Employee medical information is an emerging area of law. The lack of age-tested ground rules often leads to horrifying mistakes on the part of HR and managers. However, despite the gray areas, there are some guidelines. J. Larry Stine, principal for Atlanta-based Wimberly & Lawson law firm, offers a road map.
What parts of an employee's medical information is generally legal for an employer to know?
Under the Americans with Disabilities Act (ADA), which predominantly governs [medical] questions prior to a conditional offer of employment, there's fundamentally a flat prohibition on obtaining medical information or doing medical examinations of applicants. So an employer really can know nothing. This doesn't mean that the [prospective employee] can't tell the interviewer any information he or she wants. If the applicant volunteers the information, then it's legal to know it.
What happens when a person moves beyond the applicant stage?
During this period, subject to completion of a physical examination or provision of medical information, fundamentally an employer can ask anything about medical [conditions] and can require medical examinations in all areas. Pretty much anything that's medical is wide open during that limited period of time.
And once the person becomes an employee?
After the person becomes employed and the conditional offer of employment is fulfilled, the employer can learn "some" information concerning the medical condition of its employee. For example, the employee is working in a noisy area in a facility that's in excess of 85 decibels on an eight-hour time-weighted average. Pursuant to Occupational Safety and Health Administration (OSHA) rules, the employer is required to do a baseline audiometric test, which is a type of medical test that tests employees' hearing. Or, for example, somebody has to wear a respirator. He or she is required to have a pulmonary test and be examined by a physician. That's medical information the employer has a legal right to know.
What other need-to-know circumstances apply to employees handling medical data?
If an employee files a workers' compensation claim, the company has to know medical information concerning his or her claim. Another situation for which the employee needs to have medical information is when an employee claims to have a medical condition requiring reasonable accommodation. Theoretically if the company is self-insured and running its own health-insurance program, it needs medical information in order to pay the benefits, so it has a legal right to that information. One other situation is when the company has a voluntary health program and employees elect to participate in it, then the employer can obtain information that way.
What parts of an employee's medical information must remain confidential?
That's simple-all of it. The ADA requires that medical information obtained by an employer must be maintained in separate and confidential files. It can't even be physically retained in the personnel files. If somebody's keeping medical information in a personnel file, he or she has got a problem under the ADA. However, this information can be shared, but it has to be shared on a need-to-know basis.
Who would qualify for the need-to-know basis?
Anybody in the company who has been assigned a responsibility that would have need for the information in the performance of his or her job. For example, the company may have a health-insurance clerk whose job it is to process health claims. He or she is going to need access to certain medical information to process those claims. Also, the president of the company probably has the need to know how everything's being done in the company. And there's a strong argument that the chief operating officer has a need to know everything that goes on in the company. The HR manager normally would have pretty free access to it also. And then [it's decided from there] on a need-to-know basis. It's a case-by-case, fact-by-fact determination as to whether this employee's job required him or her to have the medical information. Most of the time it's simple.
Let's say a manager comes to HR to complain about an employee's performance. The HR person knows this is likely because of the employee's medical condition. Can HR share that?
In circumstances in which a manager is having difficulties with the performance of an employee and it's related to a medical condition, the manager or supervisor has a clear right to know that information. The only medical condition you have to be careful disclosing in this situation is AIDS. The reason for that is certain states have passed AIDS confidentiality statutes that make those cases super-sensitive, which is understandable. A person would have to be hard-pressed before releasing information that an employee has HIV or AIDS. But outside of that, if an employee has been having emotional problems that impact performance and the HR manager knows it, the supervisor should know it.
Why is that a general rule?
There's a real debate going on as to whether employers have to provide reasonable accommodations without a request by the employee. The general rule, and I think most people would agree on it, is the employee [must] request reasonable accommodation. [But] the regulations add: unless it's obvious the employee needs a reasonable accommodation. That's a tough little question. But if an HR person knows the employee is having emotional problems and can do something about it and doesn't, the company is facing a legal argument at the minimum. The employee, by telling [human resources] he or she has emotional problems, has put the employer on notice.
Many employers are trying to get a handle on health-care costs-how much information, including insurance and prescription data, can they be privy to?
If the employer is trying to get a generic handle on health-care costs and prescriptions, I'd recommend people doing the work be provided the information with the identity of employees taken out. Depersonalize the information. They don't need to know that Joe Smith is taking Prozac because then they know that guy's suffering from depression. However, a [benefits analyst] might need to know how many employees are ordering Prozac and in what quantities to try to get a handle on the use of psychiatric medicine.
What about health-care analysis on a case-by-case basis?
If the company is trying to control [costs] on a case-by-case basis, it has a health-insurance clerk working on it. Those people are probably processing a great degree of information anyway, and they have a right to know. If the person is handling specific, individual claims, he or she can't help but have the name in order to process the claim.
So, it depends on [the situation]. If an employer was doing generic reviews of prescriptions and a name was given out, there could be a problem because there's no need to know the individual's name. On the other hand, if the insurance clerk is processing claims for these very expensive drugs [for HIV], he or she needs to know the diagnosis is HIV in order to approve the payment of specific prescriptions.
If an HR person finds out about an employee's medical condition from a source other than the employee, can HR approach the employee about it?
I'm not quite certain why [HR] would want to approach the employee about his or her condition if the employee had kept it private. In general, I'd recommend against it.
Another what-if: Let's say an employee at an EAP session revealsviolent fantasies to the psychologist. Can the psychologist report this to the employer? And can the employer then take intervention?
That's probably one of the most difficult questions that can be posed on this [topic]. If the employer has sent the employee to a mandatory EAP session for a problem such as violence, drug abuse or alcohol abuse-typically what's happened is the employee has gotten himself or herself into a disciplinary proceeding anyway-what we strongly suggest in that situation is that our clients retain a release from the employee that all information pertinent to the employee's progress may be promptly released to the employer. The problem is that the psychologist is under a privileged communication. That privilege is qualified; it's not absolute.
So say the psychologist does inform the employer?
Because the psychologist or psychiatrist is waiving a privilege, it has to be a situation in which he or she feels relatively comfortable that the employee is going to act out some tendencies. It's one thing for an employee to express anger and hatred; it's another thing to act on it. Can the employer then take steps for intervention? Under the recent OSHA workplace violence policies, I'd say OSHA has taken a position that you must take steps for intervention. There's a tort of negligent retention: Most states recognize that once an employer becomes aware of an employee's violent and/or criminal propensities, the employer must take appropriate action. So the company is required by state law to act under the negligent retention aspects. Under OSHA's general-duty clause, which says an employer must provide a place of employment free from recognized hazards that can cause death or serious injury, OSHA has issued the workplace violence guidelines and mandates that employers take certain steps to avoid violent actions toward employees.
So once an employer is informed, the company must intervene?
Once an employer or HR has the information, it's almost impossible not to act on it. Whether the psychologist gives the employer the information depends on two things: One, whether he or she has a release; and two, upon his or her judgment as to whether in [his or her] professional opinion the violence is a real probability, in which case I believe the psychologist has an obligation to tell.
Is it legal to order an employee to go to an EAP and sign a release or be terminated?
Yes. The reason I feel relatively comfortable saying that is there's a long history of EAP [rulings]. For as many years as I can think of I've [seen] programs with releases, particularly in a substance-abuse or alcohol-abuse area. That's because without proper information from the treating health-care provider, the employer has no idea whether this person has successfully completed rehab or not. It's very important to know for decisions on what type of employment actions the company is going to take.
Are the courts tending to rule pro-employer or pro-employee on medical-information cases?
It's such an emerging area of the law that I see cases all over the place. But if I were going to say there's a trend one way or the other, I'd say there's a trend toward employee privacy.
Any other advice for employers?
One of the greatest concerns I have is the dissemination of false information. Example: An employer sends somebody out for a substance-abuse test, and gets back a false positive. Rumors start getting around the plant that this guy tested positive for cocaine. Then the company has a secondary test run, and it turns out there was an error in the first test. But, the company has already put the information out. It's now highly subject to breach of confidentiality, privacy and defamation [claims]. One of the things that's most important for employers to know is to keep the information confidential, only allowing it in the few hands that need it to do their jobs effectively. I'd say that's the bottom line.
Workforce, October 1997, Vol. 76, No. 10, pp. 89-93.