Navigating FMLA without violating HIPAA
Employers usually ask employees to provide a certification supporting their need for leave under the federal Family and Medical Act (FMLA). These certifications often include personal medical information — details that would be considered protected health information (PHI) under the federal Health Insurance Portability and Accountability Act (HIPAA). Employers might wonder how they process an FMLA leave request for a serious health condition without violating HIPAA.
Who HIPAA covers
The HIPAA privacy provisions apply to employers only in their activities as group health care plan sponsors. If an employee, for example, asked an HR representative whether the company’s group health plan covered her particular health condition, HIPAA would apply, and the HR representative would need to keep that information private.
HIPAA’s privacy rules don’t apply to employers in other activities. Therefore, asking for FMLA certifications from employees doesn’t involve the HIPAA rules.
Other entities covered by HIPAA rules include health care providers, such as doctors, nurses, and medical staff. They may not disclose PHI with some exceptions, such as if an employee signs an authorization to release the PHI.
Taking the doctor out of the conversation
Employers have the right to ask employees for FMLA certifications. They give employees a certification form and ask that they have the doctor complete the relevant parts. Often, the doctor then gives the completed form back to the employee who, in turn, gives it to the employer. The doctor doesn’t give the certification directly to the employer.
When doctors give completed FMLA certifications to patients/employees, no HIPAA violation exists because it’s the patient’s information. The patient (or family member), then has the right to disclose their PHI to whomever they want, including the employer.
Putting the doctor into the conversation
Employees may ask that a doctor send a completed FMLA certification directly to the employer. In that situation, the doctor will require the employee/patient to sign a HIPAA disclosure authorization. That’s where the HIPAA privacy comes into play.
Employers may not force employees to ask that doctors send the certification directly to them. Employees have the right to get the certification from the doctor and then give it to the employer.
Once requested, employees are responsible for getting the certification to the employer. If employees don’t, whether they get it from a doctor or have the doctor send it to the employer, they risk their FMLA protections.
When employers may directly contact the doctor
Under the FMLA, employers may contact an employee’s health care provider only after receiving a complete and sufficient certification, and only for authentication or clarification of the certification. Only a health care provider, an HR professional, a leave administrator, or a management official may make such contact. In no case may the employee’s direct supervisor contact the employee’s health care provider. Employers may not, however, ask the health care provider for additional information beyond that contained on the medical certification form. Therefore, this request does not trigger HIPAA privacy rules.
Key to remember: Employers don’t violate HIPAA if employees get a certification from a doctor and then give it to the employer. Otherwise, doctors must get a HIPAA disclosure authorization from the patient to directly give a certification to the employer.
