Privacy Law Library

Genetic Information Privacy Act (Part 1) and Genetic Testing and Procedure Privacy Act (Part 2)

Utah GIPA

Genetic · Employees

Part 1 regulates direct-to-consumer genetic testing companies: public privacy notice, express consent for use and sharing, separate consent for transfers, secondary uses, sample retention and marketing, and consumer access and deletion. Part 2 restricts employer and health-insurer use of genetic testing information and carries a private right of action.

Where
Utah
Citation
Utah Code Title 13, Chapter 60 (13-60-101 to 13-60-106; 13-60-203 to 13-60-207)
Status
In force
In force since
2021-05-05
Last amended
2023-05-03
Enforced by
Utah Attorney General
People can sue
Limited
Penalties
Part 1: actual damages, costs, attorney fees, and $2,500 per violation, AG only (13-60-106). Part 2: private action for actual damages, $100,000 for intentional and willful violations or punitive damages for malicious ones, plus fees (13-60-206); AG injunctions and fines up to $25,000 per intentional violation (13-60-207).
Applies to
  • Part 1: direct-to-consumer genetic testing companies that offer testing directly to consumers or collect, use, or analyze genetic data consumers provide, for Utah residents (13-60-102(2), (4))
  • Part 1 excludes PHI held by HIPAA covered entities or business associates and higher-education institutions (13-60-103)
  • Part 2: employers (13-60-204) and health insurers (13-60-205)

What a privacy notice must say

  • Provide essential information about genetic data collection, use, and disclosure, and a prominent, publicly available privacy notice on collection, consent, use, access, disclosure, transfer, security, retention, and deletion.Utah Code 13-60-104(1)(a)
  • Obtain initial express consent that describes use of genetic data, who can access test results, and how the data may be shared.Utah Code 13-60-104(1)(b)
  • Obtain separate express consent for transfers beyond vendors and service providers, uses beyond the primary purpose, and retaining the biological sample after testing.Utah Code 13-60-104(1)(c)(i)
  • Obtain Common Rule (45 C.F.R. Part 46) informed consent before transferring genetic data for research.Utah Code 13-60-104(1)(c)(ii) · Only if: Company shares genetic data for research
  • Obtain express consent for marketing based on genetic data or third-party marketing based on a test order or purchase.Utah Code 13-60-104(1)(c)(iii), (2) · Only if: Company markets based on genetic data or test purchases

Rights it gives people

  • Provide a process to access genetic data, delete the account and data, and have the biological sample destroyed.Utah Code 13-60-104(1)(f)

Practices it requires

  • Employers and health insurers must follow Part 2 restrictions on genetic testing and information.Utah Code 13-60-204, 13-60-205
  • Require valid legal process before disclosing genetic data to law enforcement or government without express written consent.Utah Code 13-60-104(1)(d)
  • Do not disclose genetic data to health, life, or long-term-care insurers or to employers without written consent.Utah Code 13-60-105

Security duties

  • Maintain a comprehensive security program for genetic data.Utah Code 13-60-104(1)(e)

Sources

Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.

Unverified: effective_date 2021-05-05 is taken from the 13-60-101 version file (C13-60-S101_2021050520210505, enacted 2021 ch. 361); Part 2's original enactment date predates its 2023 renumbering and was not recorded.

Research reference, not legal advice.