United States: EEOC Issues Final Regulations for Employers Under the Genetic Information Nondiscrimination Act

On Nov. 9, the Equal Employment Opportunity Commission (''EEOC'') issued its final regulations implementing the Genetic Information Nondiscrimination Act of 2008 (''GINA'').¹ These regulations underscore GINA's broad implications for employers, which reach far beyond genetic testing. They will become effective Jan. 10, 2011.

GINA was signed into law by President Bush in May 2008, and its employment protections took effect in November 2009. GINA restricts employers from seeking genetic information, prohibits employers from using genetic information in employment decisions, requires employers to keep genetic information confidential, and places strict limits on an employer's disclosure of genetic information.² Significantly, ''genetic information'' includes not only genetic test results, but also family medical history. The new regulations will affect many common employment practices, including preemployment medical examinations, voluntary wellness programs, and leaves of absence procedures and documentation.

1. What ''Genetic Information'' Is Protected by GINA?

The regulations define an employee's ''genetic information'' to include information from the employee's own genetic tests, the genetic tests of family members, genetic tests of a fetus or embryo carried by the employee or a family member, or even the fact that an employee or family member is seeking genetic services.³ However, genetic information does not include an employee's actual ''manifested'' disease or condition.⁴

Significantly, ''genetic information'' also includes the employee's family medical history: the ''manifestation of disease or disorder in family members.''⁵ Family medical history is not limited to information about conditions believed to be hereditary or genetic in nature, nor is it limited to information about blood relatives.⁶ As discussed below, GINA's restrictions on the collection of family medical history are likely to have the greatest impact on everyday employment practices.

2. GINA Prohibits Employers from Obtaining Genetic Information, With Few Exceptions

GINA generally prohibits employers from requesting or obtaining genetic information about an employee or job applicant. The Act creates six narrow exceptions to that rule:

• Inadvertent requests for genetic information;
• Health or genetic services offered through an employer's voluntary wellness program;
• Information provided when employees request family medical leave under federal or state law;
• Information acquired by an employer through sources that are ''publicly and commercially available'';
• Genetic monitoring of the biological effects of toxic substances in the workplace; and
• DNA analysis for law enforcement purposes.

The EEOC's regulations attempt to clarify the scope and application of these exceptions.

(a) Inadvertent Requests for Genetic Information

Congress intended this exception to address what it called the ''water cooler'' problem, in which an employer unwittingly receives family medical history through casual conversations with an employee or by overhearing conversations among co-workers. For example, a general question such as ''How are you?'' or ''How is your son feeling today?'' that elicits family medical history would not violate GINA.⁷ However, an employer who inadvertently obtains genetic information in this manner cannot ask follow-up questions that are likely to further elicit prohibited information.⁸

(i) Applicability to Electronic Communications and Social Media

The ''water cooler'' exception extends to electronic communications and to the virtual world. For example, the EEOC has indicated that an employer who receives an unsolicited e-mail about the health of an employee's family member has not violated GINA.⁹ Similarly, the EEOC explained that this exception may apply if an employee has granted a manager access to the employee's social media page (e.g., the manager ''friends'' the employee and the employee accepts) and the employee posts family medical history or other ''genetic information'' on that page.¹⁰

(ii) Limited Safe Harbor for Medical Exams or Inquiries

The final regulations limit an employer's ability to rely on the ''inadvertent request'' exception when seeking a medical examination or medical information, such as in connection with an employee's request for a leave of absence or reasonable accommodation for a disability. ¹¹ Specifically, an employer's receipt of genetic information in response to a lawful request for medical information generally will not be considered inadvertent—unless the employer had expressly directed the employee and/or his or her health care provider not to disclose genetic information in their response. In effect, the EEOC has created a narrower safe harbor, which applies only if the employer has provided affirmative notice. The EEOC has suggested the following notice language:

The EEOC has indicated that alternative language may be used, as long as it conveys the same information that genetic information should not be provided.

If the employer fails to provide such a notice, it may still establish that its receipt of the genetic information was inadvertent, if the request was not likely to elicit genetic information (e.g., where the employer has made a narrowly tailored request for information but receives an overly broad response that contains genetic information). ¹³ Yet the EEOC has described the notice as effectively ''mandatory'' in certain cases, based on the likelihood of genetic information being disclosed. For example, the EEOC commented that this type of ''warning is mandatory in all cases where a covered entity requests a health care professional to conduct an employment-related medical examination on the covered entity's behalf, since in that situation, the covered entity should know that the acquisition of genetic information (e.g., family medical history) would be likely in the absence of the warning.''¹⁴

In light of these regulations, employers will want to consider providing this type of notice when seeking medical examinations or medical information. The notice could be incorporated into the employer's written documentation or provided as a separate document.¹⁵

(b) Voluntary Wellness Programs

Employers may offer health and genetic services to employees if such services are provided through a voluntary wellness program.¹⁶ The EEOC solicited public comment on how the term ''voluntary'' should be defined, and the final regulations adopted the present definition under the ADA: a wellness program is ''voluntary'' only if it neither requires employees to participate nor penalizes employees who decline to do so.¹⁷

Employers seeking to provide genetic services through a wellness program must obtain prior knowing, voluntary and written authorization from employees to collect their genetic information, which requires:

• a written request in clear language that the employee is reasonably likely to understand;
• a description of the information being requested and the general purposes for which it will be used; and
• a description of the safeguards in place to protect against unlawful disclosure of the genetic information. ¹⁸

Even with such an authorization, individually identifiable genetic information may be provided only to the employee (or family member, if the family member is receiving the genetic services) and the licensed health care professionals or board certified genetic counselors involved in providing such services. Such information cannot be accessible to managers, supervisors, or others who make employment decisions, ''or to anyone else in the workplace.''¹⁹ The employer may receive genetic information from the wellness program only in aggregate terms that do not disclose the identity of specific individuals.²⁰

The final regulations clarify that employer wellness programs may offer financial incentives to participate in health or genetic services, provided that they make it clear that the incentive will be available regardless of whether the participant answers the questions regarding genetic information.²¹ The regulations include detailed examples, such as the following:

In contrast, if the employer failed to identify which questions request genetic information or otherwise to make clear which questions must be answered in order to receive the financial incentive, the regulations indicate that the assessment would violate GINA.²³ Employers offering voluntary wellness programs will want to review these new regulations carefully, even if they are collecting only family medical history rather than actual genetic results.

(c) Requests for Family Medical Leave Under Federal or State Law

An individual requesting leave under the Family and Medical Leave Act (''FMLA'') or similar state or local law to care for an ill relative may disclose family medical history when completing the required paperwork for the leave.²⁴ Under these limited circumstances, an employer would not violate GINA. This exemption also applies to employers who are not covered by the FMLA or its state or local equivalents, but who have policies permitting employees leave to care for ill family members, as long as all employees are required to document the family member's health condition.²⁵ Genetic information obtained as a result is subject to GINA's confidentiality requirements and must be kept separate from an employee's personnel file.²⁶

(d) Commercially and Publicly Available Information

As a general principle, GINA is not violated if an employer stumbles across genetic information in newspapers, magazines, periodicals, the internet, television, movies, or other ''commercially and publicly available'' sources.²⁷ For example, the EEOC explains that an employer would not violate GINA if it learned that an employee had the BRCA1 or BRCA2 gene associated with breast cancer by reading a newspaper article profiling several women living with the knowledge that they have the gene.²⁸

There are a few limitations to this exception, however. First, an employer's search of medical databases, court records or research databases carrying restricted access rights is not within the exception.²⁹ Second, personal websites and social networking sites with limited access generally are not included within the ''commercially and publicly available'' exception.³⁰ Third, the exception does not apply when an employer accesses commercially and publicly available information with the intent of obtaining genetic information.³¹ Finally, an employer's acquisition of genetic information from a media source (such as a commercial database containing individuals' health information) that is likely to yield such information falls outside this exception, even if the source is commercially and publicly available.³²

(e) Genetic Monitoring of Effect of Workplace Toxins

GINA permits employers to engage in the genetic monitoring of the biological effects of toxic substances in the workplace, as required by federal or state law, or where the individual gives prior knowing, voluntary and written authorization to the monitoring.³³ The employees' authorization must be written in clear, understandable language and explain the type of genetic information that will be obtained, the purposes for which it will be used, and the limitations on its disclosure. GINA requires that the individual receive results of the monitoring and that the employer receive information only in aggregate terms that do not disclose the identity of specific individuals.³⁴ Where monitoring is based on voluntary consent, individuals who refuse to participate should be warned of the potential dangers of not participating, and the employer may not retaliate against them.³⁵

(f) DNA Analysis for Law Enforcement Purposes

This limited exception permits employers that engage in DNA testing for law enforcement purposes as a forensic lab or for purposes of human remains identification to require genetic information of employees. However, employers may only request or require genetic information of lab employees to the extent that the information is used to detect sample contamination. The EEOC clarified that this exception should not permit employers to obtain health-related genetic information. ³⁶

3. GINA Prohibits Discrimination Based on Genetic Information

GINA expanded Title VII of the Civil Rights Act of 1964 (''Title VII'') by prohibiting employers from discriminating against employees or applicants on the basis of genetic information. GINA mirrors most of the protections of Title VII, but expressly provides that there is no disparate impact cause of action.³⁷ Consistent with the Title VII protocol, an aggrieved individual must follow the EEOC's administrative process in pursuing a claim.

Employers may be liable for unlawful discrimination under GINA if they consider an individual's genetic information in making employment-related decisions. For example, the EEOC explains that an employer could not reassign someone whom it learned had a family medical history of heart disease, based on its belief that the job would be too stressful and might eventually lead to heart-related problems for the employee.³⁸

GINA does not preempt other federal, state, or local laws that offer equal or greater protection to individuals. For example, GINA does not affect the many state laws that already limit or prohibit genetic testing by employers. Additionally, GINA does not limit individual rights under laws that prohibit disability discrimination and does not affect rights under state workers' compensation laws.³⁹

4. Employers Must Separate Genetic Information From Personnel Files

If an employer obtains genetic information, GINA requires the employer to keep such information separate from personnel files.⁴⁰ For instance, if an employee's FMLA leave request contains genetic information (such as information about a family member's diagnosed condition), it needs to be kept in a separate confidential medical file and not in the regular personnel file. However, GINA does allow employers to keep the genetic information in the same file as other medical information subject to the ADA.⁴¹ An employer is not required to remove genetic information placed in personnel files prior to GINA's effective date; however, the employer must not disclose such information to a third party.⁴²

5. GINA Strictly Limits Disclosure of Genetic Information

GINA only allows an employer to disclose genetic information in certain limited situations:

• to the individual to whom the genetic information relates;
• to an occupational health researcher;
• to comply with a court order;
• to government officials investigating GINA compliance;
• to comply with the requirements of the FMLA or similar state or local laws; and
• to federal, state, or local health officials in connection with a family member's ''contagious disease that presents an imminent hazard of death or life threatening illness.''⁴³

These strict limitations require employers complying with a court order to tailor their disclosure of genetic information carefully to the terms of the order. The EEOC has explained that an employer cannot disclose genetic information in response to an otherwise valid discovery order, subpoena, or court order that does not specify that genetic information must be disclosed:

The employer also must ensure the employee is aware of the court order, and inform the employee of any genetic information that was disclosed pursuant to the order.⁴⁵

Employers should also note the high standard for disclosing a family member's contagious disease to health officials. The standard requires the employer to assess whether the health risk rises to the level of an ''imminent hazard of death or life threatening illness,'' in order to defend itself against a potential claim under GINA. Again, the individual whose family member's information is disclosed must be notified of the disclosure. ⁴⁶

6. Complying With the EEOC's New Regulations Under GINA

As illustrated by the new GINA regulations, GINA affects much more than genetic testing of employees. Employers should review their practices for compliance with GINA per the final regulations.

First, employers should identify situations where they may currently request ''genetic information'' from applicants and employees, such as family medical history, and re-evaluate those practices in light of the new GINA regulations. The following areas require particular attention:

• Ensuring that any pre-employment medical screening does not inquire (or appear to inquire) about family medical history or other genetic information;
• Reviewing standard leaves of absence documentation (e.g., leave request forms, medical certifications) to avoid questions that may be impermissible under GINA;
• Considering use of GINA notice language, such as the EEOC's approved language set forth above, when requesting employment-related medical examinations or information; and
• Reevaluating any employee wellness programs in light of the limited exceptions and detailed requirements under these regulations.

Second, employers should educate their managers about the fact that genetic information is now a protected characteristic under Title VII. Just as managers cannot consider race or religion in making employment-related decisions, managers cannot consider genetic information either. This will require educating managers about the full scope of ''genetic information'' covered by GINA, including its application to family medical history. Employers also may want to consider updating their equal employment opportunity and non-discrimination policies to explain that discrimination based on genetic information is prohibited.

Third, employers should maintain all documents containing medical information or genetic information in separate medical files, with appropriate limitations on access and disclosure. Additionally, employers should seek legal advice prior to disclosing any genetic information in the litigation context, given the very narrow circumstances in which genetic information may be disclosed even in response to otherwise valid subpoenas or discovery demands.

In summary, the EEOC's new regulations demonstrate that GINA will have broad-reaching effects on all employers, not merely employers engaged in genetic testing. Employers will want to assess their current practices in order to achieve compliance by the Jan. 10, 2011 effective date of these regulations.

Footnotes

1 Regulations Under the Genetic Information Nondiscrimination Act of 2008, 75 Fed. Reg. 68,911 (Nov. 9, 2010) (to be codified at 29 C.F.R. pt. 1635). GINA includes two titles. Title I applies to health care providers and health plans, and addresses the use of genetic information in health insurance.

Title II applies to employers, and addresses the use of genetic information in the employment context. For a general overview of GINA, please refer to ''New Federal Law Regulates Collection and Use of Genetic Information by Employers and

Group Health Plans,'' available at http://www.mofo.com/news/updates/files/13919.html . The EEOC's regulations address Title II of GINA.

2 29 C.F.R. § 1635.1. Although this article refers to ''employers,'' employment agencies, labor organizations, and joint labor-management committees are also covered by Title II of GINA. 29 C.F.R. § 1635.2(b). Similarly, the EEOC defines ''employees'' to include applicants, current employees, and former employees. 29 C.F.R. § 1635.2(c).

3 A ''genetic test'' is an ''analysis of human DNA, RNA, chromosomes, proteins, or metabolites that detects genotypes, mutations, or chromosomal changes.'' 42 U.S.C. § 2000ff(7) (2008). Genetic tests are used to detect gene variants associated with a specific disease or condition. 29 C.F.R. § 1635.3(f).

For example, ''genetic tests'' include tests to determine whether an individual carries the BRCA1 or BRCA2 genetic variant associated with a predisposition to develop breast cancer. However, genetic tests also include DNA testing for nonmedical purposes, such as ancestry or paternity analysis. 75 Fed. Reg. 68912, 68916. The definition of ''genetic information'' excludes both information about an individual's or family member's age or gender, and information about their race or ethnicity, provided the latter is not derived from a genetic test. 29 C.F.R. § 1635.3(c)(2).

4 29 C.F.R. § 1635.3(g). Manifested diseases or conditions may be protected by various existing laws, such as the Americans with Disabilities Act and state laws prohibiting discrimination based on medical condition or disability.

5 29 C.F.R. § 1635.3(c)(iii).

6 75 Fed. Reg. at 68,915; 29 C.F.R. § 1635.3(a)(1).

7 29 C.F.R. § 1635.8(b)(1).

8 29 C.F.R. § 1635.8(b)(1)(ii)(B). For example, the employer should not ask whether other family members have the condition.

9 29 C.F.R. § 1635.8(b)(1)(ii)(C).

10 29 C.F.R. § 1635.8(b)(1)(ii)(D).

11 Naturally, employers should remain mindful that the ADA and state laws strictly limit an employer's ability to request medical examinations or medical information. Even in the limited circumstances in which such requests may be otherwise permitted, however, GINA still may penalize an employer for obtaining genetic information.

12 29 C.F.R. § 1635.8(b)(1)(i)(B).

13 29 C.F.R. § 1635.8(b)(1)(i)(C).

14 75 Fed. Reg. at 68,921.

15 Id. The notice also might be provided verbally, ''where the covered entity does not typically make requests for medical information in writing.'' 29 C.F.R. § 1635.8(b)(1)(i)(A).

16 29 C.F.R. § 1635.8(b)(2).

17 29 C.F.R. § 1635.8(b)(2)(ii)(A).

18 29 C.F.R. § 1635.8(b)(2)(ii)(B).

19 29 C.F.R. § 1635.8(b)(2)(i)(C).

20 29 C.F.R. § 1635.8(b)(2)(i)(C)-(D). The regulations were revised to provide that an employer who receives aggregated information does not violate GINA, if the small number of program participants makes an individual's information readily identifiable with no effort on the part of the employer.

21 75 Fed. Reg. at 68,923. For example, the employer may offer an incentive for employees to complete a health risk assessment that includes questions about family medical history, but the incentive must be available to employees whether or not they answer the questions related to genetic information.

22 29 C.F.R. § 1635.8(b)(2)(ii)(A).

23 29 C.F.R. § 1635.8(b)(2)(ii)(B).

24 29 C.F.R. § 1635.8(b)(3).

25 Id.

26 75 Fed. Reg. at 68,924.

27 42 U.S.C. § 2000ff-1(b)(4); 29 C.F.R. § 1635.8(b)(4).

28 75 Fed. Reg. at 68,924.

29 29 C.F.R. § 1635.8(b)(4)(i).

30 29 C.F.R. § 1635.8(b)(4)(ii). As described above, however, the inadvertent request exception may apply if the employee has granted a manager access to his social media page and posts the genetic information himself on that page.

31 29 C.F.R. § 1635.8(b)(4)(iii). For example, an employer cannot enter the name of an employee and a disease into a search engine and expect the information it acquires to fall within this exception.

32 29 C.F.R. § 1635.8(b)(4)(iv).

33 29 C.F.R. § 1635.8(b)(5); 75 Fed. Reg. at 68,925.

34 29 C.F.R. § 1635.8(b)(5)(iii).

35 29 C.F.R. § 1635.8(b)(5); 75 Fed. Reg. at 68,925-26.

36 29 C.F.R. § 1635.8(b)(6); 75 Fed. Reg. at 68,926.

37 29 C.F.R. § 1635.5(b).

38 75 Fed. Reg. at 68,918.

39 29 C.F.R. § 1635.11.

40 29 C.F.R. § 1635.9(a)(1).

41 29 C.F.R. § 1635.9(a)(2).

42 29 C.F.R. § 1635.9(a)(5).

43 29 C.F.R. § 1635.9(b)(1)-(6).

44 75 Fed. Reg. at 68,928.

45 29 C.F.R. § 1635.9(b)(3).

46 29 C.F.R. § 1635.9(b)(6).

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved