The Illinois Governor recently signed SB 2886, which expands the scope of the state’s Genetic Information Privacy Act (“GIPA”) to include “biomarker testing” and “biomarker.” GIPA currently regulates the collection, use, and disclosure of genetic testing information.

The bill defines “biomarker” as “a characteristic that is objectively measured and evaluated as an indicator of normal biological processes, pathogenic processes, or pharmacologic responses to a specific therapeutic intervention,” which “includes, but is not limited to, gene mutations or protein expression.” The bill defines “biomarker testing” as “the analysis of a patient’s tissue, blood, or fluid biospecimen for the presence of a biomarker,” which “includes, but is not limited to, single-analyte tests, multi-plex panel tests, and partial or whole genome sequencing.”

The bill revises the legislative findings to reflect that biomarker testing, like genetic testing, can be “valuable to an individual” and that “public health will be served by facilitating its voluntary and confidential nondiscriminatory use of genetic testing and biomarker testing information.” As a result, SB 2886 extends GIPA’s protections to biomarker data, including:

• Confidentiality protections: SB 2886 requires that the use of biomarker testing, and the information derived from testing, is confidential and privileged and may be released only to the individual tested and persons specifically authorized in writing by that individual.
• Insurer prohibitions: The bill prohibits an insurer from seeking information derived from biomarker testing for use in connection with a policy of accident or health insurance (unless the individual voluntarily submits favorable results), for nontherapeutic purposes, or for underwriting purposes.
• Employer limitations: Under SB 2886, an employer may not solicit, request, or require submission of biomarker information as a condition of employment. Where release of biomarker testing information is authorized, it must comply with the same restrictions that currently govern genetic testing information.
• Disclosure restrictions: No person may disclose or be compelled to disclose the identity of any person upon whom a biomarker test is performed, or the results of a biomarker test, in a manner that permits identification of the subject, unless an exception applies.
• Consent requirements: GIPA’s existing written consent requirements for the release of genetic testing information now extend to biomarker testing information.

GIPA has a private right of action, with damages of $2,500 per negligent violation and $15,000 per intentional or reckless violation. GIPA continues to be the basis for a large number of private lawsuits, though many (but not all) of these cases have been brought in the employment context. The amendments to GIPA enacted by SB 2886 take effect on January 1, 2027.