30-23-103.  Exceptions. (1) This part does not apply to:

(a) protected health information that is collected by a covered entity or business associate as those terms are defined in 45 CFR, parts 160 and 164, if separate informed consent related to the collection, use, and dissemination of genetic data is obtained from the consumer, parent, guardian, or power of attorney, and the covered entity or business associate follows the policies under 30-23-104(6)(a) through (6)(d);

(b) an entity when it is engaged only in collecting, using, or analyzing genetic data or biological samples in the context of research as defined in 45 CFR 164.501 conducted with the express consent of an individual and in accordance with:

(i) the federal policy for the protection of human research subjects under 45 CFR, part 46, the good clinical practice guideline issued by the international council for harmonisation of technical requirements for pharmaceuticals for human use; or

(ii) the United States food and drug administration policy for the protection of human subjects under 21 CFR, parts 50 and 56; or

(c) uses by a governmental agency.

(2) Beginning June 1, 2025, any collection, storage, use, or dissemination of genetic data by a governmental agency must be performed in accordance with a specific state law or executed through a search warrant.