- The science
of human genetics is concerned with deciphering and understanding
information contained within an individual’s DNA.
carried within the DNA is of a highly sensitive, personal
and intimate nature, and therefore protecting that information
is of concern to individuals, families and groups.
- Mapping and
sequencing human DNA is now possible as a result of the
multi-billion dollar Human Genome Project, formally completed
on April 14, 2003 (coincidently the same day HIPAA’s
privacy standards took effect!).
- A more thorough
understanding of human genes offers great promise for predicting
health risks and promoting the development or effective
Other than in the
context of law enforcement
identification and location efforts, the HIPAA
Privacy Rule does not discuss or provide special privacy
protections for genetic information. (By contrast, psychotherapy
notes do receive "extra" limits on use and disclosure.)
opted not to create a “special” standard for genetic
information, though some genetic information will be protected
by the privacy regulation if it meets the definition of protected
health information (PHI).
According to the
U.S. Department of Health and Human Services (HHS), PHI includes
genetic information that otherwise meets the statutory definition
(see 65 Fed. Reg. 86261). Therefore, under HIPAA, genetic
information will be protected to the same extent as other
Although not specifically
stated in the regulations, information about genetic tests,
services or counseling, and family history will be protected.
HHS has made clear that medical information about a family
member contained within an individual’s medical record
is information about the individual and therefore may not
be disclosed without meeting the requirements of the Rule
(see 65 Fed. Reg. 82492).
It is important
to note however, that HIPAA will not protect the actual tissue
or blood sample itself -- protection is only afforded to the
information that it contains or generates. Anonymized
biological material is not considered PHI; this is likely
to have implications for banked tissue and other forms of
Protection of genetic
information in the research setting will depend upon whether
a researcher or institution is functioning as a provider (a
type of covered entity)
and whether the provider conducts insurance-related transactions.
For researcher who are not providers, use and disclosure of
genetic information will be affected by HIPAA where the PHI
was obtained from a provider who (or an entity which) must
comply with the regulation (i.e., is a covered entity or in
a business associate
relationship with one).
The HIPAA statute
includes the first federal protection against genetic discrimination
in health insurance. It prohibits commercial health insurers
from excluding an individual from group coverage because of
past or present medical conditions, including predisposition
to certain diseases. It specifically states that genetic information
in the absence of a current diagnosis is not a pre-existing
those protections, HIPAA does not prevent covered health plans
from requesting genetic information from plan members or from
prospective members as a part of the insurance underwriting
process. In addition, HIPAA does not prohibit health insurers
from charging higher premiums based on genetic makeup; neither
does it specifically limit the disclosure of genetic information
about individuals to insurers. However, the Rule’s minimum
necessary standard should serve to prevent an insurer
from insisting that a provider disclose genetic test results
of a member when the results are not necessary for the health
plan to reimburse the cost of the test.