Privacy Issues in the Community College Workplace

Medical information is “individually identifiable” if it “includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name, address, electronic mail address, telephone number or social security number, or other information that,

alone or in combination with other publicly available information, reveals the individual's identity.” 222

b. Requirements of Valid Authorization A sample authorization for release of Medical Information is provided as Appendix R . A health care provider cannot release information to an employer (or anyone else for that matter) unless the patient’s written authorization:

 Identifies the person authorized to release the information;

 Identifies the person authorized to receive the information;

 Identifies any limitations on the types of information to be disclosed and the purposes for which the information can be used;  States a specific date after which the health care provider is no longer authorized to disclose the information;

 Is typed or handwritten by the person signing it;

 Is separate from any other language contained on the same page and executed by a signature that serves no other purpose; and  Advises the signing party of the right to receive a copy of the authorization. 223

c. Exceptions to the Rule—Instances When Written Authorization Is Not Required under the CMIA There are several exceptions to the requirement of written authorization that are relevant in the employment context.

 Medical information shall be disclosed by a health care provider in the course of legal proceedings pursuant to a subpoena or order of the court, board, commission, or other administrative body having jurisdiction of the matter and legal authority to compel the production of records.

Also, a health care provider may exercise its discretion to disclose medical information to an employer without written authorization if:  the employer is responsible for paying for health care services rendered to the patient and it is necessary to disclose the records to the employer to allow the employer to determine responsibility for payment; or  the information pertains to health care services which were rendered to an employee at the request and expense of the employer; and

Privacy Issues in the Community College Workplace ©2019 (c) Liebert Cassidy Whitmore 69