(1) The Genetic Information Privacy Act does not apply to protected health information collected by a covered entity or business associate as those terms are defined in 45 C.F.R. parts 160 and 164.

(2) The disclosure of genetic data pursuant to the Genetic Information Privacy Act shall comply with all state and federal laws for the protection of privacy and security. The act shall not apply to protected health information collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the federal Department of Health and Human Services, 45 C.F.R. parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and the Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009, Public Law 111-5.