Medical Privacy Rights of Employees
- If an employer or prospective employer requests your medical records from a doctor or insurance plan, or asks specific questions about your health status, the Privacy Rule prevents them from releasing this information without your authorization. The rule applies equally to electronic, written and oral forms of information, including conversations about you that may have taken place among doctors, nurses and other providers. Employers are also prohibited from accessing your health care bills from providers or clinics.
- Many different types of health care providers are covered by the Privacy Rule, and they must have procedures in place to prevent unauthorized disclosure of your records. This means that in general, your employer cannot obtain medical information about you from the vast majority of practitioners such as doctors, dentists, chiropractors and psychologists; health care delivery sites, including hospitals, clinics and nursing homes; billing and payment entities like insurance companies, health management organizations, company self insurance plans, Medicare and Medicaid; and health care clearinghouses, which process or convert one form of medical data into another.
- The Genetic Information Nondiscrimination Act was passed in 2008 to protect employees from a wide range of discriminatory practices, including harassment, based on their genetic information. The law applies to all private businesses, state and local government bodies, public schools and labor organizations with at least 15 employees. Covered employers may not request or require records of your genetic tests, tests of your relatives and/or your family medical history. If these records are in an employer's possession, they must be kept confidential.
- In addition to blocking an employer's access to your medical information without your consent, HIPAA gives you rights of review and notification. If you ask for a copy of your records, covered providers are generally required to provide it within 30 days. If there are errors in your file, you are entitled to have corrections made and/or missing information added within 60 days. While the law allows your medical records to be released, under limited circumstances, to certain parties without your knowledge, you have a right to be notified of a particular provider's policy about releasing this information and to get a report if it occurs.
