§ 24-4-24-10 — Obligations of consumer genetic testing provider; prohibition on certain disclosures by genetic testing provider; limitation on assessment of certain costs by consumer genetic testing provider

(a) A consumer genetic testing provider that
performs, or causes to be performed, genetic testing on an individual's
biological material shall do the following:
(1) Implement commercially reasonable security measures to
protect:
(A) the individual's biological material; and
(B) data resulting from genetic testing performed on the
individual's biological material;
from unauthorized access, destruction, use, modification, or
disclosure.
(2) Allow the individual access to any data resulting from genetic
testing performed on the individual's biological material.
(3) Provide the following:
(A) A procedure by which the individual can revoke any
consent provided by the individual under section 9 of this
chapter. The procedure must enable the individual to
communicate the revocation:
(i) directly to the provider; and
(ii) through one (1) or more means, at least one (1) of which
must be the primary means by which the provider
communicates with the individual.
(B) Both:
(i) notice of the existence of; and
(ii) instructions regarding the use of;
the procedure under clause (A) that are sufficiently clear and
concise as to be reasonably understandable by a person of
ordinary intelligence.
(4) Comply with a revocation of consent by the individual not
later than thirty (30) days after the individual communicates the
revocation to the provider, including by:
(A) destroying the individual's biological material not later than
thirty (30) days after the individual revokes the individual's
consent to the provider's retention of the biological material
under section 9(a)(4) of this chapter; and
(B) destroying any data resulting from genetic testing
performed on the individual's biological material not later than
thirty (30) days after the individual revokes the individual's
consent to the provider's retention of the data under section
9(a)(5) of this chapter.
(5) Provide a third party with access to the individual's biological
material, or to data resulting from genetic testing performed on
the individual's biological material, only under contractual terms
that prohibit the third party from:
(A) using the biological material or data for any use to which
the individual has not consented under section 9 of this chapter;
(B) providing another party with access to the biological
material or data; or
(C) retaining the biological material or data longer than the
provider is authorized to retain the biological material or data
under this chapter.
(6) Ensure that:
(A) any advertising or marketing communications sent to the
individual as a result of the individual's:
(i) solicitation and use of the provider's services; or
(ii) use of the provider's website or other remote or virtual
services;
are clearly and prominently denoted as advertising or marketing
materials; and
(B) advertising or marketing communications described in
clause (A) that are sent by a third party clearly and prominently:
(i) identify the third party; and
(ii) notify the individual that any claims made in the
advertising or marketing communications have not been
evaluated by the provider.
(b) A consumer genetic testing provider may not provide data, other
than deidentified data, resulting from genetic testing performed on an
individual's biological material to:
(1) an insurer;
(2) a person that, in the ordinary course of the person's business,
provides information or data to insurers for the purposes of
underwriting or rating of risks; or
(3) a person that employs the individual;
regardless of whether the individual has consented to the provider
providing third parties with access to the data under section 9(a)(3) of
this chapter.
(c) A consumer genetic testing provider may not charge a fee for the
provision of biological material or for the provision of data resulting
from genetic testing performed on biological material:
(1) to a law enforcement agency on the basis of a search warrant;
or
(2) as required by a court order;
that is more than the actual cost, not including labor costs or overhead
costs, to the consumer genetic testing provider of providing the
material or data.

Legislative History

As added by P.L.233-2025, SEC.2.