Background:

The World Privacy Forum filed comments on proposed regulations for implementing Title I of GINA, the Genetic Non-Discrimination Act. The WPF requested a change to the proposed regulations, asking the Department of Health and Human Services require immediate posting of revised notices of privacy practices on the web sites of affected health plans. Under the proposed regulations, written notice of revised privacy practices to individuals could be delayed due to the cost of postal mailing. The WPF noted that a revised privacy notice posted on a health plan’s web site would not incur postal costs, and that regulated entities should take this minimum step to inform consumers of any changes regarding privacy practices affecting genetic non-discrimination.

• Download the comments (PDF)

• or Read comments below

—–

Comments of the World Privacy Forum to the U.S. Department of Health and Human Services Regarding Genetic Information Nondiscrimination Act of 2008, GINA NPRM (RIN 0991–AB54

Via Federal eRulemaking Portal

December 4, 2009

Re: Comments of the World Privacy Forum regarding GINA NPRM (RIN 0991–AB54

The World Privacy Forum appreciates the opportunity to comment on the Department’s proposed modifications to the HIPAA privacy rule that seek to implement section 105 of Title I of the Genetic Information Nondiscrimination Act of 2008 (GINA) regarding the privacy and confidentiality of genetic information, and to make other changes. The proposed rule appeared in 74 Federal Register 51698 (October 7, 2009).

The World Privacy Forum is a non-profit, non-partisan public interest research group that focuses on analysis and research of privacy issues, including issues relating to health care privacy. More information on our work, including our past comments on GINA regulations and HIPAA, may be found at https://www.worldprivacyforum.org.

I. Comment on Section 164.520—Notice of Privacy Practices for Protected Health Information

Our comments are limited to the effect of the proposed changes on the Notice of Privacy Practices (NPP) already required under the HIPAA privacy rule. The World Privacy Forum believes that the NPP is an important feature of the fair information practices that the HIPAA privacy rule implements.

The NPP not only informs individuals of their rights, but it also informs the personnel of a covered entity of the basic rules that apply to protected health information. The NPP is not the only way to instruct the personnel of a covered entity, but it remains valuable for that purpose. Not every individual or covered entity employee is likely to study an NPP religiously, but the availability of the NPP for review when an individual or employee has a need is essential.

At the same time, the World Privacy Forum recognizes the costs involved with changing an NPP and with distributing the changes to individuals. The Department’s willingness to take these costs into account is well-founded in this case. While the changes resulting from GINA are important, they are also limited. Most individuals – and even most personnel of health plans – are not likely to have much knowledge about or involvement with the changes that affect underwriting. We believe it is likely that plan personnel involved in underwriting will be informed on the new limitation. Still, the Department may want to emphasize the need for training appropriate personnel in the GINA provisions.

Under the narrow circumstances of the GINA changes, the World Privacy Forum believes that if there is a delay in revising the NPP, the negative consequences are likely to be minor. We suggest that the Department require each affected health plan to prepare promptly a revised NPP (or perhaps just a temporary supplement highlighting the change) and to post that notice on its website as soon as the revision is completed. Actual notice to individuals can be postponed until the next annual mailing to members as provided under the existing rule. The Department could assist by preparing language that plans could post on their websites to highlight the change. Integration of the change in the standard NPP could then occur with the annual mailing.

While we believe that a delay of notice is acceptable in this case, we observe that delays may not always be appropriate. If Congress or the Department creates new provisions or changes existing provisions that directly modify important individual privacy rights affecting common behavior or providing new options for individuals pertaining to use and disclosure of PHI, rights of access or amendment, or accountability for compliance, we will not support any significant delay in notifying individuals of those new or changed provisions. The underwriting change does not meet our test for an important right affecting common behavior or providing new options for individuals.

II. Conclusion

We urge the Department to require each affected health plan to promptly prepare a revised NPP and post that notice on its website upon completion of the revised NPP. This will not have a deleterious fiscal impact, and it will at the same time provide individuals with the ability to find the revised NPP information in the interim between the next annual mailing.

Respectfully submitted,

Pam Dixon
Executive Director,
World Privacy Forum