Health and genetic data laws by state

AB 1798: Genetic testing for life and disability insurance.

Life or disability insurers must not cancel, limit, deny coverage, or make adverse underwriting decisions based on genetic characteristics or genetic test results, except for life or disability policies with face value exceeding $1,500,000 where test results are in the medical record and not from direct-to-consumer tests. Insurers must not require, request, or use genetic information for insurance purposes.

Takes effect 1 January 2027

AB 1883: Workplace surveillance tools.

An employer shall not use a workplace surveillance tool to prevent compliance with laws, infer protected activity, make inferences about emotional state or gait, or collect neural data. An employer shall not use facial recognition technology to make inferences about a worker for firing, deactivation, or disciplinary purposes. An employer shall not use a workplace surveillance tool to infer a worker's protected status.

Takes effect 1 January 2027

AB 2448: Medical information: confidentiality.

A business that electronically stores or maintains medical information on sensitive services for healthcare providers, service plans, pharmaceutical companies, contractors, or employers must develop capabilities, policies, and procedures by July 1, 2024, to limit user access to gender affirming care, abortion, abortion-related services, and contraception information; prevent disclosure of such information outside the state; segregate such information; and automatically disable access by out-of-state individuals and entities.

Takes effect 1 January 2027

SB 278: Health data: HIV test results.

A provider of health care may disclose HIV test results identifying a Medi-Cal beneficiary without written authorization to the beneficiary's assigned Medi-Cal managed care plan and to external quality review organizations, for quality improvement programs including value-based payment and healthy behavior incentive programs. A Medi-Cal managed care plan may disclose de-identified HIV test results to State Department of Health Care Services staff for the same purpose.

SB 497: Legally protected health care activity.

Providers of health care, health care service plans, and contractors must not release medical information related to individuals seeking or obtaining gender-affirming health care or mental health care in response to subpoenas based on another state's laws that interfere with such rights. State and local agencies must not provide CURES data or resources to further out-of-state investigations based on another state's laws regarding legally protected health care activity.

AB 45: Privacy: health data: location and research.

Persons must not collect, use, disclose, sell, share, or retain personal information of natural persons physically located at or within a precise geolocation of a family planning center, except as necessary to perform requested services or goods. Persons must not geofence entities providing in-person health care services in California to identify, track, collect information from, or send notifications or advertisements to persons seeking or providing health care services.

Took effect 1 January 2026

SB 25-129: Legally Protected Health-Care Activity Protections

Public entities and persons or entities licensed or regulated by the state must not provide information, resources, or assistance to out-of-state or federal investigations seeking to impose liability for legally protected health-care activities. Practitioners may request prescription labels for mifepristone or misoprostol list the health-care practice name instead of the practitioner's name.

HB 424: An act to amend title 16 relating to autism surveillance and registration.

Repeals Delaware's autism surveillance and registration program that required healthcare practitioners and hospitals to report autism diagnoses in children to the Department of Health and Social Services. Requires the Department to expunge all protected health information collected under the program within 6 months, though aggregate data may be retained.

SB 2886: Genetic info privacy-biomarker

Insurers may not seek or use genetic or biomarker testing information for accident and health insurance except when an individual voluntarily submits favorable results. Employers, employment agencies, labor organizations, and licensing agencies must not solicit, require, or use genetic or biomarker testing information in employment decisions. Persons must not disclose genetic or biomarker test results identifying the subject except to authorized recipients.

HB 5295: Reproductive health privacy

Electronic health networks must prevent disclosure of patients' coded private health care information related to abortion, gender dysphoria, and abortion-related services to out-of-state providers unless for technical support, quality assurance, payment, health care operations, or with patient consent. Electronic health networks must develop technological capabilities to parse, segregate, and allow patients to control sharing of such information.

Takes effect 1 July 2027

HB 3487: Bhwc data collection

The Department of Financial and Professional Regulation must collect demographic and professional data from behavioral health professionals at initial licensure application and license renewal, ensure the data collection process is secure and complies with privacy laws, and publish aggregated de-identified data annually by January 31 on its website and through accessible formats.

Took effect 1 January 2026

HB 1521: Consumer genetic testing providers.

Consumer genetic testing providers must obtain freely given, specific, informed, and unambiguous consent before performing additional testing, using biological material for other purposes, providing third-party access, retaining material or data beyond thirty days, disseminating marketing based on results, or sharing service usage information. Providers must implement commercially reasonable security measures, allow individual data access, provide revocation procedures, and may never provide non-deidentified genetic data to insurers, insurance data providers, or employers.

Took effect 1 July 2025

HB 676: AN ACT relating to the Kentucky statewide health data utility.

Participants including health facilities, health care payers, and health care professionals must submit health information to the Kentucky statewide health data utility according to requirements established by the executive director, within three months after the relevant exchange becomes operational or when the person begins doing business requiring compliance.

HB 473: AN ACT relating to consumer data privacy.

Controllers that conduct business in Kentucky and control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50% of gross revenue from selling personal data, must conduct and document data protection impact assessments for targeted advertising, selling personal data, profiling with reasonably foreseeable risks, sensitive data processing, and other heightened-risk processing.

LD 1970: An Act To Amend The Laws Regarding Consent For Hiv Testing And Disclosure Of Related Medical Information For Insurance Purposes

Health care providers must obtain a patient's informed consent before performing an HIV test, except for repeated testing to monitor established infection. Patients must be informed orally or in writing about what HIV infection involves and the meaning of test results, and must have the opportunity to ask questions. Health care providers may disclose HIV test results to other health care providers working directly with the patient only for direct medical or dental care purposes.

LD 1945: An Act To Clarify Data Collection Processes In Health Care Facilities

Changes the age threshold for health care facilities collecting sexual orientation and gender identity data from 18 years of age or older to 19 years of age or older.

HB 1007: Disability and Life Insurance - Medical Information (Genetic Testing Protection Act)

Insurance carriers offering life, long-term care, or disability insurance in Maryland may not unfairly discriminate based on medical information lacking actuarially sound relationship to insurance risk. Carriers may not access sensitive medical information or genetic data without written consent, mandate genetic testing or genome sequencing, or use genetic test results to deny, limit, cancel, or affect coverage.

Took effect 1 October 2025

HB 301: Criminal Procedure - Forensic Genetic Genealogical DNA Analysis and Search - Affidavit for Judicial Authorization

Law enforcement agents with prosecutor approval must submit a sworn affidavit to obtain judicial authorization before initiating forensic genetic genealogical DNA analysis and search. The affidavit must assert that the perpetrator's identity is unknown, the crime involves murder, rape, felony sexual offense, or substantial ongoing threat to public safety or national security, the forensic sample is biological material reasonably believed deposited by a perpetrator, and an STR DNA profile was developed, entered into state and national databases, and failed to identify a known individual.

Took effect 1 October 2025

HB 590: Generally revise laws related to electronic health care records

Health carriers must establish and maintain five types of application programming interfaces for insureds and contracted providers by the earliest date required by the Centers for Medicare and Medicaid Services. Health care providers requesting medical laboratory tests may not engage in information blocking. Certain test results must be disclosed to patients within 72 hours or when the provider directs release, whichever is first.

SB 163: Generally revise privacy laws related to biometric, genetic, and neural data

Entities that collect genetic or neurotechnology data must obtain express consent from consumers before collection, use, or disclosure; provide privacy notices; implement security programs; and allow consumers to access, delete, and revoke consent for their data. Entities may not disclose such data to insurers or employers without express consent. Government agencies may not search consumer DNA or neurotechnology databases without a search warrant or investigative subpoena.

HB 7639: An act relating to commercial law--general regulatory provisions -- genetic information privacy act

Direct-to-consumer genetic testing companies must provide consumers clear privacy information and obtain express consent before collecting, using, or disclosing genetic data. Companies must implement reasonable security procedures, enable consumers to access or delete their data, and prohibit service providers from retaining or using genetic data beyond specified purposes.

SB 49: safeguard the integrity, privacy, and security of genetic data and provide a civil penalty therefor.

Direct-to-consumer genetic testing companies must obtain express consent before collecting, disclosing, or using consumers' genetic data, provide privacy policies and notices in plain language, implement security programs, and honor consent revocations within thirty days. Service providers must maintain the same confidentiality obligations.

Took effect 1 July 2026

HB 130: Relating to genetic information security for residents of this state; providing a civil penalty; providing a private cause of action.

Medical facilities, research facilities, companies, and nonprofit organizations conducting genome sequencing in Texas must not use genome sequencers or software from foreign adversaries, must not store genomic data in foreign adversary countries, must not sell genomic data to foreign adversaries in bankruptcy, and must certify annual compliance to the attorney general.

Took effect 1 September 2025

HB 4224: Relating to information regarding consumer access to health care records.

A covered entity must prominently post on its Internet website and at any facility detailed instructions for consumers to request their health care records, contact the disciplinary or licensing authority, and file a consumer complaint. This requirement does not apply to entities that only conduct claims processing, data processing, data analysis, utilization review, or billing on behalf of other covered entities.

Took effect 1 September 2025

HB 4377: Relating to the retention of certain genetic material and genetic information by the Department of Family and Protective Services.

The Department of Family and Protective Services and any testing laboratory it contracts with must promptly destroy genetic material and delete genetic information obtained from individuals for genetic testing after the testing purpose is accomplished. The department must retain genetic test results, which remain confidential. All testing laboratories must comply by January 1, 2026.

Took effect 1 September 2025

SB 922: Relating to the disclosure of certain medical information by electronic means.

Physicians must provide requested medical information within 15 business days of receiving written consent or request. Persons administering or controlling electronic health records must not disclose sensitive test results by electronic means before the third day after the results are finalized. Sensitive test results are pathology or radiology reports with reasonable likelihood of malignancy findings or test results revealing genetic markers.

Took effect 1 September 2025

HB 199: Health Data Amendments

The Department of Health and Human Services must develop and maintain written plans for collecting, managing, and using health data, including strategic, data management, and analytics plans published on its website. The department must establish an opt-out system allowing individuals to suppress their identifiable health data and may not disclose identifiable health data except as specifically authorized by the act.

Took effect 6 May 2026

HB 182: Genetic Information Amendments

Medical facilities and genomic research facilities must not use genetic sequencers or operational and research software produced by, distributed by, or domiciled within foreign adversaries. They must not store genetic sequencing data within foreign adversary boundaries and must ensure data security through encryption and access restrictions. By December 31, 2028, they must provide sworn compliance statements to the attorney general.

Takes effect 1 January 2028

H 639: An act relating to genetic data privacy

Direct-to-consumer genetic testing companies must obtain express consent for collection, use, and disclosure of genetic data; provide clear privacy notices; implement security procedures; enable consumer access and deletion; prohibit service providers from retaining data for other purposes; and refrain from disclosing genetic data to insurance or employment entities without a search warrant or express consent.

Took effect 1 July 2026

H 814: An act relating to neurological rights and the use of artificial intelligence technology in health and human services

Persons must obtain written informed consent before collecting, recording, or sharing neural data from brain-computer interfaces and must not allow brain-computer interfaces to bypass conscious decision-making without specific written consent for each category of action. Health care providers using generative AI for patient communications must include disclaimers and contact instructions. Suppliers of mental health chatbots must protect user data, disclose AI use, and comply with safety and privacy requirements. Health plans using AI for utilization review must base determinations on individual clinical information and not deny services based solely on AI recommendations.

Took effect 1 July 2026

HB 1019: Health Coordination Network Program; patient data collection.

The Commissioner of Health must contract with a nonprofit organization to create, operate, and maintain the Health Coordination Network Program, which receives real-time patient visit information from all hospitals and shares it with participants including health care providers, insurance carriers, and public health agencies to facilitate care coordination and improve quality of care.

Took effect 1 July 2026

HB 603: Virginia All-Payer Claims Database; disclosure of information, limitation.

Data suppliers including health insurers, third-party administrators, and government health plans must submit paid claims data to the Virginia All-Payer Claims Database. The nonprofit organization must protect patient privacy, not disclose provider-specific reimbursement information beyond what is publicly available, and provide affected entities 30 days to review accuracy before public release of reports naming providers or where one provider represents 60 percent or more of data.

Took effect 1 July 2026

HB 1937: Acute psychiatric bed registry; patient privacy and data security, etc.

Every state facility, community services board, behavioral health authority, and private inpatient provider licensed by the Department must participate in the acute psychiatric bed registry and update bed availability information whenever there is a change or at least daily. The Commissioner must create a Bed Registry Advisory Council to review and approve all data access requests and ensure compliance with privacy laws.

Took effect 1 July 2025

SB 1439: Acute psychiatric bed registry; patient privacy and data security, etc.

Every state facility, community services board, behavioral health authority, and private inpatient provider licensed by the Department must participate in the acute psychiatric bed registry and designate employees to submit information about bed availability whenever there is a change or at least daily. The Department must develop and administer the registry and create an Advisory Council to review and approve data access requests.

Took effect 1 July 2025

HB 1382: Modernizing the all payers claim database.

The health care authority must establish or select a lead organization through competitive procurement to coordinate and manage a statewide all-payer health care claims database. Data vendors must collect, process, and secure claims data from carriers, third-party administrators, and public programs. The lead organization must release data only in compliance with privacy protections and established procedures.