(a) This chapter applies to a direct-to-consumer genetic testing company that:
(1) offers its products or services to individuals who are residents of this state; or
(2) collects, uses, or analyzes genetic data that:
(A) results from the company’s products or services; and
(B) was provided to the company by an individual who is a resident of this state rather than by or at the direction of a health care provider.
(b) This chapter does not apply to:
(1) an entity only when they are engaged in collecting, using, or analyzing genetic data or biological samples in the context of research, as defined by 45 C.F.R. § 164.501, that is conducted in accordance with:
(A) the federal policy for the protection of human subjects (45 C.F.R. part 46);
(B) the good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH); or
(C) the United States Food and Drug Administration policy for the protection of human subjects (21 C.F.R. Parts 50 and 56);
(2) genetic data that is protected health information collected by a covered entity or business associate, as defined by 45 C.F.R. part 160, subject to the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.);
(3) an institution of higher education or a private or independent institution of higher education, as those terms are defined by § 61.003, Education Code;
(4) an entity when the entity is offering genetic testing products or services through a health care provider; or
(5) the collection, use, or analysis of genetic data by a health care provider.