|
Massachusetts Nurse :: September
2005
HIPAA and the union’s right to information
By Joe Twarog
Associate Director, Labor Education & Training
 The
term HIPAA is often heard and used frequently in health care settings.
But, it is also a term that is frequently misused, either intentionally
or other wise, especially when the union is concerned. This article
will briefly review HIPAA only as it refers to the MNA as a union
and its right to bargaining unit information.
HIPAA demystified
The Health Insurance Portability
and Accountability Act, commonly known as “HIPAA,” was
passed by Congress in 1996. The privacy rule became effective
in April 2001 with full compliance
for healthcare providers occurring in April 2003. The act has
two primary goals:
- To improve portability and continuity
in health insurance coverage and efficiency in healthcare
delivery by standardizing
electronic
data interchange
- To protect the confidentiality and security
of health care data by the setting and enforcing of standards.
The
establishment of these new rules was entrusted to the Department
of Health and Human Services. There are two
parts to HIPAA
reflecting these goals. The first deals with regulations
that allow employees
to retain their health insurance coverage if they lose
or change jobs. The second part, the privacy rule, deals
with the security
and confidentiality of health care related data. One
of the
original ideas behind the act was to compel the healthcare
industry to
computerize its paper records as a way to save money.
This of course led to
a legitimate concern over the privacy of those computerized
records.
The act is complex and has had numerous modifications
and rule clarifications. For instance, new regulations
recently
took
effect dealing with group plan coverage. Also, the
Department of Justice
has recently ruled on accountability and criminal liability
for violations of HIPAA.
One objective of HIPAA is to
protect patient’s privacy rights
as far as their medical and health records are concerned.
The act’s “privacy
rule” governs how “covered entities” (health
plans, insurers, HMOs, health care providers) may
use and disclose protected health information. The
privacy
rule states that covered
entities must adopt reasonable safeguards to protect
their patient's medical information.
Employment records
However, the Department of Health
and Human Services has repeatedly stated that the privacy rule
does
not apply
to employers and
employment records when they are acting in their
role as employers, and when
the medical information was obtained for employment
purposes such as evaluating employee issues under
the Americans
with Disabilities Act, the Family and Medical
Leave Act, Workers'
Compensation,
etc.
Even though the vast majority of RNs work as
employees of a “covered
entity” (a hospital) under the act, employment
records are excluded under the privacy rule.
This means that if the union requests
employment information from the employer about
bargaining unit employees, the employer is required
to provide the information
consistent with the National Labor Relations
Act or the Massachusetts labor law, Chapter 150
(e).
Some employers have cited HIPAA, either mistakenly
or intentionally, as the reason for refusing
to provide the union with requested
information. This is not a valid reason and
such refusal might constitute grounds for an unfair
labor practice
charge against
the employer.
NLRB cases
The National Labor Relations Board has
recently ruled in a number of cases that the employer
was in violation
of
the National
Labor
Relations Act for failure to provide such
information as the union requested. A 2004 NLRB general
counsel report states: “We
(the NLRB) decided that the promulgation
of the HIPAA regulations did not terminate
an employer’s obligation to bargain
over an accommodation of its confidentiality
interest in health information
concerning unit employees.” The NLRB
further stated that “portions
of the OSHA-required injury reports may
not have even been HIPAA covered” because
the employee records were held by the employer
acting as an employer. In such cases “the
employee would have no reasonable expectation
of privacy in those portions of
the injury reports.”
The government
has set up a HIPAA hotline, 866.282.0659,
where questions may be
answered.
|
