On January 25, 2013, the Department of Health and Human Services (“HHS”) formally published its Omnibus Final Rule (“Final Rule”), which includes modifications to the HIPAA Privacy and Security Rules under the Health Information Technology for Economic and Clinical Health Act (“HITECH”) and the Genetic Information Nondiscrimination Act (“GINA”). Because the Final Rule covers a broad range of topics, we will be issuing a series of articles in our HIPAA Impact Series to provide further analysis on these topics. This article focuses on the impact of the Final Rule on the implementation of GINA.
Background
In general, Title I of GINA prohibits group health plans from discrimination in premiums or contributions for group coverage based on genetic information, prohibits the use of genetic information as a basis for determining eligibility or setting premiums in the individual and Medicare supplemental (Medigap) insurance markets and limits the ability of group health plans, health insurance issuers and Medigap issuers to collect genetic information or to request or require that individuals undergo genetic testing. On October 7, 2009, the Department of Health and Human Services issued a notice of proposed rulemaking that recommended certain modification to the HIPAA Privacy Rule to make it consistent with GINA, including clarifying that genetic information is health information and prohibiting health plans from disclosing or using genetic information for underwriting purposes.
Prohibition on Use of Genetic Information
The Final Rule mandates that all health plans that are covered entities under the HIPAA Privacy Rule, except issuers of long-term care policies, are prohibited from using or disclosing protected health information for underwriting purposes and implements the mandate primarily by adding or revising definitions in the HIPAA Privacy Rule.
New Privacy Rule Definitions
The Final Rule amends the definition of “health information” in the Privacy Rule to specifically include “genetic information.” “Genetic information” is defined as information regarding: (1) the genetic tests of an individual; (2) genetic tests of the individual’s family members; (3) the individual’s family medical history; (4) the individual’s request for, or receipt of, genetic services or participation in clinical research that includes genetic services by the individual or his or her family members; or (5) the genetic information of a fetus carried by an individual or a pregnant woman who is a family member of the individual and the genetic information of any embryo legally held by the individual or family member using an assisted reproductive technology.
“Genetic information” specifically excludes information about the sex or age of an individual. “Family members” are defined to include an individual’s dependents as well as those persons who are, or become, related to an individual through marriage, birth, adoption or placement for adoption and extends to an individual’s fourth-degree relatives, i.e., great-great-grandparents, great-great-grandchildren and first cousins once-removed. The Final Rule also revised the core HIPAA definitions of “payment” and “health care operations” to account for GINA’s restrictions on use of genetic information and adds definitions for “genetic services” and “genetic test.”
The Final Rule also adds a definition of “manifestation or manifested,” which means, with respect to a disease, disorder or pathological condition, that an individual has been or reasonably could be diagnosed with the disease, disorder or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved. A disease, disorder or pathological condition is not “manifested” if the diagnosis is based principally on genetic information. This is significant because, although a health plan cannot use genetic information for underwriting purposes, if a genetic condition manifests into a disease, the health plan is permitted to utilize that fact for underwriting purposes.
Finally, the Final Rule adds a new, specific definition of “underwriting purposes.” Accordingly, “underwriting purposes” means, with respect to a group health plan, health insurance coverage or Medicare supplemental policy: (1) rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage or policy; (2) the computation of premium or contribution amounts under the plan, coverage or policy; (3) the application of any pre-existing condition exclusion under the plan, coverage or policy; and (4) other activities related to the creation, renewal or replacement of a contract of health insurance or health benefits. The Final Rule also requires health plans that perform underwriting services to update their Notices of Privacy Practices to state that genetic information may not be used or disclosed for underwriting purposes.
Practical Takeaways
Group health plans that perform underwriting services need to take proper steps to ensure that genetic information is not used or disclosed during the underwriting process. In addition, those group health plans need to amend their Notices of Privacy Practices to state that genetic information will not be used or disclosed for underwriting purposes and revise any policies and procedures to ensure these changes are implemented appropriately.
Health care providers have typically treated genetic information as health information, so the Final Rule should have little impact on their operations.
For more information, please contact Mark Swearingen at 317-977-1458 or mswearingen@wp.hallrender.com or your regular Hall Render attorney.
Hall Render’s HIPAA Impact Series has provided in-depth analysis of HIPAA issues and developments since the passage of HITECH. View our HIPAA Impact Series and sign up to receive updates by visiting www.hallrender.com/impact.
