HIPAA Privacy Rule and non-government mandatory drug testing/physicals

[Guest Jkyger]

New Privacy Rules say that a disclosure wavier is not required for drug testing/physicals if OSHA, MSHA, or state law require it, however what about drug testing for pre-employment, for-cause, after accident, follow-up, etc., and physicals (that comply with ADA, etc.) for is NOT required by OSHA, MSHA or state law? It seems like a full blown compliance with the HIPAA Privacy Rule is required. Tell me I'm wrong and why! Please!

You would think HHS would also cite DOT drug testing requirements as well???

[Steve72]

Whether you are wrong or not depends on whether the testing entity is a covered entity. Many employer clinics maintained for this purpose are able to escape from HIPAAs definition (for example, because they do not conduct any covered transactions electronically).

Even if the testing entity is a covered entity, however, there is a (relatively) easy out. Remember that the employer itself is not covered by HIPAA's rules. There is nothing in HIPAA that would prevent an employer from requiring an employee to submit to drug testing and executing an authorization for the employer to receive the information. Failure to execute the authorization would subject the employee to disciplinary action.

HIPAA prevents covered entities from conditioning the provision of treatment payment or healthcare operations on the execution of an authorization. It does not extend similar restrictions to employers.