Most HR teams know FCRA. A lot of them know Ban the Box too, at least the basics. Almost none of them have heard of GINA, and that gap causes real problems.
GINA is short for the Genetic Information Nondiscrimination Act of 2008. The part that matters for hiring is Title II. It says employers with 15 or more employees can't request, require, or buy genetic information about an applicant or employee. Not "shouldn't." Can't.
Here's the piece that trips people up. Under FCRA, if you disclose what you're checking and get signed consent, the check is lawful. GINA doesn't work that way. An applicant can sign a form agreeing to answer questions about their family's health history, and the question is still illegal. Their signature doesn't fix it.
So let's go through what actually counts as genetic information, where it sneaks into hiring paperwork without anyone meaning for it to, and the handful of narrow situations where asking is actually fine.
The EEOC defines genetic information broadly, well beyond DNA test results. It includes your own genetic tests, genetic tests of your family members, your family's medical history, and any request for or receipt of genetic services.
Read that list again and notice what's on it: family medical history. That's the one employers miss. A question as ordinary as "does heart disease or cancer run in your family" is asking for genetic information under this law, even though nobody involved thinks of it that way.
The 15-employee threshold covers employment agencies, labor organizations, and apprenticeship programs too, not just direct employers. And GINA splits into three separate obligations: don't request, require, or buy this information, don't use it in an employment decision, and don't disclose it improperly. Three ways to break the same law.
With a short list of narrow exceptions, which I'll get to, it is unlawful to ask an applicant or employee about their own or a family member's genetic tests or medical history. Full stop.
Compare that to how FCRA thinking usually works in an HR office. Disclose it, get consent, you're covered. GINA breaks that pattern on purpose. Consent from the applicant does not create a lawful reason to ask in the first place. That part's not optional.
Why does the EEOC draw the line here? Their reasoning is simple. Your family's health history doesn't tell an employer anything about whether you can do the job today. There's no legitimate business reason to ask for it, so the law just takes the question off the table.
Here's what this looks like in practice. A medical intake form that asks "has anyone in your family had heart disease, cancer, or diabetes" is a GINA violation. It doesn't matter that there's a signature line at the bottom. It doesn't matter that the applicant answered willingly. The question itself is the problem.
The most common trap is the post-offer medical exam. The ADA lets you require a physical after a conditional offer, and that part's fine. But the exam or the intake questionnaire that goes with it can't ask about family medical history.
The EEOC has pursued real enforcement action over exactly this, including a settlement reportedly north of a million dollars against a retailer whose post-offer physical questionnaire asked about grandparents', parents', and children's cancer and heart disease history. I'd confirm the exact figure before you repeat it anywhere official. But the shape of that case is real, and it isn't rare.
If you outsource the physical to a third-party medical provider or an occupational health clinic, you're still on the hook for what their intake form asks. That's not just an HR-paperwork problem. It's a vendor management problem, and a lot of employers never check.
General wellness intake forms and even casual onboarding small talk can create the same exposure. The line isn't about intent. It's about whether you're soliciting the information or just passively receiving it. This sits right next to your background check process even though it never touches the actual FCRA report, which is exactly why it belongs in the same compliance review.
GINA has an inadvertent acquisition exception, and people usually call it the water cooler exception. If a manager overhears an employee mention their mother's cancer diagnosis in the break room, that's not a violation. Nobody asked. It just happened.
Here's the limit, and it matters. The second that manager follows up with a question meant to get more of that information, the exception is gone. Overhearing something is inadvertent. Digging for more is not.
The same idea applies when a medical provider volunteers family history during a lawfully requested exam. That stays inadvertent only if you told the provider in writing, ahead of time, not to send you genetic information. The EEOC calls this the safe harbor. Skip that written notice and you lose the protection.
These exceptions are genuinely narrow. They're not a workaround, they're specific carve-outs for specific situations. The EEOC recognizes:
The one HR teams actually run into is different from all of those. You can request family medical history to the extent you need it to support an employee's FMLA leave certification, or a comparable state leave. That's lawful specifically because you're administering a benefit an employee already asked for, not screening a candidate.
There's also a voluntary wellness program exception. Employers can collect genetic information, including family medical history, through a voluntary wellness program, but only with written authorization the employee gives knowingly and voluntarily, plus EEOC rules around confidentiality and how big an incentive you can offer for it. Those incentive limits have moved before. Check the current number before you build a program around it.
Say this part twice, because people mix it up: none of these exceptions apply to hiring or pre-employment screening. They apply after someone is already your employee, for leave administration and benefits. Not before.
Pull your post-offer medical exam forms and any third-party occupational health vendor's questionnaire. Read every question on them. If any ask about family health history, that form needs to change today. If you use an outside provider, give them the safe harbor language in writing. Don't assume they already know this.
If genetic information ever does reach you inadvertently, keep it confidential, in a separate medical file, same standard as other ADA-protected records. It should never reach whoever's making the hiring decision.
Train your managers, too, on the difference between hearing something and asking a follow-up question. That distinction is the entire exception.
Keep this separate from your FCRA process in your own head, too. A clean FCRA program tells you nothing about whether your medical intake forms are GINA-compliant. Two different laws, doing two different jobs.
If a question could reveal a candidate's or an employee's family health history, the safest default is simple: don't ask it. No consent form changes that. This isn't a topic that needs a one-time fix, either. Forms change, vendors change, new hires draft new intake paperwork without knowing this rule exists. It's worth a periodic look, not a box you check once and forget.
If you're not sure whether your current screening and onboarding paperwork would hold up, that's exactly the kind of gap our free Find Your Match tool is built to help you catch, by pointing you toward CRA partners whose process already accounts for it.