Don't violate patient privacy regs for anyone

Have you ever been put into the uncomfortable position of being asked for confidential health information about an employee by a senior leader or administrator? Be ready for this "sticky situation," as it may violate patient privacy regulations, says Patricia B. Strasser, PhD, RN, COHN-S/CM, FAAOHN, principal of Partners in BusinessHealth Solutions in Toledo, OH.

Managers may wrongly believe they don't need to comply with the Health Insurance Portability and Accountability Act (HIPAA) because it's a health insurance regulation. They may mistakenly think that the regulation doesn't apply to in-house occupational health.

However, maintaining confidentiality of health information extends beyond HIPAA. "Responsibility for preventing disclosure of health information does not rest exclusively with health care providers. Managers who are in receipt of medical information must also prevent inappropriate disclosure of the information," says Strasser.

Be prepared to make management aware of this fact, if they ask for inappropriate information. "Sometimes supervisors want more information than they need to have," says Strasser. "Occupational health nurses are frequently pressured to provide information such as an employee's diagnosis."

Human resources professionals are more likely to be aware of the regulations, and say, "Just tell me what I need to know." "Many don't want to even know the information or have the chance to be influenced by it," says Strasser. "There is more awareness because of the increase in legislation and lawsuits."

Managers may ask about a worker's condition, or why a potential employee didn't pass a post-offer evaluation. "The issue is not what the diagnosis is," says Strasser. "The issue is whether the person is capable of performing the job requirements with or without accommodation. Knowing that a person has had a myocardial infarction or has asthma is not important for the supervisor to know. What's important is what the person's physical capabilities are."

Don't give in to pressure

Don't ever disclose information you know is not appropriate to give. "Not only are you jeopardizing your professional ethical obligations, but there may be legal issues as well," says Strasser.

Instead, help the company managers understand that a specific diagnosis doesn't matter. "Medical conditions affect each person differently," says Strasser. "One person may be totally incapable of performing a job because of a certain condition. Another person with the same diagnosis may be able to do the job without any difficulty."

Still, occupational health nurses/managers frequently find themselves torn between safeguarding employee health information and being responsive to their employers, says Kathleen Liever, an employment law associate at Fowler White Boggs in Tampa, FL.

"Privacy violations can arise as a result of pressure by human resources personnel or supervisors to reveal employee or applicant health information beyond that related to the particular job performed," says Liever.

During a disciplinary investigation, you may be asked to turn over a doctor's note submitted by an employee who has a history of absences.  Similarly, an employer may require a fitness for duty certificate or doctor's note in order for an employee to return to work after an extended absence or leave. "These notes often state the employee's diagnosis, which is confidential," says Liever.

[For more information on compliance with patient privacy regulations, contact:

Kathleen Liever, Employment Law Associate, Fowler White Boggs, Tampa, FL. Phone: (813) 222-2086. Fax: (813) 229-8313. E-mail:]