genetic information (HIPAA)

• The science of human genetics is concerned with deciphering and understanding information contained within an individual’s DNA.

• Information carried within the DNA is of a highly sensitive, personal and intimate nature, and therefore protecting that information is of concern to individuals, families and groups.

• Mapping and sequencing human DNA is now possible as a result of the multi-billion dollar Human Genome Project, formally completed on April 14, 2003 (coincidently the same day HIPAA’s privacy standards took effect!).

• A more thorough understanding of human genes offers great promise for predicting health risks and promoting the development or effective treatments.

Other than in the context of law enforcement identification and location efforts, the HIPAA Privacy Rule does not discuss or provide special privacy protections for genetic information. (By contrast, psychotherapy notes do receive "extra" limits on use and disclosure.)

HIPAA’s drafters opted not to create a “special” standard for genetic information, though some genetic information will be protected by the privacy regulation if it meets the definition of protected health information (PHI).

According to the U.S. Department of Health and Human Services (HHS), PHI includes genetic information that otherwise meets the statutory definition (see 65 Fed. Reg. 86261). Therefore, under HIPAA, genetic information will be protected to the same extent as other health information.

Although not specifically stated in the regulations, information about genetic tests, services or counseling, and family history will be protected. HHS has made clear that medical information about a family member contained within an individual’s medical record is information about the individual and therefore may not be disclosed without meeting the requirements of the Rule (see 65 Fed. Reg. 82492).

It is important to note however, that HIPAA will not protect the actual tissue or blood sample itself -- protection is only afforded to the information that it contains or generates. Anonymized biological material is not considered PHI; this is likely to have implications for banked tissue and other forms of genetic research.

Protection of genetic information in the research setting will depend upon whether a researcher or institution is functioning as a provider (a type of covered entity) and whether the provider conducts insurance-related transactions. For researcher who are not providers, use and disclosure of genetic information will be affected by HIPAA where the PHI was obtained from a provider who (or an entity which) must comply with the regulation (i.e., is a covered entity or in a business associate relationship with one).

The HIPAA statute includes the first federal protection against genetic discrimination in health insurance. It prohibits commercial health insurers from excluding an individual from group coverage because of past or present medical conditions, including predisposition to certain diseases. It specifically states that genetic information in the absence of a current diagnosis is not a pre-existing condition.

Notwithstanding those protections, HIPAA does not prevent covered health plans from requesting genetic information from plan members or from prospective members as a part of the insurance underwriting process. In addition, HIPAA does not prohibit health insurers from charging higher premiums based on genetic makeup; neither does it specifically limit the disclosure of genetic information about individuals to insurers. However, the Rule’s minimum necessary standard should serve to prevent an insurer from insisting that a provider disclose genetic test results of a member when the results are not necessary for the health plan to reimburse the cost of the test.

Last modified: 14-May-2005 [SA]