*SB0033.1*
February 7, 2025
SENATE BILL No. 33
_____
DIGEST OF SB 33 (Updated February 6, 2025 12:14 pm - DI 140)
Citations Affected: IC 22-9; IC 24-4.
Synopsis: Consumer genetic testing providers. Provides that a person
may not discriminate against an individual on the basis of the
individual's solicitation and use of consumer genetic testing services or
on the basis of the results of genetic testing performed by a provider of
consumer genetic testing services (provider). Requires a provider to
disclose specified information to an individual who submits biological
material to the provider for genetic testing. Prohibits a provider that
performs, or causes to be performed, genetic testing on an individual's
biological material from: (1) taking specified actions with regard to:
(A) the biological material; or (B) data resulting from genetic testing
performed on the biological material; unless the provider has solicited
and received the individual's consent to the action; or (2) providing
data, other than deidentified data, resulting from genetic testing
performed on the individual's biological material to: (A) an insurer; (B)
a business that provides information or data to insurers for the purposes
of underwriting or rating of risks; or (C) the individual's employer.
Imposes requirements on a provider with respect to: (1) controlling
access to an individual's biological material and data; (2) complying
with the individual's revocation of consent with regard to the
(Continued next page)
Effective: July 1, 2025.
Hunley, Buchanan, Johnson T,
Ford J.D., Spencer, Koch
January 8, 2025, read first time and referred to Committee on Commerce and Technology.
February 6, 2025, reported favorably — Do Pass.
SB 33—LS 6244/DI 119 Digest Continued
individual's biological material and data; and (3) marketing or
advertising sent to the individual as a result of the individual's
solicitation and use of the provider's genetic testing services or use of
a website or other remote or virtual service associated with the
provider's genetic testing services. Provides that a provider may not
charge a fee for the provision of biological material or data resulting
from genetic testing performed on biological material: (1) to a law
enforcement agency on the basis of a search warrant; or (2) as required
by a court order; that is more than the provider's actual cost of
providing the material or data. Provides for enforcement of the bill's
provisions by the attorney general.
SB 33—LS 6244/DI 119SB 33—LS 6244/DI 119 February 7, 2025
First Regular Session of the 124th General Assembly (2025)
PRINTING CODE. Amendments: Whenever an existing statute (or a section of the Indiana
Constitution) is being amended, the text of the existing provision will appear in this style type,
additions will appear in this style type, and deletions will appear in this style type.
Additions: Whenever a new statutory provision is being enacted (or a new constitutional
provision adopted), the text of the new provision will appear in this style type. Also, the
word NEW will appear in that style type in the introductory clause of each SECTION that adds
a new provision to the Indiana Code or the Indiana Constitution.
Conflict reconciliation: Text in a statute in this style type or this style type reconciles conflicts
between statutes enacted by the 2024 Regular Session of the General Assembly.
SENATE BILL No. 33
A BILL FOR AN ACT to amend the Indiana Code concerning trade
regulation.
Be it enacted by the General Assembly of the State of Indiana:
1 SECTION 1. IC 22-9-14 IS ADDED TO THE INDIANA CODE AS
2 A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY
3 1, 2025]:
4 Chapter 14. Genetic Discrimination
5 Sec. 1. The definitions in IC 24-4-24 apply throughout this
6 chapter.
7 Sec. 2. A person may not discriminate against an individual on
8 the basis of the individual's solicitation and use of consumer
9 genetic testing services or on the basis of the results of genetic
10 testing performed by a consumer genetic testing provider,
11 including by discriminating against the individual in any of the
12 following ways:
13 (1) Denying the individual access to the person's goods or
14 services.
15 (2) Charging the individual a different rate for the person's
16 goods or services.
SB 33—LS 6244/DI 119 2
1 (3) Suggesting that the individual will be subject to any of the
2 measures described in subdivisions (1) through (2).
3 SECTION 2. IC 24-4-24 IS ADDED TO THE INDIANA CODE AS
4 A NEW CHAPTER TO READ AS FOLLOWS [EFFECTIVE JULY
5 1, 2025]:
6 Chapter 24. Consumer Genetic Testing Providers
7 Sec. 1. (a) As used in this chapter, "consumer genetic testing"
8 means a service in which a person:
9 (1) provides an individual with a means of submitting a
10 sample of the individual's biological material directly to the
11 person;
12 (2) performs, or causes to be performed, genetic testing on the
13 submitted biological material; and
14 (3) returns the results of the genetic testing directly to the
15 individual.
16 (b) The term does not include genetic testing:
17 (1) of biological material of a patient of a health care provider
18 (as defined in IC 16-18-2-163(a)), the collection and testing of
19 which is:
20 (A) performed at the request or direction of the health care
21 provider for the purpose of the diagnosis, cure, mitigation,
22 treatment, or prevention of a physical or mental illness,
23 injury, disease, disorder, or disability; and
24 (B) subject to the Health Insurance Portability and
25 Accountability Act (HIPAA) (P.L. 104-191);
26 (2) performed as required by a court order;
27 (3) performed for purposes of a law enforcement investigation
28 at the request or direction of a law enforcement agency;
29 (4) performed at the request or direction of a coroner or
30 medical examiner for purposes of investigating the cause of an
31 individual's death; or
32 (5) performed for purposes of research (as defined in 45 CFR
33 164.501) that is subject to:
34 (A) 21 CFR 50 and 21 CFR 56; or
35 (B) 45 CFR 46.
36 Sec. 2. As used in this chapter, "consumer genetic testing
37 provider" or "provider" means a person that, in the ordinary
38 course of the person's business:
39 (1) offers consumer genetic testing; or
40 (2) collects, uses, or analyzes genetic data that:
41 (A) results from a consumer genetic testing product or
42 service; and
SB 33—LS 6244/DI 119 3
1 (B) is provided to the person by a consumer;
2 in exchange for consideration.
3 Sec. 3. As used in this chapter, "deidentified data" means data
4 that cannot reasonably be used to infer information about, or
5 otherwise be linked to, an identifiable consumer and that:
6 (1) is subject to:
7 (A) administrative and technical measures to ensure that
8 the data cannot be associated with a particular consumer;
9 (B) public commitment by the holder of the data to:
10 (i) maintain and use the data in deidentified form; and
11 (ii) not attempt to reidentify the data; and
12 (C) legally enforceable contractual obligations that
13 prohibit any recipients of the data from attempting to
14 reidentify the data; or
15 (2) meets requirements for deidentification of the data set
16 forth in 45 CFR 164.514.
17 Sec. 4. As used in this chapter, "DNA" has the meaning set forth
18 in IC 10-13-6-2.
19 Sec. 5. As used in this chapter, "genetic data" means any data,
20 regardless of format, that:
21 (1) results from the analysis of an individual's biological
22 material, including analysis of:
23 (A) the complete DNA;
24 (B) regions of the DNA;
25 (C) chromosomes;
26 (D) genes; or
27 (E) gene products; and
28 (2) concerns an individual's genetic characteristics.
29 The term does not include deidentified data.
30 Sec. 6. As used in this chapter, "genetic testing" means analysis
31 of genetic data.
32 Sec. 7. As used in this chapter, "insurer" has the meaning set
33 forth in IC 27-1-2-3.
34 Sec. 8. (a) A consumer genetic testing provider may not
35 perform, or cause to be performed, genetic testing on an
36 individual's biological material unless the provider has provided
37 the individual with a written disclosure of the provider's privacy
38 policy, including the provider's policies and procedures regarding
39 the provider's collection, maintenance, security, retention, and use
40 of both biological material sent to the provider and data resulting
41 from genetic testing performed on the biological material.
42 (b) The disclosure under subsection (a) must include complete
SB 33—LS 6244/DI 119 4
1 information regarding the following:
2 (1) The identity of any third party that may perform genetic
3 testing on biological material sent to the third party by the
4 provider.
5 (2) The manner in which:
6 (A) biological material sent to the provider; and
7 (B) data resulting from genetic testing performed on
8 biological material sent to the provider;
9 is stored, transferred, and secured.
10 (3) Any:
11 (A) testing or analysis that the provider performs or causes
12 to be performed on; or
13 (B) other purpose for which the provider uses;
14 biological material sent by an individual to the provider that
15 is in addition to the genetic testing requested by the
16 individual.
17 (4) The:
18 (A) identity of any third party to which the provider
19 provides access to:
20 (i) biological material sent to the provider; or
21 (ii) data resulting from genetic testing performed on
22 biological material sent to the provider; and
23 (B) purpose for which the third party uses the biological
24 material or data.
25 (c) A consumer genetic testing provider shall:
26 (1) publish the disclosure described in subsection (a) on the
27 provider's website; and
28 (2) include on the provider's website prominent directions and
29 hyperlinks to the location of the disclosure on the provider's
30 website.
31 Sec. 9. (a) A consumer genetic testing provider that performs,
32 or causes to be performed, genetic testing on an individual's
33 biological material may not take any of the following actions unless
34 the provider has solicited and received the individual's freely given,
35 specific, informed, and unambiguous consent to the action:
36 (1) Perform, or cause to be performed, any testing or analysis
37 of the individual's biological material that is not requested by
38 the individual except as required to comply with state and
39 federal law.
40 (2) Use the individual's biological material for any use other
41 than the genetic testing requested by the individual.
42 (3) Subject to section 10(b) of this chapter, provide access by
SB 33—LS 6244/DI 119 5
1 a third party to:
2 (A) the individual's biological material; or
3 (B) data, other than deidentified data, resulting from
4 genetic testing performed on the individual's biological
5 material.
6 (4) Retain the individual's biological material for more than
7 thirty (30) days after the performance of the genetic testing
8 requested by the individual, except as required to comply with
9 state or federal law.
10 (5) Retain data, other than deidentified data, resulting from
11 genetic testing performed on the individual's biological
12 material for more than thirty (30) days after the completion
13 of the service except as required to comply with state and
14 federal law.
15 (6) Disseminate advertising or marketing communications to
16 the individual based on the individual's genetic testing results.
17 (7) Provide information regarding the individual's:
18 (A) solicitation and use of the provider's genetic testing
19 services; or
20 (B) use of the provider's:
21 (i) website; or
22 (ii) other remote or virtual services;
23 associated with the provider's genetic testing services;
24 to a third party to enable the third party to disseminate
25 advertising or marketing communications to the individual.
26 (b) A provider's solicitation of an individual's consent to an
27 action described in subsection (a) must:
28 (1) describe the action in terms that are sufficiently clear and
29 concise as to be reasonably understandable by a person of
30 ordinary intelligence; and
31 (2) solicit the individual's consent to the action separately
32 from a solicitation of the individual's consent to any other
33 action described in subsection (a).
34 (c) Consent to an action under subsection (a) is not freely given,
35 specific, informed, and unambiguous if the consent is provided by
36 any of the following means:
37 (1) The individual's inaction.
38 (2) The individual's acceptance of:
39 (A) general or broad terms of service; or
40 (B) any other document requiring agreement by an
41 individual using the provider's services;
42 containing information unrelated to the action under
SB 33—LS 6244/DI 119 6
1 subsection (a).
2 (3) The individual closing, muting, pausing, or hovering a
3 computer cursor over a piece of content.
4 (4) The individual's communication of consent through an
5 Internet user interface that is designed or manipulated with
6 the substantial effect of subverting or impairing user
7 autonomy, decision making, or choice.
8 Sec. 10. (a) A consumer genetic testing provider that performs,
9 or causes to be performed, genetic testing on an individual's
10 biological material shall do the following:
11 (1) Implement commercially reasonable security measures to
12 protect:
13 (A) the individual's biological material; and
14 (B) data resulting from genetic testing performed on the
15 individual's biological material;
16 from unauthorized access, destruction, use, modification, or
17 disclosure.
18 (2) Allow the individual access to any data resulting from
19 genetic testing performed on the individual's biological
20 material.
21 (3) Provide the following:
22 (A) A procedure by which the individual can revoke any
23 consent provided by the individual under section 9 of this
24 chapter. The procedure must enable the individual to
25 communicate the revocation:
26 (i) directly to the provider; and
27 (ii) through one (1) or more means, at least one (1) of
28 which must be the primary means by which the provider
29 communicates with the individual.
30 (B) Both:
31 (i) notice of the existence of; and
32 (ii) instructions regarding the use of;
33 the procedure under clause (A) that are sufficiently clear
34 and concise as to be reasonably understandable by a
35 person of ordinary intelligence.
36 (4) Comply with a revocation of consent by the individual not
37 later than thirty (30) days after the individual communicates
38 the revocation to the provider, including by:
39 (A) destroying the individual's biological material not later
40 than thirty (30) days after the individual revokes the
41 individual's consent to the provider's retention of the
42 biological material under section 9(a)(4) of this chapter;
SB 33—LS 6244/DI 119 7
1 and
2 (B) destroying any data resulting from genetic testing
3 performed on the individual's biological material not later
4 than thirty (30) days after the individual revokes the
5 individual's consent to the provider's retention of the data
6 under section 9(a)(5) of this chapter.
7 (5) Provide a third party with access to the individual's
8 biological material, or to data resulting from genetic testing
9 performed on the individual's biological material, only under
10 contractual terms that prohibit the third party from:
11 (A) using the biological material or data for any use to
12 which the individual has not consented under section 9 of
13 this chapter;
14 (B) providing another party with access to the biological
15 material or data; or
16 (C) retaining the biological material or data longer than
17 the provider is authorized to retain the biological material
18 or data under this chapter.
19 (6) Ensure that:
20 (A) any advertising or marketing communications sent to
21 the individual as a result of the individual's:
22 (i) solicitation and use of the provider's services; or
23 (ii) use of the provider's website or other remote or
24 virtual services;
25 are clearly and prominently denoted as advertising or
26 marketing materials; and
27 (B) advertising or marketing communications described in
28 clause (A) that are sent by a third party clearly and
29 prominently:
30 (i) identify the third party; and
31 (ii) notify the individual that any claims made in the
32 advertising or marketing communications have not been
33 evaluated by the provider.
34 (b) A consumer genetic testing provider may not provide data,
35 other than deidentified data, resulting from genetic testing
36 performed on an individual's biological material to:
37 (1) an insurer;
38 (2) a person that, in the ordinary course of the person's
39 business, provides information or data to insurers for the
40 purposes of underwriting or rating of risks; or
41 (3) a person that employs the individual;
42 regardless of whether the individual has consented to the provider
SB 33—LS 6244/DI 119 8
1 providing third parties with access to the data under section 9(a)(3)
2 of this chapter.
3 (c) A consumer genetic testing provider may not charge a fee for
4 the provision of biological material or for the provision of data
5 resulting from genetic testing performed on biological material:
6 (1) to a law enforcement agency on the basis of a search
7 warrant; or
8 (2) as required by a court order;
9 that is more than the actual cost, not including labor costs or
10 overhead costs, to the consumer genetic testing provider of
11 providing the material or data.
12 Sec. 11. (a) The attorney general has exclusive authority to
13 enforce the provisions of this chapter.
14 (b) The attorney general may initiate an action in the name of
15 the state and may seek an injunction to restrain any violations of
16 this chapter and a civil penalty not to exceed seven thousand five
17 hundred dollars ($7,500) for each violation under this chapter.
18 (c) The attorney general may recover reasonable expenses
19 incurred in investigating and preparing the case, including
20 attorney's fees, in any action initiated under this section.
21 (d) Before initiating an action under this section, the attorney
22 general shall provide a provider thirty (30) days written notice
23 identifying the specific provisions of this chapter that the attorney
24 general alleges have been or are being violated. If, within the thirty
25 (30) day period set forth in this subsection, the provider:
26 (1) cures the alleged violation; and
27 (2) provides the attorney general an express written statement
28 that:
29 (A) the alleged violation has been cured; and
30 (B) actions have been taken to ensure no further such
31 violations will occur;
32 the attorney general shall not initiate an action against the
33 provider.
34 (e) If a provider:
35 (1) continues an alleged violation following the thirty (30) day
36 period set forth in subsection (d); or
37 (2) breaches an express written statement provided to the
38 attorney general under subsection (d)(2);
39 the attorney general may initiate an action against the provider
40 under subsection (b).
41 (f) Nothing in this section may be construed as providing the
42 basis for a private right of action for violations of this chapter or
SB 33—LS 6244/DI 119 9
1 any other law.
SB 33—LS 6244/DI 119 10
COMMITTEE REPORT
Mr. President: The Senate Committee on Commerce and
Technology, to which was referred Senate Bill No. 33, has had the
same under consideration and begs leave to report the same back to the
Senate with the recommendation that said bill DO PASS.
(Reference is to SB 33 as introduced.)
BUCHANAN, Chairperson
Committee Vote: Yeas 8, Nays 2
SB 33—LS 6244/DI 119