That HR Form Question About Your Mom's Health? It's Legally a DNA Test.

Here's a sentence that should stop you mid-scroll: if your boss asks whether your mom has diabetes, that question is treated the same way, legally, as if they'd swabbed your cheek and sent it to a lab. No DNA kit. No spit tube. Just a form, a checkbox, maybe a "friendly" wellness questionnaire — and suddenly you and your mother are both wrapped up in something the law calls genetic information.

I know what you're thinking. "Family medical history" sounds like small talk you'd share over coffee, not something that belongs in the same category as a lab report. But that's exactly why this is worth fifteen minutes of your night — because the gap between what feels private and what the law actually protects is way bigger than most of us assume.

Wait, My Mom's Diabetes Is MY Genetic Information?

Let's start with the legal definition, because it's genuinely surprising. Illinois' Genetic Information Privacy Act, known as GIPA, defines "genetic testing" to include not just a lab test done on you, but also genetic tests done on your family members — and, this is the part that catches people off guard, "the manifestation of a disease or disorder in family members" of you, the employee or applicant. Translation: it's not just about DNA in a tube. If a disease shows up in your relatives, that fact alone counts as your genetic information under the law.

Think about what that actually means. A hiring manager doesn't need a lab. They don't need a swab. They just need to ask, "Has anyone in your immediate family had heart disease?" and — legally — they've just collected the same category of protected information as if they'd run a genetic panel. The question itself is the event. Not the follow-up. Not what they do with the answer. Just the asking. This article is part of a series — start with Deepfake Crypto Scams What Comes Next.

This Isn't Theoretical — It's Already a Lawsuit Wave

Illinois has been down this road before, sort of. You may have heard of BIPA, the state's biometric privacy law that's generated lawsuits over fingerprint scanners and facial recognition at work. Well, the same plaintiffs' attorneys who built careers on BIPA cases appear to have found a new target: GIPA. According to JD Supra, more than ten class action lawsuits have already been filed in Cook County alleging employers violated GIPA by requiring applicants or employees to disclose family medical history as part of hiring.

And here's where it gets financially serious. GIPA doesn't require anyone to prove they were actually harmed. It sets fixed damages: $2,500 per negligent violation, and $15,000 per intentional or reckless one — what lawyers call "liquidated damages," meaning the dollar amount is already decided by the statute, no need to show a bruise. Now do the math with me for a second. If a mid-sized healthcare employer runs one hiring cycle and asks 500 applicants a family-history question on an intake form, that's potentially $1.25 million to $7.5 million in exposure. From one line on one form. Nobody has to prove they lost a job, or paid higher insurance, or suffered anything at all — the asking is the violation.

Why Does a Question About Your Mom Count As YOUR Genetic Data?

This part actually makes sense once you sit with it. Genetic information is unusual because it's never just about one person — it leaks. Your risk of heart disease, certain cancers, or diabetes is shaped by genes you share with your parents, siblings, and kids. According to research published on ScienceDirect, even a "mild" family history — say, one close relative diagnosed younger than average — can raise your own risk two to five times above the general population. A strong family history, the kind suggesting a dominant inherited condition, can push your risk up 50% or more.

That's the whole reason lawmakers decided this category of information deserves extra locks on the door. It's not paranoia. A single fact about your grandmother's breast cancer diagnosis can reveal information about shared inherited risk — and about your siblings' and kids' risk, too. The Equal Employment Opportunity Commission has actually described a version of this exact scenario: an employer refusing to hire someone because her grandmother had breast cancer, fearing the applicant will eventually be diagnosed too and drive up insurance costs. That's not a hypothetical dreamed up by lawyers — it's cited by the EEOC itself, according to analysis from Ogletree Deakins. Previously in this series: If Software Screened You For A Job Loan Or Apartment 42 Stat.

The purpose of GIPA is to protect individuals from having their genetic information disclosed, sold, or transferred without their consent or used against them in a discriminatory manner. — analysis of Illinois' Genetic Information Privacy Act, Inside Privacy

The Mix-Up Almost Everyone Makes

Here's where I want to slow down, because there's a mix-up that trips up even people who think they know this stuff. Most people assume the law is only broken if someone actually uses your family health information against you — denies you the job, jacks up your insurance, whatever. That belief isn't crazy. It comes from a real federal law, GINA (the Genetic Information Nondiscrimination Act), which really does focus on discrimination — the misuse of the information after it's collected.

But GIPA, the Illinois state law, works differently, and this is the part that surprises people. GIPA doesn't wait around for misuse. It prohibits the collection itself. You can violate the law simply by asking the question on a form — whether you ever read the answer, store it, act on it, or forget it exists five minutes later. The solicitation is the harm. Full stop. It's a bit like a "no trespassing" law that punishes you for opening the gate, not just for what you do once you're inside the yard.

And this is exactly why "voluntary" wellness programs don't get a pass. A lot of employers assume that if a health questionnaire is optional — "answer if you'd like!" — they're in the clear. According to Nixon Peabody, GIPA class actions increasingly target exactly these kinds of hiring and wellness forms that request family medical history — voluntary framing doesn't erase the fact that the information was solicited in the first place.

What This Means the Next Time Someone Hands You a Form

So what do you actually do with this? You don't need a law degree. You just need a new instinct. Next time an application, a wellness survey, or an HR intake form asks anything shaped like "has anyone in your family ever had X," recognize it for what it is: a request for genetic information, not casual curiosity. That doesn't mean panic — plenty of employers ask these questions out of genuine ignorance about where the legal line sits, not malice. But you're now allowed to pause and ask why they need to know, and what happens to that answer once you give it. Up next: That Familiar Face Promising You Money Only 0 1 Of Us Can Te.

This is the same instinct I try to build around biometric data — your face, your fingerprint, your voice — because privacy rules can attach at the moment information is collected. Genetic information just runs the same playbook with a different body part: instead of a camera capturing your face, it's a form capturing your family tree.

So here's the question worth sitting with: if a single line on a job application can legally expose information about you, your parents, and your kids all at once — who else, exactly, is standing behind you when you check that box?