The tough decision to use confidential information.

The employer's duty and employee rights collide when employers reveal medical claims information.

DILEMMA A

A heavy-equipment operator has a history of alcohol and substance abuse. This operator's job performance has been satisfactory after getting help and cleaning up his act.

The help included special medication to help him kick his substance abuse habit. Suddenly the operator has stopped submitting receipts for his medication reimbursement from the Section 125 plan. Does the plan administrator assume that the operator is back to abusing drugs and could endanger the lives of co-workers? What can the administrator do, what actions should he or she take?

DILEMMA B

You are an insurance claims administrator for a health services company, which is self-insured. This company has several positions that persons who have tested positive for the AIDS virus cannot hold (the reasons for excluding the AIDS patients are bona fide and would hold up against an ADA claim). One day, a person who holds one of those positions submits a receipt for reimbursement for AZT (medication for AIDS patients). What is the responsibility of the claims administrator to protect the company or the privacy of the employee?

DILEMMA C

A claims administrator for a self-insured company finds a reimbursement claim for a lithium prescription (an anti-depressant medication) filed by a high-level project manager. The company is trying to decide which manager to assign to a very important, yet very stress-filled project. Is it the claims administrator's duty to inform the company about the project manager's possible depression or must the manager's right to privacy be protected?

Medical records are, by law and tradition, confidential records. Yet some employers are making a decision to break that confidentiality. When an employer's obligation to provide a safe workplace and an employee's right to privacy collide, employers face an ethical dilemma. On the one hand, medical claims are confidential; on the other hand, not disclosing confidential information could endanger workers, or the public or possibly cause loss of life.

"The employer has a duty to provide a safe workplace and also the duty to keep certain information confidential about employees. Employees have the right to a safe workplace and to reasonably expect a right to privacy," said Jack Raisner, professor of law for the St. John's University School of Business Administration in New York. "So, it becomes a matter of duties versus rights."

As the number of self-insured employers grows, and more benefit and medical records are filed on computers, the potential for compromising employee privacy increases.

"The sophistication of computers and the amount of benefits information employers are storing on computers opens up a whole can of worms," said Peggy Espy Schiffers, president of Schiffers Associates, a human resource consulting firm located in Arlington, Va. "Before computers were widely used, it was much harder for employers to find patterns of behavior. Now, there are lots of ways for employers to discover and spot anomalies through benefits and medical records."

With the ability to access records at their fingertips, employers must determine how they handle the information. Under some state laws and common law, employees have a right to privacy, but increased accessibility means an employer cannot ensure the privacy of employee medical records.

"Employers should probably put up a sign over their entrance that reads: 'All hope abandon, ye who enter here!' Because employers in this day and age cannot absolutely, 100 percent, guarantee their employees' right to privacy," said Sally Henning, an attorney in private practice in Akron, Ohio, and former chief counsel to B.F. Goodrich/Uniroyal Inc.

Because of the nature and the amount of information available, some employers may not be aware of what records are kept and the information that those records can impart. For example, by tracking Section 125 reimbursement plan activities, it's possible for employers to spot patterns in an employee's behavior--such as increasing visits to a physician and purchasing prescription drugs.

No clear rules

"Handling information from medical claims is an area where the rules aren't too clear," said Schiffers. "I always tell my clients that they need to be aware of that. When you set up a benefits package, you must have procedures built into it."

Since every situation requires a different solution, it's difficult for employers to always adhere to procedures. However, procedures provide consistent guidelines, and inconsistency can be an employer's worst enemy. Employers that aren't prepared to deal with these types of dilemmas could be forced to make quick, emotion-wracked decisions--and that's generally when mistakes happen.

Employers also have to consider how federal and state laws regulate both medical and other employment-related records. For example, the Americans with Disabilities Act (ADA) regulates how employers can use information on medical conditions. And under the ADA, some medical conditions are defined as disabilities.

"An employer's duty in keeping an employee's medical records confidential has definitely been strengthened by the ADA," said Raisner. "An employer that uses information from medical claims to make an employment decision must have an overriding concern such as protecting the health, safety and security of its employees. Otherwise, the employer shouldn't use the information."

According to Raisner, the employer's need-to-know is the key. If there is a substantial risk of harm to others, then it may be well within an employer's right to act on the information.

HR professionals interviewed for this article agreed with Raisner. In a situation like Dilemma A, with the heavy-equipment operator receiving treatment for substance abuse, the potential for injury to others and possibly the public overrides the need for privacy. Of course, all the HR professionals agreed that the situation had to be handled carefully.

"If you have taken the proper precautions with the heavy-equipment operator, then you are well within your rights to act on the information," said E. Sue Reitz, vice president, human resources, Children's Hospital in Akron, Ohio.

"By proper precaution, I mean developing a system like our hospital uses. We have a re-entry contract for employees who have gone through substance abuse rehabilitation. For two years, we review their performance and keep a close watch on attendance, sick days and benefits records. The employee signs the contract and is aware that he or she is placed under a microscope for two years."

Raisner said that a contract or agreement of this type works well, because it automatically lowers an employee's expectations of privacy. "The employee knows and expects that his or her employment records will be examined carefully to spot any potential problems," Raisner said.

In most cases though, an employer doesn't have the right to use medical claims information when making an employment decision. This applies in Dilemma C to the employee who is taking lithium, a well-known treatment for depression.

"A case like that one should throw up a giant red flag," said Reitz. "There is absolutely nothing there that justifies an employer's right to know."

In Dilemma B, the employee receiving a prescription for AZT, matters of public policy or public health would probably justify the employer acting on the information and asking the employee to take a blood test. However, employers have to exercise caution.

"You can't be 100 percent positive that the prescription is for the employee," said Schiffers. "It could be for a dependent or spouse."

An employer asking for an HIV test on employees working in health care is not totally out of line. Again, Raisner points out that in such a sensitive area, employee expectations of privacy may be lowered.

"Again, if you take the proper precautions, you shouldn't have to face a dilemma like this," said Reitz. "In most cases the employer probably has no right to know, especially if the information comes from confidential medical records. However, in medically sensitive jobs, an employer can require employees to undergo blood testing. But an employer has to inform employees before hiring them that it reserves the right to random testing."

All employers have to keep an overwhelming amount of information about employees on file. As in the case of all employment records, medical and nonmedical, someone has to review and store that information. So in a sense, the employee's privacy has already been compromised. It's up to the employer to determine how confidential information is used and protected.

Bill Leonard is a staff writer for HRMagazine.