The new Health Insurance Portability and Accountability Act rule on privacy scheduled to go into effect on April 14 may reach as far as the disclosure of information about workplace drug testing and substance abuse management. The Standards for Privacy of Individually Identifiable Health Information, known as the Privacy Rule, generally will prevent "covered entities" from disclosing protected health information to non-covered entities without authorization from the subject of the protected health information. The disclosure requirements may apply to many collection facilities, laboratories, Medical Review Officers and other service providers who analyze and review applicants' and employees' drug and alcohol test results.
"Covered entities" under HIPAA must require employers using their services to provide HIPAA-compliant authorization before releasing drug and alcohol test results (i.e., protected health information) for employees and job applicants. Forms currently being used by employers for this purpose may not meet the requirements of the regulations which identify the key components and specifics for the authorization form. Additionally, the forms must be signed by the employees or applicants. As a practical matter, since HIPAA compliance ultimately falls on the shoulders of the "covered entity," the collection facility, laboratory or Medical Review Officer may have its own authorization form for employers.
In addition to the release of test results, other aspects of an employer's substance abuse policy may require use of a HIPAA-compliant authorization form. For example, when an employee enters into substance abuse rehabilitation, an employer may require progress reports from the substance abuse professional who evaluated and treated the employee. If the substance abuse professional is a "covered entity" under HIPAA, the employer may then be required to have the employee sign a specific HIPAA-compliant authorization form permitting the release of the "personal health information", i.e., the substance abuse professional's records, to the employer.
Employers also should be aware that this federal law does not preempt more stringent state law requirements, where applicable.
If you would additional information about the Privacy Rule requirements concerning drug testing and substance abuse management programs, including sample forms, or workplace substance abuse generally, please contact the Jackson Lewis attorney with whom you regularly work, or members of the Jackson Lewis Substance Abuse Practice Group.
If you have other questions about HIPAA, please contact the Jackson Lewis attorney with whom you regularly work, or members of the Jackson Lewis Employee Benefits Practice Group.
