Understanding Illinois GIPA: Implications for Insurers and Employers
The Illinois Genetic Information Privacy Act (GIPA) is at the heart of numerous class action lawsuits, challenging the accessibility and use of genetic data. This legislation enforces statutory penalties ranging from $2,500 to $15,000 based on negligence or intent. High-profile defendants, often from insurance companies and genetic testing enterprises, face potential financial repercussions. To avert litigation, companies must identify vulnerabilities and adopt preventive measures.
Key Sections of GIPA and Their Impact
GIPA-related lawsuits frequently revolve around three critical sections of the Act. Section 15(a) restricts disclosure of genetic data to the person tested and their authorized representatives, often targeting genetic testing companies. For example, in Carter v. MyHeritage, Inc., plaintiffs claimed unauthorized data sharing, leading to a motion to compel arbitration. These cases highlight the importance of understanding regulatory compliance requirements.
Section 20(b) addresses insurers, prohibiting the use of genetic information for underwriting purposes. Though health insurers rarely face lawsuits under this provision, challenges have been raised against life insurers. Key rulings in Thompson v. Prudential Life Ins. Co. of Am. and Anderson v. American Life Ins. Company indicate that life insurers are usually exempt. The Illinois Appellate Court upheld this view in Reynolds v. State Farm Life Ins. Co., underscoring the nuances of regulatory compliance for providers and carriers.
Section 25(c)(1) prohibits employers from using genetic data as employment criteria. This section often involves third-party collection of applicants' medical information during physical exams. Cases such as Foster v. Service Sanitation, Inc. and Collins v. NTN Bearing Corp. of America have broadened the interpretation of soliciting genetic information, affecting both providers and employers.
Legal Precedents and Business Strategies
Numerous cases, including Million v. Hospital Sisters Health System, affirm that plaintiffs don't need to prove actual harm under GIPA. Conversely, Thompson v. Continental Tire The Americas, LLC, found that a mere breach might not suffice for Article III standing. This legal landscape necessitates robust risk management and regulatory compliance strategies.
To mitigate GIPA-related risks, firms must ensure written consent before collecting genetic data, validate the necessity of such information, and communicate applicants' privacy rights clearly. Educating personnel on legal aspects of genetic data collection and secure third-party agreements is crucial. With similar statutes in states like California and Texas, companies must remain vigilant, as GIPA liabilities can affect entities beyond Illinois.
For expert guidance on navigating GIPA and industry-specific regulations, professionals can consult legal experts at Weil, such as David R. Singh, Blake Steinberg, and Ian Smith, who specialize in complex commercial litigation and insurance-related legal services.