GINA Compliance for Welfare Plan Sponsors

by Andrew L. Oringer, and Roberta Casper Watson, The Wagner Law Group

This practice note addresses compliance issues under the Genetic Information Nondiscrimination Act of 2008 (GINA) (Pub. L. No. 110-233, 122 Stat. 881) for employer welfare plans, specifically group health plans and wellness programs. GINA was enacted to protect individuals against discrimination in health insurance coverage and employment based on their genetic information. This note describes key definitions and concepts under GINA, provides a detailed look at the prohibitions on the collection and use of genetic information and other rules in the context of group health plans, and reviews the application of GINA to wellness programs and health risk assessments.

Both main titles of GINA—Title I, applicable to health plans and issuers, and Title II, primarily applicable to employers—affect employer-provided group health plans and wellness programs and are discussed here. For additional in-depth information on GINA Title II compliance for employers, see Genetic Information Nondiscrimination Act (GINA) Employment Discrimination Prohibitions.

This practice note is organized under the following topics:

• •GINA Titles I and II Overview
• •Important Defined Terms
• •Welfare Plan Compliance under GINA Title I
• •Welfare Plan Compliance under GINA Title II
• •GINA and Wellness Programs
• •GINA Penalties and Enforcement
• •Compliance Tips

Note on citations: The main provisions of GINA Title I amend the portability and non-discrimination rules of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which are codified under various provisions of the Employee Retirement Income Security Act of 1974 (ERISA), the Public Health Service Act of 1944 (PHSA), and the Internal Revenue Code of 1986 (I.R.C.). GINA Title I's statutory amendments and implementing regulations are incorporated in substantially similar provisions under each of these laws, resulting in the parallel citations provided here.

For related content, see Health Care Benefits Law § 16.19A, "Genetic Information Nondiscrimination Act."

Title I of GINA applies to group health plans and health plan insurers in the individual and group markets. It has three main rules:

• •Prohibition on genetic information-based discrimination in rate setting. Plans may not increase group premiums or contribution amounts based on genetic information.
• •Limitation on genetic testing requests or requirements. Plans may not request or require genetic testing of a covered individual or family member, subject to certain exceptions.
• •Certain prohibitions on the collection of genetic information. Plans generally may not request, require, or purchase genetic information prior to or in connection with enrollment or at any time collect or use genetic information for underwriting purposes.

See ERISA § 702 (29 U.S.C. § 1182); 42 U.S.C. § 300gg-4; I.R.C. § 9802.

These rules are discussed below in Welfare Plan Compliance under GINA Title I.

Section 106 of GINA provides for coordination in rulemaking, interpretation, and enforcement among the various agencies responsible for implementing Title I: the Department of Labor (DOL, under ERISA), the Department of Health and Human Services (HHS, under the PHSA), and the Internal Revenue Service (IRS, under the I.R.C.).

GINA Title II applies to employers, employment agencies, labor organizations, and apprenticeship and training programs. The main Title II rules applicable to employers are:

• •Prohibition on genetic information-based discrimination in employment. Employers may not base employment-related decisions, including with respect to the terms and conditions of employment and employee benefits, on the genetic information of an employee (or applicant).
• •Prohibition on collection of genetic information. Employers may not seek to acquire (by request, requirement, or purchase) the genetic information of an employee (or applicant) or his or her family member, except in limited circumstances.
• •Confidentiality requirements. Employers are subject to confidentiality and disclosure requirements for any genetic information they do collect.
• •Prohibition on retaliation. Employers may not retaliate against any person for exercising his or her rights under GINA.

See 42 U.S.C. §§ 2000ff to 2000ff-9.

Similar rules apply in the context of employment agencies, labor organizations, and apprenticeships and training programs. The principal impact of these restrictions on group health plans and wellness programs is discussed below in Welfare Plan Compliance under GINA Title I. The EEOC is responsible for the implementation and enforcement of GINA Title II.

In order properly to apply GINA to welfare plans, it is important that practitioners understand how the following terms are defined for purposes of the law. Except as otherwise noted, these definitions apply to both Title I and II of GINA.

Genetic information means information about:

• •The genetic tests (as defined below) of an individual or an individual's family members (as defined below)
• •The manifestation of a disease or disorder (as defined below) in an individual's family members (i.e., family medical history) –or–
• •A request for or receipt of genetic services (which means any genetic test, genetic counseling—including obtaining, interpreting, or assessing genetic information—or genetic education) by an individual or an individual's family member

29 C.F.R. § 2590.702-1(a)(3); 45 C.F.R. § 146.122(a)(3); Treas. Reg. § 54.9802-3T(a)(3); 29 C.F.R. § 1635.3(c).

Although the definition of genetic information is very broad, it does not include information about the sex or age of any individual. However, for pregnant women (or a family member of a pregnant woman), genetic information does include any genetic information of the fetus that the pregnant woman is carrying. 29 C.F.R. § 2590.702-1(a)(3)(ii); 45 C.F.R. § 146.122(a)(3)(ii); Treas. Reg. § 54.9802-3T(a)(3)(ii); 29 C.F.R. § 1635.3(c)(2). The EEOC included a clarification in its regulations that information about race and ethnicity that is not derived from a genetic test is not genetic information. 29 C.F.R. § 1635.3(c)(2).

Family members of an individual includes the individual's dependents and any first-degree relative (e.g., parents, spouses, siblings, and children), second-degree relative (e.g., grandparents, grandchildren, aunts, uncles, nephews, and nieces), third-degree relative (e.g., great-grandparents, great-grandchildren, great aunts, great uncles, and first cousins), or fourth-degree relative (e.g., great-great grandparents, great-great grandchildren and children of first-cousins) of the individual or of a dependent of the individual. 29 C.F.R. § 2590.702-1(a)(2); 45 C.F.R. § 146.122(a)(2); Treas. Reg. § 54.9802-3T(a)(2); 45 C.F.R. § 160.103; 29 C.F.R. § 1635.3(a).

Note that the GINA definition of family member treats relatives by affinity (such as by marriage or adoption) the same as relatives who share a common biological ancestor.

In United States v. Windsor, 133 S. Ct. 2675 (2013), the Supreme Court struck down § 3 of the Defense of Marriage Act of 1996, which prohibited the recognition of same-sex marriage for any purpose under federal law. Guidance issued by the HHS's Centers for Medicare & Medicaid Services (CMS), under the PHSA, and the IRS in the wake of that decision suggests that the terms spouse and marriage should apply the same for same-sex marriages as for opposite-sex marriages for purposes of specifying the individuals to be included in the definition of family members. CMS, Frequently Asked Question on Coverage of Same-Sex Spouses (March 14, 2014); IRS, Answers to Frequent Asked Questions for Individuals of the Same Sex Who Are Married Under State Law (last reviewed Feb. 4, 2016). HHS issued separate guidance further acknowledging that the privacy protections prohibiting the use of genetic information for underwriting purposes applicable to genetic information of family members and the manifestation of a disease or disorder in a family member includes the manifestation of a disease or disorder in a same-sex spouse and dependents of such marriage. HHS, HIPAA and Same-sex Marriage: Understanding Spouse, Family Member, and Marriage in the Privacy Rule.

Genetic test, for purposes of GINA Title I, is an analysis of human DNA, RNA, chromosomes, proteins, or metabolites that detects genotypes, mutations, or chromosomal changes. However, there is a carve-out for an analysis of proteins or metabolites which is directly related to a manifested disease, disorder, or pathological condition (see definition below) that could reasonably be detected by a health-care professional with appropriate training and relevant expertise. 29 C.F.R. § 2590.702-1(a)(5)(i); 45 C.F.R. § 146.122(a)(5)(i); Treas. Reg. § 54.9802-3T(a)(5)(i).

For example, a test to determine whether an individual has a BRCA1 or BRCA2 variant, which are associated with breast cancer, is a genetic test. The following are not considered genetic tests: an HIV test, a cholesterol test, or a test for the presence of alcohol or drugs.

The definition of "genetic test" in GINA Title II is the same as for Title I, other than the exception for analyses that are directly related to a diagnosable manifested disease, disorder, or pathological condition. Instead, Title II has a more limited exception for an "analysis of proteins or metabolites that does not detect genotypes, mutations, or chromosomal changes." 42 U.S.C. § 2000ff(7); 29 C.F.R. § 1635.3(f). The broader Title I exception provides some leeway for a group health plan to collect or use information derived from such an analysis, provided that it directly relates to an individual having a relevant manifested disease or disorder. DOL, FAQs on the Genetic Information Nondiscrimination Act, Q4. The narrower exception under Title II is consistent with its more restrictive prohibitions applicable to employers.

Manifestation of a disease, disorder, or pathological condition occurs if an individual has been or could reasonably be diagnosed with the disease, disorder, or condition by a health-care professional with appropriate training and relevant expertise. A disease, disorder, or condition is not manifested if its diagnosis is based principally on genetic information. 29 C.F.R. § 2590.702-1(a)(6); 45 C.F.R. § 146.122(a)(6); Treas. Reg. § 54.9802-3T(a)(6); 29 C.F.R. § 1635.3(g).

As noted above, the main provisions of GINA Title I expanded HIPAA's non-discrimination rules for group health plans to (1) prohibit genetic information-based discrimination in rate setting, (2) limit genetic testing requests or requirements, and (3) prohibit the collection of genetic information for certain purposes. Sections 101, 102, and 103 of GINA make these changes by amending the relevant provisions of ERISA, the PHSA, and the I.R.C. (see ERISA §§ 502, 702, 733(d) (29 U.S.C. §§ 1132, 1182, 1191b(d)); 42 U.S.C. §§ 300gg-4, 300gg-22(b), 300gg-91(d)); and I.R.C. §§ 9802, 9832(d), 9834).

Each of these rules are discussed in detail further below. Other GINA Title I provisions (1) update HIPAA privacy regulations regarding genetic information, including a separate prohibition on its use or disclosure for underwriting purposes under HIPAA (GINA § 105, codified at 42 U.S.C. § 1320d-9) and (2) amend the PHSA and the Social Security Act to make the principal Title I rules applicable to issuers of individual market policies and Medicare supplemental health insurance policies (medigap plans) (GINA §§ 102(b), 104, codified at 42 U.S.C. §§ 300gg-53 and 1395ss, respectively).

Plans and Issuers Subject to GINA Title I

GINA Title I generally applies to group health plans, as that term is defined for purposes of the HIPAA portability and non-discrimination rules at ERISA § 733(a) (29 U.S.C. § 1191b(a)); 42 U.S.C. § 300gg–91(a); I.R.C. §§ 9832(a), 5000(b)(1). Under ERISA and the PHSA, it also applies to issuers of such plans. ERISA § 702(e) (29 U.S.C. § 1182(e)); 42 U.S.C. § 300gg-4(e). Generally, such plans include any employee welfare benefit plan or other group health plan that provides medical care (including items and services paid for as medical care), whether through insurance, reimbursement, or otherwise.

It will be important for practitioners who represent employers and/or insurers to be aware of whether a particular benefit offered under an employee welfare benefit plan is a HIPAA-excepted benefit and therefore will be exempt from certain laws. HIPAA-excepted benefits include certain stand-alone dental and vision benefits, long-term care insurance, employee assistance programs, and travel insurance. These excepted benefits are exempt from the HIPAA portability, nondiscrimination and wellness program rules as well as GINA Title I. Very small employer group health plans that provide coverage to fewer than two participants who are current employees as of the first day of the plan year (including retiree-only plans) are exempt from some, but not all, of the GINA requirements. ERISA § 702(e) (29 U.S.C. § 1182(e)); 29 C.F.R. §2590.732(b)(2); I.R.C. § 9802(e); 26 C.F.R. § § 54.9831-1(b)(2). For more information, see ACA and HIPAA Excepted Benefits.

Note, however, that even if certain benefits are exempt from GINA Title I, the employer will still likely be subject to Title II of GINA, as discussed below.

Prohibition on Genetic Information-Based Discrimination in Rate Setting

In general, group health plans are prohibited from using genetic information as a basis for setting or adjusting premiums or contribution amounts for a group covered under the plan, regardless of whether those amounts are paid by the employer or by covered employees. ERISA § 702(b)(3) (29 U.S.C. § 1182(b)(3)); 42 U.S.C. § 300gg-4(b)(3); I.R.C. § 9802(b)(3); 29 C.F.R. § 2590.702-1(b); 45 C.F.R. § 146.122(b). Treas. Reg. § 54.9802-3T(b).

By its terms, this rule applies to group rates, but HIPAA non-discrimination rules pre-dating GINA already set limits on a group health plan's ability to provide incentives or otherwise adjust an individual's premium or contribution amount based on certain health factors of the individual, including genetic information. 29 C.F.R. § 2590.702(c); 45 C.F.R. § 146.121(c); Treas. Reg. § 54.9802-1(c).

The distinction between using genetic information as opposed to information about the manifestation of a disease, disorder, or condition is key. Adjusting plan premiums or contributions based purely on the latter is generally permissible. For example, a group insurer can use claims experience derived from the treatments or benefits that have been sought by plan participants when it sets coverage rates. The GINA rule prohibits genetic information from being used for this purpose (including family medical history), even if it is just one factor among many taken into account for setting the group rate. ERISA § 702(b)(3)(B) (29 U.S.C. § 1182(b)(3)(B)); 42 U.S.C. § 300gg-4(b)(3)(B); I.R.C. § 9802(b)(3)(B); 29 C.F.R. § 2590.702-1(b)(2); 45 C.F.R. § 146.122(b)(2). Treas. Reg. § 54.9802-3T(b)(2).

Example. Consider a plan participant who tests positive for a genetic variant associated with colorectal cancer and undergoes further analysis which indicates an increased risk of developing cancer, but who shows no sign or symptom of disease. GINA prohibits the plan from adjusting premiums or contributions based on the genetic testing results. However, if the individual subsequently develops colorectal cancer in a manner that can be diagnosed without relying principally on genetic testing (or relying on a protein or metabolite analysis directly related to the disease), the plan could factor in that diagnosis when determining an increase in the applicable group premium or contribution rate. This is because information about an individual's manifested disease or disorder is not genetic information for which the GINA prohibition would apply. DOL, FAQs on the Genetic Information Nondiscrimination Act, Q5.

Note, however, that a manifestation of a disease, disorder, or condition in one individual cannot be used as genetic information about other group members to adjust plan premiums or contribution amounts. That is, an insurer can change its group rates if it observes that a covered individual's genetic condition has become manifest, but it cannot do so based on the fact that the individual has covered dependents in the plan who may be at risk of inheriting the condition (in that case, the manifestation of the condition in the individual would be genetic information of the dependents). 29 C.F.R. § 2590.702-1(b)(3) (Ex. 2); 45 C.F.R. § 146.122(b) (Ex. 2); Treas. Reg. § 54.9802-3T(b)(3) (Ex. 2).

Limitations on Genetic Testing Requests or Requirements

Subject to the exceptions noted below, GINA Title I prohibits group health plans from requesting or requiring an individual covered by the plan or any family member of the individual to undergo a genetic test. ERISA § 702(c) (29 U.S.C. § 1182(c)); 42 U.S.C. § 300gg-4(c); I.R.C. § 9802(c); 29 C.F.R. § 2590.702-1(c); 45 C.F.R. § 146.122(c); Treas. Reg. § 54.9802-3T(c).

Exceptions to Genetic Testing Limitations

This section discusses the three exceptions to the genetic testing limitations:

• •Health-care professional exception. A health-care professional is permitted to request or recommend genetic testing or genetic testing information relating to an individual in the course of providing health-care services.
• •Payment exception. A plan administrator can request or require genetic tests, to the minimum extent necessary, for making a determination regarding a payment (as defined in the HIPAA privacy regulations at 45 C.F.R. § 164.501).
• •Research exception. Requests for genetic testing for research purposes are permitted, provided certain conditions are met.

29 C.F.R. § 2590.702-1(c)(2), (c)(4), (c)(5); 45 C.F.R. § 146.122(c)(2), (c)(4), (c)(5); Treas. Reg. § 54.9802-3T(c)(2), (c)(4), (c)(5).

Health Professional Exception

The prohibition on requests for genetic testing does not impair health professionals from providing health-related services. For example, a doctor who learns that a patient has a family medical history of Huntington's disease during a routine medical exam can recommend the patient undergo genetic testing for the condition without violating GINA, as long as the recommendation forms part of the health services being provided to the patient. DOL, FAQs on the Genetic Information Nondiscrimination Act, Q8.

Payment Exception and Medical Appropriateness

Of the three exceptions, the payment exception likely arises for employee benefit practitioners most frequently, as it is involved in claims and appeals determinations. A plan that conditions health benefit payments on the medical appropriateness of a treatment can use this exception to require a covered participant to undergo genetic testing to make the medical appropriateness determination for a covered item or service under the plan, as long as the plan requests the minimum amount of information necessary.

Example. A plan normally covers mammograms for participants starting at age 40, but covers them for individuals who have a high risk of breast cancer starting at age 30. The plan may require individuals under age 40 to submit genetic information, including family medical history and genetic tests to determine eligibility for this benefit coverage based on its criteria for assessing the individual's breast cancer risk. DOL, FAQs on the Genetic Information Nondiscrimination Act, Q10.

Such requests for genetic testing related information must be limited to the minimum amount of information necessary to make the payment determination. For example, if a plan covers genetic testing for participants who have a family member with a manifested condition such as celiac disease and a participant whose child has been diagnosed with the condition seeks such testing, the plan could not request or require the participant to reveal the test results since the outcome is not relevant to payment of the participant's benefit claim. 29 C.F.R. § 2590.702-1(e) (Ex. 1); 45 C.F.R. § 146.122(e) (Ex. 1); Treas. Reg. § 54.9802-3T(e) (Ex. 1).

Research Exception

To satisfy the exception for research purposes, all of the following conditions must be met:

• •The request for genetic testing must be in writing and relate to research as defined in 45 C.F.R. § 46.102(d) that complies with any applicable federal, state, or local laws regarding the projection of human research subjects.
• •The request must clearly indicate that compliance with the request must be voluntary, and noncompliance may not result in an adverse effect on eligibility for benefits or premium or contribution amounts.
• •No genetic information may be collected or required for underwriting purposes.
• •The plan completes and submits a Notification of Research Exception under GINA in the form prescribed by HHS. The form and instructions can be found on the Employee Benefits Security Administration website.

29 C.F.R. § 2590.702-1(c)(5); 45 C.F.R. § 146.122(c)(5); Treas. Reg. § 54.9802-3T(c)(5).

Certain Prohibitions on Collection of Genetic Information

The following sections describe the GINA Title I prohibitions on collecting genetic information (1) for underwriting purposes and (2) prior to or in connection with enrollment. (Note that for purposes of GINA, to collect genetic information means to request, require, or purchase such information.)

No Collection of Genetic Information for Underwriting Purposes

Group health plans and issuers are not permitted to collect genetic information for underwriting purposes. ERISA § 702(d)(1) (29 U.S.C. § 1182(d)(1); 42 U.S.C. § 300gg-4(d)(1); I.R.C. § 9802(d)(1); 29 C.F.R. § 2590.702-1(d)(1); 45 C.F.R. § 146.122(d)(1). Treas. Reg. § 54.9802-3T(d)(1).

The term underwriting purposes is broadly defined for this purpose and includes any of the following:

• •Implementing rules regarding or determinations of initial or continuing eligibility for plan benefits
• •Determinations of premium or contribution amounts (including deductibles, co-insurance, or other cost-sharing mechanisms as well as discounts, rebates, payments in kind, or other premium differential mechanisms)
• •Application of any pre-existing condition exclusion –or–
• •Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits

ERISA § 733(d)(9) (29 U.S.C. § 1191b(d)(9)); 42 U.S.C. § 300gg-91(d)(19); 26 I.R.C. § 9832(d)(10); 29 C.F.R. § 2590.702-1(d)(1)(ii); 45 C.F.R. § 146.122(d)(1)(ii); Treas. Reg. § 54.9802-3T(d)(1)(ii).

Notwithstanding the breadth of this definition, the determination of whether or not a benefit under the plan is medically appropriate (for a plan that conditions benefits on the medical appropriateness of an item or service) is not considered to be an underwriting purpose. Therefore, such a plan may require a covered individual to provide genetic information to the extent needed to administer the medical appropriateness standard. However, the minimum necessary rule discussed above for the payment exception to the genetic testing limitations also applies in this case. 29 C.F.R. § 2590.702-1(d)(1)(iii); 45 C.F.R. § 146.122(d)(1)(iii); Treas. Reg. § 54.9802-3T(d)(1)(iii).

As will be discussed further below, this prohibition has significant implications for wellness programs that offer incentives to participate (or penalize non-participation). Since the underwriting definition encompasses all aspects of coverage costs for covered individuals, it is important no such inducements are conditioned on whether or not an individual provides genetic information.

No Collection of Genetic Information Prior to or in Connection with Enrollment

A group health plan may not request, require, or purchase genetic information about an individual either prior to his or her effective date of coverage under the plan (timing rule) or in connection with plan enrollment (enrollment rule). ERISA § 702(d)(2), (29 U.S.C. § 1182(d)(2); 42 U.S.C. § 300gg-4(d)(2); I.R.C. § 9802(d)(2); 29 C.F.R. § 2590.702-1(d)(2); 45 C.F.R. § 146.122(d)(2). Treas. Reg. § 54.9802-3T(d)(2).

The enrollment rule is broadly interpreted so that genetic information may not be used not only in connection with enrollment eligibility or status, but also with respect to any rules for waiting periods or effective date of coverage; eligibility for any plan benefit, benefit limitations, restrictions, or cost-sharing; or termination of coverage. 29 C.F.R. § 2590.702-1(d)(2)(i); 45 C.F.R. § 146.122(d)(2)(i). Treas. Reg. § 54.9802-3T(d)(2)(i).

Incidental Collection Exception to the Timing Rule

An exception to the timing rule applies when a covered plan or issuer inadvertently obtains genetic information incidental to its legitimate collection of other information. This may happen, for example, when an individual, without being asked, offers genetic information about him- or herself or about a family member during the plan enrollment process.

However, the exception does not apply if it would be reasonable to anticipate that the individual would disclose genetic information under the circumstances in which information was being collected, unless the individual was explicitly directed not to provide genetic information. It would also not apply if the genetic information obtained were used for underwriting or enrollment purposes. 29 C.F.R. § 2590.702-1(d)(2)(ii); 45 C.F.R. § 146.122(d)(2)(ii); Treas. Reg. § 54.9802-3T(d)(2)(ii).

Other Timing Rule Exceptions

The preamble to the implementing regulations clarified that certain situations involving the administrative handling of lawfully collected genetic information would not violate the timing rule. For example, a plan that permissibly collected genetic information about an individual can transfer that information to a successor plan (e.g., in the context of a merger or acquisition) prior to the date the individual becomes covered under the successor plan without violating the timing rule (so long as the information is not used for enrollment or underwriting purposes). Similarly, no violation would occur simply because the plan held genetic information and the individual subsequently had a break in coverage and then re-joined the plan at a later date, or if a plan required periodic re-enrollment but maintained the genetic information it collected from the prior coverage period (again, if the information was not used in connection with enrollment or underwriting purposes). 74 Fed. Reg. 51,664, 51,668 (Oct. 7, 2009).

As noted above, GINA Title II, among other things, prohibits employers from basing employment decisions on genetic information and acquiring the genetic information of their employees and the family members of their employees, except in limited circumstances.

As described in the following sections, these requirements can impact the benefit plans and programs (whether or not they are group health plans) that employers offer to their employees. For additional in-depth information on GINA Title II compliance in the employment context, including litigation matters, handling of confidential genetic information, posting requirements, and more, see Genetic Information Nondiscrimination Act (GINA) Employment Discrimination Prohibitions

Employers Subject to GINA Title II

Title II of GINA applies generally to employers, employment agencies, labor organizations, and apprenticeship and training programs. This discussion focuses on employers, but similar rules apply to all such covered entities. The GINA definition of employer is borrowed from Title VII of the Civil Rights Act of 1964 (42 U.S.C. § 2000e(b)(1)) and covers private employers having 15 or more employees, as well as federal, state, and local governmental agencies (limited exceptions exist for Indian tribes and tax-exempt bona fide private clubs). 42 U.S.C. § 2000ff; 29 C.F.R. § 1635.2(d); Exec. Order 13145 (Nov. 21, 2009).

Note, however, that the GINA Title I rules discussed above would apply to a group health plan that was sponsored by an employer even if the employer did not meet the 15-employee threshold for Title II application.

Anti-discrimination Provisions

GINA Title II's prohibition on making employment-related decisions based on genetic information covers all aspects of the employment relationship, including matters pertaining to the terms, conditions, or privileges of employment. It also prohibits the limitation, segregation, or classification of employees based on genetic information in a manner that would or would tend to deprive any employee of employment opportunities or otherwise adversely affect their employment status. 42 U.S.C. § 2000ff-1(a); 29 C.F.R. §§ 1635.4, 1635.5.

These rules would preclude, for example, using genetic information as a basis for eligibility or participation determinations in any employee welfare benefit plan or program, or discriminating as to the level or availability of benefits offered, whether or not the plan is subject to rules for group health plans, including those under GINA Title I.

Prohibition on the Collection of Genetic Information

Employers may not request, require, or purchase genetic information of their employees (or applicants) or of their family members, subject to certain exceptions. 42 U.S.C. § 2000ff-1(b); 29 C.F.R. § 1635.8. Bear in mind that the exceptions allow for the collection of genetic information, but they do not provide relief from the prohibition on the use of such information in making employment- or employee benefits-related decisions. 42 U.S.C. § 2000ff-1(c).

Also note that these exceptions are distinct from and must be applied separately to any of the exceptions available under the Title I rules applicable to group health plans and issuers of such plans. So even if a Title II exception permits an employer to ask for genetic information, it would still be unlawful for the employer's group health plan to use that information for underwriting or enrollment purposes.

The two exceptions that are the most relevant for employer welfare plans are the inadvertent acquisition exception and the exception for plans or programs that offer health or genetic services (including wellness programs). See 42 U.S.C. § 2000ff-1(b)(1), (2); 29 C.F.R. § 1635.8(b)(1), (2). The inadvertent acquisition exception is discussed immediately below, and the health and genetic services exception is discussed below under GINA and Wellness Programs.

Inadvertent Acquisition Exception

An employer's inadvertent request or inadvertent requirement for genetic information of an employee or family member of an employee does not violate the Title II prohibition. 42 U.S.C. § 2000ff-1(b)(1); 29 C.F.R. § 1635.8(b)(1). Regulations provide special rules for regarding the advertent acquisition of genetic information in the context of collecting other medical information.

Inadvertent Acquisition Related to the Collection of Medical Information

If an employer makes a lawful request for medical information other than genetic information (e.g., in a health risk assessment), its request will generally not be considered inadvertent for the exception unless the person from whom the medical information is requested was instructed not to provide any genetic information. This instruction should be in writing, but may be verbal if the employer does not typically make requests for medical information in writing. 29 C.F.R. § 1635.8(b)(1)(A).

The regulations provide the following model language that can be used to help preserve the inadvertent acquisition exception when making requests for non-genetic information:

The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. Genetic information, as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services.

29 C.F.R. § 1635.8(b)(1)(B).

The exception may still apply in the absence of the provision of such a notice or the use the model language if the request for medical information was not likely to result in the disclosure of any genetic information. The example given in the regulations is receiving an overly broad response to a tailored question requesting non-genetic information. 29 C.F.R. § 1635.8(b)(1)(C).

This model language may also be helpful to preserve the incidental collection exception to the Title I prohibition against collecting genetic information prior to an individual becoming covered under a health plan or policy.

Inadvertent Acquisition Unrelated to the Collection of Medical Information

Other examples of the inadvertent acquisition exception include genetic information revealed to employer personnel through casual conversations, overheard conversations, communications from the employee, provided in each case the it did not arise from a solicitation likely to lead to a disclosure of genetic information. 29 C.F.R. § 1635.8(b)(1)(ii).

The inadvertent acquisition exception would also apply for an employer that learned about the genetic information of an employee from an employee's social media website to which the employer has access. 29 C.F.R. § 1635.8(b)(1)(ii)(D). A similar exception applies for genetic information obtained from a commercially or publicly available source so long as it was not actively seeking such information (e.g., happening upon an employee's family member's obituary that reveals family medical history). 29 C.F.R. § 1635.8(b)(3).

The Title I prohibition on collecting genetic information for underwriting purposes and Title II's prohibitions on the collection of genetic information and its anti-discrimination in employment provisions constrain wellness program design and the use of health risk assessments (HRAs).

HRAs are questionnaires commonly used in connection with wellness programs to assist in identifying risk factors for certain diseases or conditions among employees and assist them with opportunities for education, treatment and prevention, referrals, or promoting behavioral changes. To the extent that an HRA asks an employee or his or her spouse to provide information about their medical history or information about a manifested disease or disorder, then such information is genetic information and will implicate GINA.

This section briefly describes the rules under GINA for wellness programs and HRAs, including the limited circumstances where inducements can be used for such programs. Programs that do not involve genetic information are not subject to GINA, but may be affected by other laws. In fact, many laws other than GINA pertain directly to wellness programs, including HIPAA's non-discrimination provisions, as amended by the Patient Protection and Affordable Care Act of 2010 (ACA), and Title I of the Americans with Disabilities Act of 1990 (ADA) and the final regulations and Interpretive Guidance relating to employer wellness programs issued by the EEOC. 81 Fed. Reg. 31,143 (May 17, 2016), modified by 83 Fed. Reg. 65,296 (Dec. 20, 2018). For a practice note on designing wellness programs that takes into account HIPAA, ACA, GINA, ADA, ERISA, COBRA, and other considerations, see Wellness Program Design and Compliance.

Title I and Wellness Programs

GINA Title I prevents wellness program sponsors from using inducements to encourage individuals to provide genetic information (e.g., family medical history) in connection with the program because of the prohibition on collecting genetic information for underwriting purposes. It also affects the timing of when an individual is permitted to provide genetic information at all, even on a voluntary basis.

Underwriting Restriction and Inducements

Employers may not use incentives (e.g., providing rewards, gifts, or premium discounts) or imposing penalties (e.g., charging higher premiums or deductibles) to induce an employee to provide genetic information in connection with a wellness program that is itself, or is linked to, a group health plan. This is because the gift, rebate, premium reduction or increase, or other inducement is seen as affecting the cost of coverage and consequently would result in impermissibly using genetic information for underwriting purposes in violation of GINA Title I.

Designing Title I-Compliant HRAs

Title I does not prohibit a wellness program design that either (1) uses inducements for participants to provide information that is not genetic information or (2) requests participants to provide genetic information where there is no impact on cost or eligibility (and the information is not used for underwriting or enrollment purposes). See 29 C.F.R. § 2590.702-1(d)(3) (Ex. 5); 45 C.F.R. § 146.122(d)(3) (Ex. 5); Treas. Reg. § 54.9802-3T(d)(3) (Ex. 5).

Therefore, an HRA administered in connection with a wellness program can comply with GINA Title I in one of two ways:

• 1By not requesting genetic information —or—
• 2By making the participant's provision of genetic information strictly optional and free from inducement (i.e., no incentive or penalty is applied, and no benefit is offered or denied, based on whether or not the participant complies with the request for genetic information or on the information disclosed).

Although GINA Title I will not apply for HRAs that follow these recommendations, the HRA may be subject to additional restrictions and limitations under GINA Title II (limiting an employer's ability to offer inducements to provide genetic information to certain voluntary wellness programs, HIPAA (restricting wellness programs that are part of a group health plan from discriminating on the basis of a health factor), and the ADA (limiting an employer's ability to offer inducements to provide disability-related information or undergo a physical exam to certain employee health programs.

HRAs that do not request genetic information. Such HRAs must not ask any questions requesting an individual's genetic information (i.e., that relate to the individual's family medical history or any information about genetic testing, genetic services, genetic counseling, or genetic diseases relating to the individual or the individual's family members). Best practices for no-genetic-information HRAs:

• •Include the model statement instructing the individual not to divulge any genetic information described above in the section entitled "Inadvertent Acquisition Exception" under Plan Compliance under GINA Title II to protect against a GINA Title II violation.
• •Do not rely on an individual's acknowledgement to reading and understanding the model statement. Make clear to the individual by additional means (e.g., in other written HRA instructions and/or verbally) that he or she should only answer medical questions about him- or herself and not about any family members (including a spouse), and not to divulge any information about genetic testing or genetic services.

HRAs that contain optional questions regarding genetic information. For this alternative, ensure the HRA clearly states that (1) the individual is not required to answer any questions relating to genetic information and (2) if the individual declines to respond to such questions, there will be no increased cost or other adverse effect for the individual. Also note:

• •A best practice for designing an HRA that contains both required responses and voluntary responses is to bifurcate the form into separate sections to avoid confusion about which questions are optional.
• •An employer sponsoring a wellness program that acquires genetic information will need to satisfy the conditions for the applicable exception from the GINA Title II prohibition, including those related to voluntariness and obtaining prior written authorization, described further below.

Timing Restriction on Collecting Genetic Information

GINA Title I does not permit genetic information about an individual covered under a group health plan (or related wellness program) until after the individual is enrolled in the group health plan (i.e., the first date of plan coverage). Thus, when an employer does collect genetic information in connection with a wellness program, it is important not to do so until on or after the first date of plan coverage. 29 C.F.R. § 2590.702-1(d)(3) (Ex. 3); 45 C.F.R. § 146.122(d)(3) (Ex. 3); Treas. Reg. § 54.9802-3T(d)(3) (Ex. 3).

Applicability of Title I Rules

Since GINA Title I applies to group health plans, these restrictions only apply if the wellness program is itself, or is offered in connection with, a group health plan, which is often the case. Even a stand-alone wellness program that is not treated as a group health plan would need to be administered in compliance with GINA Title II requirements, described below, which apply directly to employers who offer wellness programs that include disability-related questions or medical examinations.

Title II and Wellness Programs

One of the exceptions to GINA Title II's prohibition on employer collection of genetic information is for the purpose of providing health or genetic services, including through a wellness program. EEOC final regulations address the conditions that must be satisfied to qualify for this exception, specifically relating to inducements offered in connection with wellness programs (whether or not such program is part of a group health plan) that require disability-related inquiries or medical examinations described below. 81 Fed. Reg. 31,143.

Requirements for Collecting Genetic Information under a Wellness Program

To be eligible for the health or genetic services exception to the prohibition on an employer's collection of genetic information, a wellness program must meet the following requirements:

Reasonable design. The program must be reasonably designed to promote health or prevent disease, based on all relevant facts and circumstances. This standard, consistent with one used for ADA and HIPAA non-discrimination compliance, is satisfied if the program:

• •Has a reasonable chance of improving the health of or preventing disease in participants
• •Is not overly burdensome (e.g., by requiring extended participation periods, invasive procedures, financial requirements, or other burdens to receive the program benefits)
• •Is not a subterfuge for avoiding the GINA Title II rules or highly suspect as to its method for improving health or preventing disease –and–
• •Does not require a test, screening, or collection of health information from a participant, unless either:
  • o The participant receives the results of the test or screening, follow-up information, or other advice designed to improve the participant's health –or–
  • o The employer actually uses the information to design a program to address at least a subset of any conditions identified

29 C.F.R. § 1635.8(b)(2)(i)(A).

Voluntary. A participant's providing of genetic information must be voluntary. Specifically, no participant can be required to provide genetic information or penalized for declining to do so. 29 C.F.R. § 1635.8(b)(2)(i)(B).

Prior written authorization. The program administrator must obtain prior, knowing, voluntary, written authorization from a participant before acquiring genetic information. The authorization form must:

• •Be written in a manner reasonably likely to be understood by the participant
• •Describe the type of genetic information sought and the general purposes for which it is to be used –and–
• •Describe the restrictions on disclosure of genetic information

29 C.F.R. § 1635.8(b)(2)(i)(C).

Use and disclosure limitations. Programs that collect genetic information must comply with confidentiality and disclosure rules under GINA Title II (or, alternatively, with HIPAA's privacy, security, and breach notification rules if the genetic information is protected health information (PHI) under HIPAA). 42 U.S.C. § 2000ff-5; 29 C.F.R. § 1635.9.

The generally applicable Title II confidentiality rules require that genetic information:

• •Be treated as a confidential medical record and maintained in medical files separate from personnel files –and–
• •Only be disclosed (1) to (or with the written consent of) the individual; (2) consistent with the exceptions in 29 C.F.R. § 1635.9(b) to researchers or in connection with court orders, government investigations, and FLSA certifications; or (3) to a public health agency in connection with a public health event

42 U.S.C. §§ 2000ff-5; 29 C.F.R. § 1635.9.

Additional limitations apply for programs that collect individually identifiable genetic information. Such information:

• •Must be used solely for purposes of providing the health and genetic services
• •May only be disclosed (1) to the individual receiving genetic services, (2) to the licensed health-care professionals or board-certified genetic counselors providing the services, or (3) consistent with the exceptions under 29 C.F.R. § 1635.9, described above
• •May not be made accessible to employer personnel who make employment decisions or others in the workplace –and–
• •May not be disclosed to the employer except in an aggregated form that does not identify specific individuals

29 C.F.R. § 1635.8(b)(2)(i)(D), (E).

The EEOC notes that compliance with similar disclosure limitations under ADA rules will likely necessitate a third-party service provider to administer the wellness program and/or the implementation of a firewall if in-house personnel are involved in administration of the wellness program. See 29 C.F.R. part 1630 appendix § 1630.14(d)(4)(i)-(iv) (81 Fed. Reg. 31,126, 31,142).

Permissible Inducements

In general, Title I of the ADA and Title II of GINA limit the ability to offer inducements (whether financial or in-kind, and no matter how de minimis) to an employee or his or her spouse in connection with a wellness program that includes questions about disabilities or genetic information or a medical examination. A now-rescinded rule that had established acceptable parameters for incentives offered to an employee whose spouse provides health status information did not survive a court challenge. That rule was vacated by the United States District Court for the District of Columbia in AARP v. United States EEOC, 267 F. Supp. 3d 14 (D.D.C. 2017) and AARP v. United States EEOC, 292 F. Supp. 3d 238, modified by 2018 U.S. Dist. LEXIS 27317 (D.D.C. 2018). The EEOC formally removed the vacated provisions, effective as of January 1, 2019. 83 Fed. Reg. 65,296 (removing and reserving 29 C.F.R. § 1635.8(b)(2)(iii)).

In general, a wellness program cannot induce a participant to provide genetic information in connection with a wellness program by offering an incentive or imposing a penalty (whether financial or in-kind, and no matter how de minimis). However, inducements are permissible for completion of an HRA that either:

• •Does not ask for any genetic information –or–
• •Includes inquiries about genetic information but informs the participant, in clear language reasonably likely to be understood, that he or she will receive the inducement regardless of whether or not responses to the genetic information questions are provided

29 C.F.R. § 1635.8(b)(2)(ii).

Other Title II Rules for Wellness Programs

Additional restrictions and clarifications under the Title II final rules include the following:

• •The program may not penalize an employee's spouse (or the employee) based on medical information collected from the spouse (e.g., by denying an inducement because the spouse has high blood pressure). 29 C.F.R. § 1635.8(b)(2)(i)(A).
• •Employers may not deny access to health benefits or retaliate against an employee based on a refusal by the employee's spouse to provide his or her medical information. 29 C.F.R. § 1635.8(b)(2)(v).
• •Employers cannot require or induce wellness program participants to agree to the sale, exchange, sharing, transfer, or other disclosure of their genetic information (except for purposes of program administration or pursuant to the limited disclosures permitted by law) or to waive confidentiality protections applicable to genetic information. 29 C.F.R. § 1635.8(b)(2)(iv).
• •No inducements may be offered to provide either genetic information or manifestations of a disease or disorder regarding an employee's children, even if the children are adults and even if the children participate in the program. (Although this language no longer appears in the regulations after the removal of 29 C.F.R. § 1635.8(b)(2)(iii), it may remain the position of the EEOC.)

For additional information on wellness programs, see Wellness Program Design and Compliance.

Title I Penalties and Enforcement

The DOL, HHS, and IRS are responsible for GINA Title I enforcement pursuant to ERISA, the PHSA, and the I.R.C., respectively. ERISA § 502(c)(10) (29 U.S.C. § 1132(c)(10)); 42 U.S.C. § 300gg-22(b)(3); I.R.C. §§ 9834, 4980D.

For most plans, the GINA Title I enforcement provisions impose a penalty for periods of violation of $100 per day per aggrieved participant or beneficiary. This amount is capped, if the failure was unintentional, at the lesser of $500,000 or 10% of the employer's group health plan costs for the preceding taxable year. ERISA § 502(c)(10)(B), (D)(iii) (29 U.S.C. § 1132(c)(10)(B), (D)(iii)); 42 U.S.C. § 300gg-22(b)(3)(B), (D)(iii); I.R.C. § 4980D(b), (c)(3). These amounts are subject to annual inflation adjustments pursuant to the Federal Civil Penalties Inflation Adjustment Act of 1990 as amended by the Federal Civil Penalties Inflation Adjustment Act Improvements Act of 2015 (for 2024, the penalty is $141 per day with a $710,310 cap).

Moreover, if a violation is not discovered and corrected prior to the receipt of a notice of failure by the Secretary, the minimum penalty is $2,500, or $15,000 for such violations that are more than de minimis (subject to adjustment for inflation; $3,550 and $21,310, respectively, for 2024). On the other hand, the enforcing agency may waive part or all of the penalty for violations having a reasonable cause to the extent the penalty would be excessive relative to the failure, and no penalty will apply if:

• •The agency concludes that the liable party did not know of the failure (and would not have known by exercising reasonable diligence) –or–
• •The failure was due to reasonable cause and is corrected within 30 days after the date discovered (or the date discovery would have occurred upon exercising reasonable diligence)

ERISA § 502(c)(10)(C), (D), (E) (29 U.S.C. § 1132(c)(10)(C), (D), (E)); 42 U.S.C. § 300gg-22(b)(3)(C), (D), (E); I.R.C. § 4980D(b)(3), (c); 81 Fed. Reg. at 43,442.

Title II Penalties and Enforcement

Generally, GINA Title II incorporates penalty and enforcement provision from Title VII of the Civil Rights Act of 1964 (or certain other statutes covering governmental employees). 42 U.S.C. § 2000ff-6. Individuals may seek reinstatement, hiring, promotion, back pay, injunctive relief, compensatory or punitive damages, and attorney's fees and costs (subject to applicable caps combined compensatory and punitive damages). 29 C.F.R. § 1635.10. However, punitive damages are not available against federal, state, or local government employers. EEOC, Background Information for EEOC Final Rule on Title II of the Genetic Information Nondiscrimination Act of 2008, Q&A24.

For more information on the EEOC's enforcement of Title VII, see EEOC Enforcement of Anti-discrimination Laws: Key Considerations.

Relationship between Title I and Title II Enforcement

GINA's construction provision clarifies that activities authorized under GINA Title I do not constitute a violation of Title II. 42 U.S.C. § 2000ff-6(c); 29 C.F.R. § 1635.11(c). Further, GINA prevents double liability under both titles based on the same action. 42 U.S.C. § 2000ff-6(a)(2)(B)(i); 29 C.F.R. § 1635.11(b)(2). However, distinct acts may be enforced separately under both titles. For example, an employer that amends its health plan to require participants to undergo genetic testing is liable under Title II, but the plan's implementation of the requirement could result in a Title I violation. 29 C.F.R. § 1635.11(b)(2)(iii).

• •Keep EEO policies updated with respect to prohibitions against discrimination based on genetic information.
• •Conduct appropriate training for Human Resources and other personnel whose roles may implicate GINA provisions, including individuals responsible for employment-related decisions.
• •Be vigilant in guarding against the inadvertent acquisition of employee genetic information. Do not permit employees to disclose family medical history, including medical information about a spouse, children, or extended family.
• •Use the model language provided by the EEOC warning against providing genetic information when collecting other information to avoid inadvertent acquisition, and make sure the employee understands the warning.
• •Adopt confidentiality and disclosure protocols for any genetic information acquired in compliance with GINA, the ADA, and HIPAA, as applicable.
• •When relying on an exception that allows the acquisition of genetic information, implement policies and controls to ensure compliance with applicable conditions.
• •Never collect genetic information prior to the first date of coverage under a related group health plan.
• •Ensure wellness programs meet the reasonable designed requirements under GINA (and the ADA and HIPAA), including by not being overly burdensome.
• •Draft HRAs with care to account for GINA considerations. Either do not solicit any genetic information from an employee or his or her spouse or do so on a strictly optional and voluntary basis. Always be explicitly clear that if an incentive is offered, it does not depend on whether optional genetic information questions are answered, and no penalty will be imposed for declining to answer such questions.
• •If a wellness program is designed to permit the participation of employees' children, ensure that no inducements are offered in connection with the genetic information of an employee's child(ren).