Ind. Code ch. 24-4-24

in effect

Ind. Code § 24-4-24-1 "Consumer genetic testing"

Sec. 1. (a) As used in this chapter, "consumer genetic testing" means a service in which a person: (1) provides an individual with a means of submitting a sample of the individual's biological material directly to the person; (2) performs, or causes to be performed, genetic testing on the submitted biological material; and (3) returns the results of the genetic testing directly to the individual. (b) The term does not include genetic testing: (1) of biological material of a patient of a health care provider (as defined in IC 16-18-2-163(a)), the collection and testing of which is: (A) performed at the request or direction of the health care provider for the purpose of the diagnosis, cure, mitigation, treatment, or prevention of a physical or mental illness, injury, disease, disorder, or disability; and (B) subject to the Health Insurance Portability and Accountability Act (HIPAA) (P.L. 104-191); (2) performed as required by a court order; (3) performed for purposes of a law enforcement investigation at the request or direction of a law enforcement agency; (4) performed at the request or direction of a coroner or medical examiner for purposes of investigating the cause of an individual's death; or (5) performed for purposes of research (as defined in 45 CFR 164.501) that is subject to: (A) 21 CFR 50 and 21 CFR 56; or (B) 45 CFR 46. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-2 "Consumer genetic testing provider"

Sec. 2. As used in this chapter, "consumer genetic testing provider" or "provider" means a person that, in the ordinary course of the person's business: (1) offers consumer genetic testing; or (2) collects, uses, or analyzes genetic data that: (A) results from a consumer genetic testing product or service; and (B) is provided to the person by a consumer; in exchange for consideration. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-3 "Deidentified data"

Sec. 3. As used in this chapter, "deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer and that: (1) is subject to: (A) administrative and technical measures to ensure that the data cannot be associated with a particular consumer; (B) public commitment by the holder of the data to: (i) maintain and use the data in deidentified form; and (ii) not attempt to reidentify the data; and (C) legally enforceable contractual obligations that prohibit any recipients of the data from attempting to reidentify the data; or (2) meets requirements for deidentification of the data set forth in 45 CFR 164.514. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-4 "DNA"

Sec. 4. As used in this chapter, "DNA" has the meaning set forth in IC 10-13-6-2. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-5 "Genetic data"

Sec. 5. As used in this chapter, "genetic data" means any data, regardless of format, that: (1) results from the analysis of an individual's biological material, including analysis of: (A) the complete DNA; (B) regions of the DNA; (C) chromosomes; (D) genes; or (E) gene products; and (2) concerns an individual's genetic characteristics. The term does not include deidentified data. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-6 "Genetic testing"

Sec. 6. As used in this chapter, "genetic testing" means analysis of genetic data. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-7 "Insurer"

Sec. 7. As used in this chapter, "insurer" has the meaning set forth in IC 27-1-2-3. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-8 Consumer genetic testing provider privacy policy; required disclosure

Sec. 8. (a) A consumer genetic testing provider may not perform, or cause to be performed, genetic testing on an individual's biological material unless the provider has provided the individual with a written disclosure of the provider's privacy policy, including the provider's policies and procedures regarding the provider's collection, maintenance, security, retention, and use of both biological material sent to the provider and data resulting from genetic testing performed on the biological material. (b) The disclosure under subsection (a) must include complete information regarding the following: (1) The identity of any third party that may perform genetic testing on biological material sent to the third party by the provider. (2) The manner in which: (A) biological material sent to the provider; and (B) data resulting from genetic testing performed on biological material sent to the provider; is stored, transferred, and secured. (3) Any: (A) testing or analysis that the provider performs or causes to be performed on; or (B) other purpose for which the provider uses; biological material sent by an individual to the provider that is in addition to the genetic testing requested by the individual. (4) The: (A) identity of any third party to which the provider provides access to: (i) biological material sent to the provider; or (ii) data resulting from genetic testing performed on biological material sent to the provider; and (B) purpose for which the third party uses the biological material or data. (c) A consumer genetic testing provider shall: (1) publish the disclosure described in subsection (a) on the provider's website; and (2) include on the provider's website prominent directions and hyperlinks to the location of the disclosure on the provider's website. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-9 Acts of consumer genetic testing provider requiring consent of consumer

Sec. 9. (a) A consumer genetic testing provider that performs, or causes to be performed, genetic testing on an individual's biological material may not take any of the following actions unless the provider has solicited and received the individual's freely given, specific, informed, and unambiguous consent to the action: (1) Perform, or cause to be performed, any testing or analysis of the individual's biological material that is not requested by the individual except as required to comply with state and federal law. (2) Use the individual's biological material for any use other than the genetic testing requested by the individual. (3) Subject to section 10(b) of this chapter, provide access by a third party to: (A) the individual's biological material; or (B) data, other than deidentified data, resulting from genetic testing performed on the individual's biological material. (4) Retain the individual's biological material for more than thirty (30) days after the performance of the genetic testing requested by the individual, except as required to comply with state or federal law. (5) Retain data, other than deidentified data, resulting from genetic testing performed on the individual's biological material for more than thirty (30) days after the completion of the service except as required to comply with state and federal law. (6) Disseminate advertising or marketing communications to the individual based on the individual's genetic testing results. (7) Provide information regarding the individual's: (A) solicitation and use of the provider's genetic testing services; or (B) use of the provider's: (i) website; or (ii) other remote or virtual services; associated with the provider's genetic testing services; to a third party to enable the third party to disseminate advertising or marketing communications to the individual. (b) A provider's solicitation of an individual's consent to an action described in subsection (a) must: (1) describe the action in terms that are sufficiently clear and concise as to be reasonably understandable by a person of ordinary intelligence; and (2) solicit the individual's consent to the action separately from a solicitation of the individual's consent to any other action described in subsection (a). (c) Consent to an action under subsection (a) is not freely given, specific, informed, and unambiguous if the consent is provided by any of the following means: (1) The individual's inaction. (2) The individual's acceptance of: (A) general or broad terms of service; or (B) any other document requiring agreement by an individual using the provider's services; containing information unrelated to the action under subsection (a). (3) The individual closing, muting, pausing, or hovering a computer cursor over a piece of content. (4) The individual's communication of consent through an Internet user interface that is designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-10 Obligations of consumer genetic testing provider; prohibition on certain disclosures by genetic testing provider; limitation on assessment of certain costs by consumer genetic testing provider

Sec. 10. (a) A consumer genetic testing provider that performs, or causes to be performed, genetic testing on an individual's biological material shall do the following: (1) Implement commercially reasonable security measures to protect: (A) the individual's biological material; and (B) data resulting from genetic testing performed on the individual's biological material; from unauthorized access, destruction, use, modification, or disclosure. (2) Allow the individual access to any data resulting from genetic testing performed on the individual's biological material. (3) Provide the following: (A) A procedure by which the individual can revoke any consent provided by the individual under section 9 of this chapter. The procedure must enable the individual to communicate the revocation: (i) directly to the provider; and (ii) through one (1) or more means, at least one (1) of which must be the primary means by which the provider communicates with the individual. (B) Both: (i) notice of the existence of; and (ii) instructions regarding the use of; the procedure under clause (A) that are sufficiently clear and concise as to be reasonably understandable by a person of ordinary intelligence. (4) Comply with a revocation of consent by the individual not later than thirty (30) days after the individual communicates the revocation to the provider, including by: (A) destroying the individual's biological material not later than thirty (30) days after the individual revokes the individual's consent to the provider's retention of the biological material under section 9(a)(4) of this chapter; and (B) destroying any data resulting from genetic testing performed on the individual's biological material not later than thirty (30) days after the individual revokes the individual's consent to the provider's retention of the data under section 9(a)(5) of this chapter. (5) Provide a third party with access to the individual's biological material, or to data resulting from genetic testing performed on the individual's biological material, only under contractual terms that prohibit the third party from: (A) using the biological material or data for any use to which the individual has not consented under section 9 of this chapter; (B) providing another party with access to the biological material or data; or (C) retaining the biological material or data longer than the provider is authorized to retain the biological material or data under this chapter. (6) Ensure that: (A) any advertising or marketing communications sent to the individual as a result of the individual's: (i) solicitation and use of the provider's services; or (ii) use of the provider's website or other remote or virtual services; are clearly and prominently denoted as advertising or marketing materials; and (B) advertising or marketing communications described in clause (A) that are sent by a third party clearly and prominently: (i) identify the third party; and (ii) notify the individual that any claims made in the advertising or marketing communications have not been evaluated by the provider. (b) A consumer genetic testing provider may not provide data, other than deidentified data, resulting from genetic testing performed on an individual's biological material to: (1) an insurer; (2) a person that, in the ordinary course of the person's business, provides information or data to insurers for the purposes of underwriting or rating of risks; or (3) a person that employs the individual; regardless of whether the individual has consented to the provider providing third parties with access to the data under section 9(a)(3) of this chapter. (c) A consumer genetic testing provider may not charge a fee for the provision of biological material or for the provision of data resulting from genetic testing performed on biological material: (1) to a law enforcement agency on the basis of a search warrant; or (2) as required by a court order; that is more than the actual cost, not including labor costs or overhead costs, to the consumer genetic testing provider of providing the material or data. As added by P.L.233-2025, SEC.2.

Ind. Code § 24-4-24-11 Enforcement; remedies

Sec. 11. (a) The attorney general has exclusive authority to enforce the provisions of this chapter. (b) The attorney general may initiate an action in the name of the state and may seek an injunction to restrain any violations of this chapter and a civil penalty not to exceed seven thousand five hundred dollars ($7,500) for each violation under this chapter. (c) The attorney general may recover reasonable expenses incurred in investigating and preparing the case, including attorney's fees, in any action initiated under this section. (d) Before initiating an action under this section, the attorney general shall provide a provider thirty (30) days written notice identifying the specific provisions of this chapter that the attorney general alleges have been or are being violated. If, within the thirty (30) day period set forth in this subsection, the provider: (1) cures the alleged violation; and (2) provides the attorney general an express written statement that: (A) the alleged violation has been cured; and (B) actions have been taken to ensure no further such violations will occur; the attorney general shall not initiate an action against the provider. (e) If a provider: (1) continues an alleged violation following the thirty (30) day period set forth in subsection (d); or (2) breaches an express written statement provided to the attorney general under subsection (d)(2); the attorney general may initiate an action against the provider under subsection (b). (f) Nothing in this section may be construed as providing the basis for a private right of action for violations of this chapter or any other law. As added by P.L.233-2025, SEC.2.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/24Fetched: 10/17/2026