Does GINA cover family medical history, not just DNA tests?

Yes. Under Title II of the Genetic Information Nondiscrimination Act, genetic information includes the manifestation of disease or disorder in an employee's family members — in other words, family medical history — as well as genetic tests of the employee and their family and participation in genetic services. This is the definition that surprises product teams, because a wellness questionnaire asking whether a parent had heart disease is collecting genetic information even though no genome is involved.

How does an AI coaching tool collect genetic information by accident?

By conversing. A scripted intake form can be audited line by line and stripped of family-history questions. A model that asks adaptive follow-ups will, given a user who mentions a relative's diagnosis, naturally probe further because that is clinically sensible and conversationally normal. It can also elicit the information unprompted when a user volunteers it. The collection is real even though no one designed the question.

Is an employer wellness program allowed to ask health questions at all?

The Americans with Disabilities Act generally restricts employer medical examinations and disability-related inquiries, with an exception for voluntary employee health programs. The scope of that exception, and particularly how large an incentive a program can offer before participation stops being voluntary, has been contested and the applicable regulatory position has shifted over time. The safe design assumption is that large financial incentives tied to answering health questions attract scrutiny, and that programs relying on the voluntariness exception need current advice.

Do we escape the rules if the data goes to a third-party vendor rather than the employer?

Not automatically. A vendor may act as the employer's agent, and information the employer can obtain — through reports, dashboards or small-population aggregates that are effectively identifying — is treated as available to the employer. Genuinely aggregated reporting with meaningful minimum cell sizes and contractual firewalls is the usual control. Marketing a dashboard that lets a manager see team-level risk in a group of six defeats it.

Is an inferred health risk score 'genetic information' or 'medical information'?

An inference is not a genetic test, but the analysis does not stop there. If the inference is drawn from family history it is derived from genetic information, and if it functions as a judgment about an employee's health condition it can amount to a disability-related inquiry or contribute to a regarded-as claim under the ADA. Several state privacy laws also define sensitive data to include inferences about health status, so the same score can be regulated on multiple tracks.

What is the single highest-value control for an AI wellness product?

A hard constraint at the model boundary that prevents soliciting family medical history, combined with a retention rule that discards it if a user volunteers it anyway, and logging that proves both. Policy language alone does not survive review because the conversational surface is the thing doing the collecting. The control has to live in the system prompt, the tool definitions and the storage layer, and it has to be demonstrable.

GINA, AI Wellness Programs and Inferred Health Data: The Family-History Problem in 2026

The Definition That Catches People

The Genetic Information Nondiscrimination Act is usually described as the law about DNA tests, and that description is what causes the problem. Its employment title prohibits employers from using genetic information in employment decisions and, separately and more broadly, from requesting, requiring or purchasing it at all. Genetic information is defined to include genetic tests of an individual and their family members, participation in genetic services, and the manifestation of a disease or disorder in family members.

That last clause is family medical history. It means the ordinary health-risk-assessment question — has anyone in your immediate family been diagnosed with diabetes, cancer, heart disease — is a request for genetic information within the meaning of the statute. Wellness vendors have known this for years, which is why compliant intake forms carve those questions out or gate them behind a specific, narrowly-drawn authorisation. The forms were solved. The conversation was not.

Why Conversational Products Break the Existing Control

The control that made questionnaires safe was enumerability. Someone reviewed every question, removed the family-history items, and the artefact stayed fixed until the next revision. An AI wellness coach, symptom triage assistant or benefits chatbot has no such artefact. Its questions are generated, they depend on what the user said, and clinically literate models will probe family history because that is what a competent health professional would do.

There is a second path that is even harder to prevent: volunteering. Users describe their circumstances in the course of asking for help, and those descriptions contain relatives' diagnoses constantly. The statute's prohibition on requesting is not triggered by a user offering information unbidden, and there is a longstanding recognition that inadvertent acquisition is treated differently — but what happens next matters. Storing it, indexing it, embedding it, feeding it into a risk model or surfacing it in a report is a set of deliberate decisions made after the accident.

The ADA Layer: Inquiries, Voluntariness and Incentives

GINA is only one of the statutes in play. The Americans with Disabilities Act restricts employer medical examinations and disability-related inquiries, subject to an exception for voluntary employee health programs. The contested part has always been what voluntary means when a financial incentive is attached, and the regulatory position on incentive limits has changed more than once, leaving employers to design against an unsettled standard.

For an AI product this matters in a specific way: adaptive systems make the inquiry deeper for some users than others. A person who mentions a symptom receives a longer, more medically specific line of questioning than a person who does not. If participation is incentivised, the effective price of the incentive differs by health status, which is precisely the dynamic the voluntariness requirement exists to police. Product teams rarely see this because it is invisible in any single transcript.

Inference: The Risk Score Nobody Asked a Question To Produce

Modern wellness platforms increasingly do not need to ask. Wearable data, claims data, search and content engagement, and conversational tone all feed models that output risk categories. The output can be functionally equivalent to a health status determination while every input was individually innocuous.

Three exposures follow. Where the inference is derived from family history it inherits the genetic-information character of its source. Where it functions as a judgment about an employee's health condition it can support a regarded-as-disabled theory under the ADA, which does not require the employee to actually have the impairment. And under a growing number of state privacy statutes, inferences about health status are sensitive data in their own right, requiring consent, minimisation and specific disclosure regardless of how they were produced.

The Vendor Firewall and How It Fails

The standard architecture puts a third-party vendor between the employee and the employer: individuals talk to the vendor, the employer receives only aggregate reporting. Done properly this is a real control. It fails in three predictable ways.

Cell size. Dashboards that segment by department, location or team routinely produce groups small enough that a single person's status is inferable. Minimum cell thresholds have to be enforced in the product, not promised in the contract.
Escalation paths. A duty-of-care feature that alerts someone when a user expresses acute distress is defensible and often necessary — but it is a channel from individual data to a human, and who that human is, and whether they are on the employer's side of the wall, is a design decision with legal weight.
Participation reporting. Incentive administration requires telling the employer who completed the program. Completion status is benign; completion status combined with a program whose branches are health-dependent is less so, particularly where a longer path is visible in the timestamp.

Controls That Actually Survive Review

Constrain the model at the boundary: explicit instructions and tool-level guards against soliciting family medical history, tested with adversarial transcripts rather than assumed from the prompt text.
Handle volunteered information deliberately — detect, decline to pursue, exclude from storage and from any downstream risk feature, and log that the exclusion happened.
Keep the wellness surface separate from anything used in employment decisions, including shared identifiers and shared embeddings. Vector stores are a quiet route around a database firewall.
Enforce minimum cell sizes in the reporting layer and refuse to render segments below them, rather than relying on customers to configure sensibly.
Document the incentive design and how the program remains voluntary in substance, since that is the question that gets asked first.
Reconcile marketing claims. "We never collect genetic information" is a strong sentence to have written if a transcript later shows otherwise.

Frequently Asked Questions

Does GINA apply to our small company?

The employment title applies to employers meeting a threshold headcount comparable to other federal employment discrimination statutes, and it also reaches employment agencies, labor organizations and training programs. Below that threshold, state genetic privacy laws frequently apply with lower or no thresholds, and several are broader than the federal statute. Small size changes which law applies rather than whether one does.

We are a wellness vendor, not an employer. Does this reach us?

Directly, GINA's employment title binds employers, but your product is the mechanism through which an employer would violate it, and the contract will place that risk on you through representations and indemnities. Beyond that, state privacy statutes, health data laws covering entities outside HIPAA, and consumer protection enforcement over deceptive privacy claims all apply to you in your own right. Vendors are rarely the defendant in the discrimination case and frequently the defendant in everything else.

Is this HIPAA-regulated data?

Sometimes, and the answer depends on the arrangement. A wellness program offered through a group health plan can be part of a covered entity, while a standalone employer-sponsored app frequently is not, which is why a class of health information sits outside HIPAA entirely. Several states have legislated specifically into that gap with consumer health data laws carrying consent requirements and, in at least one case, a private right of action.

Can we use wearable data if the employee consents?

Consent helps but does not resolve the analysis, because the ADA voluntariness question and GINA's request prohibition are not consent-waivable in the way general privacy law often is. It also raises a practical problem: consent obtained in an employment relationship is scrutinised for coercion, particularly where declining costs money. Design so that the non-participating employee is not materially worse off, and the consent argument becomes far more defensible.

What about family members enrolled in the same program?

This is the sharpest edge of the statute. Health information about a spouse or dependent enrolled in the same program is, with respect to the employee, information about the manifestation of disease in a family member — which is the definition of genetic information. Programs that extend to families need specific authorisations and careful separation, and it is the scenario most likely to be missed in a product built for individual users.

How would this ever come to light?

Through the usual routes: an employee who was denied something and requests their file, a charge filed with the enforcement agency, a data incident that exposes what was actually retained, or a plaintiff's-side review of your own marketing claims against your logs. Conversational products are unusually discoverable, because the transcript is the evidence and it is verbatim.

Check What Your Site Promises About Health Data

Wellness and HR-tech marketing pages make absolute claims — never collects, fully anonymous, HIPAA-compliant — that were written before the product became conversational.

See every privacy, health-data and compliance claim on your site in one pass. Run a free scan and check each against what the product actually does.

This article is general information and not legal advice. GINA, ADA and state health privacy requirements are fact-specific and the regulatory position on wellness incentives has changed over time. Confirm with qualified employment and privacy counsel before designing or launching a program.

Nobody Asked for Genetic Information. The Chatbot Did.