Shown verbatim: the complete text as captured from the official PDF posted by the Indiana General Assembly, fetched 2026-09-25. Page and line markers are part of the official record; nothing is edited or removed. This is the current version. The official bill page.
First Regular Session of the 124th General Assembly (2025)
PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana
Constitution) is being amended, the text of the existing provision will appear in this style type,
additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional
provision adopted), the text of the new provision will appear in this style type. Also, the
word NEW will appear in that style type in the introductory clause of each SECTION that adds
a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts
between statutes enacted by the 2024 Regular Session of the General Assembly.
HOUSE ENROLLED ACT No. 1521
AN ACT to amend the Indiana Code concerning trade regulation.
Be it enacted by the General Assembly of the State of Indiana:
SECTION 1. IC 22-9-14 IS ADDED TO THE INDIANA CODE AS
A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE UPON
PASSAGE]:
Chapter 14. Genetic Discrimination
Sec. 1. The definitions in IC 24-4-24 apply throughout this
chapter.
Sec. 2. A person may not discriminate against an individual on
the basis of the individual's solicitation and use of consumer
genetic testing services or on the basis of the results of genetic
testing performed by a consumer genetic testing provider,
including by discriminating against the individual in any of the
following ways:
(1) Denying the individual access to the person's goods or
services.
(2) Charging the individual a different rate for the person's
goods or services.
(3) Suggesting that the individual will be subject to any of the
measures described in subdivisions (1) through (2).
SECTION 2. IC 24-4-24 IS ADDED TO THE INDIANA CODE AS
A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE UPON
PASSAGE]:
Chapter 24. Consumer Genetic Testing Providers
HEA 1521 — Concur
2
Sec. 1. (a) As used in this chapter, "consumer genetic testing"
means a service in which a person:
(1) provides an individual with a means of submitting a
sample of the individual's biological material directly to the
person;
(2) performs, or causes to be performed, genetic testing on the
submitted biological material; and
(3) returns the results of the genetic testing directly to the
individual.
(b) The term does not include genetic testing:
(1) of biological material of a patient of a health care provider
(as defined in IC 16-18-2-163(a)), the collection and testing of
which is:
(A) performed at the request or direction of the health care
provider for the purpose of the diagnosis, cure, mitigation,
treatment, or prevention of a physical or mental illness,
injury, disease, disorder, or disability; and
(B) subject to the Health Insurance Portability and
Accountability Act (HIPAA) (P.L. 104-191);
(2) performed as required by a court order;
(3) performed for purposes of a law enforcement investigation
at the request or direction of a law enforcement agency;
(4) performed at the request or direction of a coroner or
medical examiner for purposes of investigating the cause of an
individual's death; or
(5) performed for purposes of research (as defined in 45 CFR
164.501) that is subject to:
(A) 21 CFR 50 and 21 CFR 56; or
(B) 45 CFR 46.
Sec. 2. As used in this chapter, "consumer genetic testing
provider" or "provider" means a person that, in the ordinary
course of the person's business:
(1) offers consumer genetic testing; or
(2) collects, uses, or analyzes genetic data that:
(A) results from a consumer genetic testing product or
service; and
(B) is provided to the person by a consumer;
in exchange for consideration.
Sec. 3. As used in this chapter, "deidentified data" means data
that cannot reasonably be used to infer information about, or
otherwise be linked to, an identifiable consumer and that:
(1) is subject to:
HEA 1521 — Concur
3
(A) administrative and technical measures to ensure that
the data cannot be associated with a particular consumer;
(B) public commitment by the holder of the data to:
(i) maintain and use the data in deidentified form; and
(ii) not attempt to reidentify the data; and
(C) legally enforceable contractual obligations that
prohibit any recipients of the data from attempting to
reidentify the data; or
(2) meets requirements for deidentification of the data set
forth in 45 CFR 164.514.
Sec. 4. As used in this chapter, "DNA" has the meaning set forth
in IC 10-13-6-2.
Sec. 5. As used in this chapter, "genetic data" means any data,
regardless of format, that:
(1) results from the analysis of an individual's biological
material, including analysis of:
(A) the complete DNA;
(B) regions of the DNA;
(C) chromosomes;
(D) genes; or
(E) gene products; and
(2) concerns an individual's genetic characteristics.
The term does not include deidentified data.
Sec. 6. As used in this chapter, "genetic testing" means analysis
of genetic data.
Sec. 7. As used in this chapter, "insurer" has the meaning set
forth in IC 27-1-2-3.
Sec. 8. (a) A consumer genetic testing provider may not
perform, or cause to be performed, genetic testing on an
individual's biological material unless the provider has provided
the individual with a written disclosure of the provider's privacy
policy, including the provider's policies and procedures regarding
the provider's collection, maintenance, security, retention, and use
of both biological material sent to the provider and data resulting
from genetic testing performed on the biological material.
(b) The disclosure under subsection (a) must include complete
information regarding the following:
(1) The identity of any third party that may perform genetic
testing on biological material sent to the third party by the
provider.
(2) The manner in which:
(A) biological material sent to the provider; and
HEA 1521 — Concur
4
(B) data resulting from genetic testing performed on
biological material sent to the provider;
is stored, transferred, and secured.
(3) Any:
(A) testing or analysis that the provider performs or causes
to be performed on; or
(B) other purpose for which the provider uses;
biological material sent by an individual to the provider that
is in addition to the genetic testing requested by the
individual.
(4) The:
(A) identity of any third party to which the provider
provides access to:
(i) biological material sent to the provider; or
(ii) data resulting from genetic testing performed on
biological material sent to the provider; and
(B) purpose for which the third party uses the biological
material or data.
(c) A consumer genetic testing provider shall:
(1) publish the disclosure described in subsection (a) on the
provider's website; and
(2) include on the provider's website prominent directions and
hyperlinks to the location of the disclosure on the provider's
website.
Sec. 9. (a) A consumer genetic testing provider that performs,
or causes to be performed, genetic testing on an individual's
biological material may not take any of the following actions unless
the provider has solicited and received the individual's freely given,
specific, informed, and unambiguous consent to the action:
(1) Perform, or cause to be performed, any testing or analysis
of the individual's biological material that is not requested by
the individual except as required to comply with state and
federal law.
(2) Use the individual's biological material for any use other
than the genetic testing requested by the individual.
(3) Subject to section 10(b) of this chapter, provide access by
a third party to:
(A) the individual's biological material; or
(B) data, other than deidentified data, resulting from
genetic testing performed on the individual's biological
material.
(4) Retain the individual's biological material for more than
HEA 1521 — Concur
5
thirty (30) days after the performance of the genetic testing
requested by the individual, except as required to comply with
state or federal law.
(5) Retain data, other than deidentified data, resulting from
genetic testing performed on the individual's biological
material for more than thirty (30) days after the completion
of the service except as required to comply with state and
federal law.
(6) Disseminate advertising or marketing communications to
the individual based on the individual's genetic testing results.
(7) Provide information regarding the individual's:
(A) solicitation and use of the provider's genetic testing
services; or
(B) use of the provider's:
(i) website; or
(ii) other remote or virtual services;
associated with the provider's genetic testing services;
to a third party to enable the third party to disseminate
advertising or marketing communications to the individual.
(b) A provider's solicitation of an individual's consent to an
action described in subsection (a) must:
(1) describe the action in terms that are sufficiently clear and
concise as to be reasonably understandable by a person of
ordinary intelligence; and
(2) solicit the individual's consent to the action separately
from a solicitation of the individual's consent to any other
action described in subsection (a).
(c) Consent to an action under subsection (a) is not freely given,
specific, informed, and unambiguous if the consent is provided by
any of the following means:
(1) The individual's inaction.
(2) The individual's acceptance of:
(A) general or broad terms of service; or
(B) any other document requiring agreement by an
individual using the provider's services;
containing information unrelated to the action under
subsection (a).
(3) The individual closing, muting, pausing, or hovering a
computer cursor over a piece of content.
(4) The individual's communication of consent through an
Internet user interface that is designed or manipulated with
the substantial effect of subverting or impairing user
HEA 1521 — Concur
6
autonomy, decision making, or choice.
Sec. 10. (a) A consumer genetic testing provider that performs,
or causes to be performed, genetic testing on an individual's
biological material shall do the following:
(1) Implement commercially reasonable security measures to
protect:
(A) the individual's biological material; and
(B) data resulting from genetic testing performed on the
individual's biological material;
from unauthorized access, destruction, use, modification, or
disclosure.
(2) Allow the individual access to any data resulting from
genetic testing performed on the individual's biological
material.
(3) Provide the following:
(A) A procedure by which the individual can revoke any
consent provided by the individual under section 9 of this
chapter. The procedure must enable the individual to
communicate the revocation:
(i) directly to the provider; and
(ii) through one (1) or more means, at least one (1) of
which must be the primary means by which the provider
communicates with the individual.
(B) Both:
(i) notice of the existence of; and
(ii) instructions regarding the use of;
the procedure under clause (A) that are sufficiently clear
and concise as to be reasonably understandable by a
person of ordinary intelligence.
(4) Comply with a revocation of consent by the individual not
later than thirty (30) days after the individual communicates
the revocation to the provider, including by:
(A) destroying the individual's biological material not later
than thirty (30) days after the individual revokes the
individual's consent to the provider's retention of the
biological material under section 9(a)(4) of this chapter;
and
(B) destroying any data resulting from genetic testing
performed on the individual's biological material not later
than thirty (30) days after the individual revokes the
individual's consent to the provider's retention of the data
under section 9(a)(5) of this chapter.
HEA 1521 — Concur
7
(5) Provide a third party with access to the individual's
biological material, or to data resulting from genetic testing
performed on the individual's biological material, only under
contractual terms that prohibit the third party from:
(A) using the biological material or data for any use to
which the individual has not consented under section 9 of
this chapter;
(B) providing another party with access to the biological
material or data; or
(C) retaining the biological material or data longer than
the provider is authorized to retain the biological material
or data under this chapter.
(6) Ensure that:
(A) any advertising or marketing communications sent to
the individual as a result of the individual's:
(i) solicitation and use of the provider's services; or
(ii) use of the provider's website or other remote or
virtual services;
are clearly and prominently denoted as advertising or
marketing materials; and
(B) advertising or marketing communications described in
clause (A) that are sent by a third party clearly and
prominently:
(i) identify the third party; and
(ii) notify the individual that any claims made in the
advertising or marketing communications have not been
evaluated by the provider.
(b) A consumer genetic testing provider may not provide data,
other than deidentified data, resulting from genetic testing
performed on an individual's biological material to:
(1) an insurer;
(2) a person that, in the ordinary course of the person's
business, provides information or data to insurers for the
purposes of underwriting or rating of risks; or
(3) a person that employs the individual;
regardless of whether the individual has consented to the provider
providing third parties with access to the data under section 9(a)(3)
of this chapter.
(c) A consumer genetic testing provider may not charge a fee for
the provision of biological material or for the provision of data
resulting from genetic testing performed on biological material:
(1) to a law enforcement agency on the basis of a search
HEA 1521 — Concur
8
warrant; or
(2) as required by a court order;
that is more than the actual cost, not including labor costs or
overhead costs, to the consumer genetic testing provider of
providing the material or data.
Sec. 11. (a) The attorney general has exclusive authority to
enforce the provisions of this chapter.
(b) The attorney general may initiate an action in the name of
the state and may seek an injunction to restrain any violations of
this chapter and a civil penalty not to exceed seven thousand five
hundred dollars ($7,500) for each violation under this chapter.
(c) The attorney general may recover reasonable expenses
incurred in investigating and preparing the case, including
attorney's fees, in any action initiated under this section.
(d) Before initiating an action under this section, the attorney
general shall provide a provider thirty (30) days written notice
identifying the specific provisions of this chapter that the attorney
general alleges have been or are being violated. If, within the thirty
(30) day period set forth in this subsection, the provider:
(1) cures the alleged violation; and
(2) provides the attorney general an express written statement
that:
(A) the alleged violation has been cured; and
(B) actions have been taken to ensure no further such
violations will occur;
the attorney general shall not initiate an action against the
provider.
(e) If a provider:
(1) continues an alleged violation following the thirty (30) day
period set forth in subsection (d); or
(2) breaches an express written statement provided to the
attorney general under subsection (d)(2);
the attorney general may initiate an action against the provider
under subsection (b).
(f) Nothing in this section may be construed as providing the
basis for a private right of action for violations of this chapter or
any other law.
SECTION 3. An emergency is declared for this act.
HEA 1521 — Concur
Speaker of the House of Representatives
President of the Senate
President Pro Tempore
Governor of the State of Indiana
Date: Time:
HEA 1521 — ConcurEvery fact on this page links to its source, starting with the official bill record.