EEOC Warns Employers About Combining Health Records

A U.S. employer that retains an employee’s personal and occupational health information in a single electronic record runs the risk of violating federal disabilities bias law, federal genetic discrimination law, or both, according to an opinion letter issued by the U.S. Equal Employment Opportunity Commission (EEOC).

The opinion letter, dated May 31, 2011, and signed by EEOC Legal Counsel Peggy R. Mastroianni, informs an unidentified writer soliciting an opinion that though U.S. employers and some health providers have legitimate rights to access personal health information under certain circumstances, a combined electronic medical record (EMR) could lead to violations of the Americans with Disabilities Act (ADA) and the Genetic Information Nondiscrimination Act (GINA).

“An employer’s right to access personal health information about applicants and employees and to allow access to occupational health information by individuals providing health services unrelated to employment is strictly limited under both the ADA and GINA,” wrote Mastroianni. “Therefore, maintaining personal health information and occupational health information in a single EMR, particularly one that allows someone with access to the EMR to view any information contained therein, presents a real possibility that the ADA, GINA or both will be violated.”

The letter says it assumes that the employer that contacted the EEOC is using the term "personal health information" to refer to "information obtained in the course of diagnosis and treatment" and that the term "occupational health information" refers to "medical information concerning an employee's ability to work (e.g., medical information gathered after a job offer has been made, or information concerning an injured employee's ability to return to work)."

The letter comes at a time when the Obama administration is urging greater use of electronic medical records to make health care more efficient and less costly. It underscores the complex task that HR professionals must face in managing health benefits, leave and other functions that rely upon private information of employees and job applicants.

The EEOC letter noted that the ADA limits an employer’s right to make disability-related inquiries and conduct medical exams of employees and job applicants. And it said that the EEOC “has not explicitly addressed whether accessing personal health information stored in the same EMR as occupational health information would constitute a disability-related inquiry.” But the letter continued: “There seems to be no basis for distinguishing between this situation and others that the (EEOC) clearly has said would be disability-related inquiries,” and therefore subject to legal restrictions.

And the opinion letter noted that the genetic bias law, with some exceptions, “prohibits employers from requesting, requiring or purchasing genetic information … about job applicants and employees or their family members at any time, including during the post offer stage of employment.”

Mastroianni stated that “neither the ADA nor GINA specifically addresses the need for encryption, password authorization, and other security safeguards for electronic records maintained by employers. However, we do not interpret either statute’s confidentiality provisions as applying only to paper records. Therefore, if an employer maintains medical information and genetic information electronically, it must ensure that it is kept confidential, and disclosed only to the extent permitted by the ADA and GINA.”

The letter suggested that if an employer asks to see an employee’s or job applicant’s medical records, it should include a warning that if it acquires genetic information in the process, that acquisition is inadvertent.

Steve Bates is manager of online editorial content for SHRM. He can be reached at steve.bates@shrm.org.

Related Article:

Most Employers Unknowingly Affected by GINA, SHRM Online Legal Resources, July 2011