"Did Anyone in Your Family Have This?" Is a Genetic Question in Illinois.
Everyone building AI health features learned to fear HIPAA. The statute actually producing Illinois class actions has no covered-entity requirement, no proof-of-harm requirement, and pays $15,000 per intentional violation — and it treats family medical history as genetic information.
The Definition Is the Whole Story
GIPA's operative move is that "genetic information" is not limited to sequencing data. Following the federal GINA definition, it reaches the manifestation of a disease or disorder in an individual's family members. Family medical history is genetic information. No swab, no lab, no biological sample.
That single definitional choice is why the exposure surface is so much larger than teams assume. Product managers reviewing their app for "genetic data" look for DNA upload features, find none, and close the ticket. Meanwhile the onboarding questionnaire asks about family history of diabetes, and the support chatbot logs whatever the user typed.
Where AI Products Collect It Without Meaning To
Risk-scoring intake flows routinely ask about family history of cardiovascular disease, cancer or diabetes because those are the strongest features in any clinical risk model. The feature that makes the model accurate is the feature that makes it a GIPA question.
The model asks a clarifying question, the user volunteers a parent's diagnosis, and the exchange lands in a conversation log retained for quality evaluation. Nobody designed a genetic-information collection flow; one exists.
The highest-risk category. GIPA restricts employers from soliciting genetic information in connection with employment, and a wellness vendor's health-risk assessment that reaches the employer — even in aggregate-adjacent form — sits squarely in the litigated zone.
The wave of GIPA filings that opened this category came from standard occupational-health intake forms asking for family history. If your HR tech product digitises those forms, you built the collection mechanism.
GIPA restricts genetic information use in insurance underwriting. An AI underwriting feature that ingests self-reported family history has an availability problem in Illinois regardless of how predictive it is.
Consumer health AI collects family history for personalisation. Consumer scale plus per-violation statutory damages is the arithmetic that makes these cases attractive to file.
GIPA vs GINA vs HIPAA: Why the Familiar Frameworks Don't Cover You
Applies to covered entities and their business associates. Most AI wellness apps, chatbots and HR tools are neither. Teams that concluded 'HIPAA doesn't apply to us' were usually right — and then stopped analysing.
Covers genetic information in employment and health insurance, but enforcement runs through the EEOC administrative process with caps on damages. There is no per-violation statutory damages award of the kind GIPA provides.
Private right of action, statutory damages per violation, fee shifting, and no requirement to show concrete injury beyond the statutory violation. This is the combination that scales into class litigation.
Washington's My Health My Data Act and similar statutes add their own consent and private-action mechanics for consumer health data generally. GIPA is narrower in subject matter but older, better-tested, and already has a plaintiffs' bar attached.
The Retention Problem Is Worse for AI Than for Forms
A paper intake form containing family history lives in one place. The same disclosure typed into an AI product lives in at least five: the application database, the conversation transcript store, the observability and prompt-logging layer, the embedding index, and — if evaluation data flows back into fine-tuning — the model weights.
This matters because deletion obligations and data-minimisation arguments become technically hard exactly where the legal exposure is highest. A deletion request you can satisfy in the primary database but not in the vector store or the LLM provider's 30-day retention window is not a satisfied deletion request. Decide the retention posture before the feature ships, because unwinding it afterwards means re-training.
A Practical Compliance Checklist
Search your forms, prompt templates, system prompts and question banks for 'family history', 'parents', 'siblings', 'runs in your family', 'hereditary', 'inherited'. This is a text search, not a research project, and it usually finds more than expected.
The cheapest compliance posture is not collecting it. If family history improves your risk model by a small margin and creates per-user statutory-damages exposure in Illinois, that is a bad trade. Model it as a cost.
The employer-facing prohibition is the sharpest edge of the statute. If your product serves employers, family-history questions should not exist in that surface at all, and the wellness-vendor firewall must be real rather than contractual.
Users volunteer family history unprompted. Classify and redact it at ingestion rather than discovering it in a transcript export during discovery.
Exclude flagged fields from embeddings, from analytics exports, from training corpora, and from third-party sub-processors. Write down which systems are in scope; that document is your defence on the intent question, which is the difference between $2,500 and $15,000 per violation.
GIPA permits disclosure with written authorisation in defined circumstances. Consent must be specific and informed — a link to a general privacy policy is the same failure pattern that lost early BIPA cases.
Audit what your product actually asks users
Intake forms, onboarding flows and chat widgets are live, public surfaces. RatedWithAI scans them for compliance and accessibility exposure and gives you a report you can hand to counsel — free, in under a minute.
Scan Your Site for Free →Frequently Asked Questions
What exactly does GIPA prohibit?
Broadly: disclosing genetic testing information without written authorisation, and — for employers — soliciting, requesting, requiring or purchasing genetic information as a condition of employment or as part of pre-employment or continued-employment processes. It also restricts use of genetic information in insurance underwriting. Individuals may sue directly and recover $2,500 per negligent violation or $15,000 per intentional or reckless violation, plus fees.
Is family medical history really covered, or is that an aggressive reading?
It is the statutory definition. GIPA incorporates the GINA-aligned definition of genetic information, which expressly includes the manifestation of disease or disorder in family members. The filings driving this category are built on exactly that language — ordinary family-history questions on pre-employment health forms, with no DNA testing involved.
Does an AI inference count as genetic information?
Unsettled. What is not unsettled is that the input the model reasoned over — the user's statement about a relative's condition — is covered, and you retained it. Arguing about the status of the inference does not help if the collection and retention are already in scope.
We are a B2B SaaS vendor, not the employer. Are we exposed?
Potentially, on two paths. If you build the collection mechanism used in an employment context, you are the natural co-defendant, exactly as BIPA plaintiffs named biometric vendors alongside employers. And GIPA's disclosure restrictions are not limited to employers, so passing genetic information to sub-processors without authorisation is its own question.
How is this different from Washington's My Health My Data Act?
MHMD covers consumer health data broadly, requires separate consent for collection and sharing, and has its own private right of action through the state consumer protection act. GIPA is narrower — genetic information specifically — but has fixed per-violation statutory damages and a mature plaintiffs' bar. Products with a national footprint should assume both apply.
Does deleting the data end the exposure?
It reduces ongoing exposure and it is the right move, but a claim attaches at the point of unlawful collection or disclosure. Deletion after a demand letter also raises spoliation questions. The value of deletion is in limiting the class period and the count of violations, not in erasing the claim.