Law / United States / 
Utah
Genetic sequencing, storage of genetic information (HB 182)
Utah Code 26B-2-250 (enrolled as 26B-2-244 in HB 182, 2026 General Session)
A cross border transfer rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Beginning , if you operate a medical facility or genomic research facility, do not store Utah genetic-sequencing data within the territory of a designated foreign adversary, and do not use a genetic sequencer or sequencing software that is a final product of a foreign adversary.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does "operational and research software" in section 26B-2-244(1)(j) reach general-purpose analysis software, such as a machine-learning library, that a facility runs on genetic sequencing data?
What it makes you log
Logging duty
Section 26B-2-244 bars a medical facility or genomic research facility from using a genetic sequencer or software produced or distributed by a foreign adversary, bars storing genetic sequencing data within a foreign adversary's boundaries, requires reasonable encryption and access restrictions on stored data, and requires each facility to give the Attorney General and the department a sworn statement that it complies, by and every 10 years. A sworn statement of compliance is a party's own filing and requires no record to be kept, and it is not an audit by anyone. The Attorney General may investigate a reported violation and sue, and no power to demand records is stated. The bill takes effect . One prong of the definition of medical facility is a facility registered to provide health care services in the state, which is the only territorial hook the text states; the other prongs, public funding and genetic research, state none.
- Kind
- None
- As of
What this law does
Effective . Bars a medical facility or genomic research facility from using a genetic sequencer or sequencing software that is a final product of, or distributed by, a foreign adversary, its state-owned enterprise, or a person domiciled there.
Bars storing genetic-sequencing data within the territory of a foreign adversary, and bars remote access to stored sequencing data from within a foreign adversary absent written department approval, with an exemption for open, public-domain data and for certain clinical-trial data.
Requires a sworn compliance statement to the Attorney General and the state health department every 10 years, though that reporting duty does not apply to an entity already covered by the Genetic Information Privacy Act. The Attorney General has sole enforcement authority; fines of 10,000 dollars per violation become enforceable .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .