The Omnibus Final Rule issued by the Department of Health and Human Services in January 2013 set forth implementing regulations not only pursuant to the Health Information Technology for Economic and Clinical Health Act (HITECH Act) but also pursuant to the Genetic Information Nondiscrimination Act of 2008 (GINA). The Omnibus Final Rule contains a number of modifications and clarifications that are significant to the use of genetic information and family medical history by covered entities, business associates and other healthcare entities. In the Omnibus Final Rule, HHS 1) revised the HIPAA Privacy Rule (Privacy Rule) to clarify that genetic information is health information, and 2) prohibited the use or disclosure of genetic information for underwriting purposes for all health plans subject to the Privacy Rule, except long-term-care insurers.
HHS’s enhancement of the privacy accorded to genetic information is significant because genetic testing is used with increasing frequency to determine the likelihood or presence of disease manifestation or the suitability of a particular method of treatment, and it impacts not only the individual whose genetic information was used but also the family members who share the genetic code. Furthermore, HHS’s expansive view of entities forbidden to use or disclose genetic information for underwriting purposes limits the ability of insurance providers to require genetic testing or discriminate in the amount of contributions or premiums paid by an individual based on their genetic information. (See 78 Fed. Reg. 5658-59).
Clarifying Definitions
In employment and health coverage contexts GINA prohibits discrimination based on an individual’s genetic information. The Omnibus Final Rule modified or added the applicable definitions for “health information,” “family member,” “genetic information,” “genetic services,” “genetic test,” “manifestation or manifested” and “health plan.” (45 C.F.R. 160.103). Key definitions are:
1. Family Member
A family member is either a dependent or a first- through fourth-degree relative by either affinity (marriage or adoption) or consanguinity (biological). Half-siblings or less than full-consanguinity are treated as if they are full relatives.
2. Genetic Information
Genetic information includes (i) individual genetic tests; (ii) manifestation of a disease or disorder in family members of such an individual (e.g., family medical history); or (iii) any request for or receipt of genetic services, or participation in clinical research that includes genetic services, by the individual or any family member of the individual. This information includes the genetic information of a fetus or any embryo legally held by an individual or family member utilizing assisted reproductive technology, but does not include information about the sex or age of an individual. (45 C.F.R. 160.103).
For example, the diagnosis of a parent with Huntington’s disease or the results of a test for the BRCAI gene associated with breast cancer constitute genetic information. Genetic information does not include age or gender.
3. Genetic Test
A genetic test is “an analysis of human DNA, RNA, chromosomes, proteins or metabolites if the analysis detects genotypes, mutations, or chromosomal changes. A genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.” (45 C.F.R. 160.103).
A BRAC1 test or a test for the genetic marker for a particular type of colon cancer are genetic tests. Genetic tests do not include HIV tests, complete blood counts, cholesterol tests, liver function tests or tests for the presence of alcohol or drugs. The genetic testing and personalized medicine industry is rapidly evolving with, for example, the use of over-the-counter genetic tests and genetic tests to determine whether a particular medication will be beneficial for a particular individual. Therefore, HHS intends to issue further guidance on what tests are considered genetic tests. (78 Fed. Reg. 5662).
4. Manifestation or Manifested
Manifestation or manifested means “with respect to a disease, disorder, or pathological condition that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved.… [A] disease, disorder, or pathological condition is not manifested if the diagnosis is based principally on genetic information.” (45 C.F.R. 160.103).
The definition of manifestation incorporates both family medical history and genetic testing into the definition of genetic information. For example, if an individual has several family members who were diagnosed with colon cancer, the individual undergoes a genetic test to identify whether the individual has the HNPCC mutation and the test results are positive, but the individual’s colonoscopy is clear, then the individual has not manifested the disease of colon cancer. All information about the individual’s potential future manifestation of colon cancer is based on genetic information. If, and when, the individual displays polyps or other symptoms particular to colon cancer, then the individual will have the manifestation of colon cancer. (See 78 Fed. Reg. 5663-64).
Alternatively, if an individual is displaying symptoms of Huntington’s disease, the neurologist uses the Huntington’s disease genetic test to determine whether the individual has the mutation and the results of the test are positive for the mutation, then the disease has manifested even though genetic information was used to diagnose the disease. Here, genetic information was not the sole or even principal basis for diagnosing the illness. As the field of genetic testing and genetic manifestation of disease expands, HHS plans to issue guidance on manifestation and the Privacy Rule’s protection for genetic information. (See 78 Fed. Reg. 5663-64).
Prohibition of the Use of Genetic Information in Underwriting and the Exception for Long-Term Care
Title I of GINA calls for HHS to prohibit group health plans, health insurance issuers (including HMOs) and issuers of Medicare supplemental insurance plans (Medigap policies) from using or disclosing genetic information for underwriting purposes. A health plan must now state in its Notice of Privacy Practices that it is prohibited from using or disclosing for underwriting purposes PHI that is genetic information of an individual. HHS defines “underwriting purposes” to include (i) rules for or determination of eligibility for benefits under a health plan; (ii) the computation of premiums or contribution amounts under a plan (including discounts, rebates or other premium differential mechanisms in return for activities such as participating in a wellness program); (iii) the application of any pre-existing condition exclusion under the plan; and (iv) other activities related to the creation, renewal or replacement of a contract of health insurance or health benefits. (45 C.F.R. 164.502(5)(i)).
Underwriting purposes, however, do not include the “determination of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.” (45 C.F.R. 164.502(a)(5)(i)). For example, a health insurance plan can use the results of a genetic test to decide whether a particular chemotherapy drug is medically appropriate for the individual even though the drug may be covered under the health plan.
In the Omnibus Final Rule, HHS expanded the types of insurance issuers who are prohibited from using genetic information when underwriting policies. Originally, HHS proposed to prohibit all health plans subject to the Privacy Rule from using genetic information when underwriting policies. In the Omnibus Final Rule, however, HHS exempted long-term-care insurance from the prohibition on the use of genetic information when underwriting policies. (45 C.F.R. 164.502(a)(5)(i) and 78 Fed. Reg. 5665). HHS “acknowledge[d] that, at [that] time, it [did] not have the information necessary to more precisely and carefully measure the … impact on the long-term market in order to appropriately balance an individual’s privacy interests with such an impact.” (78 Fed. Reg. 5661). HHS stated that it is seeking further information on the issue and further rulemaking may prohibit the use of genetic information in underwriting for long-term-care insurance.
If you have any questions regarding these implementing regulations or any other aspect of the Omnibus Final Rule, please contact the authors.