RI S2203

Direct-to-consumer genetic testing companies must provide Rhode Island consumers with clear privacy notices and obtain express consent before collecting, using, or disclosing genetic data, with separate consent required for sample storage, third-party transfers, and marketing uses.

Consumers have the right to access their genetic data, delete their account and data, and have biological samples destroyed; companies must honor consent revocations within 30 days.

Companies are prohibited from disclosing genetic data to health insurers, life insurers, long-term care insurers, disability insurers, or employers for decision-making purposes.

Civil penalties range from up to $1,000 for negligent violations to $1,000-$10,000 for willful violations, with enforcement exclusively by the Attorney General; penalties are paid to affected individuals.

Exemptions apply to HIPAA-covered entities, scientific research at institutions complying with federal human subjects protections, newborn screening programs, and diagnostic medical tests.