GINA Regulations – How to Handle Genetic Information Privacy
by Jason E. Lopata, Esq.
Effective in November 2009, new regulations are in place under the Genetic Information Non-Discrimination Act (GINA) that effect all businesses with 15 or more employees. Originally enacted to prohibit the use of genetic information for the purpose of making employment-related decisions, the recently effective legislation now extends to restricting employers from acquiring or disclosing genetic information and more broadly defines what continues genetic information. Most relevantly, GINA prohibits health plans and employers from offering financial incentives or rewards for participating in health risk assessments (HRA) that request information about family medical histories.
While such HRAs have been used in trying to incentivize employer-led wellness or disease- management programs (and in turn, better rates or premiums from insurers), such rewards must immediately cease. However, sponsors or administrators may still obtain and use results of genetic tests to aid in payment determinations as long as they request the minimum amount of information necessary to make that determination (as set forth in the HIPAA Privacy Rule). In such an instance, such medical information about an individual employee MUST be kept separate from the employee’s personnel file, as such information is protected under the medical confidentiality provisions of the ADA. This is due to the fact that the laws prohibit the use of any type of genetic information for the purposes of making employment decisions. Failure to abide by the new regulations can lead to fines upwards of $500,000 for the violation, which includes even an inadvertent disclosure or use of such genetic medical information. So even an “innocent” mistake can be quite costly to your practice!!
So how might these new regulations affect your practice? If you are using any type of HRA for your own employees, or are asked to complete such an assessment for a third-party, review those assessments and eliminate any mandatory acquisition of the newly protected information. Such revised HRAs should only contain questions about the individual’s own medical history, and nothing about the individual’s family medical history. Practices will want to review and make the necessary changes to not only HRAs and the programs using theses assessments, but also to enrollment procedures and group health plan documents. Taking just a few moments to review these documents and procedures can save your practice from an expensive misstep.
