New HIPAA Final Rule Implements GINA Restriction on Use and Disclosure of Genetic Information for Underwriting Purposes

by Katherine Georger

On January 17, 2013, the Department of Health and Human Services ("HHS") issued its final rule implementing certain revisions to the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act of 2008 ("GINA"). GINA prohibits discrimination based on a person's genetic information in health coverage (Title I) and employment (Title II).

GINA Mandated Revisions to the Privacy Rule. On October 7, 2009, HHS issued a proposed rule that recommended certain modifications to the HIPAA Privacy Rule to make it consistent with GINA. For example, one provision within Title I of GINA requires that the HIPAA Privacy Rule be clarified to designate genetic information as health information. In addition, GINA specifies that the Privacy Rule needs to be modified to reflect GINA's proscription of a health plan's use or disclosure of genetic information for underwriting purposes. The new final rule incorporates both of these proposed revisions.

In particular, HHS modified the Privacy Rule to implement the GINA provisions as follows:

• Augments the definition of "health information" to include "genetic information"-Section 160.103;
• Adds definitions of GINA-related terms, such as "family member," "genetic information," "genetic services," "genetic test" and "manifestation or manifested" - Section 160.103;
• Mandates that all health plans that are covered entities under the HIPAA Privacy Rule, except issuers of long term care policies, are prohibited from using or disclosing protected health information for underwriting purposes - Section 164.502(a)(3);
• Includes a specific definition of "underwriting purposes;" – Section 164.501; and
• Requires that health plans performing underwriting services must include language in their "Notice of Privacy Practices" stating that genetic information may not be used or disclosed for underwriting purposes – Section 164.520.

The final rule is effective on March 26, 2013. Covered entities are given an additional 180 days, or until September 23, 2013, to comply with applicable requirements under the final rule.

Full text of the new HIPAA final rule may be found at . Contact Holland & Hart for additional information.

For questions regarding this update, please contact
Katherine Georger
Holland & Hart, U.S. Bank Plaza, 101 S. Capitol Boulevard, Suite 1400, Boise, ID 83702-7714
email: klgeorger@hollandhart.com, phone: 208-383-3984

This news update is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author. This news update is not intended to create an attorney-client relationship between you and Holland & Hart LLP. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.