From BIPA to GIPA: Another Four-Letter Word in Illinois Class Action Litigation, Part 2

This week, Baker Sterchi is dedicating this blog to a discussion of the Genetic Information Privacy Act (‘GIPA”). In a five-part series of posts, we examine GIPA’s background, key provisions of the Act, the remedies available under GIPA, certain types of GIPA cases being filed, and considerations for companies regarding GIPA litigation.

Today, our focus is on GIPA’s key definitions and the Act’s confidentiality provisions:

Key Definitions

To understand GIPA’s requirements, it is imperative to understand GIPA’s definitions.  GIPA contains a definitions section, which expressly defines certain terms used in the Act and adopts definitions specified in federal regulations for other terms.  410 ILCS 513/10.  There are too many definitions to address in this post, but below are definitions for some of the bedrock terms used in GIPA.  In our discussion of GIPA lawsuits later this week, we will examine some other important definitions contained in GIPA. 

Under GIPA, “genetic information” has the same meaning as that term is used in HIPPA and defined by federal regulation.  HIPPA defines the term to include:  1) an individual’s genetic tests; 2) genetic tests of family members of an individual; and 3) the manifestation of a disease or disorder in family members of such individuals.  45 C.F.R. 160.103.  GIPA defines “genetic testing” and a “genetic test” to have the same meaning ascribed to “genetic test” under HIPPA, as specified by federal regulation.  The applicable federal regulation defines “genetic test” as an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes.  The regulation specifies that “genetic test” does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.  “Manifested” means, with respect to a disease, disorder, or pathological condition, that an individual has been or could reasonably be diagnosed with the disease, disorder, or pathological condition by a healthcare professional with appropriate training and expertise in the field of medicine involved.  45 C.F.R. 160.103.  GIPA defines the “family member” of an individual as:  1) the spouse of the individual; 2) a dependent child of the individual; 3) any other person qualifying as a covered dependent under a managed care plan; and 4) all other individuals related by blood or law to the individual, the spouse of the individual, or the dependent child of the individual. 

Confidentiality Provisions

GIPA contains multiple provisions governing the confidentiality of genetic information and genetic testing.  The confidentiality provisions are far-reaching.  They impact employers, insurers, civil and criminal litigants, governmental agencies, and health care providers, among others.  For example, Section 15(a) indicates that except as otherwise provided in the Act, genetic testing and information derived from genetic testing is confidential and privileged and may be released only to the individual tested and to persons specifically authorized in writing in accordance with Section 30 of GIPA. 

According to Section 30(a), no person may disclose or be compelled to disclose the identity of any person upon whom a genetic test is performed or the results of a genetic test in a manner that permits identification of the test subject, except to certain specified individuals, including:  1) the subject of the test or the subject’s legally authorized representative; 2) any person designated in a specific written legally effective authorization for release of the test results executed by the subject of the test or the subject’s legally authorized representative; 3) an authorized agent or employee of a health facility or health care provider if the health facility or health care provider itself is authorized to obtain the test results, the agent or employee provides patient care, and the agent or employee has a need to know the information in order to conduct the tests or provide care or treatment; 4) reasonable effort must be made to notify the parent or legal guardian of a minor under 18 years of age if the health care provider, professional, or facility who ordered the test believes notification would be in the best interest of the minor and the provider, professional, or facility first sought unsuccessfully to persuade the minor to notify the parent or legal guardian.  

GIPA also makes all information and records held by a State agency, local health authority, or health oversight agency pertaining to genetic information “strictly confidential” and exempt from copying and inspection under FOIA.  410 ILCS 513/30(b).  Subject to limited exceptions, including the written consent of all persons to whom the information pertains, the information and records shall not be released or made public.   

Pursuant to GIPA, no person to whom the results of a test have been disclosed may disclose the test results to another person except as authorized by the Act.  410 ILCS 513/35.  In other words, if you receive test results governed by GIPA, you should not assume that because disclosure was authorized in one instance that you are similarly authorized to disclose the results.  Rather, you must determine whether you qualify for one of the exceptions to GIPA’s confidentiality provisions before disclosing the results.

GIPA includes some limitations on its confidentiality requirements.  For example, insurers will be deemed in compliance with Section 30 if they make disclosures in accordance with Article XL of the Illinois Insurance Code.  410 ILCS 513/30(c).  Additionally, results of genetic testing that indicate the individual tested is at the time of the test afflicted with a disease, whether or not currently symptomatic, are not subject to the confidentiality requirements of GIPA.  410 ILCS 513/15(d). 

Conclusion

Tomorrow, we turn our focus to the rights and remedies provisions of GIPA.  Stay tuned, as these are the provisions allowing for the recent surge in GIPA class action filings.