GATHERING HEALTH INFORMATION ON OUR EMPLOYEES

INCLUDING HIPAA PRIVACY REGULATIONS

Introduction

As Human Resource Professionals, the only concern we have about an employee’s mental or physical health is as it relates to the ability of the employee to perform the work without interfering with the work of co-employees. We do not need a diagnosis.

Pre-Employment Testing

Generally stated, governments may make demands of citizens so long as such demands are rationally related to a governmental interest and don’t unduly infringe upon any basic constitutional rights. Requirements for pre-employment tests meet this standard. There may be an argument that a citizen has some measure of a right to apply for a job funded by taxes, but legitimate pre-employment tests ensure that the best citizens become employed.

The Americans with Disabilities Act impacts pre-employment testing. That Act provides that a medical exam may not be given until after an offer of employment is made contingent upon the exam, itself. It should be here mentioned, however, that this restriction, along with the rest of the ADA, comes into play only when the subject individual has a condition that is covered by the ADA. By definition, these conditions are quite limited.

What is a Medical Examination?

Medical examinations under the ADA are those administered and interpreted by health care professionals for the purpose of learning about an individual’s physical or mental impairment. This leaves a lot of room for other tests.

Drug tests are not "medical examinations" under the ADA.

Physical fitness tests and physical agility tests are not considered medical examinations.

Please keep in mind regarding these tests that we should ask ourselves whether we are measuring what we realistically need to measure.

A blanket exclusion from employment for women who are pregnant or for individuals who test positive for HIV violates Title VII in the first case and the ADA in the second case.

Second Injury Fund Questionnaires for Applicants

These questionnaires are often given to applicants for the purpose of potential second injury fund coverage when the applicant becomes an employee. The ADA guidelines say that this cannot be done before the job offer as this would constitute knowledge of medical information and affect the offer of a job. The Louisiana Supreme Court, however, appears to think otherwise. See Wise vs. J. E. Merit Constructors, 97-0684 (1/21/98, La.) 707 So.2d 1214. Submit the questionnaire to the employee.

Health Information from a Current Employee

Employees must obey the directives of their employers so long as such directives are rationally related to a governmental interest. Regarding obtaining medical information, there is a great deal of common sense which comes into play.

We may want to get health information at the beginning of an absence, during the course of an absence, at the end of an absence upon return to work, and where we have reasonable grounds to believe that a employee at work is injured or may cause injury or harm. When and what we ask for involves the application of common sense.

We may want some sort of medical information every time a suspected abuser of sick leave goes out, but not at all for a non-abuser. We may want the information during the course of a lengthy absence for the employee whose condition we know nothing about, but not make the same request of an employee who we know is in the hospital recovering from a severe automobile accident. At return to work, we may want a fitness for duty statement from the employee who was out to recover from injuries after falling down stairs, but not make the same request from an employee we know had the flu. We are discriminating here, of course, but we are not discriminating based upon a prohibited factor as, for example, age, but for a rational basis, i.e. our own knowledge and experience.

What we ask for also seems to draw upon our good common sense. Our only goal is to find out how work is going to be impacted. When we make the request for the information, we should tell the health care provider the tasks performed by the employee and ask which tasks the employee can perform and, if not, how soon the employee is going to be able to perform the task and, also, if there is anything that we can do to allow the task to be performed. We are also going to want to know whether the condition is contagious, or in the case of a mental condition, whether the employee is a danger to himself or others. Again, we do not need a diagnosis.

The Family and Medical Leave Act does not allow an employer to change the essential functions of the job in an attempt to get the employee back to work, and that is probably a pretty good standard to apply to your own sick leave, but the result of the medical information may be that the employee can be directed to come back to work to perform some of the essential functions. The task analysis submitted to the health care provider can aid in this endeavor.

The FMLA also requires that communication to the health care provider go through the hands of the employee, and this appears to be a good standard to apply in all leave situations. If the employee does not get the information back in a reasonable period of time fixed by the employer, paid leave, whether FMLA or otherwise, may be denied.

Health Insurance Portability and Accountability Act of 1966 (HIPAA)

When Congress enacted the above law it did not address the privacy of health information. Pursuant to the authority of the law, the Department of Health and Human Services issued regulations that were effective April 14, 2001. An excellent web site on this subject is www.hhs.gov/ocr/hipaa.

The regulations cover health plans, health care clearing houses, and health care providers and the "protected information" these "covered entities" store. They do not cover public entities not serving as one of these entities. All employers, however, are affected by the privacy regs that are applicable to these covered entities.

These privacy regulations are said to give the individual more control over the dissemination of his medical information. That control is exercised by the individual by the signing of a "consent" or an "authorization." The regulations at 45 CFR 164.506 provide that a "consent" is required prior to a covered entity "using or disclosing protected health information to carry out treatment, payment, or health care operations."

Consents are used by "covered entities" for internal purposes and sharing with other entities with whom they do business to effect treatment, collect payments, and for other health care operations. Making a decision about who to promote, for example, does not fit within one of the categories. Nor does deciding who gets credit at the credit union. Therefore the "covered entity" employer cannot use this health information it has for such purposes without consent. The regulations prohibit "covered entities" from retaliating against an employee who refuses to consent. See 45 CFR 164.530(g). We are not "covered entities," nor are we requesting information from a covered entity for purposes of effecting "treatment, payment, or health care operations." This is fortunate, because where a "consent" is required, the individual may be able to restrict the information that is released for the "treatment, payment, or health care operations" to that which is "minimally necessary" to meet that end. See 45 CFR 164.506(c).

For all other releases not constituting treatment, payment, or health care operations, an "authorization" is required. See 45 CFR 164.508(a). An "authorization" is much more specific than a "consent" and specifically identifies the information to be released, to whom released, and for what purpose it is released.

There is nothing in these regulations that prevents us from taking adverse action against an employee who refuses to sign an authorization. This is compatible with the Family and Medical Leave Act and the Americans with Disabilities Act where an employee can be denied the benefits of those laws if the employee does not cooperate by providing certain medical information. The same principle that an employee must cooperate in order to get the benefits state laws provide to him, i.e. property rights to a job and sick leave, apply whether FMLA and the ADA are applicable, or not.

In summary regarding HIPAA, the privacy right aspects of this law should not cause us any significant problems beyond the problems and concerns of health care providers from whom we solicit information. They may proceed with more caution and trepidation than is warranted and cause practical problems that will just have to be dealt with on a case by case basis.

What is a Valid Authorization?

A valid authorization is specifically defined at 45 CFR .508 (b). I have attached a sample form letter to a health care provider when incorporates the concepts we discussed above and, also, which contains that which is required for a valid authorization. By way of summary, what must be in such an authorization is the identification of the entity disclosing, and the entity receiving, the specific information to be released and the use of such information, the expiration date, and the right and means to revoke.

 

____________________________________
Robert R. Boland, Jr., General Counsel
Department of State Civil Service
Post Office Box 94111
Baton Rouge, LA 70804-9111
(225) 342-8544

 

Sample Form Letter

 

__________________
Date

 

Doctor Smith
Smith Health Clinic
123 Jefferson
Baton Rouge, LA 70802

Dear Dr. Smith:

Your patient, ____________________, is an employee of ours and we are seeking certain information regarding the condition you are treating. This individual’s authorization for you to provide this information for delivery to us is contained below.

_______________________, works as a clerical employee in an office setting. Her typical tasks are listed below and we would ask that you indicate whether she can now perform each task.

Yes No
Sitting in a chair at a desk . . .
Typing and answering telephone . . .
Standing, sitting, and kneeling for purposes of filing . . .
Lifting more than 5 pounds . . . 
Climbing 2 flights of stairs . . . 
Leaping tall buildings with a single bound . . .

For each negative indication, would you please advise how long you expect that the task cannot be performed and for each task please indicate if there is anything we can do which would allow the task to be performed for an extended or limited period.

_________________________________________________________________________________

_________________________________________________________________________________

_________________________________________________________________________________

_________________________________________________________________________________

_________________________________________________________________________________

Would you please indicate whether the condition for which you are treating _____________________ is contagious to others, and if so, how long this contagious condition will last.

_________________________________________________________________________________

_________________________________________________________________________________

 

__________________________________
Dr. Smith, M.D.

Would you please complete the above information, sign where indicated, and return this completed letter to your patient who, in turn, will return it to us. We very much appreciate your cooperation.

Sincerely,

 

Joan Manager

 

 

 

To our employee:

This is to authorize us to receive the health information requested and to limit what we may do with the information. Please deliver this to the identified health care provider along with the letter dated ________________. Return the completed letter to us.

 

AUTHORIZATION

I, _______________________, hereby authorize _______________________ to provide the information requested in the letter dated __________ and signed by _______________________. This information may be released to the individual who signed that letter for purposes of evaluating my fitness for employment. I understand that my employer may share this information with others on a need to know basis for that purpose. I further understand that I have the right to revoke this authorization in writing given to the above named health care provider. If that health care provider has already taken action in reliance upon this authorization, I may not do that revocation to the extent of such action. This authorization is a one-time authorization for use only to respond to the letter identified above and will expire upon such response. I further understand that if I revoke this authorization before the requested information is delivered, the rights available to me through my employment could possibly be denied to me.

 

____________________________________ Employee                                   Date