Is this part of HIPAA compliance?

2406663 · March 2003

An ongoing and inappropriate habit of management is to send Agency wide e-mails regarding and employees personal health status. An example of this would be if an employee is out sick due to an illness/condition - the Supervisor sends out an e-mail explaining that this person will not be in and they will go onto explaining why they are out (ie. back problem, operation, etc.).
This is striking me as a violation of an employee's personal info. ...
I welcome any comments on this situation...
Just sign me as working with unskilled management living in the dark ages....

AprilShowers · March 2003

That type of medical information should be on a need to know basis only. I doubt your entire management staff "needs to know" the medical condition of your employees. I believe what you have described is a violation of the new HIPAA regulations.

Meg · March 2003

I agree. As the person responsible for ensuring our company is in compliance with the HIPAA regulations, I am fairly positive this would be a bad idea.
I would try and communicate that this practice should stop before 4/14.
Also, if any of those individuals were out on an FMLA approved reason (for example, the surgery) then again the person's rights may be violated under that rule as well.

HR in NY · March 2003

I just went to a HIPAA seminar yesterday and it's all very complicated. Is the employee the one giving the information? I learned yesterday that if the employee is the one giving the information to you, then you can do anything with that information (not that you should). It's a different story however, if you are getting that information from your health plan or a provider. Then it's covered under HIPAA. My opinion is it's fine to share that the employee is out, but it's no ones business why.

vwindham · March 2003

Sory, I am in the dark! What is HIIPAA??

Leslie · March 2003

Health Insurance Portability and Accountability Act

Balloonman · March 2003

Sounds like good intentions gone a little to far. Obviously co-workers know when someone is gone, and most probably know why. I think putting the reason in the email might be a bit much.
What I do when people will be out for an extended period of time, is get a card for the owners to sign and send to them, and then one from the office staff that I send out about 5 days later, and then another 5 days or so one from the field staff that they work with. Keeps them chipper, and looking forward to getting back. I do this with WC and non-WC injuries/illness.
My $0.02 worth.
DJ The Balloonman

Don D · March 2003

HIPAA or no HIPAA, this practice is a really bothersome one. Long before HIPAA came down the congressional chute I understood the wisdom of carefully guarding this sort of information and generally any other information that made its way to 'Personnel'. It's really a no-brainer and the supervisor who sends out such memos needs counseling immediately. I don't buy the presumption that he's a 'well-meaning guy'. I'm sure he on occasion also includes the name of the hospital and suggests employees send cards and flowers. He should get back to work and concentrate on his departmental outcomes, not his self-appointed Florence Nightingale duties. HIPAA nothwithstanding, this guy is waaaaayyy out of line.

slogan · March 2003

Remeber that HIPAA mandates that there be a "Privacy Officer" within the company. The reason for a privacy officer is to insure that no ones personal (or private) health information (refered to as PHI in HIPAA) is distributed. It is also the responsibility of the privacy officer to train employees, especially managers & supervisors, about HIPAA reg's and how they apply. Talk about job security!

HIPAA has rightly been portayed by a Hipopotamus! Just another giant government mess up.

Jessica · March 2003

So, a question for the group. I recently had an employee out of the office, request that I explain to the rest of the staff (very briefly by e-mail) why she was out so that she wouldn't have to explain thirteen times when she returned. We have under 20 employees. What would you do in that situation?

sonny · March 2003

Maybe do it verbally or begin email with "Jane has asked me to share with you. . "

Don D · March 2003

[font size="1" color="#FF0000"]LAST EDITED ON 03-13-03 AT 11:29AM (CST)[/font][p]Jessica: I would tell her that's not the role of HR. Or more to the point, tell her, "I think I'll let you do that when you get back." If she's so sensitive that she needs to be stroked to accept her personal responsibility and obligation to handle her own personal business, tell her, "You know honey, people cherish you so awfully much around here and will miss you so terribly while you're out. I just know each of them will want a special bit of time with you when you get back to find out how you're doing and just what in the hell was wrong with you. Try to take care of that, say, within a couple of days though."

(edit) One other idea. She suggested you do it by email. Let her do it by email. I really think that if you choose to do this, it will have one of two possible outcomes: Either you set yourself up to be perceived as the company babysitter, or what you say in the email backfires on you and bites you in the butt because it's not what she intended for you to pass on. No win. Other priorities.

sonny · March 2003

I change my vote. Like Don's better. Especially if there is no reason why she can't send her own email.

Rockie · March 2003

According to our Privacy Officer, if an employee requests that employees be informed of private medical information by email (or any other route), they should sign a "release" that it's okay for you to disseminate this information. Otherwise, when their condition is discussed via email in graphic detail, they may find it wasn't such a good idea after all.

HRPeg · March 2003

Just a further piece of advice: If you haven't already done so, set up a folder for each employee that you keep all of their medical and other private info in. This way, those "dark age" managers can't get their hands on it at review time.

Is this part of HIPAA compliance?

Comments