The next chapter in the ongoing effort by the federal government to narrow the permissible uses of personal health information by entities engaged in the health care industry has arrived. Building upon a foundation established by last year’s passage by Congress of the Genetic Information Nondiscrimination Act of 2008 (GINA), a number of federal agencies have issued rules aimed at insurance industry participants’ use of genetic information. Some of the organizations likely impacted by these new rules include HMOs, Medigap policy issuers, and other health insurance issuers in the group and individual insurance markets. These new rules, which address the use of genetic information with respect to certain core insurance business functions (e.g., underwriting and enrollment), effect significant changes to the business of insurance and noncompliance could result in the exposure to significant financial penalties.
GINA, these new rules which we describe in detail below, and other recently adopted laws addressing the use and disclosure of personal information (e.g., the Health Information Technology for Economic and Clinical Health Act, or HITECH Act, adopted as part of the 2009 stimulus bill) demonstrate the federal government’s heightened scrutiny with respect to the use and disclosure of personal and health-related information. As the regulatory landscape regarding use and disclosure of personal information continues to change, businesses, particularly those operating in the health care arena, will need to carefully assess and monitor their ongoing use and reliance on personal information, including genetic information.
On October 1, 2009, the Internal Revenue Service, the Employee Benefits Security Administration and the Centers for Medicare & Medicaid Services issued interim final rules (the Interim Final Rules) implementing Sections 101-103 of Title I of GINA, which prohibit group health plans, health insurance issuers in group and individual markets, and issuers of Medigap policies from using genetic information in the course of certain common insurance functions (e.g., underwriting). On the same day, the Department of Health and Human Service’s Office of Civil Rights (OCR) issued a proposed rule (the Proposed Rule) which would modify HIPAA Privacy Rule provisions (i.e., 45 CFR Parts 160 and 164) relating to the use and disclosure of genetic information by covered entity health plans. The Interim Final Rules and the Proposed Rule were published in the Federal Register on October 7, 2009, and can be viewed at http://www.access.gpo.gov/su_docs/fedreg/a091007c.html.
GINA – Interim Final Rules
Labeled by the late Senator Ted Kennedy as the "first major new civil rights bill of the new century," GINA generally prohibits group health plans, issuers in the group health insurance market and participants in the individual health insurance market from the following actions:
- Increasing group premiums or contribution amounts as a result of an enrollee’s, or prospective enrollee’s, genetic information
- Requesting or requiring individuals or their family members to submit to genetic testing
- Requesting, requiring or purchasing genetic information from individuals for enrollment or underwriting purposes
GINA also prohibits participants in the individual market from using genetic information to deny coverage, raise premiums or impose pre-existing condition exclusions. These additional prohibitions on participants in the individual market parallel HIPAA nondiscrimination provisions not previously applicable to individual market participants. Potentially affected organizations should note that GINA establishes minimum federal standards but does not preempt state laws that place even more stringent limitations on the use of genetic information.
In an effort to implement and clarify Sections 101-103 of Title I of GINA, the Interim Final Rules accomplish the following:
- Modify disparate definitions of “genetic information” in existing federal regulations to make them consistent with GINA’s statutory definition (and with one another)
- Modify the issuing agencies’ regulatory definitions of certain other key terms, including “collect,” “family member,” “manifestation(ed)” and “underwriting purposes”
- Add GINA’s definitions of “genetic test” and “genetic services” to the issuing agencies’ regulations
- Implement regulations paralleling GINA prohibitions against increasing group premiums or contribution amounts as a result of an enrollee’s, or prospective enrollee’s, genetic information
- Implement regulations following and clarifying GINA’s prohibitions regarding the “collection” of genetic information for enrollment or underwriting purposes
- Discuss and provide detailed examples regarding how the concept of “medical appropriateness” should be applied when making claims payment and underwriting determinations
- Require certain “very small group health plans” (i.e., groups with fewer than two current employee participants on the first day of the plan year) to comply with certain of the restrictions regarding the use of genetic information applicable to other insurers
- Prohibit sponsors of “self-funded non-federal governmental plans” from opting out of complying with certain restrictions against the use of genetic information applicable to other insurers
Following is a more detailed discussion of several of these provisions.
DEFINITION OF GENETIC INFORMATION
To date, the statutory definition of “genetic information” in GINA has differed from the definition within the 2004 final HIPAA portability regulations and from existing definitions within the issuing agencies’ regulations. The Interim Final Rules establish greater consistency between these rules by revising the definition of genetic information within 26 CFR §54.9801-2, 29 CFR 2590.701-2 and 45 CFR 144.103 so that they conform to GINA’s statutory definition. Similarly, as discussed further below, the Proposed Rule modifies the HIPAA Privacy Rule’s definition of “health information” to specifically and explicitly include genetic information and adds a definition of genetic information to the Privacy Rule consistent with GINA.
Under GINA, genetic information means “with respect to any individual, information about: (i) such individual’s genetic tests, (ii) the genetic tests of family members of such individual, and (iii) the manifestation of a disease or disorder in family members of such individual.” In addition, the term genetic information includes “any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by such individual or any family member of such individual.” Genetic information also includes any genetic information of a fetus or embryo carried or held by an individual. An individual’s age and gender are excluded from the definition of genetic information.
DEFINITION OF FAMILY MEMBER
The Interim Final Rules clarify that GINA’s definition of “family member,” which includes first-, second-, third- and fourth-degree relatives, includes blood relatives who share common biological ancestors (i.e., relatives by consanguinity) and relatives by adoption or marriage (i.e., relatives by affinity). The Interim Final Rules provide a few examples of individuals qualifying as “family members.” For example, the Interim Final Rules state that second-degree relatives include “grandparents, grandchildren, aunts, uncles, nephews and nieces” and that third-degree relatives include “great-grandparents, great-grandchildren, great aunts, great uncles and first cousins.”
DEFINITION OF MANIFESTATION(ED)
As noted within the preamble to the Interim Final Rules, the concept of “manifestation” is raised in three particular contexts under the Interim Final Rules. First, under the Interim Final Rules, a plan or issuer may increase premium or contribution amounts for a group health plan based on the “manifestation” of a disease or disorder of an enrollee. (Note that the agencies clarified that a plan or issuer may not, however, “use the manifested disease or disorder of one individual to as genetic information about other group members to further increase the premium or contribution amount.”) Second, as discussed above, the term “genetic information” includes “the manifestation of a disease or disorder in the family members of such individual.” Third, the term “genetic test” excludes “an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition….” [italics added for emphasis].
Under the Interim Final Rules, manifestation(ed) is defined as “with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a health care professional with appropriate training and expertise in the field of medicine involved.” The Interim Final Rules also state that “a disease, disorder, or pathological condition is not manifested if a diagnosis is based principally on genetic information.” The Interim Final Rules provide a number of examples addressing the concept of manifestation to provide guidance.
DEFINITION OF UNDERWRITING AND THE PROHIBITION AGAINST COLLECTING INFORMATION
GINA and the Interim Final Rules define “underwriting purposes” as including, with respect to group health plan coverage, rules and determinations regarding eligibility (including initial and continuing enrollment), computation of premium and contribution amounts, and application of exclusions based on preexisting conditions. The Interim Final Rules clarify that underwriting purposes also includes adjustment of deductibles or other cost-sharing mechanisms, providing discounts, payments in kind or other “premium differential mechanisms” in return for participation in wellness programs, health risk assessments (HRAs) or other activities. These clarifications expand the reach of GINA’s original prohibitions against collecting genetic information. As a result of this definition, plans may only collect genetic information through HRAs so long as individuals completing the HRAs do not receive financial benefits or payments in kind. The Interim Final Rules define the term “collect” to mean requesting, requiring or purchasing of genetic information.
HIPAA Privacy Rules – Proposed Rules
Section 105 of Title I of GINA requires the Secretary of the Department of Health and Human Services to amend the HIPAA Privacy Rules to address certain privacy protections regarding genetic information. The Proposed Rule represents DHHS’ attempt to address this statutory requirement and would, if adopted as issued, achieve the following:
- Revise the definition of “health information” to explicitly include genetic information
- Add a definition of “genetic information” to the Privacy Rule consistent with GINA’s statutory definition
- Prohibit covered entity health plans from using or disclosing genetic information for “underwriting purposes” even if an authorization is obtained
- Require covered entity health plans that use or disclose protected health information (PHI) for underwriting purposes to include language in their Notices of Privacy Practices (NPPs) explicitly stating that the plan is prohibited from using or disclosing genetic information for underwriting purposes
- Add and amend certain definitions (e.g., “manifestation” and “family members”) and Privacy Rule provisions so that the Privacy Rule better conforms with GINA and the Interim Final Rules
- Amend the Privacy Rule to make technical changes to the definition of Health Plan
The Proposed Rule would apply GINA prohibitions regarding the use of genetic information for underwriting purposes to all health plans subject to the Privacy Rule. Consequently, under the Proposed Rule this prohibition would reach beyond GINA’s application to group health plans, health insurance issuers, HMOs and issuers of Medigap policies and also apply to the following:
- Issuers of long term care policies (excluding nursing home fixed-indemnity policies)
- Employee welfare benefit plans “or other arrangements that are established or maintained for the purpose of offering or providing health benefits to the employees of two or more employers (to the extent that they are not group health plans or health insurance issuers)”
- High-risk pools “that are mechanisms established under state law to provide health insurance coverage or comparable coverage to eligible individuals”
- Certain specified public benefit programs (e.g., Medicare Parts A and B and Medicaid);
- “[A]ny other individual or group plan, or combination of individual or group plans that provides or pays for the cost of medical care”
Within the preamble to the Proposed Rule, OCR recognizes that covered entity health plans would likely face potential costs and procedural burdens associated with a required amendment to their NPPs. OCR notes that it is considering potential strategies intended to reduce the financial and procedural burdens involved with such a requirement. For example, OCR discusses potentially relaxing the Privacy Rule’s member notification requirements, which are triggered when material changes to NPPs occur, by either permitting plans to include changes within their next annual mailing or by granting affected health plans additional time to circulate revised NPPS.
Group market and individual market participants should exercise considerable caution with respect to their GINA and HIPAA compliance efforts, as penalties under these laws are potentially steep. The Department of Labor may impose GINA-related penalties on a $100 per-day-per-affected-individual basis with mandatory minimums of $2,500 for each affected individual for de minimus violations and $15,000 for each affected individual for more substantial violations. Total penalties for GINA-related violations due to “reasonable cause” would not exceed a maximum of $500,000. However, GINA does not establish a cap on total penalties for violations resulting from willful neglect. It will be of some comfort to market participants to know, however, that the Secretary of the Department of Labor has the right to waive GINA-related penalties for violations determined to be “due to reasonable cause.”) Under HIPAA, and as described by OCR, penalties for violations of the HIPAA Privacy Rule (recently modified under the American Recovery and Reinvestment Act of 2009) resulting in improper use or disclosure of genetic information “could result in a fine of $100 to $50,000 or more for each violation.” In addition, new notice provisions for “unsecured PHI” could be triggered if an improper use or disclosure of genetic information-PHI occurred.
Effective Dates and Public Comment
The Interim Final Rules will become effective for group and individual insurance market participants on December 7, 2009. The agencies implementing the Interim Final Rules will, however, accept and consider post-adoption public commentary with regard to these Rules if submitted on or before January 5, 2010. We then expect issuance of a Final Rule taking submitted comments into consideration. Comments regarding the Interim Final Rule may be submitted to any of the implementing agencies by email, mail, hand or courier delivery, or online through the federal rulemaking portal located at http://www.regulations.gov. Detailed instructions regarding the process for submitting comments may be found within 74 Fed. Reg. 51664 (October 7, 2009).
The Proposed Rule will not become effective until OCR reviews and reacts to comments from the public. Comments regarding the Proposed Rule must be submitted on or before December 7, 2009, via email, mail, hand or courier delivery, or through the federal rulemaking portal located at http://www.regulations.gov. Detailed instructions regarding the process for submitting comments may be found within 74 Fed. Reg. 51698 (October 7, 2009).
Affected health plans and insurance issuers that have not already taken steps to comply with GINA will quickly need to asses their current use of genetic information and either adopt new or modify existing policies addressing the use of genetic information in compliance with the Interim Final Rules. Businesses that have already adopted GINA-related policies will need to review and potentially update those policies to reflect changes under the Interim Final Rules. In almost all cases, affected businesses should ensure that policies addressing underwriting, claims payment, enrollment, and premium and collections adjustment speak to prohibitions regarding the use and disclosure of genetic information. Also, an additional crucial step that should not be overlooked is to develop and implement a plan intended to educate employees and staff regarding any of the policy changes made as a result of the Interim Final Rules (or the Proposed Rule, once finalized). Finally, affected businesses and organizations should consider the impact of these rules on their operations and the industry as a whole, and determine whether to take advantage of the public comment periods described above to express concerns or support for, or to request further clarification of, either the Interim Final Rules or the Proposed Rule.