Guest Article

(From the August 1, 2011 issue of Deloitte's Washington Bulletin, a periodic update of legal and regulatory developments relating to Employee Benefits.)

EEOC Questions Compliance of ERMs that Contain Both Personal and Occupational Health Information

The Equal Employment Opportunity Commission (EEOC) identified potential compliance concerns where an employee's "occupational health information" and "personal health information" are maintained in a single electronic medical record (EMR). An EMR that allows persons with access to view both the personal and occupational health information of an employee would present "a real possibility" that the Americans with Disabilities Act (ADA) or the Genetic Information Nondiscrimination Act (GINA) or both would be violated, the EEOC concluded.

The analysis came in a recent Informal Discussion Letter in which the EEOC responded to a request for guidance in the situation where an employee's personal health information (i.e., information obtained in the course of diagnosis and treatment) is maintained in a single EMR together with the employee's occupational health information (i.e., information concerning the employee's ability to work, such as the ability to return to work after an injury). This could occur, for example, where an employee of a physician practice group receives medical care from that group. The EEOC examined the requirements of the ADA and GINA and concluded that "a real possibility" of violating either or both laws would exist if access to the EMR allowed someone to view any of the information it contained.

Employment-Related Health Information Must Be Held Confidential

Both the ADA and GINA impose a confidentiality requirement on employers that generally prohibits employers from allowing access to employment-related medical information by individuals who are providing health services unrelated to employment. The EEOC explained:

In fact, the ADA requires that employers keep in a separate medical file—and treat as confidential—information they obtain regarding the medical condition or history of an employee or applicant. Similarly, GINA requires that an employer keep confidential, and maintain in files that are separate from personnel files, any employee genetic information (e.g., family medical history) it obtains. (The GINA and ADA medical information may be kept in the same file, however.) The EEOC reasoned that the ADA and GINA requirements apply to electronic as well as paper records and, if an employer maintains medical information electronically, it must ensure that it is kept confidential and disclosed only to the extent permitted by the ADA and GINA.

Employers Are Restricted from Accessing Personal Health Information

In addition to the obligation to hold employment-related medical information confidential, an employer is constrained by the ADA and GINA in its ability to access or request personal health information. The EEOC indicated that an employer's accessing of personal health information in an EMR would constitute a disability-related inquiry under the ADA—akin to where an employer searches through an employee's belongings for purposes of uncovering information about a disability. The ADA generally prohibits an employer from asking any disability-related questions (or requiring a medical examination) before extending a job offer. After an offer is extended and before the individual begins work, an employer is permitted to make disability-related inquiries or to require medical examinations as long as it does so for all entering employees in that job category. However, an employer would be prohibited under the ADA from withdrawing a job offer from an individual with a disability, so care needs to be taken by the employer that it does not obtain more information than it needs to determine whether the individual can do the job. After the individual begins work, an employer is only permitted to ask disability-related questions that are job related and consistent with business necessity.

Since an employer's accessing of personal health information in an EMR would be considered a "disability-related inquiry," the potential for violating the ADA is clear. The access would violate the ADA if it occurs: (1) before an employment offer is extended, (2) after an employment offer is extended but before work begins if it occurs without the individual's consent or is dissimilar from the inquiries made of the other entering employees in that job category, or (3) after work begins if it occurs without the individual's consent or is not job related and consistent with business necessity.

Similar restrictions apply under GINA, which generally prohibits employers from requesting, requiring or purchasing genetic information (i.e., genetic tests or family medical history) about job applicants or employees or their family members at any time. As explained by the EEOC:

Conclusion

By its terms, the Informal Discussion Letter is not an official opinion of the EEOC, but is for the purpose of discussing the issues. It does not state that separate EMRs must be maintained for personal and occupational health information, but does state that where the information is maintained in a single EMR, "particularly one that allows someone with access to the EMR to view any information contained therein," there is a real possibility of violating the ADA, GINA or both.

The information in this Washington Bulletin is general in nature only and not intended to provide advice or guidance for specific situations. If you have any questions or need additional information about articles appearing in this or previous versions of Washington Bulletin, please contact: Robert Davis 202.879.3094, Elizabeth Drigotas 202.879.4985, Mary Jones 202.378.5067, Stephen LaGarde 202.879-5608, Erinn Madden 202.220.2692, Bart Massey 202.220.2104, Tom Pevarnik 202.879.5314, Sandra Rolitsky 202.220.2025, Deborah Walker 202.879.4955. Copyright 2011, Deloitte.