Fine line: Employee records not part of medical data
Fine line: Employee records not part of medical data
'Important thing is maintaining those firewalls.'
As hospitals move rapidly toward an electronic medical record to improve patient care and coordination, employee health has a delicate task. Employee health can ride the wave to better use of technology but must still maintain employee confidentiality.
Employers should only receive limited information about an employee's health status, such as whether or not they have work restrictions or have been cleared for work, employee health experts say. Yet those same employees are often patients with information in the hospital's electronic medical records, which can be accessed by physicians and other clinicians.
"The important thing is maintaining those firewalls so the people who are looking at data solely for the purpose of employment-related activities are not privy to information that is not related to employment-related activities," says Roman Kownacki, MD, MPH, director of occupational health for Kaiser Permanente Northern California in Oakland.
"The other side of it is that if you're trying to create databases of an individual's entire health record, wouldn't you want information such as current immunization, X-ray findings related to follow up to a positive TB test, and other information that's important just for the person's general health record? How do you really assure that the appropriate firewalls are in place and the appropriate data is available for each particular entity?" he says.
Those challenges are being addressed in varying ways by employee health professionals across the country.
Just another occ health client
Think of hospital employee health as just another client of an occupational health clinic. Most employers would have no way to access a patient's personal health records, even if they wanted to.
"Technically, employee health records are not medical data, they're employment data. They're subject to employment law, not just medical record law," says Mary Stroupe, president of Integritas, Inc., a Monterey, CA-based company that makes the Stix employee health software and Agility EHR for employee and occupational health.
Some hospitals expect employee health to become a part of the broader electronic health record. But that system doesn't necessarily have the elements and functions that are required.
"For example, [the U.S. Occupational Safety and Health Administration] requires injury records be maintained 30 years after termination. If these records are part of the EMR, archived off after a period of time how can the hospital distinguish which records need to be archived off and which records need to be maintained?" says Stroupe.
There are important reasons that occupational health information is currently maintained in a separate record. "If the only place you're capturing employee health data is in the hospital's EMR, it's a problem," says Stroupe. "Let's suppose an employee has a blood and body fluid exposure. She doesn't want that where anyone in the hospital can see it.
"Or maybe the employee had a work-related drug screen. They don't want that in their personal health record. There are privacy issues that certainly the [employee health] nurses are very concerned about. The hospital's EMRs do not distinguish fundamentally between which data is employment-related and subject to employment law and which data is protected health information," she says.
Privacy protections also limit what is available to employee health professionals. Employee health does not have access to a patient's health record for example, to see whether a patient has had a previous HIV test. "We really try to keep our involvement with the electronic medical record separate," says Bruce Cunha, RN, MS, COHN-S, manager of employee health and safety at the Marshfield (WI) Clinic.
"In the past, our legal [department] said it would be okay for us to go into the electronic medical record to look up a patient's record to see if they were high-risk for bloodborne pathogens. They have since told us we can't access the EMR at all," he says.
Marshfield also seeks to protect employee information. "Employee health doesn't have any access at all to the electronic medical record of the clinic. We are two separate entities," he says.
"We treat ourselves as we do any other employer out there. No other employer outside the medical facility would have access to electronic medical records," he says. "If you treat yourself that way you're a lot less likely to have legal problems."
What you might need to share
Where do you draw the line? And how do you maintain the security? Hospitals have addressed this in different ways.
Kaiser developed its own software different ones for employee health and the electronic medical record that contains patient information. "We have to have multiple systems. There is no system that's out there that is the answer to everybody's problem," says Kownacki.
Many hospitals have occupational health software that allows for tracking and reporting of injuries. That software now is likely to conform to national EMR standards, which means it could potentially communicate with the hospital's EMR.
In fact, there are a few employee health items that you might want to allow into a patient's personal health record, such as immunizations and medication allergies.
"The aspirational goal is that on the individual patient level, you want to have a full medical record. You don't want to have a siloed medical record," says Kownacki. "What you would need is a system that you could set security protections and firewall protections."
Sharing information on medications and adverse reactions between the employee health system and the ambulatory EMR may be important in some cases to protect the employee from medical mishaps, notes Stroupe. "Whereas in the past it was not feasible [to share such information], now it's not only feasible but it's part of the whole point of having an electronic medical record," she says.
Posing new questions of records
There are other questions about information-sharing that can impact the employees' health. For example, hospitals also are increasingly collecting health information through wellness programs, including monitoring cholesterol, blood pressure, and body-mass index. What are they doing with that information? Should it be a part of the EMR, as well?
"Let's say employee health has been monitoring people and there's been some incident [such as a heart attack]. Nobody in the emergency room on Saturday night has access to all that information that employee health has been collecting," says Stroupe.
Employees may choose to share the personal health information collected by employee health with other physicians, she said. "What I anticipate happening is that the employee is going to say, 'You've been tracking my blood pressure, will you send that to my personal health record?'" says Stroupe.
Meanwhile, employee health also wrestles with lack of access to the employee's electronic health record. "If you've got a carpal tunnel case, the weight will have been redacted off the record," says Cunha. "That's part of the information I need to know. Weight is a significant risk factor for carpal tunnel."
One thing is certain: electronic medical records and occupational health software will continue to evolve. Employee health professionals should be sure that they are part of the conversation related to information technology, and that they have an advocate in the administration who understands their needs and concerns, says Kownacki.
Avoiding an electronic record isn't an option, he says. "Going from a paper record to an electronic record is going from the horse and buggy era to the 21st century," he says. "I can't even imagine going back, and I think we're just scratching the surface of what the use of this technology will be in improving health care."
As hospitals move rapidly toward an electronic medical record to improve patient care and coordination, employee health has a delicate task. Employee health can ride the wave to better use of technology but must still maintain employee confidentiality.Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.