Indiana § 24-4-24-8 - Consumer genetic testing provider privacy policy; required disclosure

§ 24-4-24-8. Consumer genetic testing provider privacy policy; required disclosure

Sec. 8. (a) A consumer genetic testing provider may not perform, or cause to be performed, genetic testing on an individual's biological material unless the provider has provided the individual with a written disclosure of the provider's privacy policy, including the provider's policies and procedures regarding the provider's collection, maintenance, security, retention, and use of both biological material sent to the provider and data resulting from genetic testing performed on the biological material.

(b) The disclosure under subsection (a) must include complete information regarding the following:

(1) The identity of any third party that may perform genetic testing on biological material sent to the third party by the provider.

(2) The manner in which:

(A) biological material sent to the provider; and

(B) data resulting from genetic testing performed on biological material sent to the provider;

is stored, transferred, and secured.

(3) Any:

(A) testing or analysis that the provider performs or causes to be performed on; or

(B) other purpose for which the provider uses;

biological material sent by an individual to the provider that is in addition to the genetic testing requested by the individual.

(4) The:

(A) identity of any third party to which the provider provides access to:

(i) biological material sent to the provider; or

(ii) data resulting from genetic testing performed on biological material sent to the provider; and

(B) purpose for which the third party uses the biological material or data.

(c) A consumer genetic testing provider shall:

(1) publish the disclosure described in subsection (a) on the provider's website; and

(2) include on the provider's website prominent directions and hyperlinks to the location of the disclosure on the provider's website.

As added by P.L.233-2025, SEC.2.