Genetic Testing and Procedure Privacy Act: restrictions on health insurers

Except as Subsection (2) provides, an insurer offering health care insurance may not in connection with the offer or renewal of an insurance product or in the determination of premiums, coverage, renewal, cancellation, or any other underwriting decision that pertains directly to the individual or any group of which the individual is a member that purchases insurance jointly, access or otherwise take into consideration private genetic information about an asymptomatic individual, request or require an asymptomatic individual to consent to a release for the purpose of accessing it, request or require an asymptomatic individual or the individual's blood relative to submit to a genetic test, or inquire into or otherwise take into consideration the fact that an asymptomatic individual or the individual's blood relative has taken or refused to take a genetic test.

An insurer offering health care insurance may not request or require an individual or the individual's blood relative to submit to a genetic procedure, and may not inquire into the results of a genetic procedure that an individual or the individual's blood relative undergoes. An insurer may request information regarding the necessity of a genetic test, but not the results of the test, if a claim for payment for the test has been made against an individual's health insurance policy.

An insurer may only store information obtained under Subsection (2) in accordance with the Health Insurance Portability and Accountability Act of 1996, and may only use or otherwise disclose it in connection with a proceeding to determine the obligation of an insurer to pay for a genetic test or health care services, making a reasonable effort to limit disclosure to the minimum necessary to carry out the purposes of the disclosure.

Nothing in the section may be construed as restricting the ability of an insurer to use information other than private genetic information to take into account the health status of an individual, group, or population in determining premiums or making other underwriting decisions.

Information maintained by an insurer about an individual under the section may be redisclosed to protect the interests of the insurer in detecting, prosecuting, or taking legal action against criminal activity, fraud, material misrepresentations, and material omissions, to enable business decisions to be made about the purchase, transfer, merger, reinsurance, or sale of all or part of the insurer's business, and to the commissioner of insurance upon formal request.

Any insurance company who violates the legal rights of an individual arising from the part is liable for each separate violation for actual damages sustained, $100,000 if the violation is the result of an intentional and willful act or punitive damages if the violation is the result of a malicious act, and reasonable attorneys' fees.

The attorney general may bring an action to restrain or enjoin a violation, and the court may, after June 30, 2003, require the payment of a civil fine of not more than $25,000 for each separate intentional violation. The section was renumbered and amended by Chapter 327, 2023 General Session.