The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 002 : Genetic Information Privacy

• § 2421d. Applicability

  (a) The provisions of this subchapter shall not reduce a direct-to-consumer genetic testing company’s duties, obligations, requirements, or standards under any applicable State and federal laws for the protection of privacy and security.

  (b) In the event of a conflict between the provisions of this subchapter and any other law, the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control.

  (c) This subchapter shall not apply to any of the following:

  (1) protected health information that is collected, maintained, used, or disclosed by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5;

  (2) a covered entity governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, to the extent that the provider or covered entity maintains, uses, and discloses genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection;

  (3) a business associate of a covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, to the extent that the business associate maintains, uses, and discloses genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection;

  (4) scientific research or educational activities conducted by a public or private nonprofit postsecondary educational institution that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46, to the extent that the scientific research and educational activities conducted by that institution comply with all applicable federal and State laws and regulations for the protection of human subjects in research, including the Common Rule pursuant to 45 C.F.R. Part 46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56, and the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g;

  (5) tests conducted exclusively to diagnose whether an individual has a specific disease, to the extent that all persons involved in the conduct of the test maintain, use, and disclose genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection; and

  (6) genetic data used or maintained by an employer, or disclosed by an employee to an employer, to the extent that the use, maintenance, or disclosure of that data is necessary to comply with a local, State, or federal workplace health and safety ordinance, law, or regulation.

  (d) Nothing in this subchapter shall be construed to affect access to publicly available information. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)