HIPAA's Genetic Information Underwriting Ban: Which Health Plans It Binds and What Counts as Underwriting

Genetic Information Is Health Information

Congress addressed the HIPAA Privacy Rule directly in section 105 of the Genetic Information Nondiscrimination Act, which added section 1180 to the Social Security Act. As codified at 42 U.S.C. 1320d-9, it instructed the Secretary to revise the rule so that "genetic information shall be treated as health information," and so that use or disclosure of genetic information for underwriting by "a group health plan, health insurance issuer that issues health insurance coverage, or issuer of a medicare supplemental policy" would "not be a permitted use or disclosure." Subsection (d) applies HIPAA's civil and criminal penalty provisions, 42 U.S.C. 1320d-5 and 1320d-6, to violations by those plans.

The current text of 45 CFR 160.103 carries out the first instruction. "Health information" is defined as "any information, including genetic information," created or received by a listed entity. The same section defines genetic information as information about the individual's genetic tests, family members' genetic tests, "the manifestation of a disease or disorder in family members," and requests for or receipt of genetic services, including those of a fetus or an embryo held through assisted reproduction. Sex and age are excluded.

Two definitional details set HIPAA apart from other genetic rules. First, a "genetic test" under § 160.103 excludes "an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition." Second, HIPAA's "family member" definition lists spouses among first-degree relatives and states that "relatives by affinity (such as by marriage or adoption) are treated the same as relatives by consanguinity."

The Underwriting Prohibition in 45 CFR 164.502(a)(5)(i)

The operative text sits among the Privacy Rule's prohibited uses and disclosures. Section 164.502(a)(5)(i) provides that "notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes." The "notwithstanding" clause places the prohibition above the permissions elsewhere in Subpart E, and the paragraph lists no exception for an individual's authorization.

HHS finalized the provision in the January 25, 2013 Omnibus Rule, 78 FR 5566, which also carried the HITECH Act changes. The rule states: "Effective date: This final rule is effective on March 26, 2013," and "Covered entities and business associates must comply with the applicable requirements of this final rule by September 23, 2013."

Which Plans It Binds and the Long-Term Care Exclusion

GINA's text reached four kinds of plan. The Omnibus Rule preamble explains that the Privacy Rule's own list of health plans in § 160.103 is longer, taking in long-term care policies, multiple-employer welfare arrangements, state high-risk pools, Medicare Parts A and B, Medicaid, military and veterans' programs, the Indian Health Service, and any other plan paying for medical care. HHS chose to apply the ban to "all health plans that are covered entities under the HIPAA Privacy Rule, including those to which GINA does not expressly apply, except with regard to issuers of long term care policies," citing its "broad authority under HIPAA."

The long-term care carve-out followed public comment. According to the preamble, commenters and "certain members of Congress" warned that the ban could affect the ability of long-term care insurers to underwrite and "the viability of the long-term care insurance market." HHS said it lacked "the information necessary to more precisely and carefully measure the extent of such an impact," excluded long-term care plans, and said it would look to a National Association of Insurance Commissioners study before reassessing. Nursing home fixed indemnity policies were never inside the exclusion: paragraph (1)(viii) of the health plan definition reads "an issuer of a long-term care policy, excluding a nursing home fixed indemnity policy."

Some coverage is outside the rule because it is outside the definition of health plan. Paragraph (2)(i) of that definition excludes excepted benefits listed in 42 U.S.C. 300gg-91(c)(1), which include accident-only and disability income coverage, liability and workers' compensation insurance, and credit-only insurance. Life insurers do not appear in the list of health plans, although the definition of "health information" names a "life insurer" among the entities that can create or receive it.

What Underwriting Purposes Means

The statute's definition, in 42 U.S.C. 1320d-9(b)(4), has four clauses: eligibility and benefit rules, premium or contribution computation, preexisting condition exclusions, and "other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits." HHS's version in § 164.502(a)(5)(i)(A) keeps all four and adds two parentheticals. Eligibility and benefits now include "changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program," and premium computation now includes "discounts, rebates, payments in kind, or other premium differential mechanisms" for the same activities.

The preamble explains the choice. Commenters asked HHS to exclude wellness programs, and HHS declined because "GINA Title I does not include an exception for wellness programs." It noted that plans may still reward assessments and wellness participation in ways that do not involve genetic information, and that "personal habit" data such as "smoking status and alcohol and drug use, is not genetic information and thus, may be used by health plans for underwriting purposes."

Paragraph (B) states that underwriting purposes "does not include determinations of medical appropriateness where an individual seeks a benefit under the plan." The preamble's example is a plan that covers yearly mammograms for members under 40 only when they show increased breast cancer risk. That plan "can ask an individual under age 40 to provide the results of a genetic test or family health history" to decide the claim, using the minimum necessary information.

GINA Title I Behind the Rule

The Privacy Rule provision is one of several Title I protections. For group coverage, 29 U.S.C. 1182(c) bars a group health plan or issuer from requesting or requiring "an individual or a family member of such individual to undergo a genetic test," while preserving a treating professional's authority to recommend one. A research exception allows a written, voluntary request under 45 CFR Part 46 if the plan notifies the Secretary and uses none of the results for underwriting. Section 1182(d) bars requesting, requiring or purchasing genetic information for underwriting, and bars collecting it from anyone "prior to such individual's enrollment under the plan or coverage in connection with such enrollment," with an allowance for incidental collection.

The Privacy Rule overlay adds something the nondiscrimination sections lack: a restriction on how a plan uses or discloses genetic information it already holds, however it arrived, with 42 U.S.C. 1320d-9(d) applying HIPAA's penalty provisions to violations. Employer conduct is handled separately under Title II and the EEOC's rule, described in GINA Title II and employer genetic information. The broader Privacy Rule structure is covered in the HIPAA Privacy, Security and Breach Notification guide.

Notice of Privacy Practices Statements

The Omnibus Rule also changed what an underwriting plan tells members. Under 45 CFR 164.520(b)(1)(iii)(C), if a health plan other than a long-term care issuer "intends to use or disclose protected health information for underwriting purposes," its notice must include "a statement that the covered entity is prohibited from using or disclosing protected health information that is genetic information of an individual for such purposes." The statement sits in the same paragraph as the separate statements on fundraising contacts and disclosures to a group health plan's sponsor.

Frequently Asked Questions