Proposed Rule Implements the Genetic Information Nondiscrimination Act
On October 1st, the Office of Civil Rights (OCR) within the Department of Health and Human Services (HHS) issued a Proposed Rule with respect to the Genetic Information Nondiscrimination Act (GINA), a federal law passed in May 2008 that protects individuals against discrimination in health care coverage and employment based on genetic information. Many states already have similar laws in place, but GINA provides a new federal baseline level of protection against genetic discrimination in health care coverage and employment.
The proposed rule attempts to implement new privacy and confidentiality protections in Title I of GINA, which deals with nondiscrimination in health care coverage, and makes changes to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. The Privacy Rule protects individuals’ health information by limiting how it can be used or disclosed by “covered entities,” which includes health insurers and plans. This post highlights some of the major changes, which are based both on GINA as well as HHS’ general authority under HIPAA. (Of note, proposed regulations to implement the employment nondiscrimination provisions were issued earlier this year by the Equal Opportunity Employment Commission (EEOC).
First, GINA requires HHS to clarify that genetic information is protected health information and therefore subject to the Privacy Rule, and the proposed rule makes this clarification. Of note, HHS has always maintained in guidance that genetic information is protected under HIPAA as long as it is individually identifiable and maintained by a covered entity. However, the proposed change goes a step further and makes this indisputable in the Rule.
Second, GINA also requires HHS to change the Privacy Rule to prohibit health plans from using or disclosing genetic information for underwriting purposes, including determining eligibility or benefits, calculating premiums or contribution amounts, and imposing pre-existing condition exclusions (and this prohibition applies even if an individual authorizes the use of his or her information for this purpose). (The Privacy Rule historically has allowed covered entities to use any protected health information for underwriting purposes). Although Title I of GINA specifies that only certain plans be subject to this prohibition, OCR proposes to apply the prohibition to all health plans governed by the Privacy Rule, including long-term care policies and employee benefit welfare plans. HHS maintains that this interpretation is consistent with both GINA and HHS’ authority under HIPAA.
Third, OCR proposes to require plans that use or disclose protected information for underwriting purposes to include a statement in their Notice of Privacy Practices about how they are prohibited from using or disclosing genetic information for underwriting purposes. The Privacy Rule already requires health plans (and most other covered entities) to provide a notice to individuals that describes how they use and disclose personal health information. However, requiring plans that perform underwriting to include a specific statement about genetic information increases transparency and further educates individuals about specific protections on genetic data.
OCR coordinated its work on the proposed rule with the Departments of Labor and Treasury, and the Centers for Medicare and Medicaid Services, which are tasked with implementing regulations for Title I of GINA and which released their interim final rule the same day that OCR issued its rule. The public has 60 days to comment on the proposed rule. Comments are due to HHS no later than December 7, 2009 and can be submitted electronically at www.regulations.gov.