(b) Exceptions. The general prohibition against requesting, requiring, or purchasing genetic information does not apply:
(B) If a covered entity uses language such as the following, any receipt of genetic information in response to the request for medical information will be deemed inadvertent: “The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. ‘Genetic information' as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services.”
(C) A covered entity's failure to give such a notice or to use this or similar language will not prevent it from establishing that a particular receipt of genetic information was inadvertent if its request for medical information was not “likely to result in a covered entity obtaining genetic information” (for example, where an overly broad response is received in response to a tailored request for medical information).
(D) Situations to which the requirements of subsection (b)(1)(i) apply include, but are not limited to the following:
(2) Where an employer requests medical information from an individual as required, authorized, or permitted by Federal, State, or local law, such as where an employee requests leave under the Family and Medical Leave Act (FMLA) to attend to the employee's own serious health condition or where an employee complies with the FMLA's employee return to work certification requirements; or
(3) Where a covered entity requests documentation to support a request for leave that is not governed by Federal, State, or local laws requiring leave, as long as the documentation required to support the request otherwise complies with the requirements of the Americans with Disabilities Act and other laws limiting a covered entity's access to medical information.
(B) A manager, supervisor, union representative, or employment agency representative learns genetic information about an individual by receiving it from the individual or third-parties during a casual conversation, including in response to an ordinary expression of concern that is the subject of the conversation. For example, the exception applies when the covered entity, acting through a supervisor or other official, receives family medical history directly from an individual following a general health inquiry (e.g., “How are you?” or “Did they catch it early?” asked of an employee who was just diagnosed with cancer) or a question as to whether the individual has a manifested condition. Similarly, a casual question between colleagues, or between a supervisor and subordinate, concerning the general well-being of a parent or child would not violate GINA (e.g., “How's your son feeling today?”, “Did they catch it early?” asked of an employee whose family member was just diagnosed with cancer, or “Will your daughter be OK?”). However, this exception does not apply where an employer follows up a question concerning a family member's general health with questions that are probing in nature, such as whether other family members have the condition, or whether the individual has been tested for the condition, because the covered entity should know that these questions are likely to result in the acquisition of genetic information;
(C) A manager, supervisor, union representative, or employment agency representative learns genetic information from the individual or a third-party without having solicited or sought the information (e.g., where a manager or supervisor receives an unsolicited email about the health of an employee's family member from a co-worker); or
(D) A manager, supervisor, union representative, or employment agency representative inadvertently learns genetic information from a social media platform which he or she was given permission to access by the creator of the profile at issue (e.g., a supervisor and employee are connected on a social networking site and the employee provides family medical history on his page).
(B) The provision of genetic information by the individual is voluntary, meaning the covered entity neither requires the individual to provide genetic information nor penalizes those who choose not to provide it;
(C) The individual provides prior knowing, voluntary, and written authorization, which may include authorization in electronic format. This requirement is only met if the covered entity uses an authorization form that:
(2) Describes the type of genetic information that will be obtained and the general purposes for which it will be used; and
(3) Describes the restrictions on disclosure of genetic information;
(E) Any individually identifiable genetic information provided under paragraph (b)(2) of this section is only available for purposes of such services and is not disclosed to the covered entity except in aggregate terms that do not disclose the identity of specific individuals (a covered entity will not violate the requirement that it receive information only in aggregate terms if it receives information that, for reasons outside the control of the provider or the covered entity (such as the small number of participants), makes the genetic information of a particular individual readily identifiable with no effort on the covered entity's part).
(B) Same facts as the previous example, except that the instructions do not indicate which questions request genetic information; nor does the assessment otherwise make clear which questions must be answered in order to obtain the inducement. This health risk assessment violates Title II of GINA.
(iv) A covered entity may not, however, condition participation in an employer-sponsored wellness program or provide any inducement to an employee, or the spouse or other covered dependent of the employee, in exchange for an agreement permitting the sale, exchange, sharing, transfer, or other disclosure of genetic information, including information about the manifestation of disease or disorder of an employee's family member (except to the extent permitted by paragraph (b)(2)(i)(D)) of this section, or otherwise waiving the protections of §1635.9.
(v) A covered entity may not deny access to health insurance or any package of health insurance benefits to an employee, or the spouse or other covered dependent of the employee, or retaliate against an employee, due to a spouse's refusal to provide information about his or her manifestation of disease or disorder to an employer-sponsored wellness program.
(vi) A covered entity may offer financial inducements to encourage individuals who have voluntarily provided genetic information (e.g., family medical history) that indicates that they are at increased risk of acquiring a health condition in the future to participate in disease management programs or other programs that promote healthy lifestyles, and/or to meet particular health goals as part of a health or genetic service. However, to comply with Title II of GINA, these programs must also be offered to individuals with current health conditions and/or to individuals whose lifestyle choices put them at increased risk of developing a condition. For example:
(B) The program in the previous example offers an additional inducement to individuals who achieve certain health outcomes. Participants may earn points toward “prizes” totaling $150 in a single year for lowering their blood pressure, glucose, and cholesterol levels, or for losing weight. This inducement would not violate Title II of GINA.
(4) Where the covered entity acquires genetic information from documents that are commercially and publicly available for review or purchase, including newspapers, magazines, periodicals, or books, or through electronic media, such as information communicated through television, movies, or the Internet, except that this exception does not apply —
(ii) To genetic information acquired through sources with limited access, such as social networking sites and other media sources which require permission to access from a specific individual or where access is conditioned on membership in a particular group, unless the covered entity can show that access is routinely granted to all who request it;
(iii) To genetic information obtained through commercially and publicly available sources if the covered entity sought access to those sources with the intent of obtaining genetic information; or
(iv) To genetic information obtained through media sources, whether or not commercially and publicly available, if the covered entity is likely to acquire genetic information by accessing those sources, such as Web sites and on-line discussion groups that focus on issues such as genetic testing of individuals and genetic discrimination.
(B) Describes the genetic information that will be obtained; and
(C) Describes the restrictions on disclosure of genetic information;
(iii) Provides for reporting of the results of the monitoring to the covered entity, excluding any licensed health care professional or board certified genetic counselor involved in the genetic monitoring program, only in aggregate terms that do not disclose the identity of specific individuals.
(2) A covered entity does not violate this section when it requests, requires, or purchases genetic information or information about the manifestation of a disease, disorder, or pathological condition of an individual's family member who is receiving health or genetic services on a voluntary basis, as long as the requirements of paragraph (b)(2) of this section, including those concerning authorization and inducements, are met. For example, an employer does not unlawfully acquire genetic information about an employee when it asks the employee's family member who is receiving health services from the employer if her diabetes is under control. Nor does an employer unlawfully acquire genetic information about an employee when it seeks information—through a medical questionnaire, a medical examination, or both—about the manifestation of disease, disorder, or pathological condition of the employee's family member who is completing a health risk assessment on a voluntary basis in connection with the family member's receipt of health or genetic services (including health or genetic services provided as part of an employer-sponsored wellness program) offered by the employer in compliance with paragraph (b)(2) of this section.
(e) A covered entity may not use genetic information obtained pursuant to subparagraphs (b) or (c) of this section to discriminate, as defined by §§1635.4, 1635.5, or 1635.6, and must keep such information confidential as required by §1635.9.
