Workplace Privacy Counsel : San Francisco Employment Privacy Law Lawyer & Attorney : Littler Mendelson Law Firm : Employment Related Privacy Issues

Approximately one month after sending this e-mail, Messier quit his position with Thrivent, apparently not on good terms, and he began looking for another job. When three consecutive prospective employers rejected Messier after contacting Thrivent for a reference check, Messier hired a reference checking company to call Thrivent, posing as a prospective employer, and inquire about Messier. In response to this inquiry, Messier’s former supervisor at Thrivent stated that Messier “has medical conditions where he gets migraines. I had no issue with that. But he would not call us. It was the letting us know.” Representing Messier, the EEOC took the position that Thrivent’s response violated the ADA’s confidentiality requirement because the ADA protects medical information learned by an employer through any job-related inquiry.

The Seventh Circuit rejected the EEOC’s position based on the ADA’s plain language. More specifically, the ADA’s confidentiality provision, by its plain terms, applies only to medical inquiries. By contrast, when Messier wrote the November 1, 2006 e-mail to his supervisor at Thrivent, Messier was responding to a generalized inquiry about “what was going on,” not to a medical inquiry. Consequently, Messier voluntarily disclosed that he had suffered a severe migraine, and the ADA did not prohibit Thrivent from re-disclosing that information.

The Seventh Circuit’s ruling is significant because employers can receive information about the medical condition of employees from a variety of sources, particularly with the explosion of self-disclosure in social media. By contrast, the ADA permits employers to make medical inquiries of current employees, or to require employees to undergo a medical examination, only: (a) when an employer has objective evidence to question whether an employee can perform essential job functions; (b) when necessary to evaluate an employee’s request for an accommodation; or (c) when necessary to determine whether an employee poses a direct threat of harm to himself or others.

In other words, like HIPAA, the ADA protects only a subset of employee health information that an employer might receive during the course of the employment relationship. As to this subset, the ADA’s confidentiality provision imposes on the employer a legal obligation to keep the information confidential, maintain it separately from the general personnel file, and limit access to those with a need to know. The Seventh Circuit’s ruling makes it easier for employers to establish policies and procedures to satisfy these legal compliance obligations because the decision narrows and specifically identifies the scope of employee health information that is subject to the ADA’s confidentiality requirement.

The Seventh Circuit’s rejection of the EEOC’s broad reading of ADA confidentiality, of course, does not mean that an employer should be careless with employees’ health information not protected by the ADA or HIPAA. State law, such as California’s Confidentiality of Medical Information Act, may still apply. But even when state law provides no protection, disclosing employees’ health information to those without a need to know exposes the employer to the risk that the information will be used improperly and has the potential to create tension and undercut employee morale. To reduce these risks, employers should remind managers who may receive voluntary disclosures of employee health information to limit their disclosure of that information to those with a need to know.

Photo credit: hoch2wo photo & design

Notably, the case did not involve an alleged HIPAA violation at all. Although in-house physicians are health care providers as defined by the HIPAA Privacy Rule, they are not “covered” health care providers required to comply with the Privacy Rule. Only providers who use HIPAA-mandated electronic codes to bill insurance companies and government welfare programs for services are subject to HIPAA. Because virtually all in-house physicians are paid a salary and do not bill for their services, HIPAA does not apply to them, contrary to common misconceptions of HIPAA’s scope.

The ADA’s confidentiality requirement, by contrast, does apply to in-house physicians. The ADA requires that employers separately file employees’ medical information and maintain it as confidential. The ADA carves out only three narrow exceptions to the confidentiality requirement. Employee medical information may be disclosed to managers to the limited extent necessary for them to accommodate an employee with a disability or otherwise be made aware of work restrictions, to first aid and safety personnel who need to know about a disability that might require emergency treatment, and to government officials responsible for enforcing the ADA.

The court in the General Dynamics case read the ADA’s confidentiality requirement to apply not only to disclosures to third parties outside the company (except in the limited circumstances described above), but also to intra-corporate disclosures. More to the point, if the complaint’s allegations turned out to be true, the in-house physician would have violated the ADA because her disclosure of Blanco’s medical information was not necessary for managers in General Dynamics’ Labor Relations Department to accommodate Blanco or to address a work restriction, and the other two exceptions obviously did not apply.

The General Dynamics decision is particularly remarkable because the court held that the ADA protects even false medical information provided by an applicant or employee to an employer. The court explained its reasoning as follows:
 

The ADA clearly protects the confidentiality of Mr. Blanco’s response [to the medical questionnaire] if truthful, and the ADA still protects its confidentiality if not. In other words, there is no prevarication exception to the ADA’s confidentiality mandate for employment entrance examinations, much less for information the company doctor perceives is inaccurate. It is the information, accurate or not, that the statute protects.

(emphasis supplied). While the court acknowledged that this ruling could be troublesome for employers, such as General Dynamics, whose employees operate heavy machinery or are exposed to workplace hazards made even riskier by a disability, the court concluded that it was bound to apply the ADA’s plain language and leave the policymaking to Congress.

The second recent decision establishes a critical limitation on what might otherwise seem like a boundless protection in light of the General Dynamics case. In the second case, Thrivent Financial for Lutherans (Thrivent) had hired a temporary IT consultant, named Messier, through Omni Resources (Omni). When Messier, a typically reliable employee, was “no-call, no-show” for work, Thrivent asked Omni for an explanation. Messier’s manager at Omni sent Messier an e-mail asking him to call because he “need[ed] to know what’s going on.” Messier responded with a lengthy e-mail to both his Omni and Thrivent managers, explaining that he had missed work because of a severe migraine and providing them with a lengthy explanation of his medical history related to migraines. The Thrivent manager later disclosed this information to a reference check company hired by Messier who suspected the Thrivent manager of re-disclosing his medical information. The EEOC, taking up Messier’s cause, sued Thrivent for violating the ADA’s confidentiality requirement.

The critical dispute between the parties revolved around whether the ADA protected Messier’s medical information in the first instance. The EEOC took the position that the ADA protects any health information provided by an employee in response to an employer-initiated inquiry, such as the inquiry by the Omni manager into the reason for Messier’s absence. Thrivent responded that the ADA protects only information that an employee is required to provide in response to a permissible medical examination or disability-related inquiry, such as a mandatory post-offer, pre-hire medical examination or a request for medical documentation to support a request for an accommodation. Because Messier had volunteered health information in response to the Omni manager’s generalized inquiry into the reasons for Messier’s absence, the ADA did not apply.

The court rejected the EEOC’s broad reading and adopted Thrivent’s narrower construction. The court reasoned as follows:

[A]n employee’s disclosure is voluntary if the disclosure is not preceded by any request or demand for medical information by the employer. Which party initiates the conversation that leads to a disclosure is not relevant; which party initiates or requests the employee’s actual disclosure of medical information is determinative.

Applying this standard to Omni’s inquiry, the court concluded that the ADA’s protections did not attach to Messier’s medical information because Omni had not asked Messier for medical information and Messier could have been absent from work for a “vast number of reasons” unrelated to his health.

HIPAA was not a factor in this case because information received by an employer in its capacity as employer is not subject to HIPAA’s protections. HIPAA applies only to individually identifiable health information created or received by or on behalf of the employer in its capacity as the administrator of a HIPAA-covered plan. Such plans are limited to group health, dental, vision, long-term care, pharmacy benefits, health care reimbursement flexible spending accounts, and employee assistance programs.

This pair of cases provides important guidance for employers on the boundaries of the ADA’s confidentiality requirement. They also reveal, by negative implication, the relatively narrow boundaries of HIPAA’s privacy protection in the employment context. Employers who have not developed policies and procedures for handling employee medical information not protected by HIPAA should consider doing so to ensure that in-house medical staff, HR professionals and managers understand when the ADA protects employee medical information, how that information may be lawfully used, and to whom it may be lawfully disclosed.

Photo credit: hoch2wo photo & design

Appolon bases her putative class action on the premise that the University’s use of credit reports in hiring disparately impacts African American and Latino applicants. She postulates that African Americans and Latinos suffer more economic hardships that adversely impact credit ratings, such as job losses and health-related bankruptcies, and that these economic hardships result in significantly lower credit ratings. Hence, Appolon contends that the use of credit reports discriminates against African Americans and Latinos.

Yet, as detailed in our blog post on the EEOC’s public meeting in October, there is a dearth of reliable studies bearing on whether use of credit history in employment decisions has an adverse impact on African Americans or Latinos. Participants at the EEOC’s public meeting noted that African Americans and Latinos do tend to have lower credit scores than Caucasians. However, employers do not receive credit scores as part of a credit history check. Consequently, studies that focus on disparities in credit scores have little to no utility when evaluating whether employers’ use of credit history has a disparate impact on these protected classes.

Appolon further postulates that credit backgrounds do not accurately predict job performance or workplace crime. She alleges that reliance on such information, therefore, is discriminatory because it is not job-related. However, participants at the EEOC meeting also addressed the lack of evidence on this point. Indeed, the meeting participants could not point to a single study that proved or disproved a link between poor credit history and poor job performance and/or workplace crime.

Even in light of the uncertainty over whether the use of credit history reports actually disproportionately impacts any protected class(es), employers should expect that Appolon’s lawsuit will be the first of many. The EEOC has strongly suggested that it will scrutinize the use of credit history reports by employers. Plaintiffs class action lawyers likely will be following Apollon’s counsel in response to this not-so-subtle cue. Accordingly, employers should re-evaluate their use of credit history in employment decisions to ensure that they are in the best possible position to defend against this next anticipated wave of employment litigation.

This entry was written by Katherine Dix.

Photo credit: contour99

Family members include: a spouse; children (natural and adopted); siblings and half-siblings; aunts, uncles, nieces and nephews; grandparents and grandchildren; great- and great-great-grandparents and grandchildren; and first cousins and first cousins once removed. Medical history includes information concerning any disease or disorder that any of these individuals has suffered — whether or not hereditary — as long as the disease or disorder has been diagnosed or the symptoms have sufficiently manifested themselves that the disease or disorder could reasonably be diagnosed.

The fact that an employee’s adopted child has the chicken pox, father was deaf, grandmother died of breast cancer or great-great grandfather died of gangrene after being shot in the Spanish-American War constitutes “genetic information under GINA and the EEOC’s implementing regulations.”

2) Warn Health Care Providers Not to Share Family Medical History

Doctors are trained to collect family medical history. Employers routinely request from doctors health information about employees, for example, for purposes of evaluating a request for a reasonable accommodation or for leave, or in connection with a workers’ compensation claim. An employer who asks a physician to provide health information about an employee runs the risk of violating GINA’s prohibition against requesting genetic information — even if the employer does not expressly ask for genetic information.

According to the EEOC, employers generally should anticipate that health care providers may disclose genetic information in response to a general request for health information related to an employee. The regulations, however, provide employers with a “safe harbor” if they include in their request to the provider the following instruction found in the EEOC’s implementing regulations (or similar language):

"The Genetic Information Nondiscrimination Act of 2008 (GINA) prohibits employers and other entities covered by GINA Title II from requesting or requiring genetic information of an individual or family member of the individual, except as specifically allowed by this law. To comply with this law, we are asking that you not provide any genetic information when responding to this request for medical information. 'Genetic information' as defined by GINA, includes an individual's family medical history, the results of an individual's or family member's genetic tests, the fact that an individual or an individual's family member sought or received genetic services, and genetic information of a fetus carried by an individual or an individual's family member or an embryo lawfully held by an individual or family member receiving assistive reproductive services."

3) Instruct Health Care Providers Not to Take Family Medical History When Conducting a Fitness-For-Duty Exam

The regulations take it one step further when a health care provider is performing a medical examination to determine an applicant’s or employee’s ability to perform a job. These situations would include a pre-hire physical examination of an applicant who has received a conditional job offer, a fitness-for-duty exam of a current employee or an examination to determine whether a current employee poses a direct threat to himself or others. In these circumstances, the regulations require that employers instruct the health care provider not even to collect family medical history or other genetic information.

4) Be Polite But Not Overly Inquisitive

GINA contains an exception to its prohibition against acquiring genetic information for the “inadvertent acquisition of genetic information.” The EEOC’s strained efforts in its regulations to highlight the distinction between unlawful and permissible acquisition demonstrates that most employers will need to provide “genetic etiquette” lessons to their managers.

According to the EEOC’s regulations, managers need not be heartless. They can ask a subordinate recently diagnosed with cancer, “How are you?”, and “Did they catch it early?”, or if the subordinate’s child is the subject of the diagnosis, “Will your daughter be OK?” However, managers who do not cut the conversation short run the risk of crossing the line by asking, for example, “Do you have cancer in your family?”, or “Are you worried that your other children might have cancer?”

In other words, managers will need to distinguish between generalized questions and what the EEOC characterizes as “probing” questions to avoid GINA’s prohibition against acquiring genetic information.

5) Overhear But Don’t Actively Listen

Identifying yet another social pirouette for managers, the EEOC regulations explain that managers who happen to overhear a conversation between employees about genetic information, such as a discussion about their respective families’ history of cancer, does not violate GINA.

However, a manager who “actively listens” to such a conversation does violate GINA. In other words, the regulations implicitly direct managers either to remove themselves from the area where the employees are engaging in the hypothetical discussion or to ask the employees to stop discussing genetic information where the manager can “actively listen” to the discussion.

6) Beware of Social Media

GINA excepts from its prohibition against acquisition of genetic information for obtaining genetic information that is publicly and commercially available. Under the EEOC’s regulations, this exception does not apply to the acquisition of genetic information from “social networking sites and online media sources which require permission to access from a specific individual.”

In other words, such sites are not publicly available. As applied to real life, this regulation means that a manager who reads about an employee’s family medical history on the employee’s Facebook page will not be able to invoke the “commercially and publicly available” exception if the employee has set the privacy settings for his or her Facebook page to “friends only” so that the manager was able to access the page only because the employee previously had accepted a “friend request,” from the manager.

Fortunately, the EEOC regulations also state that this manager still could benefit from the “inadvertent acquisition” exception described above. For example, if the employee previously “friended” a manager who happens to view family history on the employee’s Facebook page, that acquisition of genetic information would be considered inadvertent and, therefore, not in violation of GINA.

The same manger might be at risk of violating GINA, however, if the employee’s Facebook wall suggests an ongoing discussion about family medical history among coworkers who are the employee’s Facebook friends. The employees might argue that because the manager could anticipate future posts about genetic information, his or her acquisition was not inadvertent. In short, managers who have social media relationships with subordinates must be wary of collecting too much information (TMI).

7) Tightly Control Access to Genetic Information

Genetic information, when acquired in paper or electronic form, must be placed in a confidential medical file that is separate from the personnel file but could be the same file where other employee medical information is retained. Genetic information received by an employer before GINA went into effect on Nov. 21, 2009, does not have to be removed from the general personnel file if filed there, but it still must be treated as a confidential medical record with access limited to those with a need to know. Managers who acquire genetic information by hearing or reading it are not required to document what they have heard or read, but they are prohibited from using or disclosing the information in a manner that violates GINA.

8) Do Not Disclose Genetic Information in Response to a Subpoena or Civil Discovery Request

Employers routinely receive subpoenas and discovery requests that call for the production of employees’ medical information. GINA and the EEOC’s implementing regulations prohibit disclosure of genetic information in litigation except in response to a court order that specifically calls for its disclosure.

Given the broad and counterintuitive definition of “genetic information,” compliance with this requirement may be easier said than done. For example, an employee’s Family and Medial Leave Act (FMLA) certification for leave to care for the serious health condition of a family member would contain genetic information about the employee if the certification reveals the family member’s manifested disease or disorder.

Given the above, employers should consider a) permitting only designated employees to disclose information in response to a subpoena or discovery request calling for the production of an employee’s medical information, and b) training those employees on how to distinguish genetic information from other types of medical information.

9) Reevaluate Your Wellness Program

The “health risk assessment” (HRA) has become a standard weapon in employers’ battle to reduce the cost of health benefits. To motivate employees to complete an HRA, employers frequently offer financial inducements, such as a cash prize or a reduction in the employee’s monthly premium contribution.

The EEOC’s implementing regulations allow the inclusion in an HRA of questions seeking family medical history (or other genetic information) but prohibit employers from offering any financial inducement to employees to encourage them to disclose genetic information.

Thus, the regulations state that an employer may offer a financial inducement to complete the portion of the HRA that does not request family medical history as long as the HRA explicitly informs employees that they are eligible for the inducement even if they do not respond to the questions that request genetic information.

10) Be Cautious During Corporate Transactions

Neither GINA nor the EEOC’s implementing regulations address corporate transactions, yet both sets of rules pose risks to each side of the transaction. For example, neither GINA nor its implementing regulations contain an exception to the general prohibition against disclosing genetic information that would permit disclosure to a party conducting due diligence in a corporate transaction. Similarly, neither GINA nor its implementing regulations permit an acquiring company in an asset purchase transaction who will offer jobs to the target company’s employees to obtain those employees’ genetic information from the target company.

In fact, the EEOC’s regulations implicitly suggest that the acquiring company in this example should specifically tell the target company not to disclose the genetic information of its employees even if the acquiring company will become their employer. Arguably, the target company could avoid potential liability for disclosing genetic information to the acquiring company by requesting and obtaining each employee’s consent to the disclosure.

Significantly, neither GINA nor the EEOC’s implementing regulations expressly permit disclosure of genetic information with the employee’s consent. Given GINA’s very tight restrictions on disclosure of genetic information, the EEOC may take the position that a disclosure of genetic information even with the employee’s consent violates the act.

Conclusion

Complying with GINA and the EEOC’s implementing regulations will require some significant changes to “business as usual.” Given the difficult distinctions that these rules require employers to draw, employers should consider providing training to all affected employees before the EEOC’s regulations go into effect on Jan. 9, 2011.

This article was written by Philip L. Gordon for Law 360. Reprinted with express permission from the publisher.

Copyright © Portfolio Media, Inc. Content may not be shared or redistributed in any fashion without the express permission of Portfolio Media. For inquiries regarding rights and reprints, please contact reprints@law360.com.

Photo credit: Michael Siegmund