HIPAA Privacy and Employment Records

[Guest FAQ]

When new employees start on the job (a factory), the employer obtains a medical history from the employee, including questions such as present medicines being taken by the employee, recent surgeries, allergies, etc. The employer also maintains a group health plan.

The information is kept in a sealed envelope in the employee's personnel file, to be used only if needed in an emergency (e.g. the employee is unconscious on the factory floor and the first responders need to know about medical conditions or if he's allergic to anything).

Two questions -- First, would the medical history information fit under the PHI employment records exception?

Second, if the medical history would not meet the exception and must be protected as PHI, am I correct that disclosure to first responders or other medical providers would fit under the treatment exception to nondisclosure of PHI?

The employer could of course stop collecting the medical histories and require that information be obtained from providers or the health plan, but having the information on site could be important in a life-threatening situation.

Thanks in advance for any thoughts.

[J2D2]

I believe that this situation qualifies for the employment records exception. As you describe it, the information is kept sealed in the personnel file and is not created or received by a group health plan. Since the employer is not a covered entity, information that it creates for use its own use should qualify for the exception.

[Guest EmpBen]

IMHO, the employer should not be collecting this information. Has there ever been a situation when it was useful for the purpose intended? Not likely, I imagine. However, what happens when an employee collapses to the floor and the envelope is not retrieved? The employer may be held to a higher standard of care if they "should have known" the information provided by the employee. Alternatively, what if the information is so outdated by the time the employee has an incident that warrants its use that it actually harms the employee's health in using the information?

You don't mention keeping the information current. It would seem to be of very little use for a very limited time and more of a nusiance to the employer in today's world of litigious employees and myriads of privacy issues. I think the best call would be to eliminate it altogether.