GINA Title II: What the EEOC's Rules Say About Employers Acquiring, Storing and Disclosing Genetic Information

Title II of GINA and Its Covered Entities

The Genetic Information Nondiscrimination Act of 2008, Public Law 110-233, splits into a health coverage title and an employment title. The EEOC's overview page says the Commission enforces Title II, which "took effect on November 21, 2009," while the Departments of Labor, Health and Human Services and the Treasury write the rules for Title I. The employment title is codified at 42 U.S.C. 2000ff through 2000ff-11 and implemented by 29 CFR Part 1635, first published at 75 FR 68932 on November 9, 2010.

Section 1635.2(b) lists the covered entities: employers, employing offices, employment agencies, labor organizations and joint labor-management committees that run apprenticeship or training programs. The private-sector employee definition in § 1635.2(c)(1) borrows Title VII's, which reaches a person "who has fifteen or more employees for each working day in each of twenty or more calendar weeks in the current or preceding calendar year." Applicants and former employees count as employees. Separate paragraphs pick up congressional, executive branch and federal agency staff.

Genetic information under § 1635.3(c) has five parts: the individual's genetic tests, family members' genetic tests, family medical history, requests for or receipt of genetic services, and the genetic information of a fetus or of an embryo held through assisted reproduction. A "family member" runs to fourth-degree relatives, such as first cousins once removed. Sex, age, and race or ethnicity not derived from a genetic test are excluded. So are routine tests: § 1635.3(f)(3) names complete blood counts, cholesterol tests and liver-function tests, and a drug or alcohol test is not a genetic test, though a test for a genetic predisposition to alcoholism is.

The Acquisition Prohibition and Its Exceptions

The statute's core employment rule is in 42 U.S.C. 2000ff-1. Subsection (a) bars hiring, firing, pay and classification decisions made "because of genetic information." Subsection (b) makes it unlawful for an employer "to request, require, or purchase genetic information with respect to an employee or a family member of the employee" unless an exception applies.

The EEOC's rule reads "request" broadly. Under § 1635.8(a) it includes "conducting an Internet search on an individual in a way that is likely to result in a covered entity obtaining genetic information," listening in on third-party conversations or searching personal effects to obtain it, and asking about current health status in a way likely to produce it. Section 1635.8(b) then sets out the exceptions, which the EEOC's overview page counts as six:

1. Inadvertent acquisition, including overheard conversations and unsolicited disclosures
2. Health or genetic services the employer offers, including voluntary wellness programs, on the conditions described below
3. Family medical history requested to certify leave under the Family and Medical Leave Act, a state or local leave law, or a uniform employer leave policy
4. Commercially and publicly available documents such as newspapers and books, but not medical databases, court records, restricted-access social media, or sources searched with the intent of finding genetic information
5. Genetic monitoring of the biological effects of toxic workplace substances, with written notice and either a legal mandate or written authorization
6. DNA analysis by an employer that operates a forensic or human remains identification laboratory, limited to detecting sample contamination

Section 1635.8(d) applies the ban to employment-related medical examinations. A covered entity "must tell health care providers not to collect genetic information, including family medical history," in an exam meant to assess ability to do a job, and must take further reasonable measures if it learns the provider is asking anyway, which the rule says may include ceasing to use that provider.

Inadvertent Acquisition and the Safe Harbor Language

The inadvertence exception has a documentary side and a conversational side. On the documentary side, § 1635.8(b)(1)(i)(A) states that genetic information received in response to a lawful request for medical information "will not generally be considered inadvertent" unless the entity told the recipient not to provide it. Paragraph (B) supplies wording that, if used, makes any receipt "deemed inadvertent." It opens: "The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law." The rule applies this to accommodation documentation, FMLA certifications for an employee's own condition, and non-statutory leave requests.

Paragraph (C) adds that omitting the notice does not defeat the exception where the request was narrow and the reply was simply overbroad. On the conversational side, § 1635.8(b)(1)(ii) gives examples: a supervisor asking "How's your son feeling today?" or "Did they catch it early?" is within the exception, but following up with whether other relatives have the condition or whether the employee has been tested is "probing in nature" and falls outside it. A supervisor who sees family medical history posted on an employee's social media page, where the employee granted access, is also within the exception.

Wellness Programs

The statutory wellness exception in 2000ff-1(b)(2) requires that services be offered by the employer, that the employee give "prior, knowing, voluntary, and written authorization," and that only the employee and the treating professional or board certified genetic counselor see identifiable results. The regulation at § 1635.8(b)(2) adds that the program must be "reasonably designed to promote health or prevent disease," and that an authorization form must describe the information collected, its purposes and the disclosure limits.

Inducements are the contested part. Section 1635.8(b)(2)(ii) bars rewards for providing genetic information but permits them for completing a health risk assessment if it is clear the reward is paid whether or not the family history questions are answered. The rule's own example approves $150 for answering the first 80 of 100 questions when the instructions say the last 20 are optional, and disapproves the same assessment when they do not. A 2016 amendment added paragraph (iii), setting limits on inducements tied to a spouse's health information. According to the EEOC's December 20, 2018 final rule, the District Court for the District of Columbia vacated that paragraph in AARP v. EEOC, effective January 1, 2019, and the EEOC removed it from the Code of Federal Regulations on that date. The current text shows paragraph (iii) as "[Reserved]." Paragraphs (iv) and (v), which bar conditioning participation on a waiver of confidentiality and penalizing an employee for a spouse's refusal to answer, remain.

Confidentiality of Genetic Information

Section 1635.9(a) requires genetic information held in writing to be kept "on forms and in medical files (including where the information exists in electronic forms and files) that are separate from personnel files," and treated as a confidential medical record. It may share a file with ADA-protected medical information. Information in personnel files before November 21, 2009 need not be removed, but its use and disclosure are restricted. Disclosure is allowed only to the individual on written request, to health researchers under 45 CFR Part 46, under a court order (with notice to the individual if the order was obtained without their knowledge), to government officials investigating GINA compliance, for FMLA certification, and to public health agencies about a contagious disease posing an imminent hazard.

Two carve-outs keep Part 1635 from overlapping with other regimes. Section 1635.9(c) and § 1635.11(d) state that Part 1635 does not apply to genetic information that is protected health information under the HIPAA Privacy Rule. Section 1635.11(b) sets up a "firewall" so that health plan and issuer conduct is remedied under Title I and ERISA, the Public Health Service Act and the Internal Revenue Code, while employer conduct remains subject to Title II even when it concerns health benefits. The plan-side rules are covered in HIPAA's genetic information underwriting prohibition.

Remedies Through Title VII Procedures

Under 42 U.S.C. 2000ff-6(a), the powers, procedures and remedies of Title VII sections 705 through 707 and 709 through 711 apply to private-sector claims, which means the EEOC charge process. Section 1635.10(b) lists the remedies: compensatory and punitive damages "as provided for, and limited by," 42 U.S.C. 1981a, attorney's and expert fees under 42 U.S.C. 1988, and reinstatement, back pay and other equitable relief under 42 U.S.C. 2000e-5(g). Section 1635.5(b) states that a disparate impact cause of action "is not available under this part." Section 1635.10(c) requires a posted notice, with a fine of up to $100 per separate offense for a willful failure to post.

Title II sets a floor, not a ceiling. 42 U.S.C. 2000ff-8(a)(1) preserves state laws that provide "equal or greater protection." Illinois is one example, discussed in the Illinois Genetic Information Privacy Act, whose employer definition has no employee threshold and whose Section 40 creates a direct private right of action.

Frequently Asked Questions