Tips for Employers to Stay Compliant With Privacy Protections Under HIPAA, ADA, and 42 CFR Part 2

Quick Hits

• The ADA, HIPAA, and the 42 CFR Part 2 regulation seek to protect patients’ private medical information with different requirements for healthcare providers and employers.
• When employers receive a request for a reasonable accommodation, they can request a doctor’s letter or limited medical records for which there is a business need for the information. Non-healthcare employers typically are not subject to HIPAA and Part 2 for their employment functions.

HIPAA prohibits unauthorized use or disclosure of protected health information, unless the use or disclosure meets an exception, such as for treatment, payment, or operations. HIPAA applies to all medical information transmitted by covered entities and their business associates, including information about mental illness and substance use disorders. In general, hospitals, health plans, pharmacies, and other healthcare providers are subject to HIPAA privacy obligations.

Employers with self-insured, or self-funded, health plans are typically responsible for their plan’s HIPAA requirements. However, because an employer is generally not a covered entity under HIPAA for employment functions, those HIPAA prohibitions do not apply to an employer when the employer is addressing leave and accommodation requests.

Instead, employment laws like the ADA impose limits on the scope of medical inquiries and exams that an employer can require when addressing leave and accommodation requests. Specifically, an employer is limited to only seeking medical information for which there is a business need, such as to confirm the ADA applies or to confirm the scope of any restrictions for the employee that may support the need for a working accommodation or for a leave of absence.

The ADA prohibits employment discrimination and retaliation based on a person’s disability. Under the ADA, a substance use disorder can be a covered disability if it involves a legal substance, such as alcohol or opioids.

Part 2 prohibits the unauthorized use or disclosure of substance use disorder records pertaining to alcohol, illegal drugs, and legal drugs, except nicotine and caffeine. The regulation covers information created by substance use disorder programs, treatment facilities, hospitals, and employee assistance programs (EAPs). HIPAA and Part 2 do not prevent individuals from accessing or requesting their own medical records.

Requesting Medical Documentation for Accommodations

Under the ADA, an employer may request medical documentation only if:

• the employee has requested a reasonable accommodation,
• the disability or the need for accommodation is not obvious or already known to the employer, and
• the information requested is job-related and consistent with business necessity.

The employer’s request for documentation must be limited to validation that the employee has a disability as defined by the ADA and an explanation of how the disability limits a major life activity or job function. This may include details about the nature, severity, and expected duration of the impairment, and confirmation of how the requested accommodation can help the employee perform essential job functions.

It is unlawful for employers to require information about specific diagnoses or information that exceeds the medical information actually needed to meet the business needs. Any medical information an employer obtains for a disability accommodation must be kept confidential, which means only appropriate limited information should be shared internally with those who have a business need to know. For example, a manager of the employee requesting an accommodation may have a business need to know the scope and duration of the employee’s restrictions to be able to determine any reasonable accommodation that could be provided to assist the employee in effectively performing job duties. The medical information also must be kept separate from the employee’s personnel file.

Although employers may obtain a medical authorization from an employee so that the employer can directly obtain the limited medical information needed as part of the ADA accommodation process, many employers will simply provide a healthcare questionnaire form to the employee with instructions to return the completed form from the treating healthcare provider. When the employee is seeking his or her own medical information from the treating provider, there is no need for an employer to obtain a medical authorization from the employee. Regardless of the approach taken by the employer, the employer may want to use a questionnaire form as part of the ADA accommodation process to ensure only the limited medical information needed is actually requested and obtained.

Employers often document an employee’s authorization prior to requesting records from a healthcare provider. Likewise, healthcare providers may want to confirm that the employee has actually authorized the disclosure of personal health information to the employer.

Repeated and overly broad medical inquiries, efforts to obtain medical data unrelated to the job, or a failure to keep personal health information confidential could land an employer with a lawsuit alleging discrimination, harassment, or a violation of the ADA’s limitation on medical inquiries and exams.

EAPs and Wellness Programs

EAPs are typically handled by third-party administrators that give employers aggregated and anonymized data. An employer that inadvertently gains access to personally identifiable EAP datamay want to exercise caution to avoid treating disabled employees differently, including employees with mental illnesses or substance use disorders.

The ADA stipulates that participation in employer-sponsored wellness programs must be voluntary, rather than a condition of employment. For example, health risk assessments, nutrition programs, fitness classes, exercise trackers, and smoking-cessation programs are often built into employer wellness programs. Health data obtained through such workplace wellness programs must be kept confidential.

Employers With Part 2 Information

Though uncommon, under certain circumstances, an employer may receive health information subject to Part 2’s requirements. When a medical provider releases such information, it must do so pursuant to a patient’s authorization consistent with Part 2, and an employer is generally obligated to limit the use or sharing of the information protected by Part 2 to the purposes outlined by the patient’s authorization. Regardless, the employer may want to be mindful of the restrictions set by the ADA and limit disclosure internally to only those with a business need to know the limited information that needs to be disclosed for employment purposes.

Employers that obtain health information from a provider related to substance use disorders may want to take extra care to seek the underlying authorization that allowed the release of the information by the provider.

Next Steps

Understanding and complying with the privacy provisions in HIPAA, the ADA, Part 2, and state laws can reduce legal risk for employers. Therefore, employers may wish to train managers on the their internal procedures so that they take proper steps to ensure accommodation requests, drug tests, and workplace wellness programs are properly handled in a manner compliant with state and federal laws. They may wish to highlight that mental illnesses and substance use disorders can qualify as covered disabilities under the ADA, depending on the severity and nature of the impairment.

Ogletree Deakins will continue to monitor developments and will provide updates on the Cybersecurity and Privacy, Employee Benefits and Executive Compensation, Healthcare, and Leaves of Absence blogs as new information becomes available.

Tina M. Bengs is a shareholder in Ogletree Deakins’ Chicago office.

Stephen A. Riga is counsel in Ogletree Deakins’ Minneapolis office.

Tyler C. Strobel is an associate in Ogletree Deakins’ Denver office.

This article was co-authored by Leah J. Shepherd, who is a writer in Ogletree Deakins’ Washington, D.C., office. Follow and Subscribe
LinkedIn | Instagram | Webinars | Podcasts