Law / United States / 
Missouri
Genetic information, insurer and employer restrictions, confidentiality duty
Mo. Rev. Stat. Secs. 375.1300, 375.1303, 375.1306, 375.1309
In force since , effective .
A sensitive categories rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Do not require or request an individual's or their blood relative's genetic information or a genetic test, or consider genetic information or a genetic test result without the individual's approval, when making a health-plan eligibility, premium, coverage, or renewal decision.
- Do not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, unless a statutory exception applies.
- Hold any genetic information you create, store, receive, or furnish in the ordinary course of business, a profession, or a service as a confidential medical record, and do not disclose it without the individual's written authorization.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a person that holds genetic information only to provide a consumer-facing service, with no insurer or employer role, one who "creates, stores, receives or furnishes genetic information" in "the ordinary course of business" under Mo. Rev. Stat. ยง 375.1309.1?
What it makes you log
Logging duty
Sections 375.1300 to 375.1309 bar an insurer from requiring or requesting genetic information or a genetic test, or considering it without approval, for a health plan (375.1303), bar an employer from using genetic information to discriminate (375.1306), and require a person who creates, stores, receives or furnishes genetic information to hold it as confidential medical records and not disclose it without written authorization (375.1309). A duty to keep information confidential, and a written authorization to disclose, are conditions on use and state no record the holder must keep. The director's power to issue orders or sue (375.1309, subsections 2 and 3) is enforcement and names no demand for a record. Section 375.1303, subsection 3 applies the insurer rule to coverage of residents of the state.
- Kind
- None
- As of
What this law does
Within the insurance code, Missouri separately restricts the use and disclosure of genetic information, defined as the results of a genetic test (Sec. 375.1300).
An insurer may not, in connection with the offer, sale, or renewal of a health plan, require or request a person or their blood relative to provide genetic information or take a genetic test, or consider genetic information or a genetic test without the person's approval, in determining eligibility, premiums, or coverage (Sec. 375.1303, effective since ); a violation is enforced as an unfair trade practice.
An employer may not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, except for underwriting individual or group life, disability income, or long-term care insurance, action required by law, action taken with written permission, or use of information directly related to job responsibilities (Sec. 375.1306).
Any person who, in the ordinary course of business, a profession, or rendering a service, creates, stores, receives, or furnishes genetic information must hold it as a confidential medical record and may not disclose it without the individual's or their authorized representative's written authorization, except for de-identified statistical data, federally regulated health research, release under legal or regulatory process, or body identification (Sec. 375.1309).
Sections 375.1306 and 375.1309 were both added by the original 1998 enactment and substantially amended by Laws 2007, S.B. 66, effective . Neither the employer restriction nor the confidentiality duty is limited to private employers or private handlers of genetic information on its face.
Enforcement of Secs. 375.1303, 375.1306, and 375.1309 runs to the Director of the Department of Commerce and Insurance, who may issue administrative orders or bring a civil action for an injunction and other relief under Mo. Rev. Stat. Secs. 374.046 and 374.048; none of these sections creates a private right of action.
When LexLint raises it
When your app profile says your app is an insurer, makes employment decisions, makes insurance decisions or processes personal data.
Back to the example · Lint your app
Page updated .