On January 10, 2011, Equal Employment Opportunity Commission (EEOC) regulations implementing the Genetic Information Nondiscrimination Act (GINA) took effect, interpreting and clarifying the Act's employment provisions. Title II of GINA prohibits employment discrimination based on genetic information; bars employers from requesting and requiring genetic information; and imposes nondisclosure and confidentiality requirements. Although it is unlikely that many employers actively engage in genetic testing, the regulations broadly interpret GINA's requirements and many commonplace workplace occurrences -- such as conversations about the health of an employee's family member, requests for employee medical documentation, and conducting employment medical exams -- potentially can result in GINA violations. Understanding the basics of GINA is the first step in minimizing potential liability.

Coverage and Definitions

Signed into law by President George W. Bush in 2008, GINA's goal is to allow individuals to take advantage of scientific advances in human genetics without having to worry about whether genetic information will be misused for employment purposes. "Genetic information" is broadly defined to include not only information gathered through genetic tests, but also information about the individual's family medical history. Although the EEOC did not specifically define "genetic tests," the regulations provide some illustrative examples. Genetic tests include tests to determine whether an individual has certain genetic variants associated with a predisposition to a disease such as Huntington's Disease or breast cancer, and carrier screening to detect the risk of conditions such as cystic fibrosis and sickle cell anemia. Examples of tests not considered genetic tests include drug and alcohol testing, cholesterol screening, and HIV tests.

Not only is GINA's definition of "genetic information" broad, so is its coverage. Like Title VII of the 1964 Civil Rights Act, GINA covers private and state and local government employers with 15 or more employees. Former employees and job applicants are protected by the Act, in addition to current employees.

Prohibited Acts and the Inadvertent Acquisition Exception

GINA's prohibition on use of genetic information is relatively straightforward -- an employer cannot discriminate in hiring, firing, promotions and/or any other employment decisions on the basis of genetic information. GINA also prohibits retaliation for protected activity.

GINA also prohibits employers from requesting, requiring or purchasing genetic information. The regulations take an expansive view of what constitutes an impermissible "request" for genetic information, indicating it includes actions such as:

  • Conducting an Internet search on an individual in a manner likely to result in the acquisition of genetic information;
  • Actively listening to third-party conversations or searching an individual's personal effects for the purpose of obtaining genetic information; and
  • Requesting medical information in a manner likely to elicit genetic information.

Employers who "inadvertently" request or receive family medical history and/or other genetic information may be exempted from liability, but the regulations impose obligations upon employers to prevent such inadvertent acquisition. Notably, the regulations include a model "safe harbor" notice employers can use to caution individuals and/or healthcare providers not to provide genetic information in response to otherwise lawful requests for medical information. If an employer gives this warning and genetic information nonetheless is provided, it will fall within the inadvertent acquisition exception and the employer will not be liable under GINA. This model notice that can be used to satisfy this "safe harbor" requirement is as follows:

"The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. 'Genetic information,' as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services."

Even where this notice is not provided, the inadvertent acquisition exception nonetheless may be applicable if the employer's request for medical information was narrowly tailored so as not likely to elicit genetic information.

Application of the inadvertent acquisition exception and this "safe harbor" notice to some common workplace situations are described below.

FMLA Medical Certifications

Most employers use the U.S. Department of Labor (DOL) certification of healthcare provider forms in conjunction with employee requests for FMLA leave for their own serious health condition or to care for their qualifying family member with a serious health condition. With regard to medical certification of a family member health condition, GINA permits employers to request family medical history to comply with the FMLA's certification requirements, as well as with any state or local leave laws or employer policies that similarly provide leave to care for sick family members. According to Chris Kuczynski, Assistant Legal Counsel and Director of the ADA/GINA Policy Division at the EEOC, employers therefore should not include the "safe harbor" notice when requesting information to certify an employee's family member's serious health condition.

With regard to certification of the employee's own serious health condition, an argument can be made that the DOL's FMLA medical certification form is sufficiently tailored so that it is unlikely to elicit genetic information and therefore the inadvertent exception would apply even if the employer does not include the "safe harbor" notice. However, to avoid the risk of violating GINA, it is prudent that employers provide the "safe harbor" notice with FMLA medical certification forms for the employee's own serious health condition.

Medical Exams to Determine an Employee's or Job Applicant's Ability to Perform a Job

Although employers are permitted to conduct post-offer, pre-employment medical exams and to conduct employee medical exams (such as fitness-for-duty exams) so long they are consistent with the Americans With Disabilities Act, such exams must not include requests for family medical history or other genetic information. The "safe harbor" notice must be provided in conjunction with such exams and, in addition, employers must instruct the medical provider(s) not even to collect family medical history or other genetic information. Employers also should ensure that any medical questionnaires or checklists they may furnish to medical providers do not include questions about family medical history nor seek other genetic information. If an employer learns that family medical history or other genetic information nonetheless is being collected, the employer must take additional reasonable measures to prevent this from recurring, including no longer using the services of that medical provider.

Water Cooler Conversations

Managers have the potential to acquire employee genetic information through everyday interaction with employees. For example, if a manager happens to overhear an employee talking about a family member's illness, the employer may have acquired genetic information. Likewise, a manager may acquire genetic information in response to generalized questions and/or expressions of concern about the general health of an employee or an employee's family member. These and similar situations likely will fall within the inadvertent acquisition exception, unless the manager asks probing follow-up questions likely to elicit genetic information, such as whether the employee or his/her family members have been tested for an inherited disease or disorder. Victoria Lipnic, an EEOC Commissioner, noted during a February 1 public forum that it was important for her agency "to not cut off the normal flow of conversation in the workplace," and that expressions of concern "should not be a violation of federal law."

Social Media Sites

These same principles of inadvertent acquisition apply in the electronic world as well. Like an overheard conversation, being "friends" with an employee on social media sites such as Facebook is not prohibited, but if a manager notices the employee posting material about his/her own medical status or that of a family member, the manager should not continue following the discussion. Also, trying to access non-public social media pages without the employee's prior permission could expose an employer to GINA liability if genetic information is found, even if the employer claims it was not searching for that sort of information.

Employee Wellness Programs

Voluntary wellness programs may continue under GINA if properly structured. GINA permits employers to acquire genetic information in connection with a voluntary employer-sponsored wellness program, but any individualized genetic information can only be provided to the employer in aggregate form. Employees participating in the program must provide prior knowing, voluntary and written authorization.

The regulations permit employers to offer certain kinds of financial incentives to encourage participation in wellness programs, but cannot offer financial incentives to provide genetic information. For example, an employer may offer a financial incentive for employees to complete personal health risk assessments, but must identify any questions requesting genetic information and explicitly inform employees they need not respond to such questions in order to receive the incentive.

Nondisclosure and Confidentiality Requirements

Genetic information in an employer's possession must be treated as a confidential medical record and kept separate from employee personnel files. Genetic information may, however, be maintained in the same (separate) file as other medical information.

GINA also prohibits disclosure of genetic information, subject to limited exceptions. One exception is that genetic information may be disclosed if required by court order. Notably, however, this exception does not apply to common procedures in the litigation process, such as responses to subpoenas and discovery requests. This will likely be a growing area for litigation because of disagreements about the scope of discovery requests and whether the information sought can be considered genetic information.


GINA has the potential to become a major weapon in plaintiff attorneys' arsenals, because many of the ways genetic information can be obtained are seemingly innocuous. In the coming months and years, courts will determine exactly what GINA requires of employers. In the meantime, following these practical steps will help employers to minimize their GINA liability:

  • Train managers and human resource personnel about GINA's requirements;
  • Revise EEO policy statements to include prohibitions against discrimination and retaliation based on genetic information;
  • Post all required EEOC notices advising employees of the rights under GINA;
  • Review handbooks and policy manuals to ensure consistency with GINA;
  • Establish a plan for responding to subpoena or civil discovery requests to ensure that genetic information is only disclosed when explicitly required by court order;
  • Identify questions on heath risk assessments involving family medical history or genetic information, and clearly state that any financial inducement to complete the assessment will be provided regardless of whether those questions are answered;
  • Review forms and procedures used for requesting employee medical information, and add the safe harbor language as appropriate; and
  • Establish procedures to ensure that any medical records potentially containing genetic information are kept in a medical file separate from the employee's personnel file.