HIPAA Administrative Simplification: Standards for Privacy of Individually Identifiable Health Information, 51698-51710 [E9-22492]

Agencies

• Office of the Secretary
• DEPARTMENT OF HEALTH AND HUMAN SERVICES

[Federal Register Volume 74, Number 193 (Wednesday, October 7, 2009)]
[Proposed Rules]
[Pages 51698-51710]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: E9-22492]



Federal Register / Vol. 74, No. 193 / Wednesday, October 7, 2009 / 
Proposed Rules

[[Page 51698]]


-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Parts 160 and 164

RIN 0991-AB54


HIPAA Administrative Simplification: Standards for Privacy of 
Individually Identifiable Health Information

AGENCY: Office for Civil Rights, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Department of Health and Human Services (HHS) proposes to 
modify certain provisions of the ``Standards for Privacy of 
Individually Identifiable Health Information'' (Privacy Rule), issued 
under the Health Insurance Portability and Accountability Act of 1996 
(HIPAA). The purpose of these proposed modifications is to implement 
section 105 of Title I of the Genetic Information Nondiscrimination Act 
of 2008 (GINA) regarding the privacy and confidentiality of genetic 
information, as well as to make certain other changes to the HIPAA 
Privacy Rule.

DATES: Comments on the proposed rule will be considered if we receive 
them at the appropriate address, as provided below, no later than 
December 7, 2009.

ADDRESSES: Written comments may be submitted through any of the methods 
specified below. Please do not submit duplicate comments.
     Federal eRulemaking Portal: You may submit electronic 
comments at https://www.regulations.gov. Follow the instructions for 
submitting electronic comments. Attachments should be in Microsoft 
Word, WordPerfect, or Excel; however, we prefer Microsoft Word.
     Regular, Express, or Overnight Mail: You may mail written 
comments (one original and two copies) to the following address only: 
U.S. Department of Health and Human Services, Office for Civil Rights, 
Attention: GINA NPRM (RIN 0991-AB54), Hubert H. Humphrey Building, Room 
509F, 200 Independence Avenue, SW., Washington, DC 20201. Mailed 
comments may be subject to delivery delays due to security procedures. 
Please allow sufficient time for mailed comments to be timely received 
in the event of delivery delays.
     Hand Delivery or Courier: If you prefer, you may deliver 
(by hand or courier) your written comments (one original and two 
copies) to the following address only: Office for Civil Rights, 
Attention: GINA NPRM (RIN 0991-AB54), Hubert H. Humphrey Building, Room 
509F, 200 Independence Avenue, SW., Washington, DC 20201. (Because 
access to the interior of the Hubert H. Humphrey Building is not 
readily available to persons without federal government identification, 
commenters are encouraged to leave their comments in the mail drop 
slots located in the main lobby of the building.)
    Inspection of Public Comments: All comments received before the 
close of the comment period will be available for public inspection, 
including any personally identifiable or confidential business 
information that is included in a comment. We will post all comments 
received before the close of the comment period at https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: Andra Wicks, 202-205-2292.

SUPPLEMENTARY INFORMATION:

I. Background

    The ``Standards for Privacy of Individually Identifiable Health 
Information,'' or ``Privacy Rule'' was issued on December 28, 2000 (and 
later amended in August 2002), pursuant to the Administrative 
Simplification Provisions of Title II, Subtitle F, of the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA), Public 
Law 104-191. Subtitle F of Title II of HIPAA added a new Part C to 
Title XI of the Social Security Act (sections 1171-1179 of the Act, 42 
U.S.C. 1320d-1320d-8). The Privacy Rule is one of a suite of rules 
required by the Administrative Simplification provisions of HIPAA, and 
put in place the first national standards for the privacy protection of 
certain individually identifiable health information (called 
``protected health information'' or ``PHI''). The other HIPAA 
Administrative Simplification Rules provide national standards for 
electronic health care transactions and code sets, unique health 
identifiers for employers and health care providers, and the security 
of electronic PHI. The HIPAA Privacy and other Administrative 
Simplification Rules currently apply to three types of covered 
entities: health care providers who conduct covered health care 
transactions electronically, health plans, and health care 
clearinghouses.
    The HIPAA Privacy Rule protects individuals' medical records and 
other individually identifiable health information held by HIPAA 
covered entities by, among other provisions, requiring appropriate 
safeguards to protect the privacy of such information, and setting 
limits and conditions on the uses and disclosures that may be made of 
the information. The Privacy Rule also gives patients rights over their 
PHI, including rights to examine and obtain a copy of their health 
records, and to request corrections.
    On May 21, 2008, President Bush signed into law the Genetic 
Information Nondiscrimination Act of 2008 (``GINA''), Public Law 110-
233, 122 Stat. 881. Congress enacted GINA to ``establish [ ] a national 
and uniform basic standard [that] is necessary to fully protect the 
public from discrimination and allay their concerns about the potential 
for discrimination, thereby allowing individuals to take advantage of 
genetic testing, technologies, research, and new therapies.'' GINA 
section 2(5). To that end, GINA generally prohibits discrimination 
based on an individual's genetic information with respect to both 
health coverage and employment.
    In particular, with respect to health coverage, Title I of GINA 
generally prohibits discrimination in group premiums based on genetic 
information, proscribes the use of genetic information as a basis for 
determining eligibility or setting premiums in the individual and 
Medicare supplemental policy (Medigap) insurance markets, and limits 
the ability of group health plans, health insurance issuers, and 
Medigap issuers to collect genetic information or to request or require 
that individuals undergo genetic testing. Title II of GINA generally 
prohibits use of genetic information in the employment context, 
restricts acquisition of genetic information by employers and other 
entities covered by Title II, and strictly limits such entities from 
disclosing genetic information. The Departments of Labor (Employee 
Benefits Security Administration), Treasury (Internal Revenue Service), 
and HHS (Centers for Medicare & Medicaid Services) are responsible for 
administering and enforcing the GINA Title I nondiscrimination 
provisions, and the Equal Employment Opportunity Commission (EEOC) is 
responsible for administering and enforcing the GINA Title II 
nondiscrimination provisions.\1\
---------------------------------------------------------------------------

    \1\ The Departments of Labor (Employee Benefits Security 
Administration), Treasury (Internal Revenue Service), and HHS 
(Centers for Medicare & Medicaid Services (CMS)) have issued 
regulations in a separate rulemaking to implement sections 101-103 
of GINA, which amended: section 702(b) of the Employee Retirement 
Income Security Act of 1974 (29 U.S.C. 1182(b); section 2702(b) of 
the Public Health Service Act (42 U.S.C. 300gg-1(b); and subsection 
(b) of section 9802 of the Internal Revenue Code of 1986. Section 
104 of GINA applies to Medigap issuers, which are subject to the 
provisions of section 1882 of the Social Security Act that are 
implemented by CMS, and which incorporate by reference certain 
provisions in a model regulation of the National Association of 
Insurance Commissioners (NAIC). The NAIC amended its model 
regulation on September 24, 2008, to conform to section 104 of GINA, 
and the amended regulation was published by CMS in the Federal 
Register on April 24, 2009 at 74 FR 18808. With respect to Title II 
of GINA, the EEOC issued a notice of proposed rulemaking on March 2, 
2009, at 74 FR 9056.

---------------------------------------------------------------------------

[[Page 51699]]

    In addition to these nondiscrimination provisions, Title I of GINA 
contains certain new privacy protections for genetic information. In 
particular, section 105 of GINA, entitled ``Privacy and 
Confidentiality,'' amends Part C of Title XI of the Social Security Act 
by adding section 1180 to address the application of the HIPAA Privacy 
Rule to genetic information. Section 1180 requires the Secretary of HHS 
to revise the Privacy Rule to clarify that genetic information is 
health information and to prohibit group health plans, health insurance 
issuers (including HMOs), and issuers of Medicare supplemental policies 
from using or disclosing genetic information for underwriting purposes.
    In this proposed rule, HHS is proposing to implement the 
modifications required by GINA section 105, as well as to make certain 
other modifications to the HIPAA Privacy Rule, and seeks public comment 
on its proposal. In developing its proposal, HHS consulted with the 
Departments of Labor and Treasury, as required by section 105(b)(1) of 
GINA, to ensure, to the extent practicable, consistency across the 
regulations. In addition, HHS coordinated with the EEOC in the 
development of these regulations.

II. Description of Proposed Modifications

Overview and Scope

    In accordance with section 105 of GINA \2\ and the Department's 
general authority under sections 262 and 264 of HIPAA, the Department 
proposes to modify the HIPAA Privacy Rule to: (1) Explicitly provide 
that genetic information is health information for purposes of the 
Rule; (2) prohibit health plans from using or disclosing protected 
health information that is genetic information for underwriting 
purposes; (3) revise the provisions relating to the Notice of Privacy 
Practices for health plans that perform underwriting; (4) make a number 
of conforming modifications to definitions and other provisions of the 
Rule; and (5) make technical corrections to update the definition of 
``health plan.''
---------------------------------------------------------------------------

    \2\ Any reference in this section of the preamble to GINA is a 
reference to Title I of GINA, except as otherwise indicated.
---------------------------------------------------------------------------

    Section 105 of GINA requires HHS to modify the Privacy Rule to 
prohibit ``a covered entity that is a group health plan, health 
insurance issuer that issues health insurance coverage, or issuer of a 
medicare [sic] supplemental policy'' from using or disclosing genetic 
information for underwriting purposes. GINA section 105 provides that 
the terms ``group health plan'' and ``health insurance coverage'' have 
the meanings given such terms under section 2791 of the Public Health 
Service Act (42 U.S.C. 300gg-91), and that the term ``medicare [sic] 
supplemental policy'' has the meaning given such term in section 
1882(g) of the Social Security Act. In addition, the term ``health 
insurance issuer,'' as defined at 42 U.S.C. 300gg-91, includes a health 
maintenance organization (HMO). These four types of health plans (i.e., 
group health plans, health insurance issuers, and health maintenance 
organizations, as defined in the Public Health Service Act, as well as 
issuers of Medicare supplemental policies), correspond to the types of 
health plans listed at subparagraphs (i) through (iii) and (vi) of 
paragraph (1) of the definition of ``health plan'' at Sec.  160.103 in 
the HIPAA Privacy Rule.
    In addition to these four categories of health plans, the HIPAA 
Privacy Rule also applies to many other types of health plans, 
including: (1) Long-term care policies (excluding nursing home fixed-
indemnity policies); (2) employee welfare benefit plans or other 
arrangements that are established or maintained for the purpose of 
offering or providing health benefits to the employees of two or more 
employers (to the extent that they are not group health plans or health 
insurance issuers); (3) high risk pools that are mechanisms established 
under State law to provide health insurance coverage or comparable 
coverage to eligible individuals; (4) certain public benefit programs, 
such as Medicare Part A and B, Medicaid, the military and veterans 
health care programs, the Indian Health Service program, and others; as 
well as (5) any other individual or group plan, or combination of 
individual or group plans that provides or pays for the cost of medical 
care (as defined in section 2791(a)(2) of the PHS Act, 42 U.S.C. 300gg-
91(a)(2)). This last category includes, for example, certain ``excepted 
benefits'' plans described at 42 U.S.C. 300gg-91(c)(2), such as limited 
scope dental or vision benefits plans. See the definition of ``health 
plan'' at Sec.  160.103.
    The Department proposes to apply the prohibition in GINA on using 
and disclosing protected health information that is genetic information 
for underwriting to all health plans that are subject to the Privacy 
Rule, rather than solely to the plans GINA explicitly requires be 
subject to the prohibition. We believe that this interpretation is 
consistent with both GINA and the Secretary's broad authority under 
HIPAA.
    Section 264 of HIPAA (42 U.S.C. 1320d-2 note) provides the 
Secretary with authority to promulgate privacy standards that govern:
    (1) The rights that an individual who is a subject of individually 
identifiable health information should have.
    (2) The procedures that should be established for the exercise of 
such rights.
    (3) The uses and disclosures of such information that should be 
authorized or required.

Accordingly, the Secretary has wide latitude to promulgate privacy 
standards that limit the use or disclosure of individually identifiable 
health information, including genetic information. Furthermore, section 
262 of HIPAA, codified at 42 U.S.C. 1320d-1, states that:

    Any standard adopted under this part shall apply, in whole or in 
part, to the following persons:
    (1) A health plan.
    (2) A health care clearinghouse.
    (3) A health care provider who transmits any health information 
in electronic form in connection with a transaction referred to in 
section 1173(a)(1).

While other portions of HIPAA were limited to group health plans, see, 
e.g., sections 101 and 102 of HIPAA, the Administrative Simplification 
subtitle governs a substantially broader definition of ``health plan,'' 
42 U.S.C. 1320d, and instructs that ``any standard'' will apply to all 
such health plans.
    Based on this broad definition of ``health plan,'' the wide 
latitude Congress provided to the Secretary to promulgate privacy 
standards, and the charge that ``any standard'' should apply to all 
health plans, we interpret that the HIPAA administrative simplification 
provisions provide the Secretary with broad authority to craft privacy 
standards that uniformly apply to all health plans, regardless of 
whether such health plans are governed by other portions of the HIPAA 
statute.
    In GINA, Congress recognized a privacy interest on the part of 
individuals, distinct from the nondiscrimination provisions, with 
respect to the use or disclosure of individuals' genetic information in 
health coverage decisions. At a minimum, GINA requires the Secretary to 
apply this privacy interest to uses and disclosures of group health 
plans, health insurance issuers that issue health insurance coverage, 
and issuers of

[[Page 51700]]

Medicare supplemental policies. Apart from this required change to the 
HIPAA Privacy Rule, however, nothing in GINA explicitly or implicitly 
curtails the broad authority of the Secretary to promulgate privacy 
standards for any and all health plans that are governed by the HIPAA 
Administrative Simplification provisions.
    Under the Privacy Rule, consistent with the HIPAA statutory text 
discussed above, an individual's privacy interests and rights with 
respect to the use and disclosure of PHI are protected uniformly 
without regard to the type of health plan that holds the information. 
Thus, under the Privacy Rule, individuals can expect and benefit from 
privacy protections that do not diminish based on the type of health 
plan from which they obtain health coverage.
    Therefore, in keeping with a uniform privacy construct, and 
pursuant to its authority under HIPAA sections 262 and 264, the 
Department proposes to apply the prohibition on using or disclosing PHI 
that is genetic information for underwriting purposes to all health 
plans that are covered entities as defined by HIPAA section 262, and, 
correspondingly, by the Privacy Rule. The Department believes that 
individuals' interests in uniform protection under the Privacy Rule 
against the use or disclosure of their genetic information for 
underwriting purposes outweigh any adverse impact on health plans that 
are not covered by GINA. This is particularly true since we do not 
expect that all of the health plans subject to the Privacy Rule use or 
disclose PHI that is genetic information for underwriting today (or 
even conduct underwriting generally, in the case of some of the public 
benefit plans).
    Consistent with Sec.  160.104(c), the Department intends to require 
health plans to comply with these modifications to the privacy 
standards no later than 180 days from the effective date of such 
modifications. Note that the Department does not propose to extend the 
compliance date for small health plans as the Department believes 180 
days is sufficient time for small health plans to come into compliance 
with the proposed requirements.
    With this overview and description of the scope of the proposed 
rule as foundation, the following discussion describes the proposed 
modifications to the Privacy Rule section by section. Those interested 
in commenting on the proposed provisions can assist the Department by 
preceding discussion of any particular provision in the comment with a 
citation to the section of the proposed rule being discussed, or, if 
submitting a comment relevant to the above discussion, with the term 
``Scope.''

Section 160.103--Definitions

    The Department is proposing to modify Sec.  160.103 to: (1) 
Explicitly provide, as required by GINA, that the definition of 
``health information'' encompasses ``genetic information''; (2) add a 
number of terms used in GINA Title I for purposes of implementing 
GINA's provisions; and (3) make certain technical corrections to update 
the definition of ``health plan.'' We note that with respect to the 
GINA terms, this proposed rule proposes to adopt definitions that are 
generally consistent with the definitions of such terms promulgated in 
the implementing regulations for sections 101-103 of GINA.
    1. Health information. The Department has always maintained that 
genetic information is health information protected by the Privacy Rule 
to the extent such information is individually identifiable and held by 
a covered entity (subject to the general exclusions from the definition 
of ``protected health information''). Frequently Asked Question number 
354, available at https://www.hhs.gov/ocr/privacy/hipaa/faq/about/354.html, states:
    Question: Does the HIPAA Privacy Rule protect genetic 
information?
    Answer: Yes, genetic information is health information protected 
by the Privacy Rule. Like other health information, to be protected 
it must meet the definition of protected health information: it must 
be individually identifiable and maintained by a covered health care 
provider, health plan, or health care clearinghouse. See 45 CFR 
160.103.

Nevertheless, section 105 of GINA requires the Secretary to revise the 
Privacy Rule to make clear that genetic information is health 
information under the Rule. Accordingly, the Department proposes to 
modify the definition of ``health information'' at Sec.  160.103 to 
explicitly provide that such term includes genetic information. We 
note, however, that as before, genetic information, while health 
information, is only covered by the Privacy Rule to the extent that it 
meets the definition of ``protected health information.'' That is, the 
genetic information must be individually identifiable and maintained by 
a HIPAA covered entity (or business associate of a covered entity) (and 
not otherwise fall within one of the exceptions to the definition). See 
the definition of ``protected health information'' at Sec.  160.103.
    2. Genetic information. The term ``genetic information'' is a 
defined term in GINA that establishes what information is protected by 
the statute. GINA section 105 provides that the term ``genetic 
information'' in section 105 shall have the same meaning given the term 
in section 2791 of the Public Health Service Act (PHSA) (42 U.S.C. 
300gg-91), as amended by GINA section 102. Section 102(a)(4) of GINA 
defines ``genetic information'' to mean, with respect to any 
individual, information about: (1) Such individual's genetic tests; (2) 
the genetic tests of family members of such individual; and (3) the 
manifestation of a disease or disorder in family members of such 
individual (i.e., family medical history). GINA also provides that the 
term ``genetic information'' includes, with respect to any individual, 
any request for, or receipt of, genetic services, or participation in 
clinical research which includes genetic services, by such individual 
or family member of such individual; however, GINA excludes information 
about the sex or age of any individual. The basic definition of 
``genetic information'' in section 102(a)(4) of GINA (and that is to 
apply for purposes of section 105) is also expanded by section 
102(a)(3), which provides that any reference to genetic information 
concerning an individual or family member in the PHSA shall include: 
with respect to an individual or family member of an individual who is 
a pregnant woman, the genetic information of any fetus carried by such 
pregnant woman; and with respect to an individual or family member 
utilizing an assisted reproductive technology, the genetic information 
of any embryo legally held by the individual or family member. The 
Department proposes to include this statutory definition of ``genetic 
information'' in Sec.  160.103 without substantive change.
    3. Genetic test. As indicated above, GINA provides that the term 
``genetic information'' includes information about an individual's 
genetic tests or the genetic tests of family members of such 
individual. As with the term ``genetic information,'' GINA section 105 
provides that the term ``genetic test'' shall have the same meaning as 
the term has in section 2791 of the PHSA (42 U.S.C. 300gg-91), as 
amended by section 102 of GINA. Section 102(a)(4) of GINA amends 
section 2791 of the PHSA to define ``genetic test'' to mean ``an 
analysis of human DNA, RNA, chromosomes, proteins, or metabolites, that 
detects genotypes, mutations, or chromosomal changes.'' GINA further 
clarifies that the term ``genetic test'' does not include an analysis 
of proteins or metabolites that does not detect genotypes, mutations, 
or chromosomal changes, or that is directly related to a

[[Page 51701]]

manifested disease, disorder, or pathological condition that could 
reasonably be detected by a health care professional with appropriate 
training and expertise in the field of medicine involved.
    Consistent with the statutory definition of ``genetic test,'' the 
Department proposes to define ``genetic test'' at Sec.  160.103 as an 
analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if 
the analysis detects genotypes, mutations or chromosomal changes, and 
to provide in the definition that ``genetic test'' does not include an 
analysis of proteins or metabolites that is directly related to a 
manifested disease, disorder, or pathological condition. The statute 
does not define ``manifestation'' or ``manifested.'' Consequently, as 
discussed below, the Department proposes to include a definition of 
``manifestation or manifested.''
    Under this proposed definition of ``genetic test,'' a test to 
determine whether an individual has a gene variant associated with 
breast cancer (such as the BRCA1 or BRCA2 variant) is a genetic test. 
Similarly, a test to determine whether an individual has a genetic 
variant associated with hereditary nonpolyposis colorectal cancer is a 
genetic test. However, medical tests that analyze genetic material that 
is not of human origin, such as tests that detect the presence of 
viruses or bacteria in an individual, or tests that do not detect 
genotypes, mutations, or chromosomal changes, are not genetic tests. 
For example, an HIV test, complete blood count, cholesterol test, liver 
function test, or test for the presence of alcohol or drugs is not a 
genetic test.
    4. Genetic services. GINA provides that the term ``genetic 
information'' includes, with respect to any individual, any request 
for, or receipt of, genetic services, or participation in clinical 
research which includes genetic services, by such individual or any 
family member of such individual. As with the definitions above, 
section 105 of GINA provides that the term ``genetic services'' shall 
have the meaning given such term in section 2791 of the PHSA (42 U.S.C. 
300gg-91), as amended by section 102 of GINA. Section 102(a)(4) of GINA 
defines ``genetic services'' to mean: (1) A genetic test; (2) genetic 
counseling (including obtaining, interpreting, or assessing genetic 
information); or (3) genetic education. Thus, the fact that an 
individual or a family member of the individual requested or received a 
genetic test, counseling, or education is information protected under 
GINA.
    Genetic counseling is a means for individuals to obtain information 
and support about potential risks for genetic diseases and disorders. 
Genetic education is also a means for individuals to obtain information 
about potential risks for genetic diseases and disorders. The 
Department proposes to add the statutory definition of ``genetic 
services'' to Sec.  160.103 without substantive change.
    5. Family Member. The term ``family member'' is used in the 
definition of ``genetic information'' in GINA to indicate that an 
individual's genetic information also includes information about the 
genetic tests of the individual's family members, as well as family 
medical history. GINA section 105 states that the term ``family 
member'' shall have the meaning given such term in section 2791 of the 
PHSA (42 U.S.C. 300gg-91), as amended by GINA section 102(a)(4), which 
defines ``family member'' to mean, with respect to any individual: (1) 
A dependent (as such term is used for purposes of section 2701(f)(2) of 
the PHSA, 42 U.S.C. 300gg(f)(2)) of such individual; or (2) any other 
individual who is a first-degree, second-degree, third-degree, or 
fourth-degree relative of such individual or of a dependent of the 
individual. Section 2701(f)(2) of the PHSA uses the term ``dependent'' 
to mean an individual who is eligible for coverage under the terms of a 
group health plan because of a relationship to the participant.
    The Department proposes to incorporate the statutory definition of 
``family member'' into Sec.  160.103 but also to clarify in the 
regulatory text that relatives by affinity (such as by marriage or 
adoption) are to be treated the same as relatives by consanguinity 
(that is, relatives who share a common biological ancestor) and that, 
in determining the degree of relationship, relatives by less than full 
consanguinity (such as half-siblings, who share only one parent) are 
treated the same as relatives by full consanguinity (such as siblings 
who share both parents). This is consistent with the legislative 
history of GINA, which suggests that the term ``family member'' is to 
be broadly construed to provide the maximum protection against 
discrimination. See House Report 110-28, Part 2 at 27. In addition, the 
Department proposes to include in the regulatory definition, non-
exhaustive lists of persons who are first-, second-, third-, or fourth-
degree relatives. Finally, the Department proposes in the definition of 
``family member'' to refer to the definition of ``dependent'' in the 
implementing regulations at 45 CFR 144.103 rather than to the PHSA 
directly. The Department invites public comment on this definition.
    We also note that the term ``family member'' is not currently 
defined in the Privacy Rule but is used in the Privacy Rule at Sec.  
164.510(b), which provides the standard for uses and disclosures of an 
individual's PHI to family members and other persons involved in the 
individual's care and for notification purposes. It is not expected 
that adding to the Privacy Rule the above broad definition of the term 
``family member'' would impact the scope of these existing provisions, 
particularly given the use in the provisions of the additional terms 
``other relative,'' ``close personal friend,'' ``other person 
identified by the individual,'' ``personal representative,'' and 
``other person responsible for the care of the individual,'' which 
would appear to capture any other person, as appropriate, who would not 
qualify as a ``family member'' by the new definition.
    In addition to the use of the term ``family member'' in the Privacy 
Rule, the term ``family'' is used in three other instances in the Rule: 
(1) In reference to the Family Educational Rights and Privacy Act in 
the definition of ``protected health information'' at Sec.  160.103; 
(2) in the definition and disclosure permission for psychotherapy notes 
(at Sec. Sec.  164.501 and 164.508(a)(2)(B), respectively) where such 
notes may be created based upon, and used to train within, a family 
counseling session; and (3) in the disclosure permission at Sec.  
164.512(k)(4) for medical suitability determinations by the Department 
of State for circumstances where family accompany a Foreign Service 
member abroad. It is also not expected that including a definition of 
``family member'' in the Privacy Rule would impact these provisions, as 
the scope of the term ``family'' in each occurrence is determined 
independently of the Privacy Rule.
    6. Manifestation or manifested. Although not separately defined by 
GINA, the terms ``manifestation'' or ``manifested'' are used in GINA in 
three important contexts. First, GINA uses the term ``manifestation'' 
to incorporate ``family medical history'' into the definition of 
``genetic information'' by stating that ``genetic information'' 
includes, with respect to an individual, the manifestation of a disease 
or disorder in family members of such individual. Second, GINA uses the 
term ``manifested'' to exclude from the definition of ``genetic test'' 
those tests that analyze a physical malady rather

[[Page 51702]]

than genetic makeup by excluding from the definition analyses of 
proteins or metabolites that are directly related to a manifested 
disease, disorder, or pathological condition. Third, GINA uses the term 
``manifestation'' to clarify that nothing in Title I of GINA should be 
construed to limit the ability of a health plan to adjust premiums or 
contribution amounts for a group health plan based on the manifestation 
of a disease or disorder of an individual enrolled in the plan. 
However, GINA provides that, in such case, the manifestation of a 
disease or disorder in one individual cannot also be used as genetic 
information about other group members and to further increase the 
premium for the plan. Similarly, for the individual health insurance 
market, GINA clarifies that a health plan is not prohibited from 
establishing rules for eligibility for an individual to enroll in 
coverage or from adjusting premium or contribution amounts for an 
individual based on the manifestation of a disease or disorder in that 
individual or in a family member of such individual where such family 
member is covered under the individual's policy. However, the 
manifestation of a disease or disorder in one individual cannot also be 
used as genetic information about other individuals and to further 
increase premiums or contribution amounts.
    As noted above, GINA does not define the terms ``manifestation'' 
and ``manifested.'' However, based on the exceptions to the statutory 
definition of ``genetic test,'' it is clear from the context of the 
statute that a manifested disease or disorder is one ``that could 
reasonably be detected by a health care professional with appropriate 
training and expertise in the field of medicine involved.'' Thus, given 
the importance of the term in the contexts described above, the 
Department proposes to include in Sec.  160.103 a definition of 
``manifestation or manifested'' to mean, with respect to a disease, 
disorder, or pathological condition, that an individual has been or 
could reasonably be diagnosed with the disease, disorder, or 
pathological condition by a health care professional with appropriate 
training and expertise in the field of medicine involved, and to 
further provide that a disease, disorder, or pathological condition is 
not manifested if the diagnosis is based principally on genetic 
information.
    Variants of genes associated with diseases have varying degrees of 
predictive power for later development of the disease. In some cases, 
an individual may have a genetic variant for a disease and yet never 
develop the disease. In other cases, the presence of a genetic variant 
means that the individual will eventually develop the disease. 
Huntington's disease is an example of the latter case. However, an 
individual may obtain a positive test that shows the genetic variant 
for Huntington's disease decades before any clinical symptoms appear. 
Under the above definition, the presence of a genetic variant alone 
does not constitute the diagnosis of a disease even in cases where it 
is certain that the individual possessing the genetic variant will 
eventually develop the disease, such as the case with Huntington's 
disease. For example, an individual may have a family member that has 
been diagnosed with Huntington's disease and also have a genetic test 
result that indicates the presence of the Huntington's disease gene 
variant in the individual. However, when the individual is examined by 
a neurologist (a physician with appropriate training and expertise for 
diagnosing Huntington's disease) because the individual has begun to 
suffer from occasional moodiness and disorientation (symptoms which are 
associated with Huntington's disease), and the results of the 
examination do not support a diagnosis of Huntington's disease, then 
Huntington's disease is not manifested with respect to the individual. 
In contrast, if the individual exhibits additional neurological and 
behavioral symptoms, and the results of the examination support a 
diagnosis of Huntington's disease by the neurologist, then Huntington's 
disease is manifested with respect to the individual.
    As another example, an individual has had several family members 
with colon cancer, one of whom underwent genetic testing which detected 
a mutation in the MSH2 gene associated with hereditary nonpolyposis 
colorectal cancer (HNPCC). On the recommendation of his physician (a 
health care professional with appropriate training and expertise in the 
field of medicine involved), the individual undergoes a targeted 
genetic test to look for the specific mutation found in the family 
member of the individual to determine if the individual himself is at 
increased risk for cancer. The genetic test shows that the individual 
also carries the mutation but the individual's colonoscopy indicates no 
signs of disease and the individual has no symptoms. Because the 
individual has no signs or symptoms of colorectal cancer that could be 
used by the individual's physician to diagnose the cancer, HNPCC is not 
a manifested disease with respect to the individual. In contrast, if 
the individual undergoes a colonoscopy or other medical tests that 
indicate the presence of HNPCC, and the individual's physician makes a 
diagnosis of HNPCC, HNPCC is a manifested disease with respect to the 
individual.
    If a health care professional with appropriate expertise makes a 
diagnosis based on the symptoms of the patient, and uses genetic tests 
to confirm the diagnosis, the disease will be considered manifested, 
despite the use of genetic information. For example, if a neurologist 
sees a patient with uncontrolled movements, a loss of intellectual 
faculties, and emotional disturbances, and the neurologist suspects the 
presence of Huntington's disease, the neurologist may confirm the 
diagnosis with a genetic test. While genetic information is used as 
part of the diagnosis, the genetic information is not the sole or 
principal basis for the diagnosis, and, therefore, the Huntington's 
disease would be considered a manifested disease of the patient.
    7. Health plan. The Department proposes to make technical 
corrections to update the definition of ``health plan'' by revising and 
renumbering the definition to: Include specific reference to the 
Voluntary Prescription Drug Benefit Program under Part D of title XVIII 
of the Social Security Act, 42 U.S.C. 1395w-101 through 1395w-152; 
remove the specific reference to the Civilian Health and Medical 
Program of the Uniformed Services (CHAMPUS) (as defined in 10 U.S.C. 
1072(4)), as this program is now part of the TRICARE health care 
program under title 10 of the United States Code, and revise the 
reference to the title 10 health care program accordingly to read more 
generally ``health care program for the uniformed services'' rather 
than ``health care program for active military personnel''; and reflect 
that Part C of title XVIII of the Social Security Act, 42 U.S.C. 1395w-
21 through 1395w-28, is now called the Medicare Advantage program.

Section 164.501--Definitions

    The Department proposes to modify Sec.  164.501 to add a definition 
of ``underwriting purposes'' and to make conforming changes to the 
definitions of ``payment'' and ``health care operations.''
    1. Underwriting Purposes. GINA section 105 provides that the term 
``underwriting purposes'' means, with respect to a group health plan, 
health insurance coverage, or Medicare supplemental policy: (A) Rules 
for, or determination of, eligibility (including enrollment and 
continued eligibility) for, or determination of, benefits under

[[Page 51703]]

the plan, coverage, or policy; (B) the computation of premium or 
contribution amounts under the plan, coverage, or policy; (C) the 
application of any pre-existing condition exclusion under the plan, 
coverage, or policy; and (D) other activities related to the creation, 
renewal, or replacement of a contract of health insurance or health 
benefits.
    The Department proposes to adopt the statutory definition, but also 
to include certain clarifications for consistency with the regulations 
promulgated pursuant to GINA sections 101 through 103. Specifically, we 
include a parenthetical to explain that the rules for, or determination 
of eligibility for, or determination of, benefits under the plan 
include changes in deductibles or other cost-sharing mechanisms in 
return for activities such as completing a health risk assessment or 
participating in a wellness program. Similarly, we include a 
parenthetical to make clear that the computation of premium or 
contribution amounts under the plan, coverage, or policy includes 
discounts, rebates, payments in kind, or other premium differential 
mechanisms in return for activities such as completing a health risk 
assessment or participating in a wellness program. Finally, we add a 
provision to the definition to clarify that ``underwriting purposes'' 
does not include determinations of medical appropriateness where an 
individual seeks a benefit under the plan, coverage, or policy. This 
provision is intended to be consistent with the provisions in the 
regulations promulgated pursuant to GINA sections 101 through 103 that 
provide that determinations of medical appropriateness, where the 
individual seeks a benefit under the plan, are not considered 
``underwriting purposes.''
    We also note that the specific types of activities included in the 
GINA definition of ``underwriting purposes'' proposed above fall within 
the definitions of ``health care operations'' and ``payment'' under the 
Privacy Rule, and that the current definition of ``health care 
operations'' also includes the term ``underwriting.'' Thus, to avoid 
confusion, the Department proposes conforming changes to the 
definitions of ``health care operations'' and ``payment,'' as discussed 
below.
    2. Health care operations. Paragraph (3) of the definition of 
``health care operations'' in the Privacy Rule at Sec.  164.501 
includes ``[u]nderwriting, premium rating, and other activities 
relating to the creation, renewal or replacement of a contract of 
health insurance or health benefits * * *.'' In order to avoid 
confusion with the use of both ``underwriting'' and ``underwriting 
purposes'' in the Privacy Rule, and in recognition of the fact that the 
proposed definition of ``underwriting purposes'' includes activities 
that fall within both the definitions of ``payment'' and ``health care 
operations'' in the Rule, the Department proposes to remove the term 
``underwriting'' from the definition of ``health care operations.'' At 
the same time, we propose to add the term ``enrollment'' to the express 
list of health care operations activities to make clear that the 
removal of the term ``underwriting'' would not impact the use or 
disclosure of PHI that is not genetic information for enrollment 
purposes. We note that these proposed revisions are not intended to 
constitute a substantive change to the definition of ``health care 
operations.'' All uses and disclosures of PHI currently permitted for 
any activities related to the creation, renewal, or replacement of a 
contract of health insurance or health benefits under the definition of 
``health care operations,'' including what would be considered 
``underwriting'' as the term is used in the existing Rule, still would 
be permitted under the revised definition, subject to the prohibition 
on using or disclosing PHI that is genetic information at proposed 
Sec.  164.502(a)(3). However, the Department requests public comment on 
whether the removal of the term ``underwriting'' from the definition of 
``health care operations'' could have unintended consequences.
    3. Payment. The definition of ``payment'' in the Privacy Rule at 
Sec.  164.501 includes activities, such as ``determinations of 
eligibility or coverage'' by a health plan, some of which may also fall 
within the proposed definition of ``underwriting purposes'' in the same 
section. Thus, to avoid any implication that a health plan is permitted 
to disclose PHI that is genetic information for ``payment'' purposes 
that are otherwise prohibited by Sec.  164.502(a)(3) (i.e., that are 
also underwriting purposes), the Department proposes to include a 
cross-reference in the definition of ``payment'' at Sec.  164.501 to 
the proposed prohibition at Sec.  164.502(a)(3) on health plans using 
and disclosing genetic information for underwriting purposes to exclude 
such activities from the ``payment'' definition.
    In addition, the inclusion of a cross-reference in the definition 
of ``payment'' to the new underwriting prohibition at Sec.  
164.502(a)(3) is necessary to properly align the definition of 
``payment'' in the Privacy Rule with the nondiscrimination provisions 
of GINA Title I, and their implementing regulations. GINA provides a 
rule of construction, in section 102(a)(2), which adds paragraph 
2702(c)(3) of the Public Health Service Act, to make clear that health 
plans are not prohibited from obtaining and using the results of a 
genetic test in making determinations regarding payment, as such term 
is defined by the HIPAA Privacy Rule. Thus, the proposed exception 
would make clear that GINA's rule of construction regarding payment 
does not allow a health plan to request the results of genetic tests 
for activities that would otherwise constitute ``underwriting 
purposes,'' such as for determinations of eligibility for benefits.

Section 164.502(a)--Uses and Disclosures of Protected Health 
Information: General Rules

    The proposed rule includes the new prohibition on health plans 
using or disclosing PHI that is genetic information for underwriting 
purposes at Sec.  164.502(a)(3), and makes clear that such provision 
would operate notwithstanding the other provisions in the Rule 
permitting uses and disclosures. We interpret section 105 of GINA as 
requiring us to prohibit a health plan's use or disclosure of genetic 
information for underwriting purposes, even if an individual has signed 
an authorization for such purposes pursuant to Sec.  164.508. We thus 
also propose a conforming change to Sec.  164.502(a)(1)(iv) to make 
clear that an authorization could not be used to permit a use or 
disclosure of genetic information for underwriting purposes. 
Additionally, we note that this prohibition applies to all genetic 
information from the compliance date of these modifications forward, 
regardless of when or where the genetic information originated.
    Consistent with the statute, however, this prohibition should not 
be construed to limit the ability of a health plan to adjust premiums 
or contribution amounts for a group health plan based on the 
manifestation of a disease or disorder of an individual enrolled in the 
plan, even though a health plan cannot use the manifestation of a 
disease or disorder in one individual as genetic information about 
other group members and to further increase the premium for the plan. 
Similarly, for the individual health insurance market, a health plan is 
not prohibited from establishing rules for eligibility for an 
individual to enroll in coverage or from adjusting premium or 
contribution amounts for an individual based on the manifestation of a 
disease or disorder in that individual or in a family member of such 
individual where such family member is covered under the individual's 
policy,

[[Page 51704]]

even though the health plan cannot use the manifestation of a disease 
or disorder in one individual as genetic information about other 
individuals to further increase premiums or contribution amounts for 
those other individuals.
    As an example to demonstrate the proposed prohibition, if a health 
insurance issuer, with respect to an employer-sponsored group health 
plan, uses an individual's family medical history or the results of 
genetic tests maintained in the group health plan's claims experience 
information to adjust the plan's premium rate for the upcoming year, 
the issuer would be using PHI that is genetic information for 
underwriting purposes in violation of proposed Sec.  164.502(a)(3). 
Similarly, if a group health plan uses family medical history provided 
by an individual incidental to the collection of other information on a 
health risk assessment to grant a premium reduction to the individual, 
the group health plan would be using genetic information for 
underwriting purposes in violation of Sec.  164.502(a)(3).
    Also, note that the prohibition is limited to health plans. A 
health care provider may use or disclose genetic information as it sees 
fit for treatment of an individual. If a covered entity, such as an 
HMO, acts as both a health plan and health care provider, the covered 
entity may use genetic information for purposes of treatment, to 
determine the medical appropriateness of a benefit, and as otherwise 
permitted by the Privacy Rule, but may not use such genetic information 
for underwriting purposes. Such covered entities, in particular, should 
ensure that appropriate staff members are trained on the permissible 
and impermissible uses of genetic information.

Section 164.504(f)(1)(ii)--Requirements for Group Health Plans

    Section 164.504(f)(1)(ii) permits a group health plan, or health 
insurance issuer or HMO with respect to the group health plan, to 
disclose summary health information to the plan sponsor if the plan 
sponsor requests the information for the purpose of obtaining premium 
bids from health plans for providing health insurance coverage under 
the group health plan, or for modifying, amending, or terminating the 
group health plan. As this provision permits activities that constitute 
``underwriting purposes,'' as defined by GINA and this proposed rule, 
we add a cross-reference to the proposed Sec.  164.502(a)(3) 
prohibition on the use or disclosure of genetic information for 
underwriting purposes, to make clear that Sec.  164.504(f)(1)(ii) would 
not allow a disclosure of PHI that is otherwise prohibited by Sec.  
164.502(a)(3).

Section 164.506--Uses and Disclosures to Carry Out Treatment, Payment, 
or Health Care Operations

    Section 164.506(a) of the Privacy Rule sets out the uses and 
disclosures a HIPAA covered entity is permitted to make to carry out 
treatment, payment, or health care operations. In light of the fact 
that the proposed definition of ``underwriting purposes'' encompasses 
activities that fall both within the definitions of ``payment'' and 
``health care operations'' under the Privacy Rule, the Department 
proposes to add a cross-reference in Sec.  164.506(a) to the new 
prohibition at proposed Sec.  164.502(a)(3) on health plans using and 
disclosing PHI that is genetic information for underwriting purposes. 
This cross-reference is intended to make clear that Sec.  164.506 of 
the Privacy Rule would not permit health plans to use or disclose an 
individual's PHI that is genetic information for underwriting, even 
though such a use or disclosure is considered payment or health care 
operations.

Section 164.514(g)--Uses and Disclosures for Activities Relating to the 
Creation, Renewal, or Replacement of a Contract of Health Insurance or 
Health Benefit

    Section 164.514(g) of the Privacy Rule prohibits a health plan that 
receives PHI for underwriting, premium rating, or other activities 
relating to the creation, renewal, or replacement of a contract for 
health insurance or health benefits, from using or disclosing such PHI 
for any other purpose (except as required by law) if the health 
insurance or health benefits are not placed with the health plan. The 
Department proposes conforming amendments to this provision to: (1) 
Remove the term ``underwriting'' to avoid confusion given the new 
definition of ``underwriting purposes'' in the proposed rule, which 
encompasses the activities described above; and (2) make clear that a 
health plan that receives PHI that is genetic information for the above 
purposes is not permitted to use or disclose such information, in 
accordance with proposed Sec.  164.502(a)(3). Note that the removal of 
the term ``underwriting'' from this provision is not intended as a 
substantive change to the scope of the provision.

Section 164.520--Notice of Privacy Practices for Protected Health 
Information

    Section 164.520 of the Privacy Rule sets out the requirements for 
most covered entities to have and distribute a Notice of Privacy 
Practices (NPP), which describes the uses and disclosures of PHI a 
covered entity is permitted to make, the covered entity's legal duties 
to protect PHI, and the individual's rights with respect to PHI. With 
respect to the description of permitted uses and disclosures, Sec.  
164.520(b)(1)(iii) requires a covered entity to include separate 
statements if the covered entity intends to use or disclose PHI for 
certain treatment, payment, or health care operations activities, such 
as fundraising. The purpose of these statements is to put individuals 
on notice of certain uses and disclosures a covered entity may make as 
part of treatment, payment, or health care operations that may not 
otherwise be apparent in the NPP since the Privacy Rule does not 
require the listing of every permitted use or disclosure that may fall 
within treatment, payment, or health care operations. In a similar 
manner, the Department believes that individuals have a right to be 
specifically informed of the fact that health plans that intend to use 
or disclose their PHI for underwriting nonetheless may not use or 
disclose their genetic information for such purposes. Thus, the 
Department proposes to require health plans that use or disclose PHI 
for underwriting to include a statement in their NPP making clear that 
they are prohibited from using or disclosing PHI that is genetic 
information about an individual for such purposes. Without such a 
specific statement, individuals would not be aware of this restriction 
and the general statements regarding permitted uses and disclosures for 
treatment, payment, and health care operations in the NPP of a health 
plan that performs underwriting would not be accurate (i.e., the NPP 
would state that the health plan may use or disclose PHI for purposes 
of payment and health care operations, which would not be true with 
respect to genetic information when the use or disclosure is for 
underwriting purposes).
    The proposed prohibition at Sec.  164.502(a)(3) and the proposed 
requirement to explicitly include a statement regarding the prohibition 
represent a material change to the NPP of health plans that perform 
underwriting, and the Privacy Rule requires at Sec.  
164.520(c)(1)(i)(C) that plans provide notice to individuals

[[Page 51705]]

covered by the plan within 60 days of any material revision to the NPP. 
The Department recognizes that revising and redistributing a NPP may be 
costly for health plans that perform underwriting and thus requests 
comment on ways to inform individuals of this change to privacy 
practices without unduly burdening health plans, particularly given 
there may be other material changes to the NPP due to the modifications 
to the Privacy Rule required by the provisions of the Health 
Information Technology for Economic and Clinical Health (HITECH) Act, 
enacted as part of the American Recovery and Reinvestment Act of 2009. 
In particular, the Department is considering a number of options in 
this area: (1) Replace the 60-day requirement with a requirement for 
health plans to revise their NPPs and redistribute them (or at least 
notify members of the material change to the NPP and how to obtain the 
revised NPP) in their next annual mailing to members after a material 
revision to the NPP, such as at the beginning of the plan year or 
during the open enrollment period; (2) provide a specified delay or 
extension of the 60-day timeframe for health plans that perform 
underwriting to implement and inform individuals of the underwriting 
prohibition; (3) retain the provision generally to require health plans 
to provide notice within 60 days of a material revision but provide 
that the Secretary will waive the 60-day timeframe in cases where the 
timing or substance of modifications to the Privacy Rule call for such 
a waiver; or (4) make no change and thus, require that health plans 
that perform underwriting provide notice to individuals within 60 days 
of the material change to the NPP that would be required by this 
proposed rule. The Department requests comment on these options, as 
well as any other options for informing individuals in a timely manner 
of this proposed or other material changes to the NPP.
    The Department also notes that the obligation to revise the NPP for 
the reasons described above would fall only on health plans that intend 
to use or disclose PHI for activities that constitute ``underwriting 
purposes'' as defined in this proposed rule at Sec.  164.501. Thus, 
health care providers, as well as health plans that do not perform 
underwriting, would not be required to revise their NPPs.

III. Impact Statement and Other Required Analyses

Executive Order 12866

    Executive Order 12866 (58 FR 51735, October 4, 1993) directs 
agencies to determine whether a regulatory action is ``significant'' 
and, therefore, subject to review by the Office of Management and 
Budget and the requirements of the Executive Order. Executive Order 
12866, in section 3(f), defines ``significant regulatory action'' as 
one that is likely to result in a rule that may:
    (1) Have an annual effect on the economy of $100 million or more or 
adversely affect in a material way the economy, a sector of the 
economy, productivity, competition, jobs, the environment, public 
health or safety, or state, local, or tribal government or communities;
    (2) Create a serious inconsistency or otherwise interfere with an 
action taken or planned by another agency;
    (3) Materially alter the budgetary impact of entitlements, grants, 
user fees, or loan programs or the rights and obligations of recipients 
thereof; or
    (4) Raise novel legal or policy issues arising out of legal 
mandates, the President's priorities, or the principles set forth in 
the Executive Order.
    Executive Order 12866 requires a full economic impact analysis only 
for ``economically significant'' rules under section 3(f)(1).
    The Department has determined that this proposed rule is a 
``significant regulatory action'' within the meaning of section 3(f)(4) 
of Executive Order 12866, because this action raises novel policy 
issues arising out of legal mandates. However, for the reasons 
discussed below, the Department has determined that the impact of this 
proposed regulation is not such that it would reach the economically-
significant threshold under section 3(f)(1) of the Executive Order. 
Therefore, a detailed cost-benefit assessment of the proposed rule is 
not required.
    The proposed rule would prohibit health plans that are HIPAA 
covered entities from using or disclosing an individual's PHI that is 
genetic information for underwriting purposes. Health plans that do not 
currently use or disclose PHI for underwriting purposes would not be 
affected at all by the proposed rule. Further, even with respect to 
health plans that perform underwriting, plans and issuers in the group 
market have commented to the Department that they do not currently use 
genetic information for underwriting purposes because pre-GINA laws and 
regulations prohibit them from discriminating against individuals based 
on any health status-related factors, including genetic information.\3\ 
With respect to issuers in the individual market, the Department 
acknowledges that there may be more significant policy changes 
associated with the proposed prohibition on using or disclosing PHI 
that is genetic information for underwriting purposes. However, the 
Department does not have sufficient information at this time to 
determine the extent of such changes, that is, to what extent issuers 
in the individual market use genetic information for underwriting 
purposes, and thus, requests comment in this area. In the case of 
either the individual or group market, however, the Department assumes, 
because a prohibited use or disclosure of genetic information for 
underwriting purposes is also a discriminatory use of such information 
under the nondiscrimination provisions of GINA Title I and its 
implementing regulations, that there would not be costs associated with 
conforming a plan's practices to comply with the prohibition proposed 
at Sec.  164.502(a)(3) that are above and beyond the costs associated 
with complying with the regulations implementing sections 101-103 of 
GINA. With respect to the health plans not covered by GINA but subject 
to the proposed prohibition in the Privacy Rule, the Department also 
assumes that the costs to comply will be minimal because such plans 
either: (1) Do not perform underwriting, as is the case generally with 
public benefit plans; or (2) perform underwriting but do not in most 
cases use genetic information (including family medical history) for 
such purposes. The Department requests comment on its assumptions.
---------------------------------------------------------------------------

    \3\ See e.g., Comments from BlueCross BlueShield Association, 
pg. 3 (https://www.dol.gov/ebsa/pdf/cmt-12190808.pdf) and Society for 
Human Resource Management, pg. 2 (https://www.dol.gov/ebsa/pdf/cmt-12190813.pdf) in response to Request for Information issued by HHS, 
the Department of Labor, and Treasury/IRS on October 10, 2008, at 73 
FR 70208.
---------------------------------------------------------------------------

    However, because these modifications would require a change to the 
privacy practices of health plans that perform underwriting, health 
plans that use or disclose PHI for underwriting purposes would be 
required to undertake a number of actions to comply with existing 
Privacy Rule requirements. First, these health plans would be required 
to change their policies and procedures as necessary to comply with the 
proposed changes to the Privacy Rule. See 45 CFR 164.530(i)(2). Second, 
health plans that use or disclose PHI for underwriting purposes would 
be required to train workforce members whose functions are affected by 
the

[[Page 51706]]

change to the health plan's policies and procedures, within a 
reasonable period of time after the material change becomes effective, 
and to document the training. See 45 CFR 164.530(b)(2)(i)(C) and (ii). 
Finally, the affected health plans would be required to revise their 
NPPs to reflect the change in the law and to provide notice of the 
revision to individuals covered by the plan within 60 days of the 
change. See 45 CFR 164.520(c)(1)(i)(C).
    The Department estimates that approximately 630 insurers are 
affected by GINA, consisting of approximately 460 insurers offering 
coverage in connection with insured group health plans and 
approximately 490 health insurance issuers offering policies in the 
individual health insurance market.\4\ These insurers would be required 
to revise their privacy policies and procedures and train affected 
workforce members with respect to the proposed prohibition on using or 
disclosing PHI that is genetic information for underwriting purposes. 
However, given that a prohibited use or disclosure of genetic 
information for underwriting purposes would also be a discriminatory 
use of such information under the nondiscrimination provisions of GINA 
Title I and its implementing regulations, the Department expects the 
costs associated with conforming a plan's HIPAA policies and procedures 
and to conduct training to be a small addition to the costs otherwise 
associated with updating policies and procedures and developing and 
conducting the training needed to comply with the regulations 
implementing sections 101-103 of GINA. Accordingly, the Department 
estimates that these plans would need to spend an additional one hour 
of a legal professional's time at an hourly labor rate of $116 \5\ to 
revise the plan's privacy policies and procedures and to ensure the 
HIPAA Privacy Rule's prohibition is appropriately incorporated into 
training materials. This results in an estimated cost of $73,000. With 
respect to the health plans not covered by GINA but subject to the 
proposed prohibition in the Privacy Rule, the Department does not have 
sufficient information at this time to determine how many of such plans 
perform underwriting and are not otherwise part of an issuer that 
already would be obligated to update policies and procedures and train 
staff on these new provisions. Thus, the Department requests comment in 
this area.
---------------------------------------------------------------------------

    \4\ Estimates are from 2007 NAIC financial statements data and 
the California Department of Managed Healthcare. Because most self-
insured plans hire third-party administrators--insurance companies 
in most cases--to administer and provide guidance regarding 
underwriting the plans, we assume that the impact on self-insured 
plans is addressed in this discussion about the impact of the rule 
on insurers. We request comment on this assumption.
    \5\ Based on the National Occupational Employment Survey (May 
2007, Bureau of Labor Statistics) and the Employment Cost Index June 
2008, Bureau of L