Employers and other group health plan sponsors and their health insurance carriers will soon have to dust off and revise their HIPAA policies and procedures and notices of privacy practices as a result of recent changes made to the Genetic Information Nondiscrimination Act of 2008.

What these revisions will entail is the subject of a Department of Health and Human Services proposed regulation issued Oct. 7, 2009, which clarifies the status of genetic information as protected health information (PHI) under the HIPAA privacy rule in response to GINA.

Background

Among other things, HIPAA established national standards for the safeguard of “protected health information” that apply to “covered entities” (consisting of health care providers who conduct covered health care transactions electronically, health plans, and health care clearinghouses).

The HIPAA privacy rule protects individuals’ medical records and other individually identifiable health information held by covered entities by, among other provisions, requiring appropriate safeguards to protect the privacy of such information, and setting limits and conditions on the uses and disclosures that may be made of the information.

The privacy rule also gives patients rights over their PHI, including rights to examine and obtain a copy of their health records and to request corrections.

GINA compliance

GINA instructs HHS to revise the HIPAA privacy rule to clarify that genetic information is health information, and to prohibit group health plans, health insurance issuers (including HMOs), and issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes. The proposed regulation is in response to this Congressional directive. In its proposed regulation, HHS plans to modify the HIPAA privacy rule in three particulars. The proposed regulation would:

• explicitly provide that genetic information is “health information;”
• prohibit health plans from using or disclosing PHI that is genetic information for underwriting purposes; and
• mandate conforming changes to the Notice of Privacy Practices.

GINA requires HHS to modify the privacy rule to prohibit group health plans and health insurance issuers (i.e., carriers) from using or disclosing genetic information for underwriting purposes. Group health plans and health insurance issuers are, of course, HIPAA-covered entities that are subject to the privacy rule.

There are, however, other covered entities, such as certain long-term care policies, multiple employer welfare arrangements, state high-risk pools, certain public benefit programs (e.g., Medicare Part A and B, TRICARE, and the Indian Health Service program), and other combinations of individual or group plans that provide or pay for the cost of medical care.

While GINA addresses only group health plans, health insurance issuers, and Medicare supplement issuers, the proposed regulation applies the GINA prohibition on using and disclosing PHI that is genetic information for underwriting purposes to all health plans that are subject to the HIPAA privacy rule.

This expansive reading of the statute is based on HHS’s belief that it’s “interpretation is consistent with both GINA and the Secretary’s broad authority under HIPAA.”

Underwriting purposes

The proposed rules provide that the definition of “health information” encompasses “genetic information.” In doing so, the measure adds some new definitions and makes certain technical corrections to the definition of “health plan.”

Genetic information for purposes of the underwriting bar means, with respect to any individual, information about (i) such individual’s genetic tests, (ii) the genetic tests of family members of such individual, and (iii) the manifestation of a disease or disorder in family members of such individual (i.e., family medical history). It also includes the collection of genetic information for clinical research purposes, but excludes information about the sex or age of any individual.

The proposed regulation adopts the GINA definition of “underwriting purposes,” but it adds clarifications that have the effect of limiting the use of health risk assessment wellness programs.

In the preamble to the proposed regulation, HHS explains that the purpose of the clarifications is to make certain that the regulation is consistent with other agency guidance in the matter. (HHS, Treasury, and DOL have sharply limited the usefulness of health risk assessments, wellness programs, and disease management regimes by treating their use of genetic information (e.g., family histories) as “underwriting” and thus generally barred by GINA).

Perhaps the most important clarification in the proposed regulation relates to how GINA further limits the privacy rule. As a result of GINA, health plans may no longer use or disclose PHI that is genetic information for underwriting, despite other HIPAA-permitted uses and disclosures. Thus, a health plan could not use or disclose genetic information for underwriting purposes, even if an individual has signed an authorization for such purpose.

Privacy practices

HIPAA established rules requiring each covered entity to prepare and disseminate a Notice of Privacy Practices. Ordinarily, GINA’s changes would need to be reflected in the NPP and provided to individuals within 60 days.

Recognizing that revising and redistributing a NPP may be costly for health plans, and also recognizing that other requirements of law (such as the breach-notice rules under the HITECT Act) may require changes to NPPs, HHS has asked for comments on ways to inform individuals of this change to privacy practices without unduly burdening health plans.

GINA § 105 will take effect May 20, 2010. HHS will require health plans to comply with regulatory modifications 180 days following the effective date of the final rule. HHS has invited comments on the proposed regulation, which must be submitted no later than Dec. 7, 2009.

Alden J. Bianchi can be reached at ajbianchi@mintz.com.

Employee Benefit News Legal Alert is a free, weekly e-newsletter featuring articles from the nation’s leading benefits attorneys.

SUBSCRIBE