HIPAA Final Rule - What's a Covered Entity Supposed to Do?

February 21, 2013
Legal Updates

The final part of the series focuses on the HIPAA Final Rule's modification of the Privacy Rule to address genetic health information under the Genetic Information Nondiscrimination Act ("GINA").  In issuing the Final Rule, the Department of Health and Human Services ("HHS") stressed the need to protect an individual's strong privacy interest in his or her genetic information.  The Final Rule expands the Privacy Rule to include certain definitions and terminology relating to genetic health information, and adopts a prohibition on health insurance issuers from utilizing genetic information for underwriting purposes.  Ultimately, the Final Rule allows genetic information to be considered a specifically protected subset of health information under HIPAA.     

Incorporating GINA Definitions into the HIPAA Privacy Rule

The Final Rule expands the Privacy Rule to ensure the definition of "health information" includes genetic information.  Under the Rule, "genetic information" includes information relating to an individual's genetic tests, genetic tests of family members (including a fetus or embryo), and the manifestation of a disease or disorder in family members of an individual.  The Rule excludes information about an individual's sex or age from its definition of "genetic information."  

In addition, the Rule expounds on what constitutes "genetic information" by adding definitions for other GINA-related terms, including: "family member," "genetic services," "genetic test," and "manifestation" or "manifested."  In the Rule, "genetic tests" refer to tests which analyze human DNA, RNA, chromosomes, proteins, or metabolites, and which detect genotypes, mutations or chromosomal changes.  Moreover, the Rule points out that tests such as HIV, blood counts, cholesterol and liver function, or tests for drugs and alcohol are not considered genetic tests.  Further, the Rule defines "manifestation" to include a disease or disorder that could be reasonably diagnosed by a healthcare professional with knowledge in a given field.  According to HHS, this definition was drafted to prevent certain information from being deemed "genetic information" in instances where a trained health professional could diagnose a disease or disorder without necessitating a genetic test. 

Prohibition on the Use of Genetic Health Information      

The Final Rule also prohibits group health plans, health insurance issuers or issuers of Medicare supplemental policies from using or disclosing genetic information for underwriting purposes.  In creating this prohibition, the Final Rule adopts the GINA definition of "underwriting purposes," which includes: a) determination of eligibility for benefits under a plan; b) computation of premium or contribution amounts under a plan; c) application of any pre-existing condition exclusion under a plan; and d) other activities relating to the creation, renewal, or replacement of a contract of health benefits.  Nonetheless, under the Final Rule, health plans can continue to use or disclose protected health information other than genetic information for underwriting purposes, and can use genetic information for determining medical appropriateness when an individual seeks a benefit under a health plan or policy.  Importantly, these issuers should re-examine their practices in maintaining medical records to assure that they do not inadvertently rely upon genetic information embedded in their records in making underwriting decisions, including segregating, if necessary, certain reports or records containing genetic information.

Exception for Long Term Care Plans

Despite the intended broad scope of this prohibition, the Final Rule creates an exception for issuers of long term care plans.  In issuing the Final Rule, HHS took particular note of the importance in maintaining a strong market for the issuance of long term care insurance.  As a result, the Final Rule strikes a balance by permitting long term care issuers to utilize genetic information in an underwriting capacity, while requiring them to be bound by the Privacy Rule such that genetic information will be protected from unauthorized and improper disclosures and uses.    

To read the other three parts in this series, please see below:
Part One
Part Two
Part Three