Genetic Privacy Laws: GINA, Its Gaps, and DNA Databases

Genetic privacy laws in the United States protect you unevenly. The Genetic Information Nondiscrimination Act (GINA) blocks health insurers and most employers from using your DNA against you, and HIPAA guards genetic data held by doctors and health plans. Life insurers, disability carriers, long-term care insurers, direct-to-consumer testing companies, and law enforcement operate under thinner rules, and in some cases almost none. Who can reach your genetic information depends on where the data sits, what the accessor wants to do with it, and whether you ever agreed to hand it over.

What GINA Protects

GINA, passed in 2008, is the main federal genetic privacy statute.¹ It defines “genetic information” broadly, covering not just your own test results but your family members’ results and your family medical history, because family history is routinely used to estimate future risk.²

Health Insurance

Title I of GINA bars health insurers from using genetic information to decide eligibility, set premiums, or impose pre-existing condition exclusions. Health plans also cannot require you to take a genetic test as a condition of enrollment. Enforcement sits with the Departments of Labor, Health and Human Services, and the Treasury.² The HIPAA Privacy Rule reinforces this by prohibiting health plans from using genetic information for underwriting, including eligibility, premium calculations, pre-existing condition exclusions, and coverage renewal decisions.³

Employment

Title II makes it illegal for an employer to use genetic information in hiring, firing, pay, promotions, job assignments, or any other employment decision.² Employers also cannot request, require, or purchase genetic information about you or your family, with narrow exceptions: inadvertent disclosures (a coworker mentions a relative’s illness), workplace genetic monitoring for toxic exposure with your written consent, and family history needed to process federal or state family and medical leave.⁴

There is a size threshold. Title II applies only to employers with 15 or more employees, along with state and local governments, employment agencies, and labor organizations.⁵ Workers at smaller employers may need to rely on state law.

The “Manifested Condition” Limit

GINA protects against discrimination based on genetic predisposition, not based on a diagnosis that has already appeared. A health insurer cannot raise your premium because you carry the BRCA gene, but once a condition has actually manifested, GINA’s protections no longer apply to that diagnosis.⁶ Other laws, such as the Affordable Care Act’s pre-existing condition protections, cover the manifested-condition scenario for health coverage, but the line matters for employment and for insurance types GINA does not touch.

Genetic Data in Your Medical Record

When a doctor orders a genetic test, the results become part of your medical record and fall under HIPAA. Genetic data held by covered entities such as hospitals, physician offices, and health plans counts as Protected Health Information and gets the same treatment as the rest of your chart.³

Providers generally cannot share your genetic information without your written authorization. The main exceptions permit sharing for treatment, payment, and routine healthcare operations. HIPAA also allows disclosure in limited circumstances such as public health reporting, judicial proceedings under a court order, and certain law enforcement requests. You keep the right to access your genetic records and to request that errors be corrected.

Where the Federal Shield Runs Out

The gaps in the federal framework are where most real-world genetic privacy problems live.

Life, Disability, and Long-Term Care Insurance

GINA does not reach life insurance, disability insurance, or long-term care insurance.⁷ Carriers in those markets can legally ask for genetic test results and factor them into underwriting. A test showing elevated risk for a serious condition can influence whether you are offered a policy and what you pay for it. Some states restrict this use, but there is no federal ban. Because a result cannot be un-shared once it is disclosed, this is worth thinking through before you agree to a test.

Direct-to-Consumer Testing Companies

Companies that sell ancestry and health-risk kits online generally are not HIPAA-covered entities, so the Privacy Rule does not apply to them. Your DNA data at one of these companies sits under a different, thinner set of rules.

The Federal Trade Commission polices deceptive or unfair practices, including misleading privacy policies and weak data security. In a 2023 action against 1Health (formerly Vitagene), the FTC charged the company with leaving genetic and health data unsecured, misleading consumers about their ability to delete data, and retroactively changing its privacy policy without adequate notice or consent.⁸ The lesson for consumers: a privacy policy is a binding commitment, and a company cannot lawfully rewrite it after the fact to cover data already collected.

Testing companies not covered by HIPAA can still fall under the FTC’s Health Breach Notification Rule, which requires companies maintaining personal health records to notify affected consumers, the FTC, and sometimes the media when covered health information is acquired without authorization.⁹ The rule reaches services that track genetic information, and “unauthorized acquisition” includes a company sharing covered information without the user’s authorization, not just outside hacking.¹⁰

A growing number of states have enacted genetic privacy laws aimed at DTC companies. They typically require separate, informed consent before a company can collect, use, or share your genetic data, and they give you rights to access your raw data, delete your account, and have your biological sample destroyed. Coverage varies by state, so check the law where you live.

If a testing service collects personal information from children under 13 online, the Children’s Online Privacy Protection Rule (COPPA) requires verifiable parental consent before collection.¹¹ Given the permanence of DNA data, parental caution is warranted regardless of the specific service.

When Law Enforcement Wants Your DNA

Police and federal investigators reach genetic data through two very different channels.

The CODIS Database

The Combined DNA Index System (CODIS) is an FBI-run database of DNA profiles from convicted offenders, arrestees, crime-scene evidence, unidentified remains, and missing persons and their relatives.¹² It exists strictly for identification, is walled off from commercial genetic testing data, and is accessible only to government forensic labs meeting FBI quality standards.

Forensic Genetic Genealogy

Investigators increasingly upload crime-scene DNA to public genealogy databases to find distant relatives of an unknown suspect and work backward through family trees. This is the technique that identified the Golden State Killer in 2018.

The Department of Justice’s interim policy limits federal and federally funded use of forensic genetic genealogy (FGG) to unsolved violent crimes, mainly homicides and sexual offenses, and to identifying unidentified remains believed to be homicide victims. A prosecutor can authorize FGG for other violent crimes only when the situation presents a substantial and ongoing threat to public safety or national security. Before FGG can be used, the forensic profile must already have been searched through CODIS without a match, reasonable leads must have been pursued, and investigators must identify themselves as law enforcement to the genealogy service and search only databases that clearly notify users of possible law enforcement access.¹³

GEDmatch, the platform most associated with these searches, moved to an opt-in model in May 2019. Users decide whether their profile can be compared against law enforcement submissions in violent-crime cases; selecting “Public Opt-out” keeps your profile out of criminal-suspect searches, though it may still be used to identify unidentified remains.¹⁴

The Constitutional Question

In Carpenter v. United States (2018), the Supreme Court held that the government generally needs a warrant to access certain digital records held by third parties when the person has a legitimate privacy interest in them. The Court cited the “deeply revealing nature” and “comprehensive reach” of digital data.¹⁵ The case involved cellphone location data, and courts have not yet definitively decided whether its reasoning requires a warrant for commercial genetic databases, but the direction of the law favors stronger third-party protections.

One separate concern has no clear legal remedy. When you upload your DNA to a public genealogy platform, you also make your close relatives partially identifiable. A cousin who never tested can still become a lead. No current law requires their consent, and none gives them a way to object.

If Your Genetic Privacy Is Violated

For a suspected GINA Title II violation by an employer, file a charge with the Equal Employment Opportunity Commission. The deadline is 180 days from the alleged violation, extended to 300 days where a state or local agency enforces a comparable law.¹⁶ The EEOC investigates, attempts settlement or mediation, and either files suit on your behalf or issues a Notice of Right to Sue that lets you bring a federal court action within 90 days.

Remedies under Title II track Title VII of the Civil Rights Act: reinstatement, back pay, injunctive relief, and compensatory and punitive damages. Combined compensatory and punitive damages are capped by employer size, from $50,000 for employers with 15 to 100 employees up to $300,000 for employers with more than 500.¹⁶

Violations by health insurers under GINA Title I are handled by the Departments of Labor, Health and Human Services, and the Treasury rather than the EEOC. Complaints about DTC testing companies go to the FTC for deceptive or unfair practices, and to your state attorney general where state genetic privacy laws apply. Of all these deadlines, the 180-day employment window is the one that catches people out; if that is the route you need, move fast.

1
U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008
2
U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination
3
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information: General Rules
4
Office of the Law Revision Counsel. 42 U.S. Code 2000ff-1 – Employer Practices
5
U.S. Equal Employment Opportunity Commission. Fact Sheet: Genetic Information Nondiscrimination Act
6
U.S. Department of Health and Human Services. Genetic Information Nondiscrimination Act (GINA): OHRP Guidance
7
National Human Genome Research Institute. Genetic Discrimination
8
Federal Trade Commission. FTC Says Genetic Testing Company 1Health Failed to Protect Privacy and Security of DNA Data and Unfairly Changed Its Privacy Policy
9
Federal Trade Commission. Complying with FTCs Health Breach Notification Rule
10
eCFR. 16 CFR Part 318 – Health Breach Notification Rule
11
Federal Trade Commission. Childrens Online Privacy Protection Rule (COPPA)
12
Federal Bureau of Investigation. CODIS and NDIS Fact Sheet
13
U.S. Department of Justice. Interim Policy: Forensic Genetic Genealogical DNA Analysis and Searching
14
GEDmatch. Privacy and Security
15
Supreme Court of the United States. Carpenter v. United States, 585 U.S. 296 (2018)
16
U.S. Equal Employment Opportunity Commission. Questions and Answers for Small Businesses: EEOC Final Rule on Title II of the Genetic Information Nondiscrimination Act