The issue of what employers can reveal about an employee’s health condition is not new. After all, employers are often privy to employee health information. Information is most commonly exchanged in relation to a work-related injury or when an employee requests medical leave or a disability accommodation. In these instances, many would say it is considerate to be concerned about a co-worker’s health. It is almost second nature to ask questions like “are they OK,” “what is wrong,” and “when are they returning to work.” However, by answering even well-intentioned questions, employers can accidentally run afoul of the understandably confusing laws affecting workplace confidentiality. This article attempts to clarify the obligations of employers when dealing with employee health information.
The Laws
Contrary to popular belief, the Health Insurance Portability and Accountability Act (HIPAA) generally does not apply to employee health information maintained by employers. This means that employers, in most circumstances, do not have to implement measures to protect the privacy of personal health information pursuant to HIPAA.
Nonetheless, privacy rules under the Americans with Disabilities Act (ADA) restrict employers from sharing personal health information of an employee. When an employer obtains personal health information from a disability-related inquiry, medical examination or voluntary disclosure from the employee, the employer is required to treat that information as a confidential medical record.
The ADA requires employers to maintain this information in a confidential medical file that is kept separate from the employee’s personnel file. Comingling of medical and personnel files violates the ADA. The employee medical file should be accessible only to designated human resource personnel on a need-to-know basis. Employee health information may be disclosed only in limited situations and to individuals specifically outlined in the ADA’s regulations, including: 1) supervisors and managers who need to know the necessary restrictions on the employee’s duties and necessary accommodations; 2) first aid and safety personnel who need to be informed should emergency treatment of the employee become necessary; and 3) government officials who need the information to investigate compliance with the ADA.
Similarly, there are privacy rules that employers must follow under the Family & Medical Leave Act (FMLA) and the Genetic Information Nondiscrimination Act (GINA). The FMLA requires employers to keep employee health information confidential in virtually the same way as the ADA. All health information exchanged while facilitating FMLA leave must be placed in the employee’s confidential medical file.
As a general rule with very narrow exceptions, employers should never request genetic information from an employee. But in the event genetic information is inadvertently obtained or otherwise lawfully acquired, GINA requires employers to treat an employee’s genetic information as a confidential medical record. It must only be disclosed pursuant to court order or to government officials who are investigating compliance with GINA. Genetic information can be maintained in the same confidential medical file as disability-related health information.
The Bottom Line
Employers should never disclose an employee’s health information to co-workers or others without pausing to carefully assess the situation. Improper sharing of information could lead to violations of the ADA, FMLA, GINA and other laws. Notwithstanding these laws, employers may disclose employee health information with an employee’s express or written authorization. Even with authorization, requests should be examined closely and disclosure limited. Human resource personnel, supervisors and managers should be educated on these laws so they can safeguard employee health information and limit employer risk.
Lauren A. Holler is a labor and employment attorney at MacDonald Illig where she helps a variety of public, private, and nonprofit employers develop mutually beneficial labor relations with employees.
