§ 24-4-24-8 — Consumer genetic testing provider privacy policy; required disclosure

(a) A consumer genetic testing provider may
not perform, or cause to be performed, genetic testing on an
individual's biological material unless the provider has provided the
individual with a written disclosure of the provider's privacy policy,
including the provider's policies and procedures regarding the
provider's collection, maintenance, security, retention, and use of both
biological material sent to the provider and data resulting from genetic
testing performed on the biological material.
(b) The disclosure under subsection (a) must include complete
information regarding the following:
(1) The identity of any third party that may perform genetic
testing on biological material sent to the third party by the
provider.
(2) The manner in which:
(A) biological material sent to the provider; and
(B) data resulting from genetic testing performed on biological
material sent to the provider;
is stored, transferred, and secured.
(3) Any:
(A) testing or analysis that the provider performs or causes to
be performed on; or
(B) other purpose for which the provider uses;
biological material sent by an individual to the provider that is in
addition to the genetic testing requested by the individual.
(4) The:
(A) identity of any third party to which the provider provides
access to:
(i) biological material sent to the provider; or
(ii) data resulting from genetic testing performed on
biological material sent to the provider; and
(B) purpose for which the third party uses the biological
material or data.
(c) A consumer genetic testing provider shall:
(1) publish the disclosure described in subsection (a) on the
provider's website; and
(2) include on the provider's website prominent directions and
hyperlinks to the location of the disclosure on the provider's
website.

Legislative History

As added by P.L.233-2025, SEC.2.