Privacy Issues in the Community College Workplace

business associate comply with HIPAA’s Privacy Rule. Use and disclosure by business associates of information protected under HIPAA’s Privacy Rule is further described below.

K. D ISCLOSING M EDICAL I NFORMATION As previously noted, under the CMIA the general rule is that an employer may not disclose medical information unless written authorization is obtained from the subject employee. 229 Exceptions to the rule requiring written authorization include:

 when disclosure is compelled by judicial or administrative process or by any other specific provision of law;  when the information is relevant to a lawsuit, arbitration, grievance or other proceeding to which the employer and employee are parties and the employee has placed his or her medical history, mental or physical condition or treatment at issue;  administering and maintaining employee benefit plans, including health care plans and plans providing short-term and long-term disability income, and workers’ compensation; or  when the employee is incapacitated and the information is necessary to aid the treatment or diagnosis of the employee (See section 5 and 6).

The following are some specific types of requests for medical information that employers might receive.

1. E MPLOYEE R EQUESTS

California Labor Code section 1198.5 gives employees the right to inspect their personnel files.

Government Code section 3306.5 gives public safety officers the right to inspect their personnel files.

California Government Code section 31011 gives county employees the right to inspect their files.

Education Code section 87031 gives employees of community college districts the right to inspect their personnel files pursuant to California Labor Code section 1189.5.

Under CalOSHA, it appears that whenever an employee who is exposed to toxic or harmful substances requests access to medical or “exposure” records, the employer shall assure that access is provided in a reasonable time, place and manner, but in no event later than 15 days after the request for access is made. 230

Privacy Issues in the Community College Workplace ©2019 (c) Liebert Cassidy Whitmore 72