February 18, 2013. Today, we examine underwriting prohibitions as they relate to modifications of the HIPAA Privacy Rule required under the Genetic Information Nondiscrimination Act (GINA). These modifications are in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.
The Final Rule states: “The final rule adopts the approach of the proposed rule to apply the prohibition on using or disclosing protected health information that is genetic information for underwriting purposes to all health plans that are covered entities under the HIPAA Privacy Rule, including those to which GINA does not expressly apply, except with regard to issuers of long term care policies…. We also continue to believe that individuals have a strong privacy interest in not having their genetic information used in an adverse manner for underwriting purposes and to believe that this privacy interest outweighs any adverse impact on most health plans covered by the Privacy Rule.” [78 Federal Register 5660]
With regard to long-term care plans: “The Department did hear from a number of sources [during the public comment period] about the potential adverse impact a prohibition on using genetic information for underwriting would have on the ability of a long-term care insurer to effectively underwrite and thus, on the viability of the long-term care insurance market generally. The Department recognizes the importance of long-term care insurance coverage and the need to ensure its continued availability. The Department also acknowledges that, at this time, it does not have the information necessary to more precisely and carefully measure the extent of such an impact on the long-term market in order to appropriately balance an individual’s privacy interests with such an impact. Thus, this final rule excludes long-term care plans from the underwriting prohibition…. At the current time,…, we do not have sufficient information to determine the proper balance between the individual’s privacy interests and the industry’s concerns about the cost effects of excluding genetic information…. Based on the information the Department may obtain, the Department will reassess how best to move forward in this area in the future.” [78 Federal Register 5661]
While the Final Rule extends coverage of the HIPAA Privacy Rule to health plans beyond those covered under GINA, it is important to note, given the discussion excluding for now long-term care plans from the underwriting restriction pertaining to genetic information, that those long-term care plans still fall under HIPAA Privacy as covered entities. [78 Federal Register 5659] The Final Rule states: “Long-term care plans, while not subject to the underwriting prohibition, continue to be bound by the Privacy Rule, as are all other covered health plans, to protect genetic information from improper uses and disclosure and to only use or disclose genetic information as required or expressly permitted by the Rule, or as otherwise authorized by the individual who is the subject of the genetic information.” [78 Federal Register 5661]
In the posting on Friday, February 15, we presented the new definitions in the Final Rule pertaining to GINA. With regard to the definition of underwriting purposes, which was defined in the proposed rule, the Final Rule adopted the definition, but moved it to “within the underwriting prohibition at 45 CFR 164.502(a)(5)(i).” [78 Federal Register 5665] The underwriting prohibition paragraphs are presented here with the embedded definition of underwriting purposes:
(5) Prohibited uses and disclosures.
(i) Use and disclosure of genetic information for underwriting purposes: Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan:
(A) Except as provided in paragraph (a)(5)(i)(B) of this section:
(1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost- sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);
(2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);
(3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and
(4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.
(B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.[78 Federal Register 5696]
Tomorrow, we finish up the discussion on the HIPAA Privacy Rule with regard to genetic information.