I think the answer to this question depends on how you are defining “employee health information.” Is the employee being seen as a patient of the health care provider, i.e., one of the physicians within your facility has a doctor/patient relationship with the employee, or is the employee being seen for an occupational health reason, i.e., an x-ray done to rule out TB after a skin test rendered a positive result. If the employee is both a patient and has occupational health records and they are stored in an EHR, you would need to have a method to separate the two, having distinct access permissions set for each one and a distinction between what is employee health information and what is PHI.
The disclosure and authorization for the disclosure would also be dependent on the relationship as mentioned above and the contractual relationship with the employer, as this determines ownership of the record. For example, at my last employer we sent employees to an external clinic site for immunizations, exams, etc. We had a contractual relationship with this provider to provide these services and the employee sent there consented to us, the employer, receiving the results of the tests we sent them there for. If the employee went to this provider for treatment of the flu, those records could only be released with proper authorization of the employee because at this point the employee is seeking treatment as a patient, not an employee of the organization and not at our direction.
In another scenario, if your employment organization provided employee health services at the employers site at the employers direction, i.e., TB screening, this is not considered PHI, as the employer owns the health record for employment purposes and would be subject to OSHA requirements along with any other federal or state regulations regarding employee health records.
------------------------------
Julie Sours
Oak Forest,IL
Original Message:
Sent: 11-18-2015 06:36 PM
From: David Garrison
Subject: Disclosing employee health information
For those of you who "store/enter" employee health information in your charts/EHR, do you require an Authorization before disclosing the information or since it's employee health information, would you accept a general release of information?
------------------------------
David Garrison CHC,MPH
Compliance/Privacy Officer
SEARHC
Juneau,AK
------------------------------