Illinois Genetic Information Privacy Act: Consent and Damages

The Illinois Genetic Information Privacy Act, codified at 410 ILCS 513, controls how employers, insurers, health care providers, and genetic testing companies collect, use, and share genetic information about people in Illinois. Individuals can sue directly under the statute and recover $2,500 for each negligent violation or $15,000 for each intentional or reckless violation, plus attorney fees.¹ Those per-violation numbers are what make GIPA one of the more aggressive genetic privacy laws in the country.

Who and What the Law Covers

GIPA reaches a wide set of actors. “Employer” covers every person or organization employing workers within Illinois, along with state and local government, school districts, and parties to public contracts. Insurers, managed care plans, health care providers, and employment agencies are each separately defined and regulated. The definition of “genetic testing” expressly includes direct-to-consumer commercial testing, so ancestry and health-screening services fall within the statute.²

Rather than write its own definition, GIPA borrows the HIPAA definition of “genetic information” at 45 CFR 160.103.² That federal definition sweeps in the results of an individual’s genetic tests, family members’ genetic tests, family medical history, and requests for or receipt of genetic services. The statute uses the same HIPAA cross-reference for “disclosure,” “de-identified information,” and “genetic services.”

The statute does not include an explicit extraterritorial jurisdiction clause. Illinois courts have allowed out-of-state plaintiffs to bring GIPA claims when the disputed conduct occurred primarily and substantially in Illinois, looking at where the company’s policy was carried out. Out-of-state companies with Illinois-based operations should treat GIPA as applying to that Illinois activity.

Written Consent Is the Baseline

GIPA treats genetic testing results as confidential and privileged. The results may be released only to the person who was tested and to individuals specifically authorized in writing by that person.³ Without a written authorization, genetic testing information generally cannot be admitted as evidence or discovered in a legal proceeding.

Verbal consent doesn’t cut it. Section 30 requires a “specific written legally effective authorization” executed by the tested individual or their legal representative, naming who may receive the results. Any organization handling genetic data should build that written consent step into intake, disclosure, and data-sharing workflows.

What Employers Cannot Do

An employer, employment agency, labor organization, or licensing agency cannot solicit, request, require, or purchase genetic testing or genetic information from a person or a family member as a condition of employment, a job application, union membership, or licensure.⁴

Employers also cannot use genetic information to change the terms, conditions, or privileges of employment. Firing, demoting, or refusing to hire based on genetic data violates the statute. The law prohibits segregating or classifying employees in ways that would deprive them of opportunities based on genetic information, and it bars retaliation against anyone who alleges a violation or takes part in a GIPA proceeding.⁴

Genetic monitoring is a place employers slip up. GIPA defines it as periodic testing of employees to detect chromosomal damage or mutations from workplace exposure to toxic substances.² Even in industries where exposure monitoring is routine, that monitoring cannot cross into prohibited genetic data collection.

What Insurers Cannot Do

Insurers cannot seek information derived from genetic testing for use in connection with accident and health insurance policies. If an insurer receives genetic information from any other source, it still cannot use that information for any “nontherapeutic purpose” related to an accident and health policy.⁵

The underwriting prohibition is specific. Insurers cannot use genetic information to determine eligibility, compute premiums, apply pre-existing condition exclusions, or make decisions about creating or renewing a health insurance contract. There is one narrow exception: an insurer may consider genetic test results the individual voluntarily submits when those results are favorable to that individual.⁵

Direct-to-consumer testing companies face a matching restriction on the other side of the transaction: they cannot share genetic information with insurers without the individual’s written consent.²

The Long-Term Care Gap

The health insurance underwriting prohibition in Section 20(b) does not apply to insurers issuing long-term care policies, other than nursing home fixed indemnity plans.⁵ A long-term care insurer can potentially factor genetic information into underwriting in ways a health insurer cannot.

Life and Disability Coverage

Federal law offers no backstop here. The Genetic Information Nondiscrimination Act (GINA) prohibits genetic discrimination in health insurance and employment, but does not cover life insurance, long-term care insurance, or disability insurance.⁶ If you’re shopping for life or disability coverage in Illinois, GIPA’s insurer protections are focused on health insurance, and federal law does not fill the remaining gap.

When Genetic Information Can Be Disclosed

The confidentiality rule has carve-outs. Genetic information can be disclosed or admitted without the individual’s consent in several situations:

When a biological sample is legally obtained by a police officer for a criminal investigation or prosecution, the results may be disclosed to law enforcement and used as evidence. If the individual is later found innocent or not penalized, the court must expunge the records within 30 days.³
In lawsuits alleging a GIPA violation, claims under the Illinois Human Rights Act or the Illinois Civil Rights Act of 2003, enforcement actions under the Illinois Insurance Code, and workers’ compensation claims, genetic testing information is admissible and discoverable subject to a protective order.³
Test results showing that a person currently has a disease, with or without symptoms, fall outside the confidentiality protections entirely.³
DNA testing used to determine inherited characteristics in paternity cases is not restricted.²

The current-disease exception is worth pausing on. A result flagging a future risk of Alzheimer’s stays confidential. A result showing a currently diagnosable condition does not. The line between predisposition and present disease changes how the same lab report is treated under the law.

Damages and How the Math Works

GIPA gives individuals a direct path to court. A person harmed by a violation can file in Illinois circuit court or as a supplemental claim in federal court, and a prevailing plaintiff can recover:¹

Liquidated damages of $2,500 or actual damages, whichever is greater, for negligent violations.
Liquidated damages of $15,000 or actual damages, whichever is greater, for intentional or reckless violations.
Reasonable attorney fees, expert witness fees, and other litigation expenses.
Injunctive relief and any other relief the court considers appropriate.

The “per violation” language is what turns GIPA into a serious financial exposure for employers and testing companies that process genetic data at scale. If a company negligently mishandles the genetic information of hundreds of people, the $2,500 floor applies to each violation separately.

Hospitals, physicians, and other health care providers who comply with the statute, including honoring a proper written release, are not liable.³

How GIPA Differs From Federal GINA

GINA covers genetic discrimination in health insurance under Title I and employment under Title II, with the EEOC enforcing the employment side.⁷ Federal health insurers cannot use genetic information to determine eligibility, set premiums, or make coverage decisions.⁶

GIPA goes further in three ways that matter. It gives individuals a private right of action with specific liquidated damages, while GINA’s employment provisions run primarily through the EEOC’s administrative complaint process. It covers licensing agencies, so occupational licensing bodies in Illinois cannot require genetic testing or use genetic information to deny a license. And its confidentiality framework makes genetic results privileged and generally inadmissible in court, a protection GINA does not offer.

The two laws also part ways on employer size. GINA applies only to employers with 15 or more employees. GIPA’s definition of “employer” reaches “every other person employing employees within the State,” without an explicit small-employer threshold.² A small Illinois business with no federal GINA obligation can still face full liability under state law.

Practical Compliance Steps

For employers, the safest rule is to avoid collecting genetic information at all. Keep family medical history questions off any health form tied to employment. If a wellness program includes health assessments, review the intake so genetic information isn’t requested even inadvertently. Train HR staff to recognize what counts as genetic information under the HIPAA definition, which is broader than most people expect.

For insurers and managed care organizations, the work is in the underwriting pipeline. Build system controls that keep genetic test results from flowing into eligibility or premium-setting steps. If you’re relying on the narrow voluntary-and-favorable exception, the emphasis is on “voluntarily”: no pressure, incentives, or conditions that could blur that line.

For direct-to-consumer testing companies, the core obligation is keeping genetic data away from insurers absent written consent, whether the insurer asks for it or the company initiates the sharing. Terms of service and third-party data-sharing agreements should be reviewed against GIPA’s consent requirements.

Across the board, keep clean documentation of written authorizations, log who accesses genetic information and when, and make sure individuals can see exactly what they are agreeing to before they sign. The written authorization is the legal foundation for any permissible disclosure, and a missing or defective one is the kind of gap that creates per-violation exposure.

1
Illinois General Assembly. Illinois Code 410 ILCS 513 – Genetic Information Privacy Act
2
Justia Law. Illinois Code 410 ILCS 513 – Genetic Information Privacy Act
3
FindLaw. Illinois Code 410 ILCS 513/15 – Confidentiality of Genetic Information
4
Illinois General Assembly. Illinois Code 410 ILCS 513/25 – Use of Genetic Testing Information by Employers
5
FindLaw. Illinois Code 410 ILCS 513/20 – Use of Genetic Testing Information for Insurance Purposes
6
National Human Genome Research Institute. Genetic Discrimination
7
U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination