Genetic privacy developments: state DNA privacy acts, consumer genetic testing consent, GINA, and law enforcement access to genealogy databases.
Consumer genetic testing created a category of data that is permanent, shared involuntarily with relatives, and only partly covered by HIPAA. This hub follows the state genetic privacy acts filling that gap and the disputes over law enforcement access.
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →Iowa Code 729.6, enacted in 1992 and rewritten in 2010, bars every Iowa employer regardless of size from soliciting, requiring or administering a genetic test as a condition of employment, requires written informed consent before anyone obtains genetic information, and lets an aggrieved worker, county attorney or the attorney general sue for equitable relief.
Read more →Title II of the Genetic Information Nondiscrimination Act took effect November 21, 2009. The EEOC's rule at 29 CFR Part 1635 forbids covered employers, unions and employment agencies to request, require or purchase genetic information, carves out six narrow routes by which it may lawfully arrive, and treats whatever is held as a confidential medical record.
Read more →Section 105 of GINA told HHS to treat genetic information as health information and to stop group health plans, health insurers and Medigap issuers from using it for underwriting. HHS's 2013 Omnibus Rule went further, applying the ban to every HIPAA health plan except long-term care insurers, and required plans that underwrite to say so in their privacy notices.
Read more →The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →Five state statutes read for this explainer regulate companies that sell DNA tests directly to consumers or analyze the resulting data: California, Arizona, Utah, Virginia and Montana. Each requires layered consent, a way to delete data and destroy samples, and limits on sharing with insurers or employers. They differ on who is covered, who enforces, and how much a violation costs.
Read more →