Full text of the regulations

Earlier this month, the Equal Employment Opportunity Commission (“EEOC”) published its long-awaited final regulations implementing the Genetic Information Nondiscrimination Act (GINA). GINA, which became law last year, addresses the collection and use of genetic information by health insurers, employers, employment agencies and labor organizations. Title II of GINA, which covers employers, provides, among other things, that employers:

  • May not discriminate based on genetic information in hiring, firing, compensation and other terms of employment
  • May not, with some exceptions, request, require, collect or purchase protected genetic information with respect to an individual or the individual’s family
  • Must, if in possession of genetic information about an employee, maintain the information as a confidential medical record.

Though GINA has been effective since last year, the administrative rule-making process has been ongoing. The final rules just announced by the EEOC clarify some parts of the law that the statutory language did not necessarily make clear. Here are a few of the noteworthy provisions.

Prohibition on Acquiring Genetic Information and Exception for Inadvertent Disclosure

The final rules clarify GINA’s prohibition upon an employer’s acquisition of genetic information from employees. Importantly, the rules do not forbid only the deliberate acquisition of genetic information. The rules define a prohibited “request” for genetic information to include not only specific requests for that information, but also such actions as (a) conducting an Internet search on an individual that is likely to result in discovery of genetic information (b) discovering an individual’s genetic information by eavesdropping on workplace conversations and (c) requesting information on an individual’s health status in such a way that it is likely that the employer will receive genetic information in response. Thus, an employer may violate GINA even if it acquires genetic information without specific intent to do so.

There are some safeguards for employers who inadvertently discover genetic information of their employees or their family members. The law itself provides an exception to liability when an employer “inadvertently requests or requires” genetic information. The final rules elaborate on this exception, particularly with regard to an employer’s lawful requests for medical information, such as when an employer requests documentation to support a request for reasonable accommodation for a disability or requests medical information as permitted under the FMLA. The final rules create a “safe harbor” for employers who warn the employee and/or health-care provider not to provide genetic information in response to lawful requests like these. Specifically, the final rules expressly state that receipt of genetic information will be deemed inadvertent if an employer uses the following language in a written request for medical information:

The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. ‘Genetic information’ as defined by GINA, includes an individual’s family medical history, the results of an individual’s or family member’s genetic tests, the fact that an individual or an individual’s family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual’s family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services.

The absence of this language will not necessarily foreclose the employer from establishing that it “inadvertently” received genetic information in response to a request for medical information. But without this language, the employer’s acquisition of genetic information will be deemed “inadvertent” only if the employer can show that its request was not likely to elicit a response containing genetic information.

The final rules also recognize that employers may obtain genetic information through casual workplace conversation. The final rules specify that such incidents qualify as “inadvertent acquisition” so long as the employer does not ask probing follow-up questions that are likely to result in the acquisition of genetic information.

Wellness Programs

GINA contains an exception that allows employers to obtain genetic information in connection with a voluntary wellness program. The exception only applies where (1) the provision of genetic information is voluntary, meaning the individual is neither required to provide the information nor penalized for choosing not to do so, (2) the individual provides a voluntary written authorization, (3) individually identifiable genetic information is accessible only to the persons receiving genetic services and to the service provider, and not to anyone in the workplace (including anyone who makes employment decisions) and (4) individually identifiable information is not disclosed to the employer except in “aggregate” terms that do not disclose the identity of specific individuals.

The final rules give some additional guidance with respect to what it means for employees to give genetic information voluntarily in connection with a wellness program. The final rules prohibit an employer from offering a financial inducement for individuals to provide genetic information. Employers may, however, offer financial inducements for an employee’s completion of health risk assessments that include questions about genetic information, so long as the inducement is available to the employee even if the employee does not answer the questions about genetic information.

Confidentiality of Genetic Information

The final rules largely parrot the statutory language with respect to the employer’s duty to maintain the confidentiality of an employee’s genetic information. For example, the final rules repeat the statute’s requirement that an employer maintain genetic information in medical files that are separate from personnel files and treat such information as a confidential medical record.

Despite GINA’s confidentiality concerns, the final rules do contain a provision that may spare employers from an administrative burden. The final rules provide that genetic information placed in personnel files prior to November 21, 2009 need not be removed from those files. The employer, however, remains subject to all prohibitions on the use and disclosure of the genetic information.


The GINA final rules will formally go into effect on January 10, 2011. Employers should have already treated genetic information as a protected characteristic for purposes of complying with equal employment opportunity and anti-discrimination laws. Now that the final rules are in place, employers should remind their managers and human resources personnel on the law’s prohibition on acquiring, using and disclosing genetic information, as well as the duty to maintain confidentiality over genetic information. And because lawful requests for medical information can be fairly common (e.g., for purposes of determining FMLA eligibility or in investigating reasonable accommodations for a disability), employers should update their written requests to incorporate the “safe harbor” language to ensure that any acquisition of genetic information is deemed inadvertent and therefore not prohibited by GINA.