Alabama Rare Disease Registry Privacy Laws: What Genetic Counseling Offices Need to Know

Rare disease care relies on intensive genetic evaluation, which makes privacy compliance mission‑critical. In Alabama, the centerpiece is the Alabama Genetic Data Privacy Act, alongside HIPAA, disease‑specific public health registries, and the Alabama One Health Record statewide health information exchange. This guide translates those frameworks into practical steps for genetic counseling offices handling sensitive patient and family genetic data.

Overview of Alabama Genetic Data Privacy Act

Alabama enacted the Alabama Genetic Data Privacy Act, codified in Title 8, Chapter 43 of the Code of Alabama. The law focuses on direct‑to‑consumer genetic testing companies, defining key terms such as “genetic data,” “genetic testing,” “genetic testing company,” and “health care provider,” and setting out duties for collection, use, disclosure, and retention of genetic information. For rare‑disease contexts, the Act primarily governs consumer‑facing testing companies rather than licensed clinical providers, but its standards shape expectations across the genetic data ecosystem. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/))

Alabama does not maintain a single, omnibus “rare disease registry” statute. Instead, rare‑disease‑related data are captured through disease‑specific public health registries and programs (for example, the Alabama Statewide Cancer Registry and newborn screening) and within the Alabama Department of Public Health’s notifiable disease system, each operating under HIPAA public health authority and state confidentiality rules. ([alabamapublichealth.gov](https://www.alabamapublichealth.gov/ASCR/assets/ascrlaw.pdf?utm_source=openai))

Consumer Consent Requirements

The Act requires robust Consumer Consent Protocols. Genetic testing companies must prominently disclose policies on collection, use, maintenance, disclosure, security, Data Retention Policies, and how to file complaints. They must obtain initial express consent to use a biological sample and genetic data to provide the ordered service, identify who may access it (including contractors), retain it for future testing, and seek future consents for third‑party transfers not needed to fulfill the order. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

Additional express consent is required each time a company transfers a biological sample or discloses genetic data to a non‑contractor, uses data for a new purpose, or markets to the consumer based on genetic data. Informed consent under 45 C.F.R. Part 46 is mandated for independent or sponsored research uses. Consumers must be offered Data Access and Deletion Rights, including the ability to access their data, delete their account, revoke prior consents, and request destruction of their biological sample and genetic data. Companies must honor destruction requests within 30 days and secure the return of data or samples after consent revocation within 60 days. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

Confidentiality Obligations for Genetic Data

Genetic Data Confidentiality is reinforced through contractor controls and disclosure limits. Contracts must prohibit contractors from using, retaining, or disclosing samples or genetic data beyond what’s necessary to perform the contracted services, and contractors assume the same confidentiality obligations as the company. The Act also bars disclosure of a consumer’s genetic data to employers or insurers without the consumer’s express written consent. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-4/))

Companies must give clear notice if deidentified data may be shared for research and align deidentification with HIPAA’s standards. Law‑enforcement disclosures require valid legal process, and companies may publish high‑level transparency reports but cannot alert the specific individual whose data is sought. These guardrails emphasize least‑necessary use and traceable, consent‑driven disclosure. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

Applicability to Genetic Counseling Offices

Most genetic counseling offices operate as “health care providers” and HIPAA‑covered entities or business associates. The Act contains explicit HIPAA Exemptions: it does not apply to covered entities or business associates as defined in 45 C.F.R. Parts 160 and 164. In addition, “genetic testing company” under the statute excludes health care providers, underscoring that the Act primarily targets direct‑to‑consumer companies rather than clinical practices. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-5/))

What this means in practice: your clinical operations are governed chiefly by HIPAA and applicable state health privacy rules, while any partnerships with consumer genetic testing companies must account for those companies’ statutory duties. When you refer a patient to, or receive results from, a direct‑to‑consumer company, ensure your agreements and workflows respect the company’s consent and retention obligations while maintaining your HIPAA compliance. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

Enforcement and Penalties

Unauthorized Disclosure Penalties and other violations of the Act are enforced by the Alabama Attorney General’s Consumer Interest Division. The AG may seek injunctive relief and civil penalties of up to $3,000 per violation; civil penalties and costs may be waived where full restitution or actual damages have been paid to the affected consumer, and the AG is entitled to reasonable attorney’s fees in settlements. Consumers can report suspected violations directly to the AG. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-6/))

Role of Alabama Board of Genetic Counseling

Genetic Counseling Licensure in Alabama is overseen by the Alabama Board of Genetic Counseling, created by the Alabama Genetic Counselor Act in 2019. The Board licenses genetic counselors, sets qualifications and continuing education, adopts rules, and may impose administrative fines up to $1,000 per violation for breaches of the chapter, rules, or license conditions. Practicing without a required license is a Class A misdemeanor. ([agcb.alabama.gov](https://agcb.alabama.gov/))

For clinic leaders, Board oversight intersects with privacy by reinforcing competency, supervision, and scope‑of‑practice boundaries for ordering, interpreting, and counseling on genetic tests—key controls that reduce privacy risk and data mishandling in rare‑disease workflows. ([agcb.alabama.gov](https://agcb.alabama.gov/wp-content/uploads/2021/09/Westlaw-Edge-12-full-text-items-for-Alabama-Statutes-And-Court-Rules-Chapter-13A%E2%80%83Alabama-Genetic.pdf))

Patient Privacy and Security Measures

Translate the law into safeguards your team can execute. Maintain written policies covering data mapping, data minimization, Data Retention Policies, consent management, role‑based access, audit logging, breach response, and processes for honoring access, amendment, and (where applicable) deletion requests. Conduct periodic risk analyses and vendor due diligence, including business associate agreements and contractor controls aligned with confidentiality obligations. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

Integrate with Alabama One Health Record thoughtfully. Alabama’s state HIE enables secure exchange of clinical data among authorized participants and supports patient access via the MyHealth application. Its platform employs standards‑based interoperability and HIPAA‑compliant secure messaging (Direct Secure Messaging), reinforcing transmission security and interoperability while you continue to apply HIPAA’s minimum‑necessary and patient‑right‑of‑access principles. ([onehealthrecord.alabama.gov](https://www.onehealthrecord.alabama.gov/HealthInformationExchange.aspx?utm_source=openai))

When your workflows involve public health programs—such as cancer reporting or notifiable disease submissions—account for Alabama Department of Public Health authorities and confidentiality provisions. These programs operate under HIPAA’s public health exception and state law, which permit reporting without patient authorization while preserving strict confidentiality of identifiable information. ([alabamapublichealth.gov](https://www.alabamapublichealth.gov/ASCR/assets/ascrlaw.pdf?utm_source=openai))

FAQs.

What are the consent requirements under Alabama’s Genetic Data Privacy Act?

Direct‑to‑consumer genetic testing companies must present clear policies, obtain initial express consent for use, access, and retention of biological samples and genetic data, and get fresh express consent for new uses or third‑party disclosures. Research uses require informed consent under 45 C.F.R. Part 46. Consumers must have Data Access and Deletion Rights, including the ability to revoke consent, request destruction of samples/data within 30 days, and require the company to secure the return of shared data/samples within 60 days after revocation. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-3/))

How does the law affect genetic counseling offices?

Most genetic counseling offices are HIPAA‑covered health care providers and thus fall under the Act’s HIPAA Exemptions; the statute’s primary obligations apply to direct‑to‑consumer genetic testing companies, not to clinical providers. That said, when you engage with a consumer genetic company (e.g., referrals or data exchange), align your agreements and workflows with the company’s consent, confidentiality, and retention duties while maintaining HIPAA compliance. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-5/))

What penalties apply for unauthorized disclosure of genetic data?

The Alabama Attorney General can bring civil actions seeking injunctions and civil penalties up to $3,000 per violation under the Genetic Data Privacy Act, with potential waiver of penalties where full restitution is made. Clinical providers remain subject to HIPAA and state professional rules, including Board oversight for licensure compliance. ([law.justia.com](https://law.justia.com/codes/alabama/title-8/chapter-43/section-8-43-6/))

How does patient privacy protection integrate with the Alabama One Health Record system?

Alabama One Health Record is the state HIE. It enables secure, standards‑based exchange of clinical data among authorized participants, offers HIPAA‑compliant secure messaging, and supports patient access through the MyHealth app. Your role is to enforce minimum‑necessary access, maintain accurate consent and notice practices, and synchronize your retention and disclosure controls with HIE participation requirements. ([onehealthrecord.alabama.gov](https://www.onehealthrecord.alabama.gov/HealthInformationExchange.aspx?utm_source=openai))