Privacy Law Library

Consumer Genetic Testing Providers

IN Consumer Genetic Testing

Genetic

Enacted by HEA 1521 (2025) and effective on passage, this chapter regulates direct-to-consumer genetic testing companies. Before testing, they must give a written privacy disclosure. They need separate, specific consent for extra testing, secondary uses, third-party access, retention beyond 30 days, and genetics-based marketing, and they may never give identifiable genetic data to insurers or employers.

Where

Indiana

Citation

Ind. Code ch. 24-4-24 (IC 24-4-24-1 to 24-4-24-11)

Status

In force

In force since

2025-05-06

Enforced by

Indiana Attorney General (exclusive authority, IC 24-4-24-11(a))

People can sue

No

Penalties

Injunction and a civil penalty of up to $7,500 per violation plus investigative costs and attorney's fees, after a 30-day written notice and cure opportunity (IC 24-4-24-11(b)-(e)).

Applies to

• Consumer genetic testing providers: persons that, in the ordinary course of business and for consideration, offer direct-to-consumer genetic testing or collect, use, or analyze consumer-provided genetic data from such testing (IC 24-4-24-2)
• Excludes testing ordered by a health care provider and subject to HIPAA, court-ordered testing, law enforcement testing, coroner testing, and research under the Common Rule or FDA human-subjects rules (IC 24-4-24-1(b))