Back to Medical Privacy   |   View All Issues


EMPLOYEE HEALTH INFORMATION PRIVACY

INTRODUCTION
BACKGROUND
QUESTIONS AND ANSWER
CURRENT LEGAL STATUS
MODEL BILL
BIBLIOGRAPHY

INTRODUCTION

"I will follow that system of regimen which, according to my ability and judgment, I consider for the benefit of my patients. . . Whatever, in connection with my professional service, or not in connection with it, I see or hear, in the life of men, which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret."
--Oath of Hippocrates (460-377 B.C.)

New developments in science and technology are on a collision course with the rights of U.S. workers. At the same time that health care costs have become an enormous concern to employers, new technologies and scientific developments are giving employers easy access to a multitude of information about their employees’ health -- and likely future medical expenses. Despite some limited protections from the Americans with Disabilities Act of 1990, this health-related information is finding its way into employment decisions -- in hiring, promotions and down-sizing.

Consider these actual incidents:

An occupational physician working for a large corporation testifies to a government agency that he frequently receives pressure from managers to reveal health information about employees and applicants, beyond information related to the particular job performed.

A 24-year old social worker is fired soon after revealing that one of her family members has Huntington’s disease, a serious hereditary disease. A co-worker tells her that the manager was afraid that the social worker might eventually get the disease, driving up the company’s health care costs.

Employees at a large and respected research laboratory learn that in their pre-employment medical examination they were secretly tested for a variety of conditions including pregnancy, syphilis, and sickle cell anemia, included for the purpose of screening out applicants who tested positive.

A company’s health nurse is fired for refusing to give the keys for employee medical files to a manager, despite the fact that the occupational nursing code of ethics does not permit such access to employee health records -- and in spite of the company’s own stated policy on confidentiality.

A pregnant woman is told it is the company’s policy that she has to attend prenatal health seminars or her health coverage may be terminated.
return to top of document

BACKGROUND ON EMPLOYEE HEALTH INFORMATION PRIVACY

Why is privacy of health information in the workplace becoming an urgent problem?.

1) Increasingly sophisticated health/medical tests and health history questionnaires used in employment examinations can provide extremely detailed information on the health status of employees or job applicants. If employers are aware of employees’ health problems it is likely if not inevitable that this awareness will influence decisions about promotions, hirings and layoffs.

A 1998 survey by the American Management Association, found that 49% of firms in the survey required medical examinations of all new hires. An additional 15% required medical examinations of new employees in selected job categories. For larger companies the percentage of employees tested was even higher -- 57% of companies with 1,000 or more employees required examinations of all new hires.

Thus, roughly half of all U.S. employees are required to undergo pre-employment medical examinations.

What information is collected in these examinations? No surveys have been conducted on this question; however, physical examinations typically consist of: a detailed medical history questionnaire; an evaluation of vital signs (blood pressure, temperature, etc.); and an examination of lungs, abdomen and other areas of the body for any obvious health problems. All of this information is placed in the employee’s health information file. In addition, many companies require additional tests relating to job requirements. For example, if the job involves heavy or unusual physical activity, tests might assess whether an applicant could safely engage in the activity.

Beyond information from pre-employment physical examinations, employee health files may include the following:

Finally, new testing technologies are continually emerging that can add additional health information to employees’ files. For example, tests are now available that can test inexpensively for a variety of genetic traits, such as predisposition to Huntington’s disease, alcoholism, and many types of cancer.

All in all, employee health files contain a wealth of personal information, some revealing the most private aspects of an employee’s life -- e.g., chronic illnesses, sexually related diseases, emotional problems, family medical problems, bouts with cancer, and substance abuse problems.

2) Improvements in telecommunications technology make it possible for medical information to be easily accessed by insurance companies, fraud investigators, and others who may or may not have a legitimate need to know.

The health care industry is rapidly moving to maintenance of health information in electronic form. Such databases have the potential to improve the health care system -- through physicians’ greater ease of access to information needed for an accurate diagnosis, through research to determine most effective treatment strategies, and through more effectively designed public health and health education programs.

However, once medical records are placed in electronic databases, the information can be disseminated at breathtaking speed to any number of users. Internet communication systems open up yet new possibilities for improper access to medical records. As an example of the kind of abuses that could occur, it was recently reported that two drug store chains had shared prescription information with a marketing company, which then used the database to target mailings to individuals with particular health problems -- until a public outcry stopped the practice.

3) Finally, increasing scientific knowledge of how lifestyles and behaviors affect health can provide a basis for discrimination against employees and candidates. For example, some employers have refused to hire smokers or individuals who were overweight. It also is a temptation for employers to try to enforce changes in employees’ lifestyles and behavior.

Continuing scientific research has revealed numerous health problems related to common behaviors and lifestyles, including: smoking, obesity, diets high in fat, lack of exercise, and heavy drinking. For the employer faced with rising health care costs, these characteristics may be viewed as a threat to cost-reduction efforts. In an effort to keep future health care costs down, the employer may resort to:

  1. seeking information from applicants about non-work-related behaviors,
  2. avoiding hiring individuals who appear to be in these risk categories,
  3. forcing employees to participate in risk-reduction programs such as smoking cessation classes, exercise sessions, etc. (Voluntary wellness programs, of course, can be a significant benefit for employees providing that information collected through such programs is not misused.)

How widespread is the problem of improper use f medical information in employment decisions? It is simply not possible to get precise data, since typically a job applicant or employee would never know that medical information was used against them. Nevertheless, recent survey data is suggestive. A 1993 Harris poll on confidentiality of workplace medical records found that 8% of those surveyed thought that their employer had collected information about their health or lifestyle off the job that should not be collected. 4% responded positively to the question, “Have you ever had medical or health information you provided to your employer disclosed to other people at work in ways you felt were not proper?.”

These statistics are supported by a separate 1993 Harris poll on general medical privacy. This survey found that 9% of respondents believed that their employer or a family member’s employer had at some time disclosed personal medical information in a way that was improper.

These polls suggest that roughly one in twelve employees has experienced improper management of health information by employers. And one in 25 -- equivalent to more than five million Americans in the work force -- believe that their employers inappropriately shared their personal health information with others at work. Since employees are more likely to be unaware of misuse of health information than to be aware of it, these statistics, significant though they are, are likely to underestimate the magnitude of the problem.

Such violations of privacy have resulted in widespread concern among employees about the confidentiality of medical information. Reflecting this uneasiness and mistrust, the Harris poll on workplace privacy found that 41% of respondents said they were very or somewhat concerned that their “job opportunities or job status might be affected” if their medical claims information were to be seen by their employers.

Maintenance of employee health information files is typically overseen by the company’s health professionals -- occupational physicians and nurses. Both occupational physicians and nurses are governed by their professional code of ethics regarding confidentiality of employee health information. These codes state that individual records should be confidential, to be “released only when required by law or overriding public health considerations; when needed by other health professionals for pertinent reasons; and when needed by designated individuals at the request of the employee...Employers are entitled to counsel and advice about an employee’s medical work fitness but not to diagnosis or specific details, except or in compliance with law and regulations.”

Because of this ethical commitment, occupational health professionals often find themselves in the front lines of the battle for rights to privacy of health information. Although no survey data are available as to the frequency with which health professionals are pressured to release confidential information, leaders in the field report having heard many stories of such occurrences. A few lawsuits have resulted in recent years from the clash between health professionals’ ethical commitments and human resource managers’ and supervisors’ interest in accessing employee health information.

Increasingly concerned about the issue, the Association of American Occupational Health Nurses and the American College of Occupational and Environmental Medicine, the leading professional associations for occupational and environmental health nurses and physicians, are seeking federal legislation to ensure the privacy of employees’ health information. They believe such legislation is essential if employees are to feel secure that information shared with their company’s health professionals will be treated respectfully and confidentially, and if health professionals are to be protected in performing their responsibilities in an ethical manner.

What are the impacts of improper use of medical information by employers? The impact on the individual can be devastating. To be fired, or not hired or promoted, is likely to be upsetting in any case -- but to undergo this experience because of a health condition over which one has no control, which one’s employer should not have even known about, can be traumatic.

Just as seriously, it creates a climate of mistrust that may keep individuals from even seeking medical attention they need, for fear that employers will find out about their condition. 7% of those contacted in the Harris poll had the experience of wanting to seek services for a physical condition or mental health problem but not doing so because they didn’t want to harm their “job prospects or other life opportunities.” In keeping individuals from needed treatment, the lack of strict confidentiality of employee medical information transcends the impact on individuals and becomes a threat to public health.

Concern over privacy of medical information in general has grown rapidly in the last few years, and it is essential that such legislation extend to workplace health information privacy as well. In some ways the risks for employees from misuse of medical information exceed the risks for health care consumers in general. Employees experience not only a threat to privacy, but a threat to their very livelihood from misused health information. The issue for employees goes beyond privacy concerns -- it becomes a question of job discrimination against individuals who have presently, have had in the past, or are likely to have in the future, sensitive or serious personal health problems.

If employees are not fully protected in terms of health information privacy, it is easy to imagine a two-tiered system developing, in which employees with health problems have less job security and less access to good jobs. These employees would be doubly penalized -- in addition to the physical distress caused by health problems, they would suffer the insecurity and embarrassment of having their health problems known to present and future employers, with serious consequences for their job prospects.
return to top of document

QUESTIONS AND ANSWERS

Won’t industry take voluntary steps to increase confidentiality of medical information?

In 1977 the U.S. Privacy Protection Commission submitted recommendations urging business to voluntarily adopt privacy safeguards for its employment-related records. A recent review by Professor David F. Linowes, former Chairman of the U.S. Privacy Protection Commission, concluded that after twenty years, too few corporations have adequate policies to protect sensitive employee data from possible abuse. Dr. Linowes called for legislative action to enforce protection of employee information by employers, to help bring the U.S. up to privacy standards already adopted by most of the other industrialized countries.

Some corporations have voluntarily placed restrictions on access to health records. For example, the Pacific Business Group on Health, a consortium of companies committed to cost-effective but high quality health care, believes that employers should never have access to individually identifiable health information, with the provision that such information can be provided to trusted third parties for the purpose of aggregate reporting and analysis. However, not all companies are likely to be so enlightened, especially smaller companies that more directly feel increased costs resulting from seriously or chronically ill employees. As an example of corporate efforts to reduce such costs, a company was recently sued by job applicants who were turned down because special pre-employment medical tests had indicated they might develop carpal tunnel syndrome in the future.

Why shouldn’t employers have the right to reduce health care costs by hiring healthy employees?

Employers have a legitimate need to monitor and reduce costs that affect their bottom line. However, there are right and wrong ways -- ethical and unethical ways -- to reduce health care costs. There’s nothing unethical about conducting voluntary on-site wellness programs to encourage employees to be in good health. But there’s everything wrong with discriminating against employees who are performing satisfactorily in their jobs but happen to have health problems. It is unfair to them, to burden them with job discrimination on top of the health issues they’re already struggling with. And it is unfair as a society, to jeopardize or limit the job prospects of those who can perform their work well but just happen to have poor health. In the case of genetic testing, the discrimination may occur over a projected future illness that never even develops (since genetic tests usually indicate probabilities, not certainties, that an individual will contract a particular illness) -- and then it is even more unfair. This unfairness is the reason why the Americans With Disabilities Act was passed in 1990, and why privacy legislation is so urgently needed to fully protect confidentiality of medical records, an issue that was not fully addressed in the 1990 Act.

Is privacy in workers compensation claims an issue?

Yes. Workers compensation laws vary state to state. In some states, workers filing a claim must sign an authorization for the reviewing agency to access all of their medical records. The claimant’s health information is in many states part of the public record, and in some states involves a public hearing at which health information is reviewed. It is also common for workers’ compensation insurers to “share” information about claimants through an information sharing exchange system, and for state agencies to make personal workers’ compensation claims records, including medical information, available to private, for-profit information-gathering firms. These firms then sell the data to employers. For example, one prominent firm advertises that it can help employers find out if job applicants have claimed workers compensation in the past, for the purpose of avoiding hiring such applicants. Essentially this means a blacklisting of employees who have claimed workers compensation for injuries on the job.

Although employers are understandably concerned about fraudulent claims, ways need to be found to deal with fraud without violating the privacy of, and discriminating against, the vast majority who have valid work-related injuries.

CURRENT LEGAL STATUS

FEDERAL LAWS

The Americans with Disabilities Act

The landmark Americans with Disabilities Act of 1990 (ADA) prohibited job discrimination relating to physical or mental impairments that do not prevent an individual from performing their work responsibilities when provided with “reasonable accommodation” by the employer.

The ADA introduced the following confidentiality requirements with regard to employee health information. It requires that medical information from physical examinations, questionnaires or other means be obtained only after an offer of conditional employment. Such information must be obtained for all newly hired candidates, not just those with disabilities. Medical examinations of current employees are allowable only where required by federal, state, or local laws; to determine fitness-for-duty when safety is a concern; or as part of voluntary employee health programs as long as the information obtained is not used in a way that violates the ADA.

The ADA requires that medical information be maintained in confidential files, separate from normal personnel files. Such information must not be disclosed to anyone other than managers and supervisors who need to know of work restrictions or accommodations, and the following: first aid and safety personnel who need to know to provide emergency services, government officials investigating compliance with the ADA, and workers’ compensation offices in accordance with state laws.

However, the ADA’s confidentiality requirements are limited in important ways. They do not restrict the types of health information that can be collected in employment-related physical examinations. Thus, a wide variety of personal health information can be collected that is not directly job-related. Nor do they provide guidelines that would prevent managers from accessing and looking through all and any medical information in an employee’s file, while reviewing health information relevant to the employee’s job-related fitness.

The Occupational Safety and Health Act

The Occupational Safety and Health Act and subsequent amendments provide some guidelines for confidential treatment of specific types of information. For example, the guidelines are quite strict for confidentiality of information relating to bloodborne pathogens (such as the AIDS virus). They state that records relating to bloodborne pathogens must not be disclosed “without the employee’s express written consent to any person within or outside the workplace” except as required by law. Overall, however, the Occupational Safety and Health Act guidelines only cover health information relating to specific regulated hazards, in specific industries, and do not address employee health information in general.

Recent Federal Legislative Efforts

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) required that Congress pass legislation relating to confidentiality of medical records by the summer of 1999, or, by default, confidentiality guidelines would be established by the Department of Health and Human Services (HHS). A number of bills relating to medical privacy were introduced in Congress during 1997 and 1998, but none were passed. It is possible Congress may choose to extend the HIPAA deadline.

HIPAA, however, did not specifically include a requirement to address employment-related medical privacy as a component of medical privacy. While some of the recent bills have included employment-related medical privacy, the draft HHS confidentiality guidelines deliberately omitted the employment aspect, leaving it to voluntary employer initiatives. Therefore, it is unclear whether employee health information privacy is likely to be covered by federal law in the near future.

STATE LAWS

Only a handful of states have addressed employee health information privacy in any depth. California has passed legislation placing specific limits on employers’ use of applicants’ medical histories). California also restricts employers after an employee’s injury to collect only work-related medical information. Rhode Island’s law states that organizations that keep medical information must adopt policies to assure confidentiality. Colorado law specifies that “Any person who, without proper authorization, knowingly obtains a medical record or medical information with the intent to appropriate [it] to his own use or the use of another...commits theft.”

In addition, several states have laws pertaining specifically to a particular aspect of employment health privacy, such as use of genetic tests, or AIDS information. At this time, however, none of the states have yet comprehensively addressed employees’ rights to privacy of health information.

COMMON LAW

In some cases individuals have sued employers over improper use of health information, usually in relation to the common law tort action of invasion of privacy. In the workplace, lawsuits over invasions of privacy usually result from “public disclosure of private facts” or intrusion into personal matters.

In public disclosure claims, the plaintiff must show dissemination or “publication” of private matters in which the public has no legitimate concern so that it results in shame or humiliation for an ordinary reasonable person. One common problem is that “publication” of private information is often interpreted to require that information be disclosed to a substantial number of people. Disclosure of information to a few co-workers or managers may or may not be considered “publication” in this sense.

Some courts have taken the position that employers have a right to obtain and disclose any information needed to pursue their business interests. In one case, for example, a court ruled that it was legitimate for a nuclear power plant to tell employees the details of a particular workers’ illness, to quell rumors that the employee was sick due to radiation exposure -- since the rumors were interfering with work at the plant.

With regard to claims of intrusion into personal affairs, courts have balanced the rights of employers to determine an employee’s ability to perform their job with the individual’s right to privacy. Jurisdictions have varied greatly in how these rights are balanced. At times, courts have held that if an employee consents to provide information to the employer (e.g., in a pre-employment medical questionnaire), the employee has then consented to whatever is done with that information.

The inconsistencies in court rulings in this area point to the need for legislation to clarify privacy guidelines for both employers and employees. In addition, the fact that few employees are willing or able to undergo lawsuits if the outcome is unpredictable -- because of the expense, disruption, or threat to future employability -- means that common law torts do not provide an effective means of protection for the average worker.
return to top of document

MODEL BILL

MODEL PROTECTED HEALTH INFORMATION ACT

1. Prohibited Practices

1.1 It shall be illegal for an employer to discriminate against any employee or applicant on the basis of protected health information.
1.2 No employer shall inquire, collect, retain, use or disclose protected health information about any employee or applicant that would not be a legitimate basis for personnel decisions under section 1.1.

2. Definition

2.1 “Protected health information” means any information which identifies an individual, whether oral or reported in any form or medium; is created or received by an employer; and relates to past, present or future;
a. Physical or mental health history of an individual or an individual’s family (including individual cells and their DNA and genetic component);
b. Physical or mental health condition, including information about legal lifestyles, behaviors or consumption patterns which may be relevant to an individual’s health condition;
c. Diagnoses or medical test information or other information relating to a health condition, diagnosis, or prognosis;
d. The provision of health care or health care treatment;
e. Prognosis or other information relating to potential future health conditions; or
f. Payment for the provision of health care.

3. Exceptions

3.1 Nothing in sections 1.1 or 1.2 shall be construed to make it illegal for an employer to collect, use, retain, or disclose protected health information in connection with:
a. A bona fide occupational requirement; or
b. A bona fide conflict of interest policy.
3.2 After an individual has been hired, nothing in sections 1.1 or 1.2 shall be construed to make it illegal for an employer to collect, use, retain, or disclose protected health information in connection with:
a. Occupational wellness or other employer-sponsored health programs participated in on a voluntary basis by the employee; or
b. The administration of a health, disability, life or other insurance program or payment for such a program provided that no employee shall be disadvantaged with respect to participation in any employer insurance or benefit program unless:
1. the difference in treatment accurately reflects a difference in the employer’s cost of providing the benefit, according to sound actuarial principles;
2. the difference in cost is the result of the individual employee’s voluntary behavior; and
3. the practice in question does not have a disparate impact on any group protected by federal or state civil rights laws.

4. Enforcement

4.1 Any individual who has been aggrieved by a violation of this Act shall have a private right of civil action in any court of competent jurisdiction or may file a complaint with the department of labor in the state of ________________.

5. Remedies

5.1 A prevailing plaintiff in a civil action under this section is entitled to:
a. Injunctive relief;
b. All wages and benefits lost;
c. Compensatory damages; and
d. Court costs plus reasonable attorney’s and expert witness fees.
5.2 Where the department of labor determines that a violation of this Act has occurred;
a. The affected employee or applicant is entitled to all wages and benefits lost because of the violation; and
b. The department of labor may impose a civil penalty.

6. Waiver

6.1 The rights and procedures provided by this Act may not be waived by contract or otherwise, unless such waiver is part of a written settlement agreed to and signed by the parties to a pending action or complaint under the Act.

ORGANIZATIONS SUPPORTING LEGISLATION TO PROTECT CONFIDENTIALITY OF EMPLOYEE HEALTH INFORMATION

American College of Occupational and Environmental Medicine
55 West Seegers Road
Arlington Heights, Illinois 60005
Contact: Pat O’ Connor, 202-223-6222

American Association of Occupational Health Nurses, Inc.
2920 Brandywine Rd., Suite 100
Atlanta, Georgia 30341-4146
Contact: Kae Rivers Livsey, 770-455-7757, ext. 104

Pacific Business Group on Health
221 Main Street, Suite 1500
San Francisco, CA 94105
Contact: David Hopkins, PhD, Director, Health Information, 415-281-8660

Workplace Injury Litigation Group, Inc. (national association of attorneys representing injured and diseased workers)
PO Box 300488
Denver, CO 80203
Contact: Gregory E. Williams, Executive Director, 303-830-0112, Email - wilg@wilg.org, Web - www.wilg.org.

Health Privacy Project
Institute for Health Care Research and Policy
2233 Wisconsin Avenue NW, Suite 525
Washington, DC 20007
Contact: Zoe Hudson, 202-687-0880

AFL-CIO Public Policy Department
815 16th St., NW
Washington, DC 20006
Contact: Christine Owens, Assistant Director for Social Policy, 202-637-5178
return to top of document

BIBLIOGRAPHY

    Back to Medical Privacy   |   View All Issues
The National Workrights Institute       166 Wall Street, Princeton, NJ 08540       (609) 683 0313       info@workrights.org