RI H7639

Direct-to-consumer genetic testing companies must provide clear privacy notices in plain language and obtain separate express consent for each use of genetic data, including storage of biological samples, transfers to third parties, and marketing purposes.

Consumers have the right to access their genetic data, delete their account and data, and have biological samples destroyed; companies must honor consent revocations within 30 days.

Companies are prohibited from disclosing genetic data to entities responsible for health insurance, life insurance, long-term care insurance, disability insurance, or employment decisions.

Negligent violations carry civil penalties up to $1,000, while willful violations carry penalties between $1,000 and $10,000 per violation, with enforcement exclusively through the Attorney General.

Exemptions apply to HIPAA-covered entities, scientific research by institutions complying with federal human subjects protections, newborn screening programs, and diagnostic tests conducted under medical information confidentiality rules.