to consider a life or disability application on the basis of a genetic condition, defined as "a specific chromosomal or single-gene genetic condition." Subsection E treats rejection or rate-setting on that basis as unfair discrimination unless the applicant's medical condition and history and either claims experience or actuarial projections establish likely substantial differences in claims. Subsection F goes further for disability insurance, treating such decisions as unfair discrimination in the absence of a diagnosis of the condition related to information from a genetic test.

A Good-Faith Shield and No Penalty Clause

Section 12-2802 contains no fine, no criminal offense and no express right to sue. Its single liability provision runs the other way. Subsection H states that a provider and its agents and employees that act in good faith and comply with the article "are not subject to civil liability," and that good faith is presumed, subject to rebuttal by a preponderance of the evidence. The article's text does not say what follows if a person breaches subsection C or G.

Title 20 does name a consequence. Section 20-442 prohibits trade practices the article defines as unfair, and § 20-456 directs the director, after a hearing finding such a practice, to order the person to cease and desist. Subsection B lists 20-448 and 20-448.02 among the sections carrying a civil penalty of not more than $1,000 per act or violation, capped at $10,000 in aggregate; for an intentional violation the ceiling rises to $5,000 per act, capped at $50,000 in any six-month period.

No Arizona appellate decision construing 12-2802 surfaced in the searches run for this post, and those searches do not cover every database. Nothing here should be read as a finding that none exists.

The Consumer Testing Chapter Borrows 12-2802

Arizona did enact a direct-to-consumer statute. Laws 2021, chapter 254, added a new chapter to Title 44. The act numbered it chapter 38, starting at § 44-7921; the Legislature's Title 44 index lists it as chapter 39, "Genetic Testing Companies," at §§ 44-8001 to 44-8004. Its consent, deletion and security duties are charted in our direct-to-consumer genetic testing explainer and are not repeated here.

What matters for 12-2802 is the join between the two. Section 44-8002(A)(6) requires a company to "Disclose genetic data only in accordance with section 12-2802," and subsection B separately bars disclosure to health, life or long-term care insurers or to the consumer's employer. Section 44-8003(3) carves out data from the analyses listed in 12-2801(1)(b). The older recipient list is thereby part of the newer chapter's disclosure standard, alongside its separate consent rules.

On enforcement, § 44-8004 lets the attorney general seek up to $2,500 per violation, actual damages and the office's costs and fees. An attorney general release dated July 14, 2026 announced a multistate settlement with the 23andMe bankruptcy trustee over a 2023 breach, with Arizona to receive $612,269 in civil penalties. The release describes the state's genetic data law, citing it as "A.R.S. §§ 44-7921 et seq.," but does not say under which statute those penalties were assessed, and it attributes the claims to the breach investigation. No action under 12-2802 itself was located.

Frequently Asked Questions