SB2924 Summary

• Amends the Genetic Information Privacy Act to require patient consent before covered entities use or disclose genetic information for treatment, payment, health care operations, and health oversight activities.

• Prohibits disclosure of genetic information to health oversight agencies, public health departments, and health information exchanges (HIEs) without patient consent, with limited exceptions for specific oversight and public health purposes.

• Restricts covered entities from sharing genetic information with business associates without patient consent and requires written agreements ensuring business associates safeguard the information.

• Prohibits creation and use of limited data sets and de-identified genetic information without patient consent, with requirements that recipients cannot re-identify de-identified information using public or private data sources.

• Effective immediately upon becoming law.