An insurer, nonprofit health service plan, or health maintenance organization, which does not include life insurance policies, annuity contracts, long-term care insurance policies, or disability insurance policies, may not (1) use a genetic test, the results of a genetic test, genetic information, or a request for genetic services to affect a health insurance policy or contract, (2) request or require a genetic test, the results of a genetic test, or genetic information for certain purposes, or (3) release identifiable genetic information or the results of a genetic test except for internal business and to a participating health care provider without prior written authorization. Disclosure of identifiable genetic information to an employee or authorized health care provider may only be for the purpose of providing medical care to patients or conducting research approved by an institutional review board established in accordance with federal law. The insurance commissioner has the authority to issue orders where a violation is found.