[ { "id": "al-hb-21-2024", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Alabama Genetic Data Privacy Act", "subtitle": "Privacy requirements for direct-to-consumer genetic testing companies", "identifier": "HB 21 (2024)", "bill_number": "HB 21", "session": "2024 Regular Session", "statute_citation": "Ala. Code §§ 8-43-1 to 8-43-6", "status": "enacted", "introduced_date": "2024-02-06", "signed_date": "2024-05-16", "effective_date": "2024-10-01", "last_action_date": "2024-05-16", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "genetic-data-storage-privacy-sharing-industry" ], "summary": "Alabama's Genetic Data Privacy Act took effect on October 1, 2024. It regulates businesses that directly solicit biological samples from consumers for genetic-testing products or services, as well as contractors handling data for those businesses.", "legal_effects": "Genetic testing companies must publish privacy notices and obtain initial express consent. Separate consent is required for each transfer or disclosure, uses beyond the requested service, and marketing. The act also provides access, deletion, and sample-destruction procedures, requires security and contractor confidentiality, and authorizes Attorney General enforcement.", "plain_language": "If you use a consumer genetic testing service covered by the act, the company must explain its data practices and ask before several uses or disclosures. You may access your genetic data, withdraw consent, and request data deletion or sample destruction through the act's procedures.", "limitations": "The act does not cover every holder of genetic information. Its exclusions include HIPAA-covered entities and business associates, health care providers, and certain noncommercial research conducted by higher education institutions.", "primary_sources": [ { "title": "HB 21 enrolled act", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2024RS/HB21-enr.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" }, { "title": "Alabama Code § 8-43-2", "url": "https://alison.legislature.state.al.us/code-of-alabama?section=8-43-2", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 21 legislative history", "url": "https://legiscan.com/AL/bill/HB21/2024", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "history": [ { "date": "2024-02-06", "event": "Bill introduced and referred to the House Judiciary Committee.", "source": "Alabama Legislature" }, { "date": "2024-02-20", "event": "House passed the bill.", "source": "Alabama Legislature" }, { "date": "2024-05-08", "event": "Senate passed the bill as amended.", "source": "Alabama Legislature" }, { "date": "2024-05-16", "event": "Enacted as Act 2024-384.", "source": "Alabama Legislature" }, { "date": "2024-10-01", "event": "Act became effective.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the enrolled act, current code, and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "al-hb-263-2026", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Biological and neural data in health and fitness apps", "subtitle": "Proposed consent requirements for app-based data practices", "identifier": "HB 263 (2026)", "bill_number": "HB 263", "session": "2026 Regular Session", "status": "died", "introduced_date": "2026-01-15", "last_action_date": "2026-03-11", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "genetic-data-storage-privacy-sharing-industry" ], "summary": "Alabama HB 263 did not become law. It would have regulated health and fitness applications that collect biological or neural data, including information generated by analyzing genetic or other biological properties to identify a person.", "legal_effects": "Covered app providers would have needed express consent before transferring or disclosing covered data, using it beyond a requested service, or using it for marketing. The Attorney General would have had exclusive enforcement authority, with a 45-day opportunity to cure and civil penalties of up to $3,000 per violation.", "plain_language": "The proposal would have let consumers limit how a covered health or fitness app reused or shared biological and neural data. Because the bill died, it created no new consent rights or penalties.", "limitations": "The proposal applied only to apps and data practices meeting its definitions. It excluded several categories, including certain regulated health information, research, insurance activities, deidentified data, security practices, and processing needed to provide a consumer-requested product or service.", "primary_sources": [ { "title": "HB 263 engrossed bill", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB263-eng.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 263 legislative history", "url": "https://legiscan.com/AL/bill/HB263/2026", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "related_records": [ { "record_id": "al-hb-436-2025", "relationship": "Successor to the broader 2025 proposal" } ], "history": [ { "date": "2026-01-15", "event": "Bill introduced and referred to the House Judiciary Committee.", "source": "Alabama Legislature" }, { "date": "2026-02-26", "event": "House passed the bill as amended.", "source": "Alabama Legislature" }, { "date": "2026-03-11", "event": "Senate committee reported the bill and placed it on the calendar.", "source": "Alabama Legislature" }, { "date": "2026-04-09", "event": "Bill died when the 2026 regular session adjourned without final passage.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the engrossed bill and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "al-hb-265-2026", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Unlawful use of DNA", "subtitle": "Renewed proposal for criminal offenses involving nonconsensual DNA use", "identifier": "HB 265 (2026)", "bill_number": "HB 265", "session": "2026 Regular Session", "status": "died", "introduced_date": "2026-01-15", "last_action_date": "2026-02-05", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "privacy" ], "summary": "Alabama HB 265 did not become law. It would have created first-, second-, and third-degree offenses for intentionally collecting, retaining, testing, disclosing, selling, or transferring another person's DNA sample or genetic data without express consent in specified circumstances.", "legal_effects": "The bill would have assigned different criminal penalties to unauthorized DNA sale or transfer, genetic testing or disclosure, and collection or retention. It would have used definitions from Alabama's Genetic Data Privacy Act.", "plain_language": "The proposal would have criminalized several intentional uses of another person's DNA without permission. Because it died, the proposed offenses and penalties never took effect.", "limitations": "Exceptions would have applied to specified legal process, law enforcement and forensic databases, and genetic testing companies complying with state law. The bill reached the House calendar but did not receive a House floor vote.", "primary_sources": [ { "title": "HB 265 introduced bill", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB265-int.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 265 legislative history", "url": "https://legiscan.com/AL/bill/HB265/2026", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "related_records": [ { "record_id": "al-hb-449-2025", "relationship": "Reintroduction of the 2025 proposal" } ], "history": [ { "date": "2026-01-15", "event": "Bill introduced and referred to the House Judiciary Committee.", "source": "Alabama Legislature" }, { "date": "2026-02-05", "event": "Bill read a second time and placed on the House calendar.", "source": "Alabama Legislature" }, { "date": "2026-04-09", "event": "Bill died when the 2026 regular session adjourned without final passage.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the introduced bill and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "al-hb-351-2026", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Alabama Personal Data Protection Act", "subtitle": "Comprehensive consumer-data protections that include genetic data", "identifier": "HB 351 (2026)", "bill_number": "HB 351", "session": "2026 Regular Session", "statute_citation": "Ala. Code Title 8, Chapter 44", "status": "enacted", "introduced_date": "2026-01-29", "signed_date": "2026-04-17", "effective_date": "2027-05-01", "last_action_date": "2026-04-17", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "consumer-personal-data-privacy" ], "summary": "Alabama enacted the Personal Data Protection Act in 2026, but its requirements do not take effect until May 1, 2027. The act treats genetic or biometric data processed to uniquely identify a person as sensitive data within a broader consumer privacy framework.", "legal_effects": "Businesses meeting the act's coverage thresholds must obtain consent before processing sensitive data. Covered controllers also have duties involving transparency, data minimization, security, consumer requests, targeted advertising, data sales, and certain profiling. The Attorney General has exclusive enforcement authority.", "plain_language": "Beginning May 1, 2027, qualifying businesses must get consent before processing genetic data to uniquely identify a person. The act will also provide consumers with broader rights concerning personal data held by those businesses.", "limitations": "Coverage depends on business and data-processing thresholds. The act also has entity-level and data-level exemptions, including several for health care and federally regulated information, and generally excludes employment-context data from its definition of consumer.", "primary_sources": [ { "title": "HB 351 enrolled act", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" }, { "title": "Alabama Code § 8-44-1", "url": "https://alison.legislature.state.al.us/code-of-alabama?section=8-44-1", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 351 legislative history", "url": "https://legiscan.com/AL/bill/HB351/2026", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "history": [ { "date": "2026-01-29", "event": "Bill introduced and referred to the House Commerce and Small Business Committee.", "source": "Alabama Legislature" }, { "date": "2026-02-24", "event": "House passed the bill as amended.", "source": "Alabama Legislature" }, { "date": "2026-04-07", "event": "Senate passed the bill as amended and the House concurred.", "source": "Alabama Legislature" }, { "date": "2026-04-17", "event": "Enacted as Act 2026-552.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the enrolled act, current code, and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "al-hb-436-2025", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Biological and neural data protections", "subtitle": "Proposed consent requirements for covered entities", "identifier": "HB 436 (2025)", "bill_number": "HB 436", "session": "2025 Regular Session", "status": "died", "introduced_date": "2025-03-18", "last_action_date": "2025-03-18", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "genetic-data-storage-privacy-sharing-industry" ], "summary": "Alabama HB 436 did not become law. It would have regulated businesses that maintained, owned, or licensed biological or neural data, including data generated by analyzing genetic or other biological properties for identifying a person.", "legal_effects": "Covered businesses would have needed express consent before transferring or disclosing covered data, using it beyond a requested service, or using it for marketing. The Attorney General would have had exclusive enforcement authority, with an opportunity to cure and civil penalties of up to $3,000 per violation.", "plain_language": "The proposal would have let consumers limit how covered businesses reused or shared biological and neural data. Because the bill died in committee, it created no new consent rights or penalties.", "limitations": "Coverage would have depended on the bill's definitions. In particular, biological data had to be generated for identifying a person, and a covered entity had to maintain, own, or license biological or neural data. The introduced text did not contain the broad exclusions described in HB 263.", "primary_sources": [ { "title": "HB 436 introduced bill", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2025RS/HB436-int.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 436 legislative history", "url": "https://legiscan.com/AL/bill/HB436/2025", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "related_records": [ { "record_id": "al-hb-263-2026", "relationship": "Succeeded by a narrower 2026 proposal" } ], "history": [ { "date": "2025-03-18", "event": "Bill introduced and referred to the House Insurance Committee.", "source": "Alabama Legislature" }, { "date": "2025-05-14", "event": "Bill died when the 2025 regular session adjourned without further action.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the introduced bill and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised and an unsupported limitations statement corrected after primary-source review." } ] }, { "id": "al-hb-449-2025", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Unlawful use of DNA", "subtitle": "Proposed criminal offenses for nonconsensual DNA collection and use", "identifier": "HB 449 (2025)", "bill_number": "HB 449", "session": "2025 Regular Session", "status": "died", "introduced_date": "2025-03-18", "last_action_date": "2025-05-06", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "privacy" ], "summary": "Alabama HB 449 did not become law. It would have created first-, second-, and third-degree offenses for intentionally collecting, retaining, testing, disclosing, selling, or transferring another person's DNA sample or genetic data without express consent in specified circumstances.", "legal_effects": "The engrossed bill would have assigned different criminal penalties to DNA sale or transfer, unauthorized genetic testing or disclosure, and collection or retention of DNA samples. It used definitions from Alabama's Genetic Data Privacy Act.", "plain_language": "The proposal would have criminalized several intentional uses of another person's DNA without permission. Because it died after passing the House, the proposed offenses and penalties never took effect.", "limitations": "Exceptions would have applied to specified legal process, law enforcement and forensic databases, health care activities, and genetic testing companies complying with state law. The Senate did not take a final vote before the session ended.", "primary_sources": [ { "title": "HB 449 engrossed bill", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2025RS/HB449-eng.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama HB 449 legislative history", "url": "https://legiscan.com/AL/bill/HB449/2025", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "related_records": [ { "record_id": "al-hb-265-2026", "relationship": "Reintroduced as a 2026 proposal" } ], "history": [ { "date": "2025-03-18", "event": "Bill introduced and referred to the House Judiciary Committee.", "source": "Alabama Legislature" }, { "date": "2025-04-29", "event": "House passed the bill as amended.", "source": "Alabama Legislature" }, { "date": "2025-05-06", "event": "Senate committee reported the bill and placed it on the calendar.", "source": "Alabama Legislature" }, { "date": "2025-05-14", "event": "Bill died when the 2025 regular session adjourned without final passage.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the engrossed bill and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "al-sb-58-2024", "jurisdiction": "Alabama", "jurisdiction_code": "AL", "jurisdiction_type": "state", "record_type": "legislation", "title": "Genetic privacy and insurance protections", "subtitle": "Proposed consent, confidentiality, ownership, and insurance restrictions", "identifier": "SB 58 (2024)", "bill_number": "SB 58", "session": "2024 Regular Session", "status": "died", "introduced_date": "2024-02-06", "last_action_date": "2024-02-06", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "privacy", "health-insurance-nondiscrimination", "other-lines-of-insurance-nondiscrimination" ], "summary": "Alabama SB 58 did not become law. It would have required express consent for collecting, analyzing, using, retaining, or transferring DNA, declared DNA analysis results to be the individual's exclusive property and confidential, and restricted some insurer uses of genetic information.", "legal_effects": "The bill would have established criminal penalties for specified DNA collection, analysis, disclosure, and transfer without express consent. It also would have limited health, life, and long-term care insurers from requiring or using genetic information for specified eligibility, coverage, and premium decisions.", "plain_language": "The proposal would have given individuals more control over DNA samples and test results and limited some insurance uses. Because it died in committee, it created no new rights, restrictions, or penalties.", "limitations": "Exceptions would have applied to criminal investigations, court orders, medical care, regulated research, paternity matters, and other specified uses. Some insurance products were excluded, and insurers could still consider a medical diagnosis even when genetic information contributed to it.", "primary_sources": [ { "title": "SB 58 introduced bill", "url": "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2024RS/SB58-int.pdf", "publisher": "Alabama Legislature", "accessed_date": "2026-09-02" } ], "secondary_sources": [ { "title": "Alabama SB 58 legislative history", "url": "https://legiscan.com/AL/bill/SB58/2024", "publisher": "LegiScan", "accessed_date": "2026-08-31" } ], "history": [ { "date": "2024-02-06", "event": "Bill introduced and referred to the Senate Banking and Insurance Committee.", "source": "Alabama Legislature" }, { "date": "2024-05-09", "event": "Bill died when the 2024 regular session adjourned without further action.", "source": "Alabama Legislature" }, { "date": "2026-08-31", "event": "Record created from the introduced bill and legislative history." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "ca-sb-41-2021", "jurisdiction": "California", "jurisdiction_code": "CA", "jurisdiction_type": "state", "record_type": "legislation", "title": "Genetic Information Privacy Act", "subtitle": "Privacy requirements for direct-to-consumer genetic testing companies", "identifier": "SB 41 (2021)", "bill_number": "SB 41", "session": "2021-2022", "statute_citation": "California Civil Code §§ 56.18-56.186", "status": "enacted", "introduced_date": "2020-12-07", "signed_date": "2021-10-06", "effective_date": "2022-01-01", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "genetic-data-storage-privacy-sharing-industry" ], "summary": "California's Genetic Information Privacy Act took effect on January 1, 2022. It regulates direct-to-consumer genetic testing companies that collect, use, maintain, or disclose genetic data collected or derived from a consumer or from the consumer's biological sample.", "legal_effects": "Covered companies must publish privacy notices, obtain separate express consent for listed uses and disclosures, provide access and deletion methods, and maintain reasonable security practices. After a qualifying consent revocation, a company must destroy the consumer's biological sample within 30 days.", "plain_language": "If you use a genetic testing company covered by the act, it must explain its data practices and ask separately before several uses or disclosures. You may access or delete your data and request sample destruction through the act's procedures.", "limitations": "The act excludes protected health information governed by HIPAA and medical information governed by California's Confidentiality of Medical Information Act. It also contains exceptions for specified research and other activities.", "primary_sources": [ { "title": "SB 41 bill text, chaptered version", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220SB41", "publisher": "California Legislative Information", "accessed_date": "2026-09-02" } ], "secondary_sources": [], "history": [ { "date": "2020-12-07", "event": "Bill introduced.", "source": "California Legislative Information" }, { "date": "2021-10-06", "event": "Approved by the Governor and chaptered.", "source": "California Legislative Information" }, { "date": "2026-08-31", "event": "Record created from the chaptered bill text." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "federal-gina-2008", "jurisdiction": "United States", "jurisdiction_code": "US", "jurisdiction_type": "federal", "record_type": "statute", "title": "Genetic Information Nondiscrimination Act of 2008", "subtitle": "Federal protections in health coverage and employment", "identifier": "Public Law 110-233", "statute_citation": "122 Stat. 881", "status": "statute", "signed_date": "2008-05-21", "effective_date": null, "last_reviewed": "2026-08-31", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "employment-nondiscrimination", "health-insurance-nondiscrimination" ], "summary": "The Genetic Information Nondiscrimination Act of 2008, or GINA, is a federal law that restricts how covered health insurers and employers may use genetic information when making health-coverage or employment decisions. Separate parts of the law govern health coverage and employment. Each part contains its own definitions, exceptions, effective dates, and enforcement rules.", "legal_effects": "Title I limits how covered health plans and insurers may request or use genetic information. Title II limits how covered employers and other employment entities may acquire, use, or disclose genetic information. Both titles contain exceptions and enforcement provisions.", "plain_language": "GINA protects genetic information in two main settings: health coverage and employment. It generally prevents covered health insurers and employers from using that information in certain decisions. It does not provide the same protections for life, disability, or long-term care insurance.", "limitations": "GINA does not apply to every organization, insurance product, or use of genetic information. Whether it applies depends on the organization, the decision being made, and any statutory exception. Review the current law or seek legal advice for a specific situation.", "primary_sources": [ { "title": "Genetic Information Nondiscrimination Act of 2008, Public Law 110-233", "url": "https://www.govinfo.gov/content/pkg/PLAW-110publ233/pdf/PLAW-110publ233.pdf", "publisher": "U.S. Government Publishing Office", "accessed_date": "2026-08-31" } ], "secondary_sources": [], "history": [ { "date": "2008-05-21", "event": "Signed into law.", "source": "Public Law 110-233" }, { "date": "2026-08-31", "event": "Record created from the enrolled public law." }, { "date": "2026-09-02", "event": "Project-authored language and scope note revised for clarity." } ] }, { "id": "federal-hipaa-genetic-information-2013", "jurisdiction": "United States", "jurisdiction_code": "US", "jurisdiction_type": "federal", "record_type": "regulation", "title": "HIPAA Privacy Rule treatment of genetic information", "subtitle": "Genetic information as protected health information", "identifier": "78 FR 5566", "regulatory_citation": "45 C.F.R. Parts 160 and 164", "status": "approved", "effective_date": "2013-03-26", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "genetic-data-storage-privacy-sharing-medicine", "health-insurance-nondiscrimination" ], "summary": "The 2013 HIPAA final rule made clear that genetic information is health information under the HIPAA Privacy Rule. It also prohibited most health plans covered by HIPAA from using or disclosing protected health information that is genetic information for underwriting.", "legal_effects": "The rule revised HIPAA definitions and barred most HIPAA-covered health plans from using or disclosing genetic information for underwriting. It took effect on March 26, 2013, with a September 23, 2013 compliance date.", "plain_language": "Identifiable genetic information held by a health plan, health care provider, or clearinghouse covered by HIPAA can be protected health information. The rule also limits how most covered health plans may use it for underwriting.", "limitations": "HIPAA does not apply to every organization that collects genetic information. Coverage depends on the organization, the information, and the activity. The underwriting prohibition does not apply to issuers of long-term care policies.", "primary_sources": [ { "title": "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules", "url": "https://www.federalregister.gov/documents/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules-under-the", "publisher": "Office of the Federal Register", "accessed_date": "2026-09-02" } ], "secondary_sources": [], "history": [ { "date": "2013-01-25", "event": "Final rule published in the Federal Register.", "source": "78 FR 5566" }, { "date": "2026-08-31", "event": "Record created from the final rule." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "federal-nih-gds-policy-2014", "jurisdiction": "United States", "jurisdiction_code": "US", "jurisdiction_type": "federal", "record_type": "policy", "title": "NIH Genomic Data Sharing Policy", "subtitle": "Expectations for sharing large-scale human and non-human genomic data", "identifier": "NOT-OD-14-124", "status": "approved", "effective_date": "2015-01-25", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "research" ], "summary": "The NIH Genomic Data Sharing Policy applies to NIH-funded research that generates large-scale human or non-human genomic data and to later research using those data. For covered awards and contracts, compliance with the approved data-sharing plan becomes a term and condition of funding.", "legal_effects": "Applicants must provide a basic genomic data-sharing plan. Before an award, institutions must provide a more detailed plan and certification that identifies consent-based data-use limits and whether human data should use unrestricted or controlled access.", "plain_language": "If an NIH-funded project falls within the policy, the investigators and their institution must plan how and when genomic data will be submitted and shared. Human data may use unrestricted or controlled access based on consent and institutional review.", "limitations": "This is a funding policy, not a statute that applies to every genomic research project. Requirements depend on the award, the data generated, participant consent, NIH institute or center guidance, and any approved exception.", "primary_sources": [ { "title": "NIH Genomic Data Sharing Policy", "url": "https://grants.nih.gov/grants/guide/notice-files/not-od-14-124.html", "publisher": "National Institutes of Health", "accessed_date": "2026-09-02" } ], "secondary_sources": [], "history": [ { "date": "2014-08-27", "event": "Final policy announced.", "source": "NOT-OD-14-124" }, { "date": "2015-01-25", "event": "Policy became effective for covered applications and proposals.", "source": "NOT-OD-14-124" }, { "date": "2026-08-31", "event": "Record created from the official policy notice." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] }, { "id": "ms-hb-1051-2026", "jurisdiction": "Mississippi", "jurisdiction_code": "MS", "jurisdiction_type": "state", "record_type": "legislation", "title": "Mississippi Consumer Privacy Protection Act", "subtitle": "Proposed consumer protections covering identifying genetic data", "identifier": "HB 1051 (2026)", "bill_number": "HB 1051", "session": "2026 Regular Session", "status": "died", "introduced_date": "2026-01-16", "last_action_date": "2026-02-03", "last_reviewed": "2026-09-24", "record_version": "1.0", "verification_status": "verified-primary", "topics": [ "consumer-personal-data-privacy" ], "summary": "Mississippi HB 1051 did not become law. It would have established a comprehensive consumer-privacy framework that classified processing genetic data for the purpose of uniquely identifying an individual as sensitive-data processing.", "legal_effects": "Covered controllers would have needed consent before processing sensitive data for a nonexempt purpose. The bill also would have provided consumer rights involving access, correction, deletion, data portability, targeted advertising, data sales, and specified profiling. The Attorney General would have had exclusive enforcement authority after a 60-day opportunity to cure.", "plain_language": "The proposal would have required qualifying businesses to obtain consent before using genetic data to identify a consumer. Because the bill died in committee, it created no new consumer rights or business obligations.", "limitations": "The proposal would have applied only to businesses meeting its revenue and data-processing thresholds. It excluded individuals acting in employment or commercial contexts and contained exemptions for insurance entities, HIPAA-covered entities and business associates, nonprofit organizations, government agencies, regulated research, and several types of federally regulated information. Its sensitive-data definition covered genetic data when processed to uniquely identify an individual, not every use of genetic data.", "primary_sources": [ { "title": "HB 1051 introduced bill", "url": "https://billstatus.ls.state.ms.us/documents/2026/html/HB/1000-1099/HB1051IN.htm", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" }, { "title": "HB 1051 legislative history", "url": "https://billstatus.ls.state.ms.us/2026/pdf/history/HB/HB1051.xml", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" } ], "secondary_sources": [], "history": [ { "date": "2026-01-16", "event": "Bill introduced and referred to the House Judiciary A Committee.", "source": "Mississippi Legislature" }, { "date": "2026-02-03", "event": "Bill died in committee.", "source": "Mississippi Legislature" }, { "date": "2026-09-24", "event": "Record created from the introduced bill and legislative history." } ] }, { "id": "ms-hb-377-2026", "jurisdiction": "Mississippi", "jurisdiction_code": "MS", "jurisdiction_type": "state", "record_type": "legislation", "title": "Missing- and unidentified-person identification procedures", "subtitle": "DNA databases and forensic genetic genealogy requirements", "identifier": "HB 377 (2026)", "bill_number": "HB 377", "session": "2026 Regular Session", "statute_citation": "2026 Miss. Laws ch. 445", "status": "enacted", "introduced_date": "2026-01-09", "signed_date": "2026-04-08", "effective_date": "2026-07-01", "last_action_date": "2026-04-08", "last_reviewed": "2026-09-24", "record_version": "1.0", "verification_status": "verified-primary", "topics": [ "genetic-data-and-law-enforcement" ], "summary": "Mississippi enacted HB 377 in 2026 to establish procedures for missing- and unidentified-person investigations. The law governs the collection and submission of specified DNA information and requires forensic genetic genealogy testing of unidentified human remains in state custody after a specified period.", "legal_effects": "Law enforcement agencies must obtain voluntary DNA samples from appropriate family members when carrying out the law's missing-person procedures and submit resulting profiles through the specified state and federal systems. The State Medical Examiner must use forensic genetic genealogy testing after possessing unidentified human remains for 45 days. The act also requires specified missing- and unidentified-person information to be entered into the National Missing and Unidentified Persons System.", "plain_language": "The law directs Mississippi authorities to use family-reference DNA, forensic DNA databases, and genetic genealogy to help identify missing people and unidentified remains. It sets deadlines for entering information and for testing remains held by the State Medical Examiner.", "limitations": "The law concerns missing- and unidentified-person investigations rather than general law-enforcement access to genetic data. It describes family DNA samples as voluntary and refers to genealogy databases consented for law-enforcement use. The enacted text does not establish a general destruction or retention deadline for the family-reference samples collected under these procedures.", "primary_sources": [ { "title": "HB 377 final bill text", "url": "https://billstatus.ls.state.ms.us/documents/2026/html/HB/0300-0399/HB0377SG.htm", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" }, { "title": "HB 377 legislative history", "url": "https://billstatus.ls.state.ms.us/2026/pdf/history/HB/HB0377.xml", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" } ], "secondary_sources": [], "history": [ { "date": "2026-01-09", "event": "Bill introduced and referred to the House Judiciary B Committee.", "source": "Mississippi Legislature" }, { "date": "2026-02-12", "event": "House adopted a committee substitute and passed the bill.", "source": "Mississippi Legislature" }, { "date": "2026-03-11", "event": "Senate passed the bill as amended.", "source": "Mississippi Legislature" }, { "date": "2026-03-31", "event": "House and Senate adopted the conference report.", "source": "Mississippi Legislature" }, { "date": "2026-04-08", "event": "Governor approved the bill as Chapter 445.", "source": "Mississippi Legislature" }, { "date": "2026-07-01", "event": "Act became effective.", "source": "Mississippi Legislature" }, { "date": "2026-09-24", "event": "Record created from the final bill text and legislative history." } ] }, { "id": "ms-hb-565-2026", "jurisdiction": "Mississippi", "jurisdiction_code": "MS", "jurisdiction_type": "state", "record_type": "legislation", "title": "Jill Gary Eure Act", "subtitle": "Required health-plan and Medicaid coverage for biomarker testing", "identifier": "HB 565 (2026)", "bill_number": "HB 565", "session": "2026 Regular Session", "statute_citation": "2026 Miss. Laws ch. 360", "status": "enacted", "introduced_date": "2026-01-13", "signed_date": "2026-03-16", "effective_date": "2026-07-01", "last_action_date": "2026-03-16", "last_reviewed": "2026-09-24", "record_version": "1.0", "verification_status": "verified-primary", "topics": [ "biomarker-testing", "coverage-and-reimbursement", "health-insurance-coverage", "pharmacogenomics" ], "summary": "Mississippi enacted the Jill Gary Eure Act, also called Jill's Law, in 2026. The law requires covered health benefit plans, Medicaid, and the State and School Employees Health Insurance Plan to cover qualifying biomarker testing beginning with plans, contracts, or agreements entered into or renewed on or after July 1, 2026.", "legal_effects": "Covered plans must provide biomarker-testing coverage for diagnosis, treatment, disease management, or monitoring when the test is supported by specified medical and scientific evidence. The law requires written reasons for qualifying coverage denials, establishes procedures for prior authorization and coverage exceptions, and directs Medicaid to add applicable billing codes to its fee schedule.", "plain_language": "Health plans covered by the law must pay for medically supported biomarker tests, including certain genomic tests. The definition includes tests for gene mutations and gene-drug interactions, as well as whole-exome, whole-genome, and whole-transcriptome sequencing.", "limitations": "Coverage applies only to health benefit plans within the law's definitions and to tests supported by one of the listed evidence sources. Medicaid services remain subject to eligibility rules, state appropriations, federal matching funds, and applicable federal approval. The law does not require coverage by every type of insurance product.", "primary_sources": [ { "title": "HB 565 final bill text", "url": "https://billstatus.ls.state.ms.us/documents/2026/html/HB/0500-0599/HB0565SG.htm", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" }, { "title": "HB 565 legislative history", "url": "https://billstatus.ls.state.ms.us/2026/pdf/history/HB/HB0565.xml", "publisher": "Mississippi Legislature", "accessed_date": "2026-09-24" } ], "secondary_sources": [], "history": [ { "date": "2026-01-13", "event": "Bill introduced and referred to two House committees.", "source": "Mississippi Legislature" }, { "date": "2026-01-28", "event": "House passed the bill as amended.", "source": "Mississippi Legislature" }, { "date": "2026-03-04", "event": "Senate passed the bill.", "source": "Mississippi Legislature" }, { "date": "2026-03-16", "event": "Governor approved the bill as Chapter 360.", "source": "Mississippi Legislature" }, { "date": "2026-07-01", "event": "Act became effective.", "source": "Mississippi Legislature" }, { "date": "2026-09-24", "event": "Record created from the final bill text and legislative history." } ] }, { "id": "ny-cvr-79-l", "jurisdiction": "New York", "jurisdiction_code": "NY", "jurisdiction_type": "state", "record_type": "statute", "title": "Confidentiality of records of genetic tests", "subtitle": "Consent, confidentiality, and biological-sample requirements", "identifier": "New York Civil Rights Law § 79-l", "statute_citation": "N.Y. Civil Rights Law § 79-l", "status": "statute", "last_reviewed": "2026-09-02", "record_version": "1.1", "verification_status": "verified-primary", "topics": [ "privacy", "research" ], "summary": "New York Civil Rights Law section 79-l generally requires written informed consent before a genetic test is performed and before results are disclosed. It also treats genetic-test records and results as confidential and regulates the retention, research use, and destruction of biological samples.", "legal_effects": "The person or organization ordering a genetic test must obtain written informed consent. Separate written consent is generally required to disclose results. Unless the tested person authorizes longer retention, the biological sample generally must be destroyed within 60 days after written results are provided to the tested person.", "plain_language": "In most covered situations, you must give written permission before a genetic test is performed or its results are shared. The law also limits how long a sample may be kept and when it may be used for research.", "limitations": "The section contains exceptions and special rules for court orders, specified public health programs, research, insurers, and other circumstances. Whether the consent, confidentiality, or destruction rules apply depends on the purpose of the test and the statutory exception at issue.", "primary_sources": [ { "title": "New York Civil Rights Law § 79-l", "url": "https://www.nysenate.gov/legislation/laws/CVR/79-L", "publisher": "New York State Senate", "accessed_date": "2026-09-02" } ], "secondary_sources": [], "history": [ { "date": "2026-08-31", "event": "Record created from the current consolidated law page." }, { "date": "2026-09-02", "event": "Project-authored analysis revised after primary-source review." } ] } ]