Background
 

The Health Insurance Portability and Accountability Act of 1996 ("HIPAA") introduced new nondiscrimination requirements applicable to group health plans. A group health plan could not discriminate against an individual with regard to eligibility to enroll and the premiums payable based upon certain enumerated health factors. Among the enumerated health factors was genetic information.
 

Therefore, under HIPAA, a group health plan could not:
 

• impose a preexisting condition exclusion based solely on genetic information; or

   

• discriminate against an individual regarding eligibility, benefits or premiums based solely on genetic information.

Nevertheless, Congress was still concerned with how plans and their sponsors might use individual genetic information. This concern eventually resulted in passage of the Genetic Information Nondiscrimination Act of 2008 ("GINA"), which was signed into law May 21, 2008.

GINA has two Titles: Title I affects group health plans and health insurance and Title II affects employment. This discussion focuses on the Title I changes described in the interim final regulations.
 

Effective Date
 

The IRS, DOL and HHS coordinated their efforts and published the interim final regulations on October 7, 2009. On the same day, HHS published proposed changes to the HIPAA medical privacy regulations.
 

The interim final regulations are effective for group health plans on December 7, 2009. They apply to group health plans and group health insurance issuers for plan years beginning on or after January 1, 2010. (Note: Similar changes apply to individual health insurance coverage offered, sold, issued, renewed, in effect or operated in the individual market on or after December 7, 2009. The new rules applicable to individual health insurance policies are not separately addressed in this article). The proposed changes to the HIPAA medical privacy rules would apply 180 days after their effective date.
 

What GINA Does to Group Health Plans
 

GINA adds to the existing restrictions on the use of genetic information in three ways:
 

1. Group premiums or contributions cannot be increased based on genetic information.

    

2. A group health plan generally cannot request or require an individual or family member to undergo a genetic test.

    

3. A group health plan cannot request, require or purchase genetic information (a) prior to or in connection with enrollment or (b) for underwriting purposes.

Health Risk Assessments ("HRAs") and GINA

HRAs are commonly part of a wellness program associated with a group health plan. Often, incentives are provided to individuals to encourage completion of an HRA. There have been possible issues raised under the Americans with Disabilities Act ("ADA") about whether an HRA is voluntary if a reward is provided for completing the HRA. EEOC enforcement guidance under the ADA allows disability related inquiries that are part of a voluntary wellness program. This guidance provides that a wellness program is voluntary if participation is not required and if there is no penalty for not participating. In a letter dated March 6, 2009, the EEOC informally took the position that requiring the completion of an HRA as a prerequisite to enrolling in a group health plan was not allowed under the ADA. The EEOC has not expanded upon the kind of rewards (if any) that may be permitted in the context of the ADA. The GINA interim final regulations, however, do provide formal restrictions on coupling an HRA with a reward related to participation in a group health plan in a context different from the ADA.
 

The affect the GINA regulations have on HRAs derives from the definitions of genetic information, family members and underwriting. Genetic information includes a recitation of diseases manifested in family members (that is, family medical history). Family is defined broadly and includes spouses, adopted children, and relatives to the "fourth-degree" (that is great-great grandparents, great-great grandchildren and second cousins). Underwriting is also broadly defined. For example, it includes "discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program." Treas. Reg. § 54.9802-3T(d)(1)(ii)(B).
 

Therefore, an HRA that solicits information about family medical history and provides a reward or benefit described in the regulation is prohibited. Additionally, if such an HRA is requested prior to or in connection with plan enrollment, it is also prohibited by the regulation, even if there is no plan reward for completing the HRA.
 

Examples in the regulation illustrate the types of HRAs that are and are not permitted. One example assumes an HRA that solicits information about family medical history for which there is no premium reduction or other reward earned for completing it. However, certain people who complete the HRA may become eligible for additional benefits under the plan by becoming enrolled in a disease management program based on their answers about family medical history. Because answers regarding family medical history could result in an individual becoming eligible for benefits the individual otherwise would not be eligible for, the HRA in this example would be prohibited under the regulation.
 

Another example assumes an HRA that solicits information about family medical history. However, no premium reduction or other reward is provided for completing the HRA. Additionally, this HRA was not requested for completion prior to or in connection with enrollment. Since this request was not for underwriting purposes and was not prior to or in connection with enrollment, it did not violate the regulation.
 

Permissible Requests for Genetic Testing
 

As noted above, a group health plan generally cannot request or require an individual or a family member to undergo a genetic test. There are, however, three exceptions.
 

The first exception is not, strictly speaking, an exception to the general admonition that a group health plan cannot request or require genetic testing. This is because the first exception applies to health care professionals. A health care professional in connection with rendering health care services can request the individual undergo a genetic test in connection with treatment.
 

The second exception applies directly to group health plans. There are times that determining whether payment for a service is proper may require a genetic test. For example, a plan can condition payment upon obtaining a necessary genetic test when the plan conditions benefits upon a demonstration of medical appropriateness and the determination of medical appropriateness in the particular situation depends on the genetic makeup of the individual. Nonetheless, a plan may only request the minimum amount of information necessary to make the payment determination.
 

Finally, a group health plan may request (but not require) an individual undergo a genetic test for certain research purposes that are described in the regulation. Among other things, the request:
 

• Must be in writing;

   

• Indicate participation is voluntary and that failure to participate will not affect eligibility or premiums; and

   

• Information collected cannot be used for underwriting.

Proposed Changes to HIPAA Medical Privacy Rules

HHS proposed regulatory changes to the HIPAA medical privacy rules consistent with the requirements under GINA.

GINA requires a change to the HIPAA medical privacy rules to clarify that genetic information that is personally identifiable is protected health information ("PHI"). In the preamble to the proposed regulation, HHS makes it clear that it always viewed genetic information as being within the purview of PHI when it was individually identifiable. Nonetheless, HHS makes the regulatory clarification in the proposed regulation. There are also a number of technical definitional changes that are not intended to be substantive changes. Furthermore, many group health plan privacy notices will have to be updated once the proposed regulation is final to indicate that genetic information cannot be disclosed in connection with underwriting.

Action Items

Among the action items employer should consider are:
 

• Review plan documents and participant communications relating to HRAs.

   

• Review the actual HRA and determine if revisions are needed.

   

• Begin to review HIPAA privacy notices (which could be done in connection with updates made for the new requirements under HITECH).

   

• Review instances when the group health plan may be eliciting genetic information.