Genetic Information Nondiscrimination Act of 2008

Question 1

Sector

Answer 1

Medical

Question 2

Year Passed/Amended

Answer 2

2008

Question 3

Original Purpose

Answer 3

Prevent discrimination on the basis of genetic predispositions in insurance and employment, in the absence of manifest symptoms

Question 4

Primary requirements

Answer 4

Prohibits health plans, employers, unions and training programs from discriminating on the basis of genetic information, except where the individual has manifest symptoms of a disorder

Question 5

Entities subject to the law

Answer 5

Health insurance providers; employers, unions and training programs

Question 6

Term for relevant PII or regulated data

Answer 6

Genetic information; revises HIPAA to include genetic information in PHI (so all of HIPAA’s regulations on covered entities apply to genetic information)

Question 7

Definition of relevant PII or regulated data

Answer 7

Genetic information…

Question 8

Civil or criminal penalties?

Answer 8

Civil only

Question 9

Enforcing authority - Civil

Answer 9

Various: it modifies several statutes. Mostly HHS

Question 10

Penalties - Civil

Answer 10

$100 per day of noncompliance. In some cases, minimum of $15,000

Question 11

Private Right of Action?

Answer 11

No, though there may be one under similar state laws

Question 12

Preemption?

Answer 12

No

Question 13

FIP individual rights provided

Answer 13

Consent (no notice or access added, though most amended statutes separately provide for those)

Question 14

Consent requirements

Answer 14

Does not change amended statutes’ requirements, except that it provides for an opt-in research exception

Question 15

FIP controls provided

Answer 15

Information security (no information quality)

Question 16

Information security controls

Answer 16

Where employers or unions have a legitimate reason for possessing such information, they must keep it in separate forms in separate files, which must be treated as confidential employee records

Question 17

FIP information lifecycle requirements covered

Answer 17

Use and retention (no collection/disposal, disclosure)

Question 18

Use and retention requirements

Answer 18

May not use genetic information, in the absence of a manifest symptom, to discriminate.

Question 19

FIP management requirements covered

Answer 19

None (no administration, no monitoring and enforcement)