1635.8—Acquisition of genetic information.

(a) General prohibition. A covered entity may not request, require, or purchase genetic information of an individual or family member of the individual, except as specifically provided in paragraph (b) of this section. “Request” includes conducting an Internet search on an individual in a way that is likely to result in a covered entity obtaining genetic information; actively listening to third-party conversations or searching an individual's personal effects for the purpose of obtaining genetic information; and making requests for information about an individual's current health status in a way that is likely to result in a covered entity obtaining genetic information.

(b) Exceptions. The general prohibition against requesting, requiring, or purchasing genetic information does not apply:

(1) Where a covered entity inadvertently requests or requires genetic information of the individual or family member of the individual.

(i) Requests for Medical Information:

(A) If a covered entity acquires genetic information in response to a lawful request for medical information, the acquisition of genetic information will not generally be considered inadvertent unless the covered entity directs the individual and/or health care provider from whom it requested medical information (in writing, or verbally, where the covered entity does not typically make requests for medical information in writing) not to provide genetic information.

(B) If a covered entity uses language such as the following, any receipt of genetic information in response to the request for medical information will be deemed inadvertent: “The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. `Genetic information' as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services.”

(C) A covered entity's failure to give such a notice or to use this or similar language will not prevent it from establishing that a particular receipt of genetic information was inadvertent if its request for medical information was not “likely to result in a covered entity obtaining genetic information” (for example, where an overly broad response is received in response to a tailored request for medical information).

(D) Situations to which the requirements of subsection (b)(1)(i) apply include, but are not limited to the following:

(1) Where a covered entity requests documentation to support a request for reasonable accommodation under Federal, State, or local law, as long as the covered entity's request for such documentation is lawful. A request for documentation supporting a request for reasonable accommodation is lawful only when the disability and/or the need for accommodation is not obvious; the documentation is no more than is sufficient to establish that an individual has a disability and needs a reasonable accommodation; and the documentation relates only to the impairment that the individual claims to be a disability that requires reasonable accommodation;

(2) Where an employer requests medical information from an individual as required, authorized, or permitted by Federal, State, or local law, such as where an employee requests leave under the Family and Medical Leave Act (FMLA) to attend to the employee's own serious health condition or where an employee complies with the FMLA's employee return to work certification requirements; or

(3) Where a covered entity requests documentation to support a request for leave that is not governed by Federal, State, or local laws requiring leave, as long as the documentation required to support the request otherwise complies with the requirements of the Americans with Disabilities Act and other laws limiting a covered entity's access to medical information.

(ii) The exception for inadvertent acquisition of genetic information also applies in, but is not necessarily limited to, situations where—

(A) A manager, supervisor, union representative, or employment agency representative learns genetic information about an individual by overhearing a conversation between the individual and others;

(B) A manager, supervisor, union representative, or employment agency representative learns genetic information about an individual by receiving it from the individual or third-parties during a casual conversation, including in response to an ordinary expression of concern that is the subject of the conversation. For example, the exception applies when the covered entity, acting through a supervisor or other official, receives family medical history directly from an individual following a general health inquiry (e.g., “How are you?” or “Did they catch it early?” asked of an employee who was just diagnosed with cancer) or a question as to whether the individual has a manifested condition. Similarly, a casual question between colleagues, or between a supervisor and subordinate, concerning the general well-being of a parent or child would not violate GINA (e.g., “How's your son feeling today?”, “Did they catch it early?” asked of an employee whose family member was just diagnosed with cancer, or “Will your daughter be OK?”). However, this exception does not apply where an employer follows up a question concerning a family member's general health with questions that are probing in nature, such as whether other family members have the condition, or whether the individual has been tested for the condition, because the covered entity should know that these questions are likely to result in the acquisition of genetic information;

(C) A manager, supervisor, union representative, or employment agency representative learns genetic information from the individual or a third-party without having solicited or sought the information (e.g., where a manager or supervisor receives an unsolicited email about the health of an employee's family member from a co-worker); or

(D) A manager, supervisor, union representative, or employment agency representative inadvertently learns genetic information from a social media platform which he or she was given permission to access by the creator of the profile at issue (e.g., a supervisor and employee are connected on a social networking site and the employee provides family medical history on his page).

(2) Where a covered entity offers health or genetic services, including such services offered as part of a voluntary wellness program.

(i) This exception applies only where—

(A) The provision of genetic information by the individual is voluntary, meaning the covered entity neither requires the individual to provide genetic information nor penalizes those who choose not to provide it;

(B) The individual provides prior knowing, voluntary, and written authorization, which may include authorization in electronic format. This requirement is only met if the covered entity uses an authorization form that:

(1) Is written so that the individual from whom the genetic information is being obtained is reasonably likely to understand it;

(2) Describes the type of genetic information that will be obtained and the general purposes for which it will be used; and

(3) Describes the restrictions on disclosure of genetic information;

(C) Individually identifiable genetic information is provided only to the individual (or family member if the family member is receiving genetic services) and the licensed health care professionals or board certified genetic counselors involved in providing such services, and is not accessible to managers, supervisors, or others who make employment decisions, or to anyone else in the workplace; and

(D) Any individually identifiable genetic information provided under paragraph (b)(2) of this section is only available for purposes of such services and is not disclosed to the covered entity except in aggregate terms that do not disclose the identity of specific individuals (a covered entity will not violate the requirement that it receive information only in aggregate terms if it receives information that, for reasons outside the control of the provider or the covered entity (such as the small number of participants), makes the genetic information of a particular individual readily identifiable with no effort on the covered entity's part).

(ii) Consistent with the requirements of paragraph (b)(2)(i) of this section, a covered entity may not offer a financial inducement for individuals to provide genetic information, but may offer financial inducements for completion of health risk assessments that include questions about family medical history or other genetic information, provided the covered entity makes clear, in language reasonably likely to be understood by those completing the health risk assessment, that the inducement will be made available whether or not the participant answers questions regarding genetic information. For example:

(A) A covered entity offers $150 to employees who complete a health risk assessment with 100 questions, the last 20 of them concerning family medical history and other genetic information. The instructions for completing the health risk assessment make clear that the inducement will be provided to all employees who respond to the first 80 questions, whether or not the remaining 20 questions concerning family medical history and other genetic information are answered. This health risk assessment does not violate Title II of GINA.

(B) Same facts as the previous example, except that the instructions do not indicate which questions request genetic information; nor does the assessment otherwise make clear which questions must be answered in order to obtain the inducement. This health risk assessment violates Title II of GINA.

(iii) A covered entity may offer financial inducements to encourage individuals who have voluntarily provided genetic information (e.g., family medical history) that indicates that they are at increased risk of acquiring a health condition in the future to participate in disease management programs or other programs that promote healthy lifestyles, and/or to meet particular health goals as part of a health or genetic service. However, to comply with Title II of GINA, these programs must also be offered to individuals with current health conditions and/or to individuals whose lifestyle choices put them at increased risk of developing a condition. For example:

(A) Employees who voluntarily disclose a family medical history of diabetes, heart disease, or high blood pressure on a health risk assessment that meets the requirements of (b)(2)(ii) of this section and employees who have a current diagnosis of one or more of these conditions are offered $150 to participate in a wellness program designed to encourage weight loss and a healthy lifestyle. This does not violate Title II of GINA.

(B) The program in the previous example offers an additional inducement to individuals who achieve certain health outcomes. Participants may earn points toward “prizes” totaling $150 in a single year for lowering their blood pressure, glucose, and cholesterol levels, or for losing weight. This inducement would not violate Title II of GINA.

(iv) Nothing contained in § 1635.8(b)(2)(iii) limits the rights or protections of an individual under the Americans with Disabilities Act (ADA), as amended, or other applicable civil rights laws, or under the Health Insurance Portability and Accountability Act (HIPAA), as amended by GINA. For example, if an employer offers a financial inducement for participation in disease management programs or other programs that promote healthy lifestyles and/or require individuals to meet particular health goals, the employer must make reasonable accommodations to the extent required by the ADA, that is, the employer must make “modifications or adjustments that enable a covered entity's employee with a disability to enjoy equal benefits and privileges of employment as are enjoyed by its other similarly situated employees without disabilities” unless “such covered entity can demonstrate that the accommodation would impose an undue hardship on the operation of its business.” 29 CFR 1630.2(o)(1)(iii); 29 CFR 1630.9(a). In addition, if the employer's wellness program provides (directly, through reimbursement, or otherwise) medical care (including genetic counseling), the program may constitute a group health plan and must comply with the special requirements for wellness programs that condition rewards on an individual satisfying a standard related to a health factor, including the requirement to provide an individual with a “reasonable alternative (or waiver of the otherwise applicable standard)” under HIPAA, when “it is unreasonably difficult due to a medical condition to satisfy” or “medically inadvisable to attempt to satisfy” the otherwise applicable standard. See section 9802 of the Internal Revenue Code (26 U.S.C. 9802, 26 CFR 54.9802-1 and 54.9802-3T ), section 702 of the Employee Retirement Income Security Act of 1974 (ERISA) (29 U.S.C. 1182, 29 CFR 2590.702 and 2590.702-1 ), and section 2705 of the Public Health Service Act ( 45 CFR 146.121 and 146.122 ).

(3) Where the covered entity requests family medical history to comply with the certification provisions of the Family and Medical Leave Act of 1993 (29 U.S.C. 2601 et seq.) or State or local family and medical leave laws, or pursuant to a policy (even in the absence of requirements of Federal, State, or local leave laws) that permits the use of leave to care for a sick family member and that requires all employees to provide information about the health condition of the family member to substantiate the need for leave.

(4) Where the covered entity acquires genetic information from documents that are commercially and publicly available for review or purchase, including newspapers, magazines, periodicals, or books, or through electronic media, such as information communicated through television, movies, or the Internet, except that this exception does not apply—

(i) To medical databases, court records, or research databases available to scientists on a restricted basis;

(ii) To genetic information acquired through sources with limited access, such as social networking sites and other media sources which require permission to access from a specific individual or where access is conditioned on membership in a particular group, unless the covered entity can show that access is routinely granted to all who request it;

(iii) To genetic information obtained through commercially and publicly available sources if the covered entity sought access to those sources with the intent of obtaining genetic information; or

(iv) To genetic information obtained through media sources, whether or not commercially and publicly available, if the covered entity is likely to acquire genetic information by accessing those sources, such as Web sites and on-line discussion groups that focus on issues such as genetic testing of individuals and genetic discrimination.

(5) Where the covered entity acquires genetic information for use in the genetic monitoring of the biological effects of toxic substances in the workplace. In order for this exception to apply, the covered entity must provide written notice of the monitoring to the individual and the individual must be informed of the individual monitoring results. The covered entity may not retaliate or otherwise discriminate against an individual due to his or her refusal to participate in genetic monitoring that is not required by federal or state law. This exception further provides that such monitoring:

(i) Is either required by federal or state law or regulation, or is conducted only where the individual gives prior knowing, voluntary and written authorization. The requirement for individual authorization is only met if the covered entity uses an authorization form that:

(A) Is written so that the individual from whom the genetic information is being obtained is reasonably likely to understand the form;

(B) Describes the genetic information that will be obtained; and

(ii) Is conducted in compliance with any Federal genetic monitoring regulations, including any regulations that may be promulgated by the Secretary of Labor pursuant to the Occupational Safety and Health Act of 1970 (29 U.S.C. 651 et seq. ), the Federal Mine Safety and Health Act of 1977 (30 U.S.C. 801 et seq. ), or the Atomic Energy Act of 1954 (42 U.S.C. 2011 et seq. ); or State genetic monitoring regulations, in the case of a State that is implementing genetic monitoring regulations under the authority of the Occupational Safety and Health Act of 1970 (29 U.S.C. 651 et seq. ); and

(iii) Provides for reporting of the results of the monitoring to the covered entity, excluding any licensed health care professional or board certified genetic counselor involved in the genetic monitoring program, only in aggregate terms that do not disclose the identity of specific individuals.

(6) Where an employer conducts DNA analysis for law enforcement purposes as a forensic laboratory or for purposes of human remains identification and requests or requires genetic information of its employees, apprentices, or trainees, but only to the extent that the genetic information is used for analysis of DNA identification markers for quality control to detect sample contamination and is maintained and disclosed in a manner consistent with such use.

(c) Inquiries Made of Family Members Concerning a Manifested Disease, Disorder, or Pathological Condition. (1) A covered entity does not violate this section when it requests, requires, or purchases information about a manifested disease, disorder, or pathological condition of an employee, member, or apprenticeship program participant whose family member is an employee for the same employer, a member of the same labor organization, or a participant in the same apprenticeship program. For example, an employer will not violate this section by asking someone whose sister also works for the employer to take a post-offer medical examination that does not include requests for genetic information.

(2) A covered entity does not violate this section when it requests, requires, or purchases genetic information or information about the manifestation of a disease, disorder, or pathological condition of an individual's family member who is receiving health or genetic services on a voluntary basis. For example, an employer does not unlawfully acquire genetic information about an employee when it asks the employee's family member who is receiving health services from the employer if her diabetes is under control.

(d) Medical examinations related to employment. The prohibition on acquisition of genetic information, including family medical history, applies to medical examinations related to employment. A covered entity must tell health care providers not to collect genetic information, including family medical history, as part of a medical examination intended to determine the ability to perform a job, and must take additional reasonable measures within its control if it learns that genetic information is being requested or required. Such reasonable measures may depend on the facts and circumstances under which a request for genetic information was made, and may include no longer using the services of a health care professional who continues to request or require genetic information during medical examinations after being informed not to do so.

(e) A covered entity may not use genetic information obtained pursuant to subparagraphs (b) or (c) of this section to discriminate, as defined by §§ 1635.4, 1635.5, or 1635.6, and must keep such information confidential as required by § 1635.9.