GINA Notice

GINA prohibits employers and group health plans from using genetic information in employment or coverage decisions, and requires a safe-harbor paragraph on every medical information request.

See the Step-by-Step ProcessView Safe-Harbor Language
What Include the GINA safe-harbor paragraph on any request for medical information (FMLA certifications, fitness-for-duty exams, ADA accommodation documentation) telling providers not to supply genetic information, including family medical history. If a wellness program could collect genetic information, provide required disclosures and avoid using that information for underwriting.
Who Title II (employment) applies to employers with 15 or more employees. Title I (health plan) applies to group health plans of any size. Both titles can apply to the same employer simultaneously.
When Every time you request medical information from an employee, applicant, or their health care provider. Before any wellness program collects health information that could include genetic data.
Risk Title II (employment) violations: EEOC enforcement can result in compensatory and punitive damages (capped at $50K to $300K based on employer size), injunctive relief, and back pay. Title I (health plan) violations: up to $100 per affected individual per day under IRC § 4980D (statutory rate, not inflation-adjusted). The safe-harbor paragraph is your primary protection on the employment side.
Request
Medical info request

Include the safe-harbor paragraph on or with every request (FMLA, ADA, fitness-for-duty).

Wellness
Before collection

Provide required disclosures and authorizations before a wellness program collects health information.

Yearly
Template audit

Spot-check forms and vendor packets to confirm the safe-harbor paragraph is present and current.

Trigger Due Date / Window Notes
Requesting medical information (FMLA, ADA, fitness-for-duty) Every time you send the request The safe-harbor paragraph must be included on or with the request, not added after the fact.
Wellness program collects health information Before collection begins Provide required disclosures and authorizations; confirm the program does not use family medical history or genetic test results for underwriting decisions.
Annual template audit (best practice) Once per year Spot-check all medical-info request forms, vendor packets, and wellness materials to confirm the safe-harbor paragraph is present and current.
Trigger: Requesting medical information
Window: Every time you send the request
Notes: The paragraph must be on or with the request, not added after.
Trigger: Wellness program collects health information
Window: Before collection begins
Notes: Provide disclosures/authorizations; no underwriting use of genetic info.
Trigger: Annual template audit (best practice)
Window: Once per year
Notes: Spot-check forms, vendor packets, and wellness materials.
  • Safe-harbor paragraph: See the Safe-Harbor Language section below, the EEOC's model text, ready to embed in your medical-info request templates.
  • Updated FMLA and ADA forms: Your standard certification and accommodation request forms with the safe-harbor text already embedded.
  • Wellness disclosures and authorization: If a wellness program could collect genetic information (including through a spouse health questionnaire), include the required EEOC notice and authorization before collection.
  • Written policy and training: A short HR policy stating that genetic information must not be solicited or stored in personnel files, and brief training for HR staff and any vendors who handle medical documentation.
1
Embed the safe-harbor paragraphAdd the GINA paragraph (from the Safe-Harbor Language section below) to every template that requests medical information: provider letters, FMLA certification forms, ADA accommodation requests, fitness-for-duty releases, post-offer medical exam instructions.
2
Audit wellness materialsReview any wellness program or health risk assessment vendor materials. Remove family medical history questions unless the program is structured with proper EEOC-compliant disclosures and authorizations, and confirm genetic information is not used in any underwriting or eligibility decisions.
3
Train HR and document the policyGive HR a one-pager explaining what counts as genetic information (the definition is broader than most people expect; family medical history is included) and how to store received medical documents separately from personnel files.
4
Audit annuallyOnce a year, spot-check your forms and any vendor-supplied packets to confirm the safe-harbor paragraph is still present and that no new forms have been introduced without it.
  • Method: Include the paragraph directly on the request form or letter, paper or electronic. It must accompany the request, not be provided separately after the fact.
  • Scope: Address the instruction to both the health care provider and the employee: you are telling them not to provide genetic information in the response.
  • Privacy: Any medical information received must be stored securely and separately from personnel files, accessible only to those with a legitimate need.
  • Request templatesCopies of your current medical-information request templates showing the embedded GINA safe-harbor paragraph, with a version date.
  • Wellness disclosuresDisclosure and authorization versions used each plan year, including any vendor attestations that the program does not use genetic information for underwriting.
  • Training recordsFor HR staff and any third-party vendors who handle medical documentation requests.
  • Self-audit checklistAnnual checklist confirming all forms were reviewed and the safe-harbor paragraph is present.

Common traps

Forgetting that family medical history is genetic information: Asking an employee "does anyone in your family have heart disease?" on a health questionnaire is a GINA violation without the proper safe-harbor or authorization.
Using a vendor's form without the safe-harbor paragraph: A vendor's FMLA or ADA form template that doesn't include the GINA safe-harbor paragraph is still your responsibility to review before use.
Storing medical records in the personnel file: Records (including any that inadvertently contain genetic information) belong in a separate, restricted medical file, not the employee's general personnel file.

FAQs

Do we have to hand out a GINA notice every year?
No. GINA does not require a periodic standalone notice. Your obligation is to include the safe-harbor paragraph on medical-information requests and to follow the appropriate disclosure and authorization rules if a wellness program could collect genetic information.

What counts as "genetic information"?
Genetic test results, family medical history, the fact that a person or family member sought or received genetic services or participated in genetic research, and genetic information of a fetus or embryo. Family medical history is the most common source of inadvertent collection; it shows up in standard health questionnaires more often than employers realize.

Where exactly does the paragraph go?
On every letter or form that requests medical information from a health care provider or employee: FMLA certifications, ADA accommodation requests, fitness-for-duty release forms, post-offer medical exam instructions, and any other HR-initiated request for health information. See the Safe-Harbor Language section below for the exact text.

  • Vendor forms: Ask carriers, TPAs, and wellness vendors to confirm in writing where GINA safe-harbor language appears in their templates. You are responsible for the forms used, even when a vendor prepares them.
  • Recruiting and post-offer exams: Ensure no family history questions appear on medical questionnaires used in hiring, including post-offer physical exams administered by a third-party occupational health provider.
  • Wellness programs with spouse questionnaires: If a spouse's health information is collected as part of a wellness program, GINA Title II imposes specific authorization and incentive-limit rules. Confirm current EEOC guidance with your carrier or benefits counsel; this area has seen regulatory changes.
  • State laws: Several states have genetic privacy laws that go beyond GINA, including broader definitions of genetic information or lower employer-size thresholds. Check the rules for every state where you have employees.

Copy this paragraph and embed it in every form or letter that requests medical information. It's the primary safeguard that makes any inadvertent receipt of genetic information non-violating under GINA.

GINA Safe-Harbor Paragraph (from 29 CFR § 1635.8):

The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. "Genetic information" as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services.

What to customize: Nothing. Use this text verbatim. It is the EEOC's regulatory safe-harbor language from 29 CFR § 1635.8(b)(1)(i)(B). Do not shorten or paraphrase it.

Where to embed it: FMLA certification request letters, ADA accommodation request forms, fitness-for-duty release instructions, post-offer medical exam instructions, and any other HR communication requesting health information from a provider or employee.

29 CFR § 1635.8 (eCFR): the governing regulation; the safe-harbor language appears at § 1635.8(b)(1)(i)(B).