The provisions of §§ 37-24-60 to 37-24-63, inclusive, do not apply to:
- (1) Protected health information collected by a covered entity or business associate, as those terms are defined in 45 C.F.R. § 160.103 (November 25, 2025);
- (2) A biological sample that is obtained or genetic data that is generated for the purpose of a consumer's medical screening, diagnosis, or treatment;
- (3) A public or private institution of higher education;
- (4) An entity owned or operated by a public or private institution of higher education;
- (5) A forensic laboratory that is operated by, associated with, or under contract with, a law enforcement agency, when performing forensic analysis or related services as part of a criminal investigation;
- (6) An entity that analyzes, collects, or uses genetic data or biological samples only in the context of research, as defined in 24 C.F.R. § 164.501 (November 25, 2025), in a manner that complies with the federal policy of the protection of human research subjects under 45 C.F.R. part 46 (November 25, 2025); the Guideline for Good Clinical Practice issued by the International Council for Harmonisation (January 6, 2025); or the United States Food and Drug Administration policy for the protection of human subjects under 21 C.F.R. part 50 (December 4, 2025) and 21 C.F.R. part 56 (December 4, 2025); or
- (7) A hospital licensed under chapter 34-12, including any laboratory or health care facility owned, operated by, or affiliated with the hospital.
Source: SL 2026, ch 164 , § 6.