How private is genetic information?

Are there any laws or policies that protect personal genetic information from being released to health insurance companies in the Cayman Islands? I’ve been talking to a friend who is wary of being tested for the BRCA gene mutations that cause increased risk of certain cancers. Their doctor does not know whether if someone signs up for a new health insurance policy, they will be obliged to declare a genetic mutation like that as a “pre-existing condition”, even though they have absolutely no cancer symptoms or diagnosis at the time.

I know there is legislation in the US that safeguards personal genetic information being accessed by health insurers, but in the Cayman Islands there is nothing about this on the Health Insurance Commission website and it doesn’t seem to be specifically addressed in the soon-to-come Data Protection Law (DPL).

---

Auntie’s answer: What an interesting question since the DPL will come into effect in September 2019. There are a lot of facets to this issue so I have reached out to three different entities to cover as wide a swath as possible. I must say up front, though, that I was not able to get you a definitive answer but I hope the information I did find will be helpful. The upshot is it appears the Legislative Assembly needs to look into this to tighten up the legislation.

But anyway, I will start with the Health Insurance Commission (HIC). An official with the commission pointed to the laws and regulations currently in place governing pre-existing conditions. Section 7(9) of the Health Insurance Regulations (2017 Revision) and Sections 5(15A) and 15A of the Health Insurance Law (2018 Revision) are the relevant parts as they provide “the guidance for how pre-existing must be applied”, the official explained, adding that, according to the definition of pre-existing condition, there must be a “medical condition for which treatment was given or recommended or drugs taken or prescribed or of which symptoms were or had been manifest during the period of 12 months prior to date of the health insurance contract”.

However, he said, “We are currently reviewing the potential implications of genetic information/testing and it may necessitate an amendment to the legislation.”

At the moment, there is no legal requirement for someone applying for health insurance to declare the results of a genetic test that indicate a predisposition for a certain disease or condition. But that could change. The HIC official noted that once genetic testing and its associated benefits are fully recognised by healthcare regulatory bodies, healthcare providers and health insurance companies, “it may be necessary to ensure that the general public is not disadvantaged in any way”.

How that may manifest itself is not yet clear, since various stakeholders will have to weigh in and any changes approved by the Ministry of Health, the official added. Unfortunately, I cannot say how long it will take for the these reviews to be completed.

I also brought the question to the Office of the Ombudsman as it looks at issues surrounding information rights. An official there was able to discuss how the upcoming DPL will pertain to your question.

“Genetic information is specifically listed as one form of what is called ‘sensitive personal data’ in the Data Protection Law,” the official explained. “This means that there are some extra requirements before that type of data can be processed legally.” The full definition of sensitive personal data is contained in Section 3.

Importantly, for processing of sensitive personal data to be legal, it has to meet one condition in Schedule 2 of the law, and one condition in Schedule 3, the official said, adding, “It appears to me that in all likelihood the processing of genetic personal data under the circumstances described in the question would not meet any of the legal conditions listed in those schedules. Therefore, the processing would not be allowed under the DPL.”

However, the protections and obligations mentioned will not be in place until the law is in force in September 2019.

Lastly, I asked the Human Rights Commission for guidance and was helped by an official with the Commissions Secretariat, who said, “The question your reader asks raises important issues. Medical and genetic information is confidential and protected by the Data Protection Law and common law. However, contracts can be drafted in such a way as to require or allow disclosure to an insurer. Most typically, a health insurance provider can ask an applicant for insurance to disclose information of the sort referenced in the question.”

The official also pointed out that if the applicant were asked the specific question, he or she would be required to answer it truthfully. “Failure to do so may invalidate the insurance contract and, in certain circumstances, could constitute a criminal offence. Similarly, an insured person may be under an ongoing duty to disclose relevant information to an insurer.”

Noting, as mentioned in your question, that the US has legislation governing this issue, the official also pointed to the UK, which has a code of practice agreed to between the insurance companies and the government. You can read the code here.

The official then cautioned, “As far as we are aware there is no such legislation or policy in effect in Cayman. This is a cause for concern because, as your reader notes, individuals may be discouraged from obtaining potentially valuable diagnostic testing because of concerns that knowing the results may compromise their ability to obtain insurance. The government and relevant regulatory bodies should address this issue as a matter of priority.”

Data protection information from the Office of the Ombudsman

The laws mentioned above can be found on the CNS Library

Recent answers from Auntie

Tags: Data Protection Law, Health Insurance Commission, Human Rights Commission, Office of the Ombudsman, Personal genetic information

Category: Ask Auntie, Health Insurance Questions, Medical Questions