# HIPAA 164.502(a)(5)(i) — Prohibited uses and disclosures - Use and disclosure of genetic information for underwriting purposes - Source: https://support.icompaas.com/support/solutions/articles/a_gen_hipaa_164502a5i_ad48fda028-hipaa-164502a5i-prohibited-uses-and-disclosures-use-and-disclosure-of-genetic-information- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [Privacy Rule](https://support.icompaas.com/support/solutions/folders/f_gen_62000039493_privacyrule) - Last updated: 2026-05-30 - Publisher: iCompaas, Inc. (https://www.icompaas.com) HIPAA · Control 164.502(a)(5)(i) · Priority: medium · Component: Privacy Rule ### What this control covers Use and disclosure of genetic information for underwriting purposes: Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan: (A) Except as provided in paragraph (a)(5)(i)(B) of this section: (1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and (4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits. (B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy. From 160.103 Definitions. Genetic information means: (1) Subject to paragraphs (2) and (3) of this definition, with respect to an individual, information about: (i) The individual's genetic tests; (ii) The genetic tests of family members of the individual; (iii) The manifestation of a disease or disorder in family members of such individual; or (iv) Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual. (2) Any reference in this subchapter to genetic information concerning an individual or family member of an individual shall include the genetic information of: (i) A fetus carried by the individual or family member who is a pregnant woman; and (ii) Any embryo legally held by an individual or family member utilizing an assisted reproductive technology. (3) Genetic information excludes information about the sex or age of any individual. (ii) Genetic services means: (1) A genetic test; (2) Genetic counseling (including obtaining, interpreting, or assessing genetic information); or (3) Genetic education. Genetic test means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition. ### Why it matters Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation. ### How to implement #### AWS Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says. #### Azure Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level. #### On-premises Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause. ### Evidence to collect - `policy_document` — A signed, version-controlled policy stating leadership intent and the named owner. Signed policy or standard documents the safeguard. Focus: Prohibited uses and disclosures - Use and disclosure of genetic information for underwriting purposes. ### Quick checklist - Information — Management / Enrollment - Other — Management / Enrollment - Policy — Management / Enrollment - Definitions: — Management / Enrollment - Uses — Management / Enrollment - Disclosures — Management / Enrollment ### Related articles on this site - [Ensure IAM password policy expires passwords within 90 days or less](https://support.icompaas.com/support/solutions/articles/62000080833-ensure-iam-password-policy-expires-passwords-within-90-days-or-less) - [Ensure ELB uses predefined security policy (ssl)](https://support.icompaas.com/support/solutions/articles/62000219192-ensure-elb-uses-predefined-security-policy-ssl-) - [NIST 800-171 3.1.1 Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).](https://support.icompaas.com/support/solutions/articles/62000229223-nist-800-171-3-1-1-limit-information-system-access-to-authorized-users-processes-acting-on-behalf-of) - [NIST 800-171 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.](https://support.icompaas.com/support/solutions/articles/62000229335-nist-800-171-3-13-2-employ-architectural-designs-software-development-techniques-and-systems-engine) ## Related compliance guidance - [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects. - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.