Research · 12 min read
What Your Employer Can Be Told About a Work Injury
Two standards in the federal privacy rule let health information reach an employer or a workers' compensation program. Both are narrower than they sound, and one of them only works when the employer asked for the visit in the first place.
Key takeaways
- The employer route opens only where the provider gave care at the employer's request for a workplace surveillance or work-relatedness evaluation.
- What may move is findings about a work-related illness, injury or surveillance, not a record.
- Written notice to the individual is a condition of the route, by copy at the time of care or by a posted notice at a worksite.
- The recordkeeping rule the condition points at partially exempts employers with ten or fewer employees, so the obligation may not exist at all.
- That rule names six privacy concern cases where a name is replaced on the log by the words privacy case, and calls the list complete.
- The workers' compensation standard is a single sentence limited to what a law authorizes and to what is necessary to comply with it.
Answer first: two narrow doors, not a general one
The privacy rule has no standard permitting a company to send your health information to your employer because your employer pays for the coverage.
It has two much smaller doors. One sits inside the public health standard and covers a visit the employer arranged. The other is a single sentence about workers' compensation.
Both are permissions rather than duties. Both are fenced by conditions written into the paragraph itself.
The first door has four conditions, and the first of them decides almost everything: the care has to have been provided at the employer's request.
The four conditions on the employer route
The route permits a covered entity to disclose information to an employer about a member of that employer's workforce, and only where all four conditions are met.
The first is that the covered entity is a covered health care provider who provides health care to the individual at the request of the employer. The request has to be for one of two things: an evaluation relating to medical surveillance of the workplace, or an evaluation of whether the individual has a work-related illness or injury.
The second limits the content. What is disclosed has to consist of findings concerning a work-related illness or injury, or workplace-related medical surveillance.
The third ties the disclosure to a legal obligation. The employer has to need the findings to comply with its recording or surveillance duties under named federal recordkeeping rules, or under a state law with a similar purpose.
The fourth is the one written for the person in the record. The provider has to give written notice that this information goes to the employer. That is done by handing a copy to the individual when care is provided, or, where care happens at the worksite, by posting the notice in a prominent place there.
Following the condition to the recordkeeping rule
The third condition points at a federal injury and illness recordkeeping part, and reading it changes how wide the route looks.
That part opens with an exemption. An employer with ten or fewer employees at all times during the last calendar year does not need to keep those injury and illness records. The exception is where the agency or the labor statistics bureau tells the employer in writing to keep them.
The exemption is partial rather than total. Every covered employer still has to report a work-related incident resulting in a fatality, an in-patient hospitalization, an amputation, or the loss of an eye.
So a small employer may have no recording obligation for an ordinary injury at all. Where there is no obligation, the third condition on the disclosure has nothing to attach to.
The recordkeeping rule has a privacy list of its own
The same part tells an employer when to leave a name off the log. It calls those privacy concern cases, and instead of the name the employer enters the words privacy case.
Six categories are listed. An injury or illness to an intimate body part or the reproductive system. An injury or illness resulting from a sexual assault. Mental illnesses. Certain infections named in the rule. Needlestick injuries and cuts from contaminated sharp objects. And any other illness where the employee asks that the name be left off.
The rule then closes the list in its own words, saying this is a complete list of all injuries and illnesses considered privacy concern cases for that part.
There is a further step for cases that stay identifiable anyway. Where the employer has a reasonable basis to believe the description could still identify the person, it may use discretion in how the injury is described. Enough has to stay in to show the cause of the incident and the general severity.
The employer keeps a separate confidential list of case numbers and names so those cases can still be updated and given to the government on request.
One rulebook citing the other
The recordkeeping rule also governs voluntary sharing of the forms, and this is where it points back at the privacy rule.
If an employer decides to give the forms to anyone outside government representatives, employees, former employees and authorized representatives, it has to remove or hide names and other personally identifying information.
Three exceptions follow. An auditor or consultant hired by the employer to evaluate the safety and health program. Disclosure to the extent necessary for processing a claim for workers' compensation or other insurance benefits.
And disclosure to a public health authority or law enforcement agency. That third exception covers uses and disclosures for which consent, an authorization, or an opportunity to agree or object is not required under the federal health privacy standards. The labor rule cites the privacy section by number.
Two federal rulebooks written by different departments, each pointing at the other, is worth seeing once. It is also the reason the two questions cannot be answered separately.
What an employee can get from the log
The recordkeeping part gives employees their own access rights, and they run on short clocks.
An employee, a former employee, a personal representative or an authorized employee representative may ask for the current or stored injury and illness log for an establishment the person worked in. The employer has to provide a copy by the end of the next business day.
The employer may not strip names out of that log first. The rule says so directly, and points to the privacy case procedure as the protection instead.
For the incident report describing one person's own injury, the same next business day rule applies to that person or a personal representative. An authorized employee representative gets seven calendar days, and only the part of the form headed with the case description.
The first copies are free. An employer may charge a reasonable retrieval and copying fee for additional copies.
The workers' compensation standard is one sentence
The privacy rule's last lettered standard is a single sentence, and both of its limits sit in the middle of it.
A covered entity may disclose protected health information as authorized by, and to the extent necessary to comply with, laws relating to workers' compensation or other similar programs.
Those programs are then described rather than named. They have to be established by law and provide benefits for work-related injuries or illness without regard to fault.
Without regard to fault is doing real work there. It is what separates the programs this standard reaches from ordinary injury litigation, which travels the judicial process route instead.
The standard says nothing about notice to you, nothing about your agreement, and nothing about what a program may then do with what it receives.
What a reader can actually look at
Who asked for a visit, since the employer route only opens for care provided at the employer's request for one of two stated evaluations.
Whether written notice appeared, since the rule requires a copy at the time of care or a posted notice at a worksite.
Whether what moved was described as findings, because the content limit is findings about a work-related illness, injury or surveillance rather than a record.
Whether a program describes itself as paying benefits without regard to fault, which is how the workers' compensation standard identifies the programs it reaches.
And whether a privacy notice mentions either purpose at all, since a notice has to describe uses that do not need your authorization.
What this does not decide
It does not say that any employer or any company has received anything. Both provisions are permissions with conditions attached.
It does not reach health coverage. An employer sponsoring a plan is a separate subject with separate rules, and nothing here describes what a plan sees.
It does not follow every rule the privacy paragraph cites. The condition names several federal ranges and a category of state law, and only the injury and illness recordkeeping part is read here.
And it is not legal advice. It reports what two standards and three recordkeeping sections say.
Sources
- 45 CFR 164.512, "Uses and disclosures for which an authorization or opportunity to agree or object is not required", read at paragraphs (b)(1)(v) and (l)Paragraph (b)(1)(v), permitting disclosure to an employer about an individual who is a member of the workforce of the employer, and its four conditions. Condition (A), that the covered entity is a covered health care provider who provides health care to the individual at the request of the employer, either to conduct an evaluation relating to medical surveillance of the workplace or to evaluate whether the individual has a work-related illness or injury. Condition (B), that the protected health information disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance. Condition (C), that the employer needs such findings to comply with its obligations, under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance. Condition (D), that the covered health care provider provides written notice to the individual that protected health information relating to the medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer, by giving a copy of the notice to the individual at the time the health care is provided or, where health care is provided on the work site, by posting the notice in a prominent place at the location where the health care is provided. Paragraph (l), the workers' compensation standard, permitting disclosure as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.
- 29 CFR 1904.1, "Partial exemption for employers with 10 or fewer employees"Paragraph (a)(1), that an employer whose company had 10 or fewer employees at all times during the last calendar year does not need to keep injury and illness records unless the agency or the Bureau of Labor Statistics informs the employer in writing that records must be kept, and that all employers covered by the Act must nonetheless report any work-related incident resulting in a fatality, the in-patient hospitalization of one or more employees, an employee amputation, or an employee loss of an eye. Paragraph (a)(2), that a company with more than ten employees at any time during the last calendar year must keep the records unless its establishment is classified as a partially exempt industry.
- 29 CFR 1904.29, "Forms"Paragraph (b)(6), that in a privacy concern case the employer may not enter the employee's name on the log and must instead enter the words privacy case, and must keep a separate confidential list of the case numbers and employee names. Paragraph (b)(7), the six categories that must be considered privacy concern cases: an injury or illness to an intimate body part or the reproductive system; an injury or illness resulting from a sexual assault; mental illnesses; HIV infection, hepatitis, or tuberculosis; needlestick injuries and cuts from sharp objects that are contaminated with another person's blood or other potentially infectious material; and other illnesses where the employee voluntarily requests that the name not be entered. Paragraph (b)(8), that this is a complete list of all injuries and illnesses considered privacy concern cases for that part. Paragraph (b)(9), the employer's discretion in describing an injury or illness that may still be personally identifiable, while entering enough information to identify the cause of the incident and the general severity. Paragraph (b)(10), that an employer voluntarily disclosing the forms to persons other than government representatives, employees, former employees or authorized representatives must remove or hide names and other personally identifying information, and its three exceptions: an auditor or consultant hired by the employer to evaluate the safety and health program; the extent necessary for processing a claim for workers' compensation or other insurance benefits; and a public health authority or law enforcement agency for uses and disclosures for which consent, an authorization, or opportunity to agree or object is not required under 45 CFR 164.512.
- 29 CFR 1904.35, "Employee involvement"Paragraph (b)(2), that employees, former employees, their personal representatives and their authorized employee representatives have the right to access the injury and illness records. Paragraph (b)(2)(iii), that a copy of the relevant current or stored log must be provided by the end of the next business day. Paragraph (b)(2)(iv), that the employer may not remove the names from the log before providing copies, and that the protection instead is the privacy concern case procedure. Paragraph (b)(2)(v), that a copy of the incident report describing an injury or illness to the requesting employee or former employee must be provided by the end of the next business day, and that an authorized employee representative receives copies within 7 calendar days limited to the section of the report headed with the case description. Paragraph (b)(2)(vi), that the first copies may not be charged for and that a reasonable charge may be assessed for additional copies.
Frequently asked questions
Can my employer be told about my medical care under the privacy rule?
Only through a narrow route, and only when four conditions are met. The provider has to be one giving care at the employer's request, either for an evaluation relating to medical surveillance of the workplace or to evaluate whether the person has a work-related illness or injury. What is disclosed has to consist of findings about that illness, injury or surveillance. The employer has to need those findings to meet its recording or surveillance obligations under named federal rules or a similar state law. And the provider has to give written notice to the individual, by copy at the time of care or by posting at a worksite.
Does the rule let an employer see care it did not arrange?
This route does not. Its first condition is that the covered entity is a covered health care provider who provides health care to the individual at the request of the employer, for one of two stated evaluations. Care a person arranges independently does not satisfy that condition, so the route does not open. Other standards in the same section cover other situations, and an employer sponsoring health coverage is a separate subject governed by different rules.
What is a privacy concern case?
It is a category in the federal injury and illness recordkeeping rule where the employer may not put the employee's name on the log. Instead the employer writes the words privacy case, and keeps a separate confidential list of case numbers and names. Six categories are listed, beginning with an injury or illness to an intimate body part or the reproductive system. The list continues with an injury or illness resulting from a sexual assault, mental illnesses, and certain named infections. It ends with needlestick injuries and cuts from contaminated sharp objects, and any other illness where the employee asks that the name be left off. The rule states that this is a complete list.
Can I get a copy of my employer's injury log?
The recordkeeping rule gives employees, former employees, personal representatives and authorized employee representatives a right to that log. It covers the current or stored log for an establishment the person worked in, by the end of the next business day. The employer may not remove names from that log before providing it, and the rule points to the privacy case procedure as the protection instead. For the incident report about one person's own injury, the same next business day rule applies. An authorized representative gets seven calendar days and only the case description portion. First copies are free.
What does the workers' compensation standard actually permit?
It is one sentence. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs. Those programs have to be established by law and provide benefits for work-related injuries or illness without regard to fault. Both limits are in that sentence: authorized by the law, and only to the extent necessary. The phrase without regard to fault describes the kind of program the standard reaches, which is why an ordinary injury lawsuit travels the judicial and administrative proceedings route instead.
Do these rules mean my employer learns about a weight or metabolic program?
Nothing here describes that. Both provisions turn on a work-related injury or illness, a workplace medical surveillance evaluation, or a workers' compensation program paying benefits without regard to fault. Coverage arranged through an employer is a different subject with different rules. What a plan or an employer sees in that setting is not decided by either of these two standards, and a prescriber and the plan documents are where those questions get answered.