A recent slate of class action lawsuits seeks to expand the scope of the Illinois Genetic Information Privacy Act’s (GIPA) prohibition against considering family medical history to life insurance companies. See e.g. Reynolds v. State Farm Life Ins. Co., No. 2023 L 465 (Cir. Ct. Kane Co., Oct. 31, 2023). Although GIPA, 410 ILCS § 513/1 et seq., was passed in 1998 and has been amended a number of times, the plaintiff’s bar has only recently seized upon the statutory penalties provided for in the private right of action. At least 30 class action lawsuits have been filed in 2023. Plaintiffs have turned their sights on the life insurance industry in the last three weeks with class action complaints. Fortunately, plaintiffs’ new theory is not supported by the plain language of the Act.

GIPA restricts the use of genetic information

Section 20 of GIPA addresses the use of genetic testing information for insurance purposes.

• Section 20(a) prohibits an insurer from seeking information derived from genetic testing for use in connection with a policy of accident and health insurance.
• Section 20(b) prohibits insurers from using or disclosing protected health information that is genetic information for underwriting purposes. Underwriting purposes includes:

(1) rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);

(2) the computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities, such as completing a health risk assessment or participating in a wellness program);

(3) the application of any pre-existing condition exclusion under the plan, coverage, or policy; and

(4) other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.

• Section 20(c) allows an insurer to consider the results of genetic testing in connection with a policy of accident and health insurance if the individual voluntarily submits the results and the results are favorable to the individual.
• Section 20(d) prohibits an insurer from releasing information derived from genetic testing to a third party, except as specified in the Act.
• Section 20(e) prohibits companies that provide direct-to-consumer commercial genetic testing from sharing any genetic test information or other personally identifiable information about a consumer with any health or life insurance company without written consent from the consumer.

GIPA adopts the definition of “protected health information,” and “genetic information” from HIPAA regulations. 410 ILCS § 513/10 adopting 45 C.F.R. § 160.103.

GIPA creates a private right of action for “any person aggrieved by a violation” of the Act. 410 ILCS § 513/40(a). A prevailing party may recover for each violation up to $2,500 or actual damages for negligent violations and up to $15,000 or actual damages for intentional or reckless violations. GIPA also allows for the recovering of attorney’s fees and costs, including expert witness fees.

Class action litigation against life insurers based on family medical history questions

The spate of recent filings follows in the wake of an August 3, 2023, decision certifying a class against Sequencing, LLC for disclosing customers’ genetic information to unknown third-party developers in alleged violation of Sections 30(a)(2) and 35 of GIPA without first obtaining those customers’ consent. Melvin v. Sequencing, LLC, 344 F.R.D. 231, 233 (N.D. Ill. 2023). In the recently filed class action lawsuits against the life insurance companies, however, the plaintiffs are instead challenging life insurance application questions asking consumers to disclose their family medical history (the Complaints).

The Complaints argue that Section 20(b) applies to all insurers and prohibits them from using “protected health information that is genetic information.” “Genetic information” is defined in the HIPAA regulations to include both information about actual genetic tests, and “the manifestation of a disease or disorder in family members of an individual.” 45 C.F.R. § 160.103. The definition excludes information about the age or sex of an individual. Id. The Complaints allege that the life insurers used the family medical history questions to underwrite risks, determine eligibility, and set premiums in violation of Section 20(b).

The Complaints do not specify any genetic information sought in the exams. Instead, they rely exclusively on the term “manifestation of a disease or disorder in family members,” construing it broadly to encompass any illness, including questions regarding family histories of high blood pressure, cancer, diabetes, and heart disease. Courts interpreting this phrase under GIPA’s federal counterpart – the Genetic Information Non-Discrimination Act of 2008, 42 U.S.C.A. § 2000ff, et seq. – have limited the scope of the term to medical conditions that have a genetic predisposition or a genetic basis, excluding such issues as Covid-19, ADHD, suicide, anxiety and depression. See, e.g., Anderson v. Honeywell Int'l, 2023 WL 6892023, at *2 (D. Minn. Sept. 11, 2023); Baum v. Dunmire Prop. Mgmt., Inc., 2022 WL 889097, at *7 (D. Colo. Mar. 25, 2022); Tedesco v. Pearson Educ., Inc., 2021 WL 2291148, at *6 (E.D. La. June 4, 2021); Milner-Koonce v. Albany City Sch. Dist., 2022 WL 7351196, at *4 (N.D.N.Y. Oct. 13, 2022) (collecting authorities). Under federal law, these courts have stated that family disease history is only considered genetic information if it is used to determine the likelihood of disease in another individual, and is not considered genetic information if it is taken into account only with respect to the individual in whom such disease or disorder occurs and not as genetic information with respect to any other individual.

The Complaints’ attempt to apply Section 20(b) to the insurance suffers from a tragic flaw. The analysis of the defined term “protected health information” in GIPA in the class action complaints stops two steps short in describing the type of information that is being protected.

Section 20(b) only applies to accident and health insurance

Although it takes a few steps tracking back the various definitions, under the plain language of the Act, Section 20(b) does not apply to life insurers. Section 20(b) is limited to health insurers and health plans. Section 20(b) provides in relevant part:

(b) An insurer shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of this Section, “underwriting purposes” means, with respect to an insurer:

***

(2) the computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities, such as completing a health risk assessment or participating in a wellness program). The definition of “underwriting purposes” specifically excludes “determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage or policy.” 

410 ILCS § 513/20(b) (emphasis added). While the Complaints stops their analysis here, tracing the defined term “protected health information” shows that information collected by life insurers is not covered. GIPA adopts the definition of “protected health information” from the HIPAA regulations:

Protected health information means individually identifiable health information:

(1) Except as provided in paragraph (2) of this definition, that is:

(i) Transmitted by electronic media;
(ii) Maintained in electronic media; or
(iii) Transmitted or maintained in any other form or medium.

45 C.F.R. § 160.103 (emphasis added). “Individually identifiable health information” is defined as:

 information that is a subset of health information, including demographic information collected from an individual, and:

(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse.

45 C.F.R. § 160.103 (emphasis added). Life insurance simply is not covered.

Limiting “protected health information” in the insurance context to information obtained by health plans is consistent with how the Illinois Department of Insurance has been treating genetic information. The only sections of the Illinois Administrative Code addressing GIPA are in the sections applicable to accident and health insurance. See 50 Ill. Admin Code § 2008.107 (medical supplement); § 2001.9 (group health plans).

Life insurance companies should continue to watch changes to GIPA. The General Assembly has been expanding the scope of GIPA since its passage. In 2019, Section 20(e) was revised to prohibit direct-to-consumer commercial genetic testing companies from sharing genetic test information to include life insurance companies. The General Assembly is currently considering expanding Section 20(a) to add life insurance to accident and health insurance companies prohibited from seeking information derived from genetic testing. However, until the General Assembly changes the definition chain to add life insurance to the definition of “protected health information,” class actions like the recent Complaints should be dismissed.