This post is part of our series on key aspects of the final HITECH omnibus rule issued by the U.S. Department of Health and Human Services (HHS) on January 17, 2013 (available here), and scheduled to be published in the Federal Register on January 25. Previous posts are available here. The regulations are effective March 26, 2013, but covered entities and business associates have until September 23, 2013, to comply with most new requirements.
In addition to finalizing the HIPAA regulations under HITECH, the omnibus rule finalized modifications to the HIPAA Privacy rule required by the Genetic Information Non-Discrimination Act (GINA). GINA prohibits discrimination in employment and health insurance coverage based on a person’s genetic information. Specifically, GINA prohibits health plans from using the genetic information of an individual, for example that he or she is predisposed to develop a certain genetic disorder or carries a specific genetic mutation, for underwriting purposes.
GINA directed HHS to make modifications to the HIPAA Privacy Rule. In October 2009, HHS promulgated proposed rules to:
- Clarify that genetic information is health information for purposes of PHI;
- Prohibit health plans from using or disclosing PHI containing genetic information for underwriting purposes;
- Revise the provisions related to the Notice of Privacy Practices for health plans that perform underwriting; and
- Make technical corrections to update the definition of “health plan.”
The structure of the final rules issued by HHS track these proposed rules, while making some modifications to the details of the individual proposals. We discuss each of the major aspects of the proposed rule below.Continue Reading HITECH Update #2: HHS Finalizes Privacy Rules to Protect Genetic Information