30-23-103. Exceptions. (1) This part does not apply to:

(a) protected health information that is collected by a covered entity or business associate as those terms are defined in 45 CFR, parts 160 and 164, if separate informed consent related to the collection, use, and dissemination of genetic or neurotechnology data is obtained from the consumer, parent, guardian, or power of attorney, and the covered entity or business associate follows the policies under 30-23-104(6)(a) through (6)(d);

(b) an entity when it is engaged only in collecting, using, or analyzing genetic data or biological samples in the context of scientific or clinical research conducted with the express consent of an individual and in accordance with:

(i) the federal policy for the protection of human research subjects under 45 CFR, part 46, the good clinical practice guideline issued by the international council for harmonisation of technical requirements for pharmaceuticals for human use; or

(ii) the United States food and drug administration policy for the protection of human subjects under 21 CFR, parts 50 and 56;

(c) uses by a governmental agency; or

(d) deidentified genetic data obtained from a third party to the extent that the data is used to conduct internal, medical, or scientific research. Data must be considered deidentified if:

(i) it cannot be reasonably linked to an identifiable individual; and

(ii) the entity:

(A) takes administrative and technical measures to ensure the data cannot be associated with a particular consumer;

(B) maintains and uses data in deidentified form and does not attempt to reidentify data; and

(C) enters a legally enforceable contractual obligation that prohibits a recipient of the data from attempting to reidentify the data.

(2) Any collection, storage, use, or dissemination of genetic or neurotechnology data by a governmental agency must be performed in accordance with a specific state law or executed through a search warrant or investigative subpoena issued pursuant to 46-4-301.