March 6, 2013. Today, we continue going through the HIPAA Privacy Rule, section by section, as modified in the Final Rule: Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules Under the Health Information Technology for Economic and Clinical Health Act [HITECH Act] and the Genetic Information Nondiscrimination Act; Other Modifications of the HIPAA Rules, which was published in the Federal Register on January 25, 2013. The effective date of the Final Rule is March 26, 2013, and covered entities and business associates must comply by September 23, 2013.
Our focus today is on the first of two prohibited uses and disclosures of protected health information in the General rules regulatory provisions of 45 CFR 164.502(a)(5): (i) Use and disclosure of genetic information for underwriting purposes at 78 Federal Register 5696:
Notwithstanding any other provision of [the HIPAA Privacy Rule], a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan:
(A) Except as provided in paragraph (a)(5)(i)(B) of this section:
(1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);
(2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);
(3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and
(4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.
(B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.
We provide here the content of the Final Rule preamble that underpins the prohibited use and disclosure regulatory provision above:
“The final rule adopts the proposed prohibition on a health plan’s use or disclosure of genetic information for underwriting purposes, except with regard to health plans that are issuers of long term care policies…. This prohibition, located in this final rule at 45 CFR 164.502(a)(5), applies to all genetic information from the compliance date [September 23, 2013] of these modifications forward, regardless of when or where the genetic information originated. We do not believe a clarification of this fact in the regulatory text is necessary.
“Consistent with Sec. 101(a) of the [GINA] statute, this prohibition should not be construed to limit the ability of a health plan to adjust premiums or contribution amounts for a group health plan based on the manifestation of a disease or disorder of an individual enrolled in the plan, even though a health plan cannot use the manifestation of a disease or disorder in one individual as genetic information about other group members and to further increase the premium for the plan. Similarly, for the individual health insurance market, a health plan is not prohibited from establishing rules for eligibility for an individual to enroll in coverage or from adjusting premium or contribution amounts for an individual based on the manifestation of a disease or disorder in that individual or in a family member of such individual where such family member is covered under the individual’s policy, even though the health plan cannot use the manifestation of a disease or disorder in one individual as genetic information about other individuals to further increase premiums or contribution amounts for those other individuals. [We covered these issues in an earlier HIPAA.com posting.]
“To illustrate how the prohibition operates, we reiterate the following examples (but for the reasons explained above, decline to include them in the regulatory text). If a health insurance issuer, with respect to an employer-sponsored group health plan, uses an individual’s family medical history or the results of genetic tests maintained in the group health plan’s claims experience information to adjust the plan’s blended, aggregate premium rate for the upcoming year, the issuer would be using protected health information that is genetic information for underwriting purposes in violation of 45 CFR 164.502(a)(5)(i) [above]. Similarly, if a group health plan uses family medical history provided by an individual incidental to the collection of other information on a health risk assessment to grant a premium reduction to the individual, the group health plan would be using genetic information for underwriting purposes in violation of 164.502(a)(5)(i).
“The prohibition is limited to health plans. A health care provider may use or disclose genetic information as it sees fit for treatment of an individual. If a covered entity, such as an HMO, acts as both a health plan and health care provider, it may use genetic information for purposes of treatment, to determine the medical appropriateness of a benefit, and as otherwise permitted by the Privacy Rule, but may not use such genetic information for underwriting purposes. Such covered entities, in particular, should ensure that appropriate staff members are trained on the permissible and impermissible uses of genetic information.” 78 Federal Register 5666-5667
Tomorrow, we look at the second of two categories of modified prohibited uses and disclosures regulations: sale of protected health information.