GIPA Private Right of Action
Like BIPA, GIPA remained dormant for many years, but recently has seen a growing number of cases filed, in large part due to the significant damages available to prevailing plaintiffs. GIPA specifically provides for a private right of action and sets forth the categories of damages and other recoveries available:
Sec. 40. Right of action.
(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court against an offending party. A prevailing party may recover for each violation:
(1) Against any party who negligently violates a provision of this Act, liquidated damages of $2,500 or actual damages, whichever is greater.
(2) Against any party who intentionally or recklessly violates a provision of this Act, liquidated damages of $15,000 or actual damages, whichever is greater.
(3) Reasonable attorney's fees and costs, including expert witness fees and other litigation expenses.
(4) Such other relief, including an injunction, as the State or federal court may deem appropriate.
(b) Article XL of the Illinois Insurance Code shall provide the exclusive remedy for violations of Section 30 by insurers.
(c) Notwithstanding any provisions of the law to the contrary, any person alleging a violation of subsection (a) of Section 15, subsection (b) of Section 25, Section 30, Section 31, or Section 35 of this Act shall have a right of action in a State circuit court or as a supplemental claim in a federal district court to seek a preliminary injunction preventing the release or disclosure of genetic testing or genetic information pending the final resolution of any action under this Act.[13]
Suits filed under GIPA
In the last year or so, suits have been filed against a number of companies, including Amazon, Ford Motor Company, and ancestry.com. In a 2021 case, Bridges v. Blackstone Inc., plaintiffs sued Blackstone, which had purchased Ancestry.com. The plaintiffs had provided DNA to Ancestry before the purchase by Blackstone and alleged that as a result of the transaction, Blackstone had compelled disclosure in violation of GIPA. The 7th Circuit affirmed the district court’s finding that the plaintiffs failed to state a claim, holding that “we cannot plausibly infer that a run-of-the-mill corporate acquisition, without more alleged about that transaction, results in a compulsory disclosure within the meaning of Section 30.”[14] The district court did adopt the broad reading of “aggrieved person” that has applied in BIPA, and the 7th Circuit did not upset that part of the district court’s decision.
Emerging Suits against Life Insurers
Recently, a number of putative class actions have been filed against life insurers doing business in Illinois. Pacific Life Insurance, AIG, State Farm and others have been the targets.[15] The suits allege that GIPA prohibits life insurers from collecting family medical histories from applicants for life insurance to underwrite the policies. Specifically, the suits have language such as the insurer “required plaintiff to disclose his private family medical history as part of their life insurance policy application process.” It is too early to determine whether these suits against life insurers will be successful. If the plaintiffs have any success, this would potentially change the process for applying for some forms of life insurance in the State of Illinois.
The language of GIPA may be instructive for now.[16]
Section 20 Language and Insurers
Section 20 does not directly address the use of genetic information in life insurance.[17] However, it does have an extensive section addressing the use of such information in the health insurance context. Section 20 provides (emphasis added):
Sec. 20. Use of genetic testing information for insurance purposes.
(a) An insurer may not seek information derived from genetic testing for use in connection with a policy of accident and health insurance. Except as provided in subsection (c), an insurer that receives information derived from genetic testing, regardless of the source of that information, may not use the information for a nontherapeutic purpose as it relates to a policy of accident and health insurance.
(b) An insurer shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of this Section, "underwriting purposes" means, with respect to an insurer:
(1) rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program);
(2) the computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities, such as completing a health risk assessment or participating in a wellness program);
(3) the application of any pre-existing condition exclusion under the plan, coverage, or policy; and
(4) other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.
"Underwriting purposes" does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.
This subsection (b) does not apply to insurers that are issuing a long-term care policy, excluding a nursing home fixed indemnity plan.
(c) An insurer may consider the results of genetic testing in connection with a policy of accident and health insurance if the individual voluntarily submits the results and the results are favorable to the individual.
(d) An insurer that possesses information derived from genetic testing may not release the information to a third party, except as specified in this Act.
(e) A company providing direct-to-consumer commercial genetic testing is prohibited from sharing any genetic test information or other personally identifiable information about a consumer with any health or life insurance company without written consent from the consumer.[18]
The wording in this section clearly prohibits the usage of genetic information in certain circumstances only when it comes to “a policy of accident and health insurance.”[19]
Other Language in GIPA and adoption of HIPAA definitions
In addition to the language of HIPAA used for the definition of genetic information and the specific language contained in Section 20, GIPA relies on several other definitions in HIPAA that may be instructive. The references to HIPAA definitions includes the definition of “covered entity,”[20] as well as “protected health information.” The definition under HIPPA of protected health information is (emphasis added):
Protected health information means individually identifiable health information:
(1) Except as provided in paragraph (2) of this definition, that is:
(i) Transmitted by electronic media;
(ii) Maintained in electronic media; or
(iii) Transmitted or maintained in any other form or medium.[21]
HIPAA defines individually identifiable health information as (emphasis added):
Individually identifiable health information is information that is a subset of health information, including demographic information collected from an individual, and:
(1) Is created or received by a health care provider, health plan, employer, or health care clearinghouse; and
(2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and
(i) That identifies the individual; or
(ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.[22]
The Illinois Administrative Code references to GIPA
In addition to the various definitions and references covered, another instructive reference is the Illinois Administrative Code. In Title 50, which relates to insurance and that the Illinois Department of Insurance promulgates, there are two references to GIPA. The first is Section 2008, Minimum Standards for Individual and Group Medicare Supplement Insurance.[23] Section 107 of 2008 prohibits the use of genetic information for such insurance.[24]
The second reference is in Section 2001, Construction and Filing of Accident and Health Insurance Policy Forms.[25] Section 9 of 2001 addresses group rates based on genetic information and prohibits discrimination against participants and beneficiaries based on health status, including the usage of genetic information.[26]
Illinois Department of Insurance Checklist for ACA Small Group HMO/POS
Finally, the Illinois Department of Insurance has a checklist for HMOs and point of service companies. It provides as part of the checklist:
An insurer may not seek information derived from genetic testing for use in connection with a policy of accident and health insurance. An insurer that receives information derived from genetic testing, regardless of the source of that information, may not use the information for a nontherapeutic purpose as it relates to a policy of accident and health insurance. An insurer shall not use or disclose protected health information that is genetic information for underwriting purposes.[27]
Conclusion
Suits under GIPA have not reached the frequency of those filed and litigated under BIPA or PIPA. However, in recent times, there have been a growing number of GIPA suits filed, especially against life insurers selling policies in Illinois. Insurers will need to consider how to address these increasing class action lawsuits and how to defend under GIPA. The “information privacy act” form of IPAs continues to brew strongly in Illinois, particularly in Chicago and the collar counties.