Question: What does HIPAA cover with regard to random drug screens? We recently sent an employee for a random drug screen. He submitted the sample, but did not return to work. He then wrote a letter to the physician that collected the sample and asked him not to release the results. The physician will not release the results for fear of a lawsuit.

We have mailed the physician a copy of our drug screening policy and the signed consent form that the employee filled out when he was hired. He still refuses to send us the results, although he told us it was positive. Can an employee request the doctor to hold results of a drug screening test although the employee signed a consent form when hired?

Answer: The Health Insurance Portability and Accountability Act of 1996 (HIPAA), codified at Title 45 of the Code of Federal Regulations, parts 160 and 164, covers health plans, health care clearinghouses and those health care providers who conduct certain financial and administrative transactions electronically. Section 164.508 requires valid authorization before these covered entities can disclose protected health information, including drug screening test results.

A valid authorization must specify (i) what information can be disclosed, (ii) by whom, (iii) to whom, (iv) for what purposes, and provide (v) an expiration date or event, and (vi) the signature of the individual and date. Among other things, the authorization must place the individual on notice of his/her right to revoke the authorization in writing. An authorization is defective if it is known to have been revoked.

In addition to HIPAA requirements, recent amendments have been made to the Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681 et seq., that include greater protection regarding the exchange of employee medical information.

In order to provide medical information for employment purposes, the new statute requires that the information furnished is relevant to process or effect employment and that the employee provides "specific written consent . . . that describes in clear and conspicuous language the use for which the information will be furnished." 15 U.S.C. 1681b(g)(1)(b).

These privacy statutes permit an employee to refuse to authorize the release of drug screening results and even to revoke authorization after it is given. It appears that in your case, the employee may have revoked his authorization through his letter to the doctor. If this was the case, the doctor is prohibited from releasing any results - including the fact that the employee tested positive.

As the employer, your recourse under HIPAA and the FCRA is to decline offering a position to an applicant or to take disciplinary action against an employee who refuses to authorize the release of drug screening, or revokes that authorization. Furthermore, knowing that the test result was positive, you may act on that fact in accordance with state and local laws applicable to employees who are active users of illegal drugs.

You must, however, check state and local laws, which may delineate procedures to be followed when conducting drug testing in the workplace and what actions are appropriate with respect to an employee who tests positive for illegal drug use.

Question researched and written by Proskauer Rose LLP
http://www.proskauer.com/, Workindex.com E-mail newsletter for August 3, 2004

Click here to return to the E-zine and/or close this window