Privacy law limits release of EH records
Getting a HIPAA release may be necessary
HIPAA alert: If you think the massive privacy law doesn't apply to employee health, take another look. The exceptions to HIPAA are very specific ones, says Karl Auerbach, MD, MS, MBA, FACOEM, associate professor of occupational and environmental medicine at the University of Rochester (NY).
"Many in occupational medicine have felt that because there were certain areas carved out that they could pretty much ignore HIPAA," says Auerbach, who was scheduled to speak on the topic at the recent American Occupational Health Conference in San Diego, sponsored by the American College of Occupational and Environmental Medicine (ACOEM).
"The corridor is a very narrow one that really acts only in situations where there is a mandate to provide information, such as in workers' compensation," he says. "Everything else appears to fall under HIPAA. They do need to pay attention to it."
The Health Information Portability and Privacy Act was designed to streamline the sharing of health information, but at the same time to make it more secure. Patients must be made aware of the health care provider's privacy policy and must sign a release allowing the provider to share information for insurance coverage or discussions with other medical professionals.
According to the Department of U.S. Health and Human Services, employee health records are exempted from the HIPAA requirements if all of three conditions apply:
The health care service was provided at the request of the individual's employer as a member of the employer's work force;
The health care service relates to medical surveillance of the workplace or an evaluation to determine whether there has been a work-related injury or illness;
The employer has a duty under U.S. Occupational Safety and Health Administration regulations or state law to keep records or act on such information.
When an employee reports an injury, such as back strain related to patient handling, no release is necessary to share information with a workers' compensation provider or to place information on an OSHA injury log.
But pre-placement exams, drug tests and fitness-for-duty exams are not required by OSHA and therefore don't fall under the HIPAA exemption. Needless to say, personal medical services provided in employee health, such as blood pressure or cholesterol screenings, would be covered by HIPAA as well.
The simplest policy - and the one adopted by the Occupational and Environmental Health Program at the University of Rochester - is to ask all employees to sign a HIPAA release when they seek services from employee health. "It's really not that onerous to get a release on everybody when they come through the door," he says.
Conversely, getting a HIPAA release doesn't enable a broad sharing of an employee's medical information. In fact, employee health professionals are bound by both ethical considerations and privacy laws to reveal only the information that's necessary in a given circumstance. ACOEM's Code of Conduct states that occupational health physicians should "keep confidential all individual medical information, releasing such information only when required by law or overriding public health considerations, or to other physicians according to accepted medical practice, or to others at the request of the individual."
"HIPAA exists in the framework of other ethical responsibilities," says Auerbach. "It doesn't stand alone; it just makes [the requirements] a little more defined.
"In general, as little clinical information should be transmitted to the employer as possible," he says. For example, if a pre-placement exam indicates that an employee has a physical limitation, the EH professional should just report the limitation. "The employer is really not entitled to the diagnostic information," he says.
Even revealing duty status to a supervisor requires a HIPAA release at the University of Rochester. "We don't share information with anybody, including duty status," Auerbach says. "Just that very existence of a duty status limitation might be construed as falling under HIPAA."
There are some ambiguities and exceptions. Some states have "second-injury" laws that require the transmission of information about prior, similar injuries.
HIPAA also may not interfere with needed emergency care. If a patient is unable to sign a HIPAA release in an emergency situation, but information about the patient's prior medical history is necessary for his or her care, the provider isn't required to obtain one, Auerbach notes.
HIPAA alert: If you think the massive privacy law doesn't apply to employee health, take another look. The exceptions to HIPAA are very specific ones, says Karl Auerbach, MD, MS, MBA, FACOEM, associate professor of occupational and environmental medicine at the University of Rochester (NY).You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content