Guest Article

(From the Employer's Guide to HIPAA Privacy Requirements, Thompson Publishing Group)

Employer May Be Sued for Disclosing Contents of FMLA Request, D.C. Circuit Rules

An employee may sue his employer if the contents of his medical certification under the Family and Medical Leave Act (FMLA) are disclosed to his coworkers, a federal appeals court ruled Feb. 7. The court overturned the trial court's ruling that the employer was entitled to summary judgment because of insufficient evidence that the coworkers' knowledge of the employee's health information stemmed from his FMLA submittal. The case is Doe v. U.S. Postal Service, No. 01-5395 (D.C. Cir., Feb. 7, 2003).

Facts of the Case

"John Doe," an HIV-positive postal worker, revealed his condition to the U.S. Postal Service (USPS) in an FMLA certification that he submitted to the USPS in response to a threat of disciplinary action for missing several weeks of work. Although Doe had never revealed his status at work beforehand, he alleged, it was "common knowledge" among his coworkers when he returned.

Several USPS employees would testify that they heard about Doe's HIV status from Melvin Tahir, his management-level supervisor. Tahir denied these accusations, insisting he was not even aware of Doe's HIV status before the lawsuit.

Doe sued the USPS under the Privacy Act and Rehabilitation Act, both of which restrict federal agencies' disclosure of personal information. The Privacy Act generally prohibits "nonconsensual disclosure of any information that has been retrieved from a protected record." The Rehabilitation Act applies the confidentiality requirements of the Americans With Disabilities Act (ADA) to federal agencies.

The USPS sought summary judgment in its favor, arguing that Doe had not offered sufficient evidence that one of its employees had disclosed medical information from his FMLA certification form. Regarding the Rehabilitation Act claim, the USPS contended that Doe's FMLA submittal was a voluntary disclosure, not an employer "inquiry" governed by the ADA.

The district court agreed with the USPS, but the U.S. Court of Appeals for the District of Columbia Circuit reversed this ruling and sent the case back to the lower court for trial.

D.C. Circuit's Opinion

Doe's circumstantial evidence that the disclosures occurred after his FMLA request and were attributed to a manager responsible for reviewing the request was sufficient to avoid summary judgment, the D.C. Circuit ruled. "Doe offered two pieces of evidence from which a reasonable jury could conclude that a Postal Service employee retrieved information about his HIV status from protected medical records," Judge David Tatel wrote for the three-judge panel.

"First, Doe's co-workers' deposition testimony indicates that the disclosures occurred after Doe submitted his FMLA form," Tatel wrote. "Second, deposition testimony indicates that in the normal course of business, Tahir obtained and reviewed leave requests."

Regarding the Rehabilitation Act claim, the court ruled that Doe's disclosure to the USPS was not truly voluntary because it was necessary to avoid disciplinary action and meet FMLA's requirements. "Doe revealed his medical diagnosis to the Postal Service only after the Service, through his direct supervisor, told him in writing that he would face disciplinary proceedings" otherwise, Tatel explained. The FMLA submittal therefore fell into the category of "inquiries into the ability of an employee to perform job-related functions," whose responses are protected by the ADA, the court concluded.

Implications

This case illustrates the types of disclosures that the ADA's confidentiality provisions (as included in the Rehabilitation Act) were designed to prevent. It shows the reach of the ADA's medical inquiry provisions, which could apply to medical information submitted for FMLA purposes.

The information in question would not be regulated by HIPAA when held by the employer, because it would be excluded as an "employment record" from the definition of PHI.

Although, in this case, Doe gave his health information not to his supervisor but to a separate employee in charge of handling FMLA requests, there was evidence that this information was shared with managers and supervisors. Problems could have been avoided by restricting managers' access to this information.

The ADA has an exception to its confidentiality provisions that allows managers to be informed about restrictions on work, but this exception is narrow. The manager here seemed to have access to more information than he needed. Just as HIPAA attempts to limit access to PHI to managers by requiring firewalls, the ADA also seeks to limit the flow of information where it is not needed.

Reprinted with permission from the March 2003 newsletter of the Employer's Guide to HIPAA Privacy Requirements, © Thompson Publishing Group, Inc., 2002. All rights reserved.

BenefitsLink is an independent national employee benefits information provider, not formally affiliated with the firms and companies who kindly provide much of the content and advertisements published on this Web site, including the article shown above.