Invitae, LabCorp, and Illinois

Genomeweb article, https://www.360dx.com/business-news/labcorps-invitae-illegally-shared-genetic-data-upon-acquisition-class-action

Prompt at bottom

##

 I think your intuition is basically right: this cannot be analyzed as “genetic data was sold like a mailing list.” A clinical lab archive is not a pile of surplus hard drives; it is part medical record, part laboratory compliance record, part ongoing patient-care infrastructure, and part corporate asset. The harder question is whether Illinois GIPA creates a consent requirement that is stricter than the ordinary HIPAA/M&A rule.

Under HIPAA, the ordinary answer is fairly friendly to acquisitions. HHS has long treated transfer of records in a sale, merger, consolidation, or asset transfer to another covered entity — or to an entity that will become a covered entity — as a form of “health care operations.” The point is continuity: otherwise every hospital, lab, pharmacy, or physician practice sale would require consent from thousands or millions of patients before the buyer could safely operate the business. HHS commentary specifically says PHI may be exchanged for due diligence and transferred to the new owner on completion of the deal, with the successor then bound by HIPAA duties. (Bricker)

So if this were only HIPAA, Labcorp’s position would likely be: Invitae was a covered health care provider/lab; Labcorp is a covered health care provider/lab; the records moved as part of a going-concern acquisition approved in bankruptcy; Labcorp needed the archive to continue testing, issue amendments, support reinterpretations, answer patient/provider questions, satisfy CLIA/state record duties, and operate the acquired clinical genetics business. That is not the same as selling identifiable genetic data to an advertiser, pharma marketer, data broker, or unrelated AI platform.

But the complaint is smarter than a generic HIPAA complaint because it invokes Illinois GIPA. GIPA says that no person may disclose the identity of a person tested or the results of a genetic test in identifiable form except to specified permitted recipients, including the test subject or a person designated in a specific written authorization. (Illinois General Assembly) It also provides eye-catching statutory damages: $2,500 for negligent violations and $15,000 for intentional or reckless violations, plus fees and other relief. (Illinois General Assembly) That is why this is a class-action magnet.

However, GIPA also has HIPAA-like carve-outs. Section 31 allows a covered entity, without patient consent, to use or disclose genetic information for its own treatment, payment, or health care operations, and to disclose genetic information to another covered entity for certain payment and health care operations activities under specified conditions. (Illinois General Assembly) It separately permits covered-entity disclosures to business associates under HIPAA-style written safeguards, and permits de-identified and limited data set uses under HIPAA standards. (Illinois General Assembly) So the plaintiffs cannot simply say, “genetic data moved; therefore illegal.” They have to defeat the statutory exceptions or frame the transaction as outside them.

The “law professor” issue is probably this: was Labcorp merely the successor clinical custodian/operator of the Invitae lab archive, or was there a distinct disclosure of identifiable genetic results as a monetized asset beyond clinical operations? If Labcorp acquired the Invitae clinical testing business as a going concern, and the same archive was necessary for ongoing lab operations, Labcorp has a strong policy argument and probably a strong HIPAA argument. Labcorp and Invitae announced that a bankruptcy court approved Labcorp’s acquisition of Invitae assets in May 2024; contemporary reports described it as a $239 million going-concern acquisition of the medical-genetics business. (Labcorp)

Your GeneDx example is apt. Clinical genetic labs do not become amnesic every time the corporate wrapper changes. GeneDx could be inside BioReference, then sold or spun into a new public-company/SPAC structure, but the clinical archive remains clinically necessary. Variant reinterpretation, amended reports, family testing, clinician support, billing disputes, audits, malpractice defense, CLIA retention, and state lab requirements all presume that somebody has custody of the old data. If every transaction required fresh written consent from every prior patient, it would be nearly impossible to transfer a genetic laboratory as a functioning clinical enterprise.

Bankruptcy adds a second layer. Health care bankruptcies have special patient-record problems precisely because the records cannot simply be abandoned, auctioned casually, or destroyed without process. Bankruptcy law has procedures for patient-record disposal when a debtor lacks funds to store them, including notice and attempted patient contact; the existence of those rules reflects that patient records are not ordinary inventory. (Haynes Boone) But a going-concern sale to a qualified health care successor is usually the cleaner privacy solution, not the dirtier one, because it preserves custody, access, and compliance.

Where the plaintiff’s case may have traction is Illinois specificity plus genetics sensitivity plus “asset” rhetoric. GIPA is not merely HIPAA. It was written against fear that genetic results will be disclosed without consent or used discriminatorily. Plaintiffs will argue that “Labcorp bought Invitae’s assets” is not the same as “Invitae disclosed results for treatment/payment/operations under a patient relationship.” They may say Labcorp had no relationship with B.W. at the time of transfer, that the disclosure was for corporate acquisition value, and that the genetic archive was integrated into Labcorp’s broader “data assets,” not merely held as a locked clinical-record archive.

The defense answer is that this is too formalistic. In an acquisition, the successor steps into the acquired lab’s shoes. The patient relationship, at least for record custody and ongoing clinical obligations, should travel with the business. Otherwise, GIPA would disrupt ordinary clinical-lab continuity in a way HIPAA expressly tried to avoid. Also, GIPA itself recognizes covered-entity treatment, payment, operations, business-associate, limited data set, de-identification, HIE, oversight, and research pathways; it is not an absolute “fresh consent for every downstream handling of genetic data” statute. (Illinois General Assembly)

The scariest fact pattern for Labcorp would be if the complaint can show that identifiable Invitae genetic data was not merely migrated for continuity of clinical testing, but was pooled into Labcorp analytics, commercial data products, pharma partnerships, AI development, or non-care research without a valid authorization, IRB/privacy-board pathway, de-identification, or other statutory basis. That is a different case. There is already a wave of Illinois genetic privacy litigation around acquisitions and downstream data use, including a 2026 Tempus/Ambry-related lawsuit framed around acquisition of a genetic-testing database and alleged downstream sharing. (Fisher Phillips)

My bottom-line read: as a pure “Labcorp bought Invitae and inherited the clinical archive” claim, the lawsuit feels overbroad and somewhat artificial. But as a class-action pleading under GIPA, it is not frivolous, because Illinois law creates a more plaintiff-friendly textual hook than HIPAA and very large statutory damages. The decisive line should be: successor clinical custody and operations, likely permissible; sale or repurposing of identifiable genetic data as a separable data asset, much more vulnerable.

A good blog sentence might be:

The legal problem is not that Invitae’s clinical archive followed the laboratory business to Labcorp; that is exactly what one would expect in a going-concern lab acquisition. The real question is whether identifiable genetic results were transferred and used only as successor clinical records, or whether they were treated as a freestanding monetizable data asset outside the patient-care and health-care-operations framework.

##

##

Prompt

I can understand that if a clinical laboratory goes bankrupt, it cannot simply auction off hard drives full of patient data. But mergers and acquisitions seem different. If one laboratory acquires another, the clinical archive presumably has to go somewhere, and often it must remain available for clinical, regulatory, and patient-care purposes.    I would quickly get lost trying to think through all the legal angles, but surely this issue has arisen before. One example might be BioReference/GeneDx: GeneDx was sold off and merged with a SPAC, creating what was legally a different company, yet there remained one continuous GeneDx clinical archive.       Think this through like a HIPAA law professor. This cannot be the first time the issue has come up.   

Labcorp’s Invitae Illegally Shared Genetic Data Upon Acquisition, Class Action Complaint Alleges  / Jun. 17, 2026 | Adam Bonislawski .......