42 U.S.C. § 2000ff–5 — Confidentiality of genetic information

(a) An employer^*, employment agency^*, labor organization^*, or joint labor-management committee that has genetic information^* about an employee^* or member must keep it on separate forms and in separate medical files and treat it as a confidential medical record. It complies with this maintenance requirement if the information is maintained and treated as a confidential medical record under section 12112(d)(3)(B).

(b) Such an entity may not disclose genetic information except: (1) to the employee or labor-organization member, or to a family member^* receiving genetic services^*, at the employee’s or member’s written request; (2) to an occupational or other health researcher whose research follows part 46 of title 45, Code of Federal Regulations; (3) in response to a court order, but only the information expressly authorized, and, if the employee or member did not know about the order, after informing that person of the order and disclosure; (4) to government officials investigating compliance with this chapter when relevant; (5) as needed for the employee’s compliance with section 2613 of title 29 or State^* family-and-medical-leave requirements; or (6) to a Federal, State, or local public-health agency about information described in section 2000ff(4)(A)(iii) concerning a contagious disease presenting an imminent death or life-threatening-illness hazard, if the employee whose family member is the subject is notified.

(c) This chapter does not prohibit a covered entity from using or disclosing health information when authorized by regulations issued under part C of title XI of the Social Security Act and section 264 of HIPAA. This does not limit the Secretary^* of Health and Human Services’ authority to change those regulations.