New Jersey Genetic Privacy: Consent Rules for Employer Wellness Program Genetic Testing

Informed Consent Requirements

Core elements of informed consent

Before any wellness program genetic testing occurs in New Jersey, you need clear, written informed consent under the state’s Genetic Privacy Act. The consent should explain the specific tests, the purpose, the potential benefits and limits, who will see results, how information will be protected, how long it will be kept, and when it will be destroyed. It must also describe your right to refuse without penalty and how to withdraw later.

Voluntariness and incentives

Consent must be voluntary. Do not condition employment, coverage, or rewards on agreeing to genetic testing. Avoid incentives tied to providing genetic information or family medical history; keep participation optional and free from pressure. State plainly that results will not be used for hiring, promotion, termination, or any employment decision.

Form, language, and delivery

Use a standalone, plain‑language form separate from other wellness or benefits documents. Describe data flows in simple terms, provide a copy to the employee, and name a contact for privacy questions. Ensure accessibility for all employees and maintain signed records to evidence informed consent.

Authorization for Retaining Genetic Information

Separate “DNA Sample Authorization”

Agreeing to a test is not the same as agreeing to keep results or a specimen. If you plan any genetic information retention, obtain a distinct DNA Sample Authorization. It should specify what will be retained (raw data, report, or biological sample), the retention period, where it will be stored, the security safeguards, and who may access it for what purpose.

Time limits and data minimization

Limit retention to what is necessary for the stated purpose, and prefer de‑identified summaries where feasible. Prohibit indefinite storage, require periodic review of retention needs, and document a destruction schedule that is triggered automatically when the purpose ends or an employee revokes authorization.

Conditions for Genetic Information Disclosure

Genetic Data Disclosure Rules

Disclose genetic information only as authorized in writing by the employee or as otherwise permitted by law. Typical authorized disclosures include the tested employee, the ordering clinician or counselor, and the laboratory processing the test. Keep disclosures purpose‑bound and time‑limited, and share the minimum necessary information.

Disclosures to the employer

To preserve GINA Compliance and state privacy protections, limit what the employer receives to aggregate, de‑identified data that cannot pinpoint an individual. Never provide identifiable genetic results to supervisors, managers, or decision‑makers involved in employment actions.

Accountability and documentation

Maintain a disclosure log, verify recipient identity, and require written attestations from vendors prohibiting re‑disclosure. Review disclosures periodically to ensure ongoing compliance with the Genetic Privacy Act and internal policy.

Exceptions to Consent Requirements

Narrow, law‑driven exceptions

Exceptions are limited and interpreted narrowly. They may include valid court orders or other legal mandates with appropriate safeguards. Even when an exception applies, disclose only what is required and notify the employee unless prohibited by law.

Research and public health contexts

De‑identified information may be used for approved research when permitted by law and applicable oversight; identifiable disclosures require explicit authorization. Employer wellness programs should not rely on research exceptions to bypass informed consent.

Inadvertent acquisition

If genetic information is inadvertently acquired (for example, an unsolicited family medical history), do not use it for employment decisions. Segregate it immediately and restrict access consistent with GINA and state privacy rules.

Federal Genetic Information Nondiscrimination Act Compliance

Core prohibitions

GINA bars employers from requesting, requiring, or purchasing genetic information about employees or their family members, and from using such information in employment decisions. Family medical history is genetic information under GINA.

Wellness program guardrails

Health or genetic services within a wellness program must be truly voluntary with prior, knowing, written authorization. Do not offer inducements in exchange for genetic information. Keep individually identifiable results with the health professional or vendor; provide only aggregate, de‑identified reports to the employer; and maintain strict confidentiality.

Design tips for GINA Compliance

Use safe‑harbor notices instructing employees not to submit genetic information when medical data is requested, avoid collecting family medical history, and route all testing through independent vendors. Train managers never to solicit or review genetic data and to keep any health information separate from personnel files.

Employee Rights and Sample Destruction

Access, revocation, and corrections

Employees may access their genetic test results, request corrections to administrative records, and revoke consent or DNA Sample Authorization at any time. Revocation should stop further use or disclosure (except as already relied upon) and trigger destruction workflows.

Destruction of samples and data

Upon request or at the end of the stated retention period, destroy biological samples and identifiable genetic information securely and irreversibly. Provide written confirmation of destruction, update inventories and logs, and ensure vendors mirror these actions.

Freedom from discrimination or retaliation

Employees have the right to refuse testing, to withhold genetic information, and to exercise privacy rights without adverse employment action. Policies should state these protections plainly and offer a clear channel to raise concerns.

Employer Obligations and Legal Compliance

Build a compliant wellness program

• Decide whether Wellness Program Genetic Testing is necessary; if used, define a narrow, health‑focused purpose.
• Use standalone Informed Consent and DNA Sample Authorization forms with clear retention and destruction terms.
• Provide only aggregate, de‑identified outcomes to the employer; bar identifiable disclosures to management.
• Prohibit incentives tied to genetic information; confirm program voluntariness and non‑coercion.

Vendor and laboratory controls

• Contractually limit vendors to defined purposes, Genetic Information Retention limits, and no re‑disclosure.
• Require encryption in transit and at rest, access controls, audit logs, and prompt breach notification.
• Mandate timely destruction of samples and data, with written certificates of completion.

Security, segregation, and recordkeeping

• Segregate genetic data from HR files; restrict access to need‑to‑know clinical or privacy personnel only.
• Maintain consent records, disclosure logs, retention schedules, and training attestations.
• Review policies annually and after any legal or program changes.

Monitoring and response

• Conduct periodic audits of Genetic Data Disclosure Rules, vendor performance, and access rights.
• Establish an incident response plan tailored to genetic information and test your escalation paths.
• Offer regular, role‑specific training so employees and managers understand boundaries and rights.

Conclusion

By separating consent to test from authorization to retain, limiting disclosures to de‑identified aggregates, and aligning operations with the Genetic Privacy Act and GINA, you can deliver a useful wellness program while safeguarding employee privacy and legal compliance.

FAQs

What constitutes informed consent under New Jersey's Genetic Privacy Act?

Informed consent is a standalone, written agreement that clearly explains the test’s purpose, scope, and limits; identifies what genetic information will be collected; describes who may access it and why; outlines Genetic Information Retention and destruction timelines; states that participation is voluntary and will not affect employment; and provides instructions for revoking consent and contacting a privacy representative.

How can employers lawfully retain genetic information?

Retention requires a separate DNA Sample Authorization that specifies exactly what will be kept, for how long, where and how it will be protected, and who may access it for defined purposes. Retention must be limited, regularly reviewed, and followed by secure, documented destruction; de‑identified summaries should be used whenever possible.

When is disclosure of genetic information permitted?

Disclosure is permitted with the employee’s explicit, written authorization or when a narrow legal requirement applies. Even then, share only the minimum necessary. For wellness programs, the employer should receive only aggregate, de‑identified trends, never identifiable results, to uphold Genetic Data Disclosure Rules and state privacy protections.

How does GINA impact employer wellness genetic testing?

GINA prohibits requesting, requiring, or purchasing genetic information and bans using it in employment decisions. Wellness programs may offer health or genetic services only on a truly voluntary basis with prior, knowing, written authorization, must keep results confidential, and may provide the employer only aggregate, de‑identified information—no incentives may be tied to supplying genetic information.