IANAL, but if I'm reading this right sec. 3(a)1(A)(iii) (not sure of what the right way to cite that is) says that collection of genetic information is OK if you say it's workplace health promotion plan (and remember, you're allowed to charge employees way more for insurance if they don't participate in these "voluntary" health promotion programs).