Privacy Law Library

Genetic Information Privacy Act

Tenn. GIPA

Genetic · Health

Regulates direct-to-consumer genetic testing companies. They must give clear notice of their genetic data practices, get express consent to collect and use genetic data, get separate consent for third-party transfers, secondary uses, sample retention, and genetic-data-based marketing, and let consumers access and delete their data and have samples destroyed. Disclosure to insurers or employers needs written consent, and law enforcement access requires valid legal process.

Where
Tennessee
Citation
Tenn. Code Ann. §§ 47-18-4901 to 47-18-4906 (2023 Tenn. Pub. Acts ch. 324, HB 1310/SB 1295)
Status
In force
In force since
2023-07-01
Enforced by
Division of Consumer Affairs, Office of the Tennessee Attorney General and Reporter (complaints and rulemaking)
People can sue
No
Penalties
The act assigns enforcement to the Attorney General's Division of Consumer Affairs but sets no specific penalty amount; it does not create a private right of action.
Applies to
  • Direct-to-consumer genetic testing companies that offer genetic testing directly to Tennessee residents, or that collect, use, or analyze genetic data from such products provided by a consumer
  • Exempt: HIPAA protected health information, higher education institutions and entities they own, research hospitals and academic medical centers that are not DTC companies, law enforcement, and research conducted under the Common Rule, ICH GCP, or FDA human-subject rules

What a privacy notice must say

  • Provide essential information about genetic data collection, use, and disclosure and a prominent public privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention, and deletion.Tenn. Code Ann. § 47-18-4904(a)(1)

Rights it gives people

  • Consumers may access their genetic data, delete their account and data, and have their biological sample destroyed.Tenn. Code Ann. § 47-18-4904(a)(6)

Practices it requires

  • Obtain initial express consent that describes use of genetic data, who can access results, and how data may be shared.Tenn. Code Ann. § 47-18-4904(a)(2)
  • Obtain separate express consent for transfers to anyone other than vendors and service providers, uses beyond the primary purpose, and keeping a biological sample after testing.Tenn. Code Ann. § 47-18-4904(a)(3)(A)
  • Obtain Common Rule informed consent for research transfers, and express consent for marketing based on genetic data or on purchase of a genetic test (first-party customized content excepted).Tenn. Code Ann. § 47-18-4904(a)(3)(B)-(C), (b)
  • Require valid legal process before disclosing genetic data to law enforcement or government without the consumer's express written consent.Tenn. Code Ann. § 47-18-4904(a)(4)
  • Do not disclose genetic data to health, life, or long-term care insurers or to the consumer's employer without written consent.Tenn. Code Ann. § 47-18-4905

Security duties

  • Develop, implement, and maintain a comprehensive security program protecting genetic data.Tenn. Code Ann. § 47-18-4904(a)(5)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Whether the Division of Consumer Affairs has promulgated rules under § 47-18-4906 was not checked. | Other Tennessee genetic provisions (for example genetic testing in employment or insurance) were not researched.

Research reference, not legal advice.