42 U.S.C. § 2000ff–5 — Confidentiality of genetic information

**(a) Treatment of information as part of confidential medical record** If an employer, employment agency, labor organization, or joint labor-management committee possesses genetic information about an employee or member, such information shall be maintained on separate forms and in separate medical files and be treated as a confidential medical record of the employee or member. An employer, employment agency, labor organization, or joint labor-management committee shall be considered to be in compliance with the maintenance of information requirements of this subsection with respect to genetic information subject to this subsection that is maintained with and treated as a confidential medical record under [section 12112(d)(3)(B) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section12112/d/3/B&num=0&edition=prelim). **(b) Limitation on disclosure** An employer, employment agency, labor organization, or joint labor-management committee shall not disclose genetic information concerning an employee or member except— (1) to the employee or member of a labor organization (or family member if the family member is receiving the genetic services) at the written request of the employee or member of such organization; (2) to an occupational or other health researcher if the research is conducted in compliance with the regulations and protections provided for under part 46 of title 45, Code of Federal Regulations; (3) in response to an order of a court, except that— (A) the employer, employment agency, labor organization, or joint labor-management committee may disclose only the genetic information expressly authorized by such order; and (B) if the court order was secured without the knowledge of the employee or member to whom the information refers, the employer, employment agency, labor organization, or joint labor-management committee shall inform the employee or member of the court order and any genetic information that was disclosed pursuant to such order; (4) to government officials who are investigating compliance with this chapter if the information is relevant to the investigation; (5) to the extent that such disclosure is made in connection with the employee’s compliance with the certification provisions of [section 2613 of title 29](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title29-section2613&num=0&edition=prelim) or such requirements under State family and medical leave laws; or (6) to a Federal, State, or local public health agency only with regard to information that is described in [section 2000ff(4)(A)(iii) of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section2000ff/4/A/iii&num=0&edition=prelim) and that concerns a contagious disease that presents an imminent hazard of death or life-threatening illness, and that the employee whose family member or family members is or are the subject of a disclosure under this paragraph is notified of such disclosure. **(c) Relationship to HIPAA regulations** With respect to the regulations promulgated by the Secretary of Health and Human Services under part C of title XI of the Social Security Act ([42 U.S.C. 1320d](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d&num=0&edition=prelim) et seq.) and section 264 of the Health Insurance Portability and Accountability Act of 1996 ([42 U.S.C. 1320d–2](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-2&num=0&edition=prelim) note), this chapter does not prohibit a covered entity under such regulations from any use or disclosure of health information that is authorized for the covered entity under such regulations. The previous sentence does not affect the authority of such Secretary to modify such regulations.