Under state statutes, you cannot use or disclose medical information pertaining to your employees without a written authorization from the affected employee.2 This prohibition includes knowingly permitting an employee to use or disclose another employee’s medical information.

Discussing an employee’s private medical information with other employees who do not have a need to know the information can also lead to claims of invasion of privacy.3

For instance, in one case, a California court of appeal clarified that an employee may bring a lawsuit against an employer who publicized an employee’s private medical condition by discussing it with employees who did not need to know the information.4

The employee, Melissa Ignat, worked for Yum! Brands (Yum), the corporate parent of various fast food franchises, from 2005 - 2008. During that time, Ignat suffered from bipolar disorder. She took medication to control the disorder, but the side effects of that medication occasionally caused her to miss work.

In 2008, Ignat went on a disability leave. While on leave, Ignat’s supervisor told everyone in the department that Ignat was bipolar. Ignat claimed she was subsequently avoided by and shunned by her co-workers. One co-worker allegedly asked the supervisor if Ignat was likely to “go postal.”

Yum terminated Ignat in September 2008. Ignat filed suit against Yum and her supervisor, alleging, among other things, invasion of privacy by public disclosure of private facts.

The court held that private facts can be just as widely disclosed verbally as they can be through writings, if not more so.

Case law highlights the need to limit the disclosure of sensitive medical information.

However, medical information can be disclosed in limited circumstances:

• When compelled by a court of law or by a lawsuit filed by an employee
• When used for administering and maintaining employee benefit plans
• In relation to a workers’ compensation claim or request for medical leave5

You are not liable for any unauthorized use of the medical information by the person or entity to which you disclosed the information if you have attempted, in good faith, to comply with these medical privacy laws.6

You cannot discriminate against an employee who refuses to sign an authorization releasing medical records.7 However, the law does not prohibit you from taking necessary action in the absence of medical information due to the employee’s refusal to sign a medical release authorization.8

For example, if you are unable to ascertain an employee’s physical ability to perform a job function due to the employee’s refusal to sign an authorization, including a test to evaluate alcohol or drug usage based on reasonable suspicion, you have the right to discipline an employee based on the information available.

Authorization for an employer to disclose medical information is valid if it meets all of the following criteria:

• Handwritten by the employee/patient who signs it or is in typeface no smaller than 14-point type
• Clearly separate from any other language on the same page
• Signed only to authorize release of medical information and for no other purpose
• Signed and dated by the employee/patient or a legal representative if the employee/patient is a minor or the representative of a deceased employee/patient9

An employee who signs an authorization to release medical information is entitled to a copy of the release at their request.10 The release can be canceled or modified at any time, effective upon written notice to you.11

• Establish a confidential file for each employee that contains information related to the employee’s medical issues. Keep it separate from the regular personnel files and grant access only to those with a legitimate need to know the information.

A supervisor who is considering a particular employee for a promotion to a clerical position in another department probably has no need to know information on that employee’s employment physical. But if the position to which the employee will be promoted requires heavy lifting, records from the employment physical may be necessary to assess the individual’s restrictions or necessary accommodations.

Also, make certain that you comply with all leave laws, such as family and medical leave or pregnancy disability leave laws, relating to obtaining medical information.

Electronic Health Records

Electronic health records must be protected. If you keep electronic medical information, you must comply with these requirements:

• Protect and preserve the integrity of electronic medical information.
• Automatically record and preserve any change or deletion of any electronically stored medical information. The record of any change or deletion must include the identity of the person who accessed or changed the medical information, the date and time the medical information was accessed and the change that was made to the medical information.

Genetic Information Nondiscrimination Act (GINA)

GINA prohibits the use of genetic information, including family history, to make decisions about health insurance and employment, and restricts the acquisition and disclosure of genetic information.

GINA covers private employers with 15 or more employees. GINA generally prohibits employers from requesting, requiring or purchasing an applicant’s or employee’s genetic information, even if the employer never uses that information. Title II of GINA also prohibits employment discrimination based on genetic information.

The U.S. Equal Employment Opportunity Commission (EEOC) issued final regulations implementing the employment provisions of GINA.

According to the EEOC, “genetic information” includes:

• Information on an individual’s genetic tests
• Information on the genetic tests of a family member
• Family medical history
• Requests for and receipt of genetic services by an individual or a family member
• Genetic information on a fetus carried by an individual or family member
• Genetic information on an embryo legally held by the individual or family member using assisted reproductive technology

For instance, the EEOC settled a lawsuit involving a company that requested family history information as part of its post-offer/pre-employment medical exams of applicants. Such actions violate GINA.

For more information, visit the EEOC website.

For information on wellness programs and limitations on gathering protected information, see Wellness Programs.

California Protections for Genetic Information

California law makes it illegal to discriminate against employees or applicants because of genetic information. For more information, please see Discrimination on the Basis of Genetic Characteristics and Genetic Information.

Keeping Other Protected Medical Records Private

Records protected under state and federal privacy laws encompass more than a physician’s report or the lab results from a drug test. Medical records can include:

• Family and medical leave request forms if an employee voluntarily discloses the nature of their illness on this form
• Return to work releases
• Workers’ compensation records
• Information on disabilities being accommodated under the ADA or FEHA
• Other records that relate in any way to an employee’s medical history

The ADA and FEHA also require that you maintain an applicant’s or employee’s medical history information on separate forms, treated as confidential and kept in separate files from the employee’s general personnel information.12 You can disclose information only if:

• Supervisors need information about necessary restrictions or accommodations for work duties.
• First aid personnel might require the information to administer emergency treatment.
• Government officials, investigating ADA or FEHA compliance, request the information.13

1. Civ. Code sec. 56.35