H.F. 4439 - Genetic Information Privacy Act

• Requires direct-to-consumer genetic testing companies to provide consumers with a high-level privacy policy overview and a prominent, publicly available privacy notice detailing data collection, use, disclosure, security, and retention practices.

• Mandates companies obtain separate express consents from consumers for initial testing, data transfers to third parties, biological sample retention, research purposes complying with federal regulations (45 CFR 46), and marketing based on genetic data.

• Prohibits companies from disclosing genetic data to health insurers, life insurers, long-term care insurers, or employers without written consumer consent, and requires valid legal process for law enforcement disclosures.

• Requires companies to develop comprehensive security programs protecting genetic data, and provide consumers processes to access their data, delete accounts and data, and request destruction of biological samples.

• Establishes enforcement through the Commissioner of Commerce under section 45.027 and exempts protected health information held by HIPAA-covered entities and institutions of higher education from these requirements.