Can an employer disclose medical information to other employees

Q: What is a HIPAA violation in workplace?

A HIPAA violation occurs when a persons PHI at a covered entity or business associate has fallen into the wrong hands, whether willfully or inadvertently, without that persons consent.

Has your employer made known any of your private health information to your co-workers? Has your employer installed visible cameras above the business cash register? Do you feel that your employer has hired a private detective to monitor where you go after work?

Table of Contents Show

Can your boss tell others about your health?
What is a HIPAA violation in workplace?
Is it a HIPAA violation to say someone is out sick?
Can my boss talk about me to other employees?

The law protects an employee’s right to control the disclosure of private information. Things like job applications, criminal background checks, credit histories, complaints and commendations all contain potentially private information about an employee, and if an employer carelessly discloses them, the employee can bring a claim for invasion of privacy. Generally, an employer can disclose private information only if the disclosure is required by law or if there is a legitimate business need. Take, for example, an employer who has information about the dangerous mental state of one if its employees. An employer is required to provide a safe workplace and cannot be sued for disclosing that information to the union. Similarly, in that same example, the employer has a legitimate business interest in protecting its plant and other employees from danger.

However, if the employee can show that the disclosure was about the employee’s private life, the disclosure of such information would be offensive to a reasonable person of ordinary sensibilities, and there is no legitimate public concern, the employer will be liable for invasion of privacy. For example, that an employee is HIV positive or is a member of Alcoholics Anonymous.

These same rules apply to employee surveillance. An employer can videotape or monitor an employee if there is a legitimate business need. So, an employer can place cameras above the cash register; the legitimate business need there is preventing of theft. However, it is unlikely there would ever be a legitimate business need for a camera in a locker room.

Statutes, both federal and state, place limits on what employee information employers can disclose. For example, the Americans with Disabilities Act requires employers to keep information about an employee’s medical condition separate from the employee’s personnel file and treat it as a confidential medical record. Under the ADA, this information can only be disclosed to supervisors and managers as to the accommodations the employee needs, to first aid and safety personnel if the employee needs emergency treatment as a result of the disability, and to government officials investigating compliance with the ADA.

Similarly, the Family and Medical Leave Act requires employers to keep records that relate to medical certifications, recertifications, or medical histories confidential excepting the same scenarios as under the ADA.

An employee’s genetic information is also protected from free and full disclosure under the federal Genetic Information Nondiscrimination Act and the Texas Genetic Discrimination Law.

There are also recently-imposed requirements about how employers treat consumer information. Consumer information includes credit reports, credit score, investigative consumer reports, check writing history, insurance claims, or residential or tenant history. The federal Fair and Accurate Credit Transactions Act requires employers to take reasonable measures to protect consumer information from being misappropriated. Reasonable methods mostly include the disposal or destruction of sensitive consumer financial information. The Texas Identity Theft Enforcement and Protection Act imposes similar obligations on employers to protect sensitive person information from unlawful use.

March 02, 2020

Many people find themselves in an all-too-familiar bind at work: they need some kind of accommodation for a medical condition, perhaps even a break from working altogether, but they’re afraid to make the request because co-workers might harbor negative thoughts about their condition. Thankfully, federal and state laws provide some comfort to these employees by limiting how that kind of medical information is shared in the workplace.

In general, most employers must follow the federal Americans with Disabilities Act (ADA) and the Family and Medical Leave Act (FMLA). These laws require an employer to respond in certain ways to accommodate a person’s medical needs. In the case of the ADA, an employer is required to make reasonable adjustments to a person’s work conditions to accommodate certain disabilities. The FMLA permits people to leave their job for certain periods of time in order to deal with their own qualifying medical conditions or the conditions of certain loved ones. There are also state laws that offer more general protections against people spreading protected information to the public.

Whether an employee seeks accommodation or time off to deal with a medical condition, the employee must let the employer know some details about that medical condition. The employer might need to share this information with others, such as nurses, consultants, or medical examiners, to learn more about your request. This is where both the ADA and FMLA protect the employee. So long as the manager, supervisor, or other person is receiving this medical information in connection with a request made under the ADA or FMLA, that information cannot be spread to coworkers.

But what if the manager decided to tell everyone? A court will likely say that the manager is “interfering” with the employee’s right to seek the protection of the ADA and FMLA. Often that employee will have a right to bring suit against them to recover for the damages, including any emotional distress caused by the revelation. More importantly, one could seek the assistance of the U.S. Equal Employment Opportunity Commission or N.H. Commission for Human Rights. Either of these agencies could investigate the claim and make a ruling against the employer that enables the person to seek relief. Acting quickly is important, though, as these agencies have strict and quick filing deadlines.

If you think you might have a claim, it’s worth discussing the pros and cons of filing suit with a lawyer experienced in handling workplace privacy issues. A detailed analysis can make a significant difference in determining the extent of your damages and how to present your claim. To get started, call us at Douglas, Leonard & Garvey, P.C., (603) 288-1403 or fill out our online contact form.

Can your boss tell others about your health?

The Americans with Disabilities Act (ADA) privacy rules restrict employers from sharing personal health information of an employee.

What is a HIPAA violation in workplace?

A HIPAA violation occurs when a person's PHI at a covered entity or business associate has fallen into the wrong hands, whether willfully or inadvertently, without that person's consent.

Is it a HIPAA violation to say someone is out sick?

“None of these situations is likely a HIPAA violation, since HIPAA does not generally apply to an individual employee. As background, HIPAA applies to health plans, health care clearinghouses and health care providers. Generally, an individual employee will not fall into any one of those three categories.

Can my boss talk about me to other employees?

However, employers should also maintain strict confidentiality concerning employee status, pay, performance and medical related information to the extent possible. With few exceptions, employers shouldn't engage in discussions about other employees or disclosures concerning employees with their coworkers.