This is the first in a series of posts regarding medical privacy issues in the workplace. This first post concerns the handling of medical documents.
Both the ADA and FMLA dictate that any information related to an employee or job applicant’s medical history or current medical condition must be kept confidential in files separate from general personnel information.
The California Confidentiality of Medical Information Act (CCMIA) defines medical information as any individually identifiable information in the employer’s possession or derived from a health care provider regarding medical history, mental or physical conditions or treatment.
The CCMIA requires employers to set up procedures to ensure that this medical information remains confidential and is protected from unauthorized use and disclosure. Civil Code sec 56.20(a).
Employees who handle medical record files should be instructed about maintaining their confidentiality and records should be kept under lock and key, separate from personnel files, and if computerized, protected by access codes.
Disclosure within the company is allowed when: (1) supervisors require information about work restrictions or impairments in order to make necessary accommodations, and (2) when required by first-aid and safety personnel for possible emergency treatment.
There are also exceptions for the employer’s use and disclosure of medical information to the WCAB, information sought as part of an investigation of an on-the-job accident or illness, and maintaining a “workers’ compensation” file regarding an industrial accident.
The physician-patient privilege does not protect communication pertaining to an issue tendered in litigation based on an injury or disability, per Evidence Code sec 996, and employer disclosure of relevant information is allowed in a lawsuit, grievance or claim in which the employee places his or her medical history or condition at issue. Civil Code sec 5620(c).
Labor Code sec 3762 limits an insurer’s disclosure to its insured employer, except work restrictions or impairments necessary to make accommodations and diagnosis information where the diagnosis affects the insured’s premium. There is a general consensus that certain key people, such as a workers’ compensation manager with a self-insured employer, are entitled to the same information as an insurance company.
For example, if a workers’ compensation insurer obtains work restrictions from an injured worker’s doctor, it is permissible for those restrictions to be shared with the insured employer’s liaison per LC 3762. The liaison should then sequester that limited medical information in a separate file under lock and key, but can inform the worker’s supervisor if necessary to make reasonable accommodations.