PDFEmailPrint

Genetic Information under HIPAA

PDFEmailPrint

February 5, 2020

By: Susan E. Ziel and Stacy Walton Long

Genetic Information  is quickly becoming an important part of our lives. The Health Insurance Portability and Accountability Act of 1996,[1] as amended, and the final Privacy Rule[2] (HIPAA) are implicated by a healthcare provider’s or benefit plan’s creation, storage, and use of Genetic Information. 

Although HIPAA was enacted in 1996, and the final Privacy Rule was promulgated in 2003, it was not until 2008 that these laws and regulations were amended to ensure that Genetic Information was to be treated as Health Information[3] protected by HIPAA.[4]  These amendments included the addition of five key defined terms that confirm the scope of Genetic Information and the many individuals whose Genetic Information is protected under HIPAA, and to allow consistency with the defined terms adopted under the Genetic Information Nondiscrimination Act of 2007 (GINA)[5] adopted a year before, in 2007.  Today, as a result, HIPAA includes definitions for the following terms: (1) Individual; (2) Genetic Information; (3) Genetic Test; (4) Genetic Services; and (5) Family Member. 

  • “Individual” means the person who is the subject of protected health information or PHI under HIPAA.[6] 
  • “Genetic Information” includes specific information about a particular Individual and the Individual’s Family Members in regard to their genetic test information, the manifestation of a disease or disorder in Family Members of the Individual, or any request for, or receipt of, Genetic Services by the Individual or any Family Member of the individual.  The term also includes any Genetic Information of a fetus carried by the Individual or Family Member who is a pregnant woman and any embryo legally held by an Individual or Family Member utilizing an assisted reproductive technology.  For purposes of this definition, the term Genetic Information excludes information about the sex or age of any Individual.[7] 
  • “Genetic Test” means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes.  The term Genetic Test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.
  • “Genetic Services” means a Genetic Test, genetic counseling (including obtaining, interpreting or assessing Genetic Information), or genetic education. 
  • “Family Member” means, with respect to the Individual:
    • A Dependent[8] of the Individual; or
    • Any person who is a first-degree (parents, spouses, siblings and children), second-degree (grandparents, grandchildren, aunts, uncles, nephews, nieces), third-degree (great-grandparents, great-grandchildren, great aunts, great uncles, and first cousins), or fourth-degree (great-great grandparents, great-great grandchildren, and children of first cousins) relative of the Individual or of a Dependent of the Individual. 
    • The definition also notes that relatives by affinity, such as by marriage or adoption, are treated the same as relatives by consanguinity, that is, relatives who share a common biological ancestor.  In determining the degree of the relationship, relatives by less than full consanguinity (such as half- siblings, who share only one parent) are treated the same as relatives by full consanguinity (such as siblings who share both parents).

In summary, HIPAA defines Health Information to include Genetic Information.  Second, HIPAA provides five important definitions that confirm (1) the scope of the Genetic Information that is protected, (2) the categories of Individuals, Dependents and other Family Members whose Genetic Information is protected, and (3) a detailed definition of what qualifies as Genetic Tests and Genetic Services as they are conducted by health care providers.  Third, this overview is an important first step in confirming the impact that HIPAA has on Genetic Information, as it is created or received and maintained by HIPAA Covered Entities in the delivery of health care services today. 

If you have any questions regarding Genetic Information under HIPAA or other HIPAA-related questions, please contact Susan E. Ziel, Stacy Walton Long, or any other Krieg DeVault attorney in the Health Care Practice Group.

 

[1] Public Law 104-191.

[2] 45 C.F.R. Part 160 and subparts of Part 164.

[3] 45 C.F.R. 160.103.

[4] 42 U.S.C. 1320d-9. 

[5] Public Law 110-233.

[6] 45 C.F.R. 160.103.

[7] 45 C.F.R. 160.103.

[8] 45 C.F.R. 144.103.