What Is HIPAA?
HIPAA is the “Health Insurance Portability and Accountability Act of 1996.”
A major part of this law is protecting consumers from having their medical information made available to people they might not want to have it shared with. For example, advertising agencies or their employer. The law is directed at health care providers, health plans and health care clearinghouses. Here is what one of the government facts sheets says:
In general, your health information cannot be given to your employer, used for shared things like sales calls or advertising, or used or shared for many other purposes unless you give your permission by signing an authorization form. This authorization form must tell you who will get your information and what your information will be used for.
HIPAA also provides that patients can get copies of their medical records from their doctor, especially if they are switching to another doctor.
Does HIPAA Apply To Employers?
The basic answer is no. The law is aimed at health care providers (such as hospitals, doctors, or clinics), health plans, and health clearinghouses. These are called “covered entities.” So, in most cases that would involve UE stewards or employers, HIPAA really doesn’t apply.
If an employer is self-insured and therefore has access to employees’ medical records, then they may be considered a “covered entity.” However, most employers that are self-insured actually hire an insurance company to administer the health plan. In those cases, it is likely that the employer does not see the actual information on individual employees.
The information that “covered entities” have about an individual’s health is called “protected health information.”
Even if an employer is a “covered entity” they still must release personal health information to the union if: (1) they are authorized by the individual it pertains to; (2) the union is willing to have the employer remove the information which identifies what individuals it pertains to; or (3) the disclosure is “required by law” such as information requests related to grievance investigations, which employers are required to fulfill by the National Labor Relations Act (NLRA).
What About George Scott’s Case?
First, even though Burnemup Tool Co. provides health insurance, they are not a “covered entity,” so HIPAA really doesn’t apply.
Secondly, the information that the union was asking for about George Scott’s case is not covered under HIPAA. The National Labor Relations Board has ruled that although employers have to protect their employees’ confidentiality, the Union has a right to information that it needs to process or investigate grievances.
In this situation, the health information that the employer had gathered (what kind of medical restrictions employees were under when they returned to work), was clearly gathered and used in their role as an employer, not for medical reasons.
This is an important distinction. Information that employers gather and use for discipline, because they are required by OSHA, or to run internal health and safety programs is not covered by HIPAA. This information is not used for providing health care, it is used by an employer to run their business or service. Just because it is about employees’ health issues does not mean that employers can refuse to share it with the union.
Bear in mind, however, that UE stewards should keep medical information about individual employees confidential within the union committee.
COVID-19 and HIPAA
The Union has the right to demand to know if employees have tested positive for the COVID-19 virus or any infectious disease, including employees who are not in our bargaining unit but may have come in contact with our members. The Union needs to be able to judge independently which workers and sections of the workplace may have been impacted. Do not allow the boss to claim that HIPAA prevents them from telling the Union the name of a sick employee. HIPAA allows the disclosure of information that is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Sharing this information with the Union is necessary for the Union to represent our members’ needs, and it allows us to assist in preventing the spread of this disease and protecting our members. Demand that the boss report to the Union known positive cases of the virus immediately and on an on-going basis.
What to Do if Your Employer Refuses to Provide the Information
If your employer refuses to provide the identity of an employee who tested positive for the virus, the Union can demand that the employer bargain for an accommodation, like a confidentiality agreement, to get the requested information. An employer who refuses to bargain for an accommodation is committing an Unfair Labor Practice (ULP), although you should discuss the situation with your UE staff person before filing a charge with the NLRB. In any case, the Union can, however, immediately file a grievance if the employer refuses to provide the information or bargain for an accommodation. However, given the gravity of the situation, you should not wait to exhaust the steps of the grievance procedure before you mobilize your members.
Mobilizing Your Members to Fight for a Safe Workplace
During this pandemic, the Union cannot depend on our employers or government agencies to protect our members from unsafe working conditions. You should make it clear to your employer that it won’t be business as usual if they refuse to provide this information. If your employer still refuses to provide the requested information or bargain for an accommodation to get the information, then you have to mobilize your members to fight for a safe workplace, like you would in any other fight with your boss. You should reach into your UE toolbox of collective actions to mobilize your members. Because the community is more affected than ever by what happens in workplaces during this pandemic, your local should particularly consider actions that bring public attention, such as:
- A press conference with community allies to alert the community
- Reaching out to local elected officials to let them know that your employer is exposing their constituents to a harmful situation.
- Informational picketing while maintaining six feet of social distance between picketers.
You can also make it clear to the employer that if they won’t tell the Union who has been diagnosed with COVID-19 so that the Union can help workers take the needed steps to protect themselves, then the members will have to operate under the assumption that everybody they have come in contact with, or may come in contact with at the workplace, is potentially going to transmit the virus to them.
