What if the temporary staffing agency refuses to provide medical information, claiming privacy under the Health Insurance Portability and Accountability Act (HIPAA)?

OSHA says the employer that provides day-to-day supervision must make reasonable efforts to acquire the necessary information to record the case under Part 1904. However, if the controlling employer is not able to obtain medical information from the staffing agency, the controlling employer should record the case based on the information that is available. OSHA expects that employers will share information about work-related injuries and illnesses.

The HIPAA privacy rule would apply to a staffing agency only if it meets the definition of a “covered entity,” which includes health plans, health care clearinghouses, and health care providers who conduct certain financial and administrative transactions electronically. However, even if the staffing agency meets the definition of a covered entity, HIPAA would permit them to disclose health information to the controlling employer for purposes of compliance with Part 1904. Source: OSHA letter of interpretation dated January 12, 2018.