Alabama Donor Gamete Matching and Privacy Laws: What REI Programs Need to Know

Parental Status of Donor

Under Alabama’s Uniform Parentage Act, a “donor” is an individual who produces eggs or sperm used for assisted reproduction. Critically, when a donor provides gametes to a licensed physician for use by a married woman, the donor is not a legal parent of any resulting child. Your consent paperwork and protocols should reflect these assisted reproduction parental rights so donors and intended parents understand the boundaries from the outset. ([law.justia.com](https://law.justia.com/codes/alabama/title-26/chapter-17/article-1/section-26-17-102/?utm_source=openai))

If a husband provides sperm for, or consents to, assisted reproduction by his wife, he is the legal father of the resulting child. Maintain a signed record of consent, retained by the licensed physician, to avoid downstream disputes about status. ([alison.legislature.state.al.us](https://alison.legislature.state.al.us/code-of-alabama?section=26-17-703&utm_source=openai))

Posthumous scenarios are addressed explicitly: if a spouse dies before placement of eggs, sperm, or embryos, the deceased spouse is not a parent unless that spouse consented in a signed record (kept by the assisting physician) to be treated as a parent if assisted reproduction occurs after death. Your forms should capture this choice clearly. ([law.justia.com](https://law.justia.com/codes/alabama/title-26/chapter-17/article-7/section-26-17-707/?utm_source=openai))

Confidentiality of Genetic Information

Alabama law makes it a Class A misdemeanor to intentionally release an identifiable genetic specimen collected for a parentage proceeding without a court order or written permission from the individual who furnished the specimen. Safeguard chain-of-custody and disclosure pathways in paternity-related testing to honor this genetic testing confidentiality mandate. ([law.justia.com](https://law.justia.com/codes/alabama/title-26/chapter-17/article-5/section-26-17-511/?utm_source=openai))

For direct-to-consumer (DTC) genetic data that patients or donors may share with your program, Alabama’s Genetic Data Privacy Act requires clear notices, express or informed genetic data consent requirements for specified uses, and consumer controls to access, delete, and request destruction of a biological sample. Build intake workflows that verify a DTC company’s consent artifacts before ingesting such data. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/?utm_source=openai))

Within covered clinical operations, HIPAA governs protected health information. Align your internal policies and disclosures with HIPAA standards for privacy and security while recognizing how these obligations interact with Alabama statutes described here. ([mayerbrown.com](https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law))

Consumer Data Privacy Law Compliance

Alabama’s new consumer privacy framework—the Alabama Personal Data Protection Act—establishes baseline personal data protection Alabama requirements for “controllers” and “processors.” It applies to entities that conduct business in Alabama or target Alabama residents and either process data of at least 25,000 consumers or derive at least 25% of gross revenue from the sale of personal data. Assess Alabama Personal Data Protection Act applicability early if any part of your REI program sits outside HIPAA (for example, marketing, patient portals for non-PHI, or ancillary services). ([mayerbrown.com](https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law))

Core duties include a clear privacy notice; purpose limitation and data minimization; reasonable security; contracts with processors; and honoring consumer rights to access, correct, delete, and obtain data in a portable format within 45 days (extendable once by 45 days). Where you process sensitive data—such as genetic or biometric identifiers—you must obtain consent; for known children, comply with COPPA. Post a conspicuous web mechanism to let consumers opt out of targeted advertising and sales. ([mcdermottlaw.com](https://www.mcdermottlaw.com/wp-content/uploads/2026/04/State-PDFs_Alabama-1.pdf))

Practical steps for REI teams: inventory non-HIPAA data flows (web analytics, ad tech, donor-matching tools handling non-PHI); refresh your privacy notice to map APDPA categories and rights; stand up request-handling playbooks; and ensure processor agreements cover required terms. ([mcdermottlaw.com](https://www.mcdermottlaw.com/wp-content/uploads/2026/04/State-PDFs_Alabama-1.pdf))

Donor Registry Regulations

Alabama maintains an anatomical gift donor registry under the Revised Uniform Anatomical Gift Act. This registry records organ, eye, and tissue donation wishes; it is not a gamete donor registry and does not govern sperm or egg donation for reproduction. REI programs should not rely on this system for gamete donor tracking or disclosure. ([alison.legislature.state.al.us](https://alison.legislature.state.al.us/code-of-alabama?section=22-19-161&utm_source=openai))

Access to the anatomical gift donor registry is limited: procurement organizations and designated parties may query it to confirm donation decisions at or near death, and personally identifiable information may not be used or disclosed for other purposes without the donor’s express consent. This information is not publicly accessible. ([law.justia.com](https://law.justia.com/codes/alabama/title-22/title-1/chapter-19/article-9/section-22-19-179/?utm_source=openai))

Hospitals and procurement organizations must make reasonable searches of the registry and related records when an individual is at or near death to honor documented donation intent. ([law.justia.com](https://law.justia.com/codes/alabama/title-22/title-1/chapter-19/article-9/section-22-19-173/?utm_source=openai))

Genetic Data Privacy Act

Alabama’s Genetic Data Privacy Act (Title 8, Chapter 43) governs DTC genetic testing companies, defined to exclude “health care providers.” If your program receives DTC reports from donors or patients, this Act shapes how those companies should have gathered consent and what rights consumers have over their genetic data—key context when you accept or rely on such information. ([alison.legislature.state.al.us](https://alison.legislature.state.al.us/code-of-alabama?section=8-43-2&utm_source=openai))

Required practices include prominent, plain-language disclosures about collection, use, retention, disclosure, and security; express consent for core uses; and informed consent for research transfers. Consumers must be able to access their data, delete accounts, and request destruction of samples; companies must destroy samples within 30 days of request and retrieve data/samples from third parties within 60 days after consent revocation. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/?utm_source=openai))

The Act also bars disclosure of a consumer’s genetic data to health, life, disability, or long-term care insurers, or to employers, without express written consent, and permits disclosures to law enforcement only under valid legal process. Factor these guardrails into your donor-intake counseling and document review. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/?utm_source=openai))

Exemptions under APDPA

Many REI programs fall outside APDPA because of the Health Insurance Portability and Accountability Act exemption at the entity level for HIPAA-covered entities and business associates. Additional entity exemptions include financial institutions subject to GLBA, certain higher-education institutions, small businesses with fewer than 500 employees that do not sell personal data, and nonprofits with fewer than 100 employees that do not sell personal data. ([mayerbrown.com](https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law))

APDPA also provides data-level exemptions for PHI under HIPAA, GLBA-regulated data, FCRA-regulated data, FERPA-covered education records, and data about individuals acting in a commercial (B2B) context. If your organization or specific processing activities are not exempt, prepare to implement APDPA notices, rights handling, and opt-outs alongside existing HIPAA controls. ([mayerbrown.com](https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law))

Effective Date and Compliance Deadlines

Key dates: Alabama’s Genetic Data Privacy Act took effect on October 1, 2024. Alabama’s Personal Data Protection Act takes effect on May 1, 2027. Plan your roadmap with these milestones in view, especially if parts of your operation sit outside HIPAA. ([alaha.org](https://www.alaha.org/app/uploads/2024/09/2HANDOUT-G.-Everett-COMBINED-Legislation-and-Cases-of-Interest-in-Alabama-in-2023-2024-4887-7186-3777-v.2.pdf?utm_source=openai))

Under APDPA, you must respond to verified consumer rights requests within 45 days of receipt (with a single 45‑day extension when reasonably necessary). Build verification, fulfillment, and denial-notice templates now so they are production-ready by May 1, 2027. ([mcdermottlaw.com](https://www.mcdermottlaw.com/wp-content/uploads/2026/04/State-PDFs_Alabama-1.pdf))

Under the Genetic Data Privacy Act, DTC companies must destroy biological samples within 30 days of a consumer’s request and recover shared samples/data within 60 days after consent revocation. If you accept DTC results, incorporate these timing rules into your donor/recipient advisories and data-handling SOPs. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/?utm_source=openai))

FAQs.

What defines parental status of a donor under Alabama law?

A donor who donates gametes to a licensed physician for use by a married woman is not a legal parent of a child conceived through assisted reproduction. If a husband provides sperm or consents to assisted reproduction by his wife, he is the legal father; a deceased spouse is not a parent unless there is a signed record consenting to parentage after death. ([alison.legislature.state.al.us](https://alison.legislature.state.al.us/code-of-alabama?section=26-17-702&utm_source=openai))

How does the Genetic Data Privacy Act protect donor information?

For DTC genetic testing, companies must provide clear notices; obtain express or informed consent for specified uses and research; enable access, deletion, and destruction of samples; and refrain from disclosing genetic data to insurers or employers without express written consent. Timebound requirements include 30‑day sample destruction and 60‑day retrieval from third parties after revocation. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/?utm_source=openai))

What are the key compliance requirements for REI programs under APDPA?

If APDPA applies to your non‑HIPAA processing, you must maintain a clear privacy notice; honor consumer rights (access, correction, deletion, portability) within 45 days; obtain consent for sensitive data (including genetic/biometric); post an opt‑out for targeted advertising and sales; minimize collection to what is necessary; secure data; and contract appropriately with processors. Many HIPAA‑covered programs qualify for the Act’s entity‑level exemption, but verify scope carefully. ([mcdermottlaw.com](https://www.mcdermottlaw.com/wp-content/uploads/2026/04/State-PDFs_Alabama-1.pdf))

Is donor registry information publicly accessible without consent?

No. Alabama’s anatomical gift donor registry is accessible to procurement organizations to confirm donation decisions at or near death. Personally identifiable information in the registry cannot be used or disclosed for other purposes without the donor’s express consent, and it is not available for public inspection. ([law.justia.com](https://law.justia.com/codes/alabama/title-22/title-1/chapter-19/article-9/section-22-19-179/?utm_source=openai))