Illinois GIPA: How the Genetic Information Privacy Act Reaches Employers, Insurers and Family Medical History

What GIPA Protects

The Genetic Information Privacy Act sits at 410 ILCS 513. Its short-title section carries the source note "P.A. 90-25, eff. 1-1-98," so the statute predates the federal Genetic Information Nondiscrimination Act by a decade. The legislative findings in Section 5 record the General Assembly's view that "many members of the public are deterred from seeking genetic testing because of fear that test results will be disclosed without consent" or "used in a discriminatory manner."

Section 15(a) makes "genetic testing and information derived from genetic testing" confidential and privileged, releasable only to the person tested and to persons that individual authorizes in writing under Section 30. Section 30(a) then forbids any person to disclose, or be compelled to disclose, the identity of a tested person or test results in a way that identifies the subject, subject to a short list of recipients such as the subject, a person named in a written authorization, and treating staff with a need to know. Section 35 carries the restriction forward: a person who receives results may not pass them on except as the Act authorizes.

Two carve-outs shape the scope. Section 15(d) states that results showing the person "is at the time of the test afflicted with a disease, whether or not currently symptomatic," fall outside the confidentiality requirements. Sections 31 through 31.10 let HIPAA covered entities use and disclose genetic information for treatment, payment, health care operations, public health and research on terms that track the federal rules, including HIPAA's minimum necessary standard.

Family Medical History Counts as Genetic Information

GIPA does not write its own definition. Section 10 says "genetic information" has "the meaning ascribed to it under HIPAA, as specified in 45 CFR 160.103," and gives "genetic testing" the HIPAA meaning of "genetic test," adding that it "includes direct-to-consumer commercial genetic testing." The federal definition, quoted by the Illinois Appellate Court in Reynolds v. State Farm Life Insurance Co., covers information about an individual's genetic tests, the genetic tests of family members, "the manifestation of a disease or disorder in family members," and requests for or receipt of genetic services.

The third limb is what brings routine health questionnaires within the Act. In Reynolds, the plaintiff said an insurer's paramedical exam asked about relatives' illnesses. The court agreed that this information qualified as "information about the manifestation of a disease or disorder in" his family members, and so was genetic information. GIPA's own "family member" definition in Section 10 is broad: a spouse, dependent children, covered dependents under a managed care plan, and "all other individuals related by blood or law" to any of them.

The Employer Provisions in Section 25

Section 10 defines "employer" to include the State, local governments, school districts, parties to public contracts, apprenticeship committees "and every other person employing employees within the State." The definition sets no minimum number of employees. Section 25(a) directs employers, employment agencies, labor organizations and licensing agencies to treat genetic information consistently with federal law, naming GINA, the ADA, Title VII, the FMLA, OSHA, the Federal Mine Safety and Health Act and the Atomic Energy Act.

Section 25(c) then lists four things none of those entities may do "directly or indirectly":

1. Solicit, request, require or purchase genetic testing or genetic information of a person or a family member, or administer a genetic test, as a condition of employment, a preemployment application, labor organization membership or licensure
2. Change the terms, conditions or privileges of employment, or terminate employment, membership or licensure, because of genetic testing or genetic information about the employee or a family member
3. Limit, segregate or classify employees in ways that deprive them of opportunities because of that information
4. Retaliate against anyone who alleges a violation or takes part in a proceeding under the Act

The remaining subsections are the exceptions and their limits. Section 25(d) voids any agreement offering employment, pay or a benefit in return for taking a genetic test. Section 25(e) allows genetic information in a workplace wellness program only where the employer offers health or genetic services, the employee authorizes it in writing, identifiable results go only to the employee and the treating professional, and the employer sees only aggregate data. Section 25(g) states that "inadvertently requesting family medical history" does not violate the Act, and Section 25(i) permits genetic monitoring for toxic workplace exposures under five stated conditions. Section 25(k) separately prohibits anyone from knowingly selling to or interpreting for an employer a genetic test of an employee or applicant, outside the listed exceptions.

Insurers and Section 20

Section 20 treats insurers differently from employers. Subsection (a) bars an insurer from seeking genetic testing information "for use in connection with a policy of accident and health insurance" and from using such information for a "nontherapeutic purpose" in that context. Subsection (c) lets an insurer consider results the individual volunteers if they are favorable. Subsection (e) reaches a different business altogether: a company providing direct-to-consumer commercial genetic testing may not share test information or other personally identifiable information with "any health or life insurance company" without the consumer's written consent.

Subsection (b), which both parties in Reynolds traced to a 2014 amendment, prohibits an insurer from using or disclosing "protected health information that is genetic information for underwriting purposes," and defines underwriting with four clauses taken from HIPAA. Long-term care insurers are excluded, except for nursing home fixed indemnity plans. In Reynolds, filed December 10, 2025, the Second District read subsection (b) as limited to health insurance underwriting and affirmed dismissal of a putative class action against a life insurer. The court also held that the information was not protected health information at all, because the complaint did not allege that the insurer or its examination vendor was a health care provider, health plan, employer or clearinghouse.

The Private Right of Action and Liquidated Damages

Section 40(a) gives "any person aggrieved by a violation of this Act" a right of action in state circuit court or as a supplemental claim in federal court. A prevailing party may recover, for each violation, liquidated damages of $2,500 or actual damages, whichever is greater, against a party that acts negligently, and $15,000 or actual damages against a party that acts intentionally or recklessly, together with attorney's fees, expert fees, costs and injunctive relief. Section 40(b) makes Article XL of the Illinois Insurance Code the exclusive remedy for Section 30 violations by insurers. Section 40(c) authorizes a preliminary injunction against a pending release of genetic information.

Not every claim has succeeded. In Bridges v. Blackstone, Inc., decided May 1, 2023, the Seventh Circuit affirmed dismissal of a Section 30 suit by customers of Ancestry.com against the private equity firm that bought the company. The court said it could not "plausibly infer that a run-of-the-mill corporate acquisition, without more alleged about that transaction, results in a compulsory disclosure within the meaning of Section 30." It expressly left open whether a party that receives, rather than discloses, genetic information can be liable under Section 30.

Biomarkers From January 1, 2027

Public Act 104-642, enacted from Senate Bill 2886 and approved by the Governor on July 24, 2026 according to the bill status page, amends Sections 5, 10, 15, 20, 25, 30, 31 through 31.10 and 50, with an effective date of January 1, 2027. It adds definitions of "biomarker" and "biomarker testing" by cross-reference to Section 356z.46 of the Illinois Insurance Code, and inserts those terms throughout: biomarker test results become confidential under Section 15, insurers may not seek them under Section 20, and employers may not solicit them or condition employment on them under Section 25. Section 40 is not among the amended sections; its remedy attaches to "a violation of this Act," which from that date includes the biomarker provisions.

How GIPA Differs From BIPA

The Seventh Circuit in Bridges noted that the parties borrowed the acronym GIPA from the far more litigated Biometric Information Privacy Act. The two remedies sections are built the same way, but the figures differ. Section 20 of BIPA, 740 ILCS 14, sets liquidated damages of $1,000 for negligent and $5,000 for intentional or reckless violations. GIPA's are $2,500 and $15,000. BIPA's Section 20 also now provides, after Public Act 103-769 (effective August 2, 2024), that repeated collection or disclosure of the same biometric data from the same person by the same method is a single violation. GIPA's Section 40 contains no equivalent provision; its source note still reads P.A. 98-1046, effective January 1, 2015.

The scope differs as well. BIPA regulates private entities that collect biometric identifiers. GIPA's employment provisions apply to public and private employers alike, and its definition of genetic information reaches what an applicant says about a parent's illness, not only laboratory results. How the federal employment rule handles the same questions is covered in GINA Title II and employer genetic information.

Frequently Asked Questions