Urgent message: In addition to drug testing their own employees, many urgent care centers offer drug testing as a service to other employers. Therefore, it’s important to understand the laws affecting the privacy of drug screen results.
Alan A. Ayers, MBA, MAcc is Vice President of Strategic Initiatives for Practice Velocity, LLC and is Practice Management Editor of The Journal of Urgent Care Medicine
Introduction
It’s standard procedure throughout the country for employers to require employees and applicants to submit to drug testing both before and after being hired. There isn’t any overarching federal law that requires or prohibits drug testing by private employers, but many states have enacted laws regarding employee drug testing. However, the results of a drug test are generally protected by both federal and state laws.1
This article will examine the impact of HIPAA requirements on employee drug test results, the protections afforded employees, and the potential liability for healthcare providers such as urgent care centers.
Drug Test Results as Protected Health Information
HIPAA is a concern for all healthcare organizations, including privately owned urgent care companies. The rules pertaining to patient privacy are reasonably clear, but questions arise as to whether drug test results are protected health information under HIPAA when performed for employment purposes.
Federal statutes, including HIPAA, the ADA (Americans With Disabilities Act2), and other employment laws (eg, the Drug-Free Workplace Act (DFWA), the Fair Credit Reporting Act (FRCA), and U.S. Department of Transportation regulations) require companies to treat test results as confidential. Most states regard drug-testing results as confidential, as well.
Drug test results may not be disclosed to third parties except as required by law or pursuant to a court order. This can include an investigation or litigation concerning a claim related to the drug test, such as an employment issue, workers’ compensation, or a criminal matter.3
Within an employer’s organization, policies should state who has access to this personal health information (PHI). This may include the human resources department and the hiring or supervising manager. An employer should have restrictions on how (and if) such information can be shared with others. As part of this process, employees who undergo a drug test will typically sign a release at the time of the test to permit the employer to receive the results.
Healthcare provider drug testing policies
It is important to note that the HIPAA Privacy Rule doesn’t protect an employee’s employment records—even if the information in those records is health-related. And in most instances, the HIPAA Privacy Rule doesn’t apply to the actions of an employer. However, the Privacy Rule does protect an employee’s medical or health plan records if she is also a patient of the provider or a member of the health plan.4 This specifically refers to medical treatment sought in the employer’s primary business (ie, the employee becomes a patient), in which the medical record would be treated with the same privacy protections as every other patient record. Thus, it makes no difference if the employer is a healthcare provider, like an urgent care center. Even though an urgent care facility may perform the drug testing in-house, rather than employing a third-party collection point—which may offer greater privacy protections—the rules for PHI are applied across the board for all employers. An urgent care owner should add procedures on access and disclosure of results to its drug testing policy when the drug testing is performed onsite.
Policies usually state that testing laboratories may conduct testing only for substances included on a disclosure list given to the individual, and may not conduct testing unrelated to drug usage.
Employers commonly keep all records concerning test results in medical files that are maintained separately from the company’s personnel files. Drug test results, like all medical information about urgent care center employees, should be kept confidential. According to the Equal Employment Opportunity Commission, “if the results of a drug test reveal the presence of a lawfully prescribed drug or other medical information, such information must be treated as a confidential medical record.”5
The individual, department, or the facility that receives drug test results should share drug test results only as needed. A manager may only need to know that an employee or applicant passed or failed the test without any further details. There are other situations when it’s necessary to disclose the test, such as unemployment eligibility determination, workers’ compensation claims, and disability benefits. The employee’s consent may be required, depending on the specific situation and applicable regulations. A prudent strategy would be to obtain written consent for release from the applicant or employee whenever possible.6
Typically, private employers will have their own policies in place if an individual tests positive for drugs. These may include mandatory rehabilitation, firing, or not being hired for the position initially. Although some employers elect to do so, a private employer such as an urgent care facility isn’t required to allow an employee or prospective employee to complete rehabilitation or to allow him a “second chance” before termination for drug use.
HIPAA Authorization
HIPAA stipulates that “covered entities” must provide HIPAA-compliant authorization before releasing drug and alcohol test results. Collection facilities or labs employed for the drug test will typically have an authorization form.
Urgent care employers should also remember that HIPAA doesn’t preempt more rigorous state law requirements.7 A state may have drug testing laws and privacy laws that apply to drug test as a matter of personal privacy, with tougher standards that the federal law.8
Decriminalized Marijuana
Many questions have arisen with the decriminalization of marijuana in several states.9 Specifically, employers are concerned about employees who are under a doctor’s care with a legal prescription for marijuana. The fact that the employee is under the care of a doctor is HIPAA-protected, but employees can be tested for drugs. In most cases, the question focuses on the rationale for the drug test. The employer must have reasonable suspicion that the employee has been taking drugs before he can be tested. This means that the employer has a legitimate reason to think that the employee has been taking drugs.
Arizona, Arkansas, Connecticut, Delaware, Illinois, Maine, Minnesota, Nevada, New York, Pennsylvania, and Rhode Island now have laws with explicit language with some degree of employment protection, typically prohibiting adverse action against an employee or applicant based on their status as a medical marijuana cardholder or participation in a medical marijuana program. For example, the states of Arizona10 and Delaware8 have protections in place prohibiting any punishment for medical marijuana users who aren’t impaired on the job, but not for recreational users.
Note that if an employee is required to take a drug test, the employer should treat all their employees fairly and equally. Failure to do so may subject the employer to a discrimination action.
Liability
Healthcare providers like urgent care centers must be concerned with the potential liability for the inappropriate disclosure of an employee’s drug results. The release of test results—even to the police—without a court order or the employee or applicant’s written consent could result in the urgent care being subject to litigation.11 In addition, disclosure of drug test results to unauthorized third parties could lead to an employee or applicant bringing a lawsuit based on negligence, invasion of privacy, intentional infliction of emotional distress, defamation, or violations of HIPPA and other federal law. A jury can award additional damages for pain and suffering.3
To date, few cases have held for private sector employees against random drug testing, either in refusing to take the test on privacy grounds and were fired, or when drug test results were inaccurate. Most state courts have held that the employment-at-will doctrine exceeds employees’ privacy rights. The California Supreme Court is the only court to hold differently, because that state is one of the few whose state Constitution includes a right to privacy. As such, state private sector employees (not job applicants) have been found to be protected by the right to privacy.12
It’s vital for employers to have clear, consistent definitions of what behavior justifies drug testing. Thorough training on how to handle employee testing is a must.
Conclusion
In addition to complying with HIPAA and state laws, an urgent care operation should have in place a drug testing policy as part of its employment policies. This should be crafted to allow for maximum flexibility for the employer.
In summary, test results and other PHI from a drug test should not be disclosed to another employer or to a third-party individual, government agency, or private organization without the prior written authorization of the person tested.
It’s critical that this policy be communicated and understood by all personnel who might be impacted. This includes the owner, upper management, frontline supervisors, and the urgent care facility’s employees.
References
- Workplace Fairness. Drug testing. Available at: https://www.workplacefairness.org/drug-testing-workplace. Accessed December 13, 2017.
- Americans with Disabilities Act of 1990. Available at: https://www.eeoc.gov/eeoc/history/35th/thelaw/ada.html. Accessed December 13, 2017.
- McDonnell S. Do companies report failed drug tests to the police? AZ Central. Available at: http://yourbusiness.azcentral.com/companies-report-failed-drug-tests-police-27003.html. Accessed December 13, 2017.
- HHS Office for Civil Rights (OCR). Employers and Health Information in the Workplace, Health Information Privacy. Available at: https://www.hhs.gov/hipaa/for-individuals/employers-health-information-workplace/index.html. Accessed December 13, 2017.
- U.S. Equal Employment Opportunity Commission. Americans with Disabilities Act: Questions and Answers. Available at: https://www.ada.gov/employmt.htm. Accessed December 13, 2017.
- Society for Human Resources Management. Confidentiality and sharing drug test results. Available at: https://www.shrm.org/resourcesandtools/tools-and-samples/hr-qa/pages/confidentialityandsharingofdrugtestresults.aspx. Accessed December 13, 2017.
- Friedland AS, Lazzarotti JJ, Perry RR, et al. HIPAA privacy rule impacts employer drug testing procedures. Jackson Lewis website. Available at: https://www.jacksonlewis.com/resources-publication/hipaa-privacy-rule-impacts-employer-drug-testing-procedures. 16 Delaware Code Online. The Delaware Medical Marijuana Act. Available at: http://www.delcode.delaware.gov/title16/c049a/index.shtml. Accessed December 13, 2017.
- National Conference of State Legislatures. Marijuana overview. Available at: http://www.ncsl.org/research/civil-and-criminal-justice/marijuana-overview.aspx. Accessed December 13, 2017.
- Arizona Medical Marijuana Act (“AMMA”), A.R.S. § 36-2801. Available at: http://3g6615161omg2tl5k03v3pnt.wpengine.netdna-cdn.com/prop-203.pdf. Accessed December 13, 2017.
- Vezina v United States, Civ. A. No. 2008 U.S. Dist. LEXIS 24437, 2008 WL 833747, *1 (W.D.La. Mar. 27, 2008).
- National Workrights Institute. Drug testing in the workplace. 2010. Available at: http://workrights.us/?products=drug-testing-in-the-workplace. Accessed December 13, 2017. California Laws on Drug Testing, California Employment Law, NOLO. Available at: https://www.nolo.com/legal-encyclopedia/california-laws-drug-testing.html. Accessed December 13, 2017.
