Enacted in 2008, the Illinois Biometric Information Privacy Act, 740 ILCS 14 et seq. (the “BIPA”), went largely unnoticed until a few years ago when a handful of cases sparked a flood of class action litigation over the collection, use, storage, and disclosure of biometric information. Seeing thousands of class action lawsuits, organizations have
Genetic Information Nondiscrimination Act
More EEOC COVID-19 Guidance: Testing, Screening, Managers, Confidentiality, and Telework
Since March of this year, the Equal Employment Opportunity Commission (EEOC) has released guidance on a near-monthly basis addressing various FAQs concerning COVID-19 issues. The guidance has focused on disability-related inquiries, confidentiality, hiring, and reasonable accommodations under the Americans with Disabilities Act (ADA), as well as issues under Title VII of the Civil Rights Act…
HIPAA Privacy Rule Waiver, Other Medical Information Questions During the COVID-19 Pandemic
As the coronavirus spreads across the globe and in the United States, providers, businesses, employers, and others are struggling to understand what medical information they can collect and what information they can share. These are difficult questions the answers to which involve considering factors such as long-standing compliance requirements (e.g., HIPAA, ADA, GINA, state law), the unprecedented times we are in, business risk, and common sense. Government is trying to act to relieve some of these challenges, but questions still remain.
HIPAA Privacy Rule Waiver of Penalties and Sanctions
Effective March 15, 2020, for example, Secretary of the U.S. Department of Health and Human Services (HHS) Alex M. Azar (Secretary) waived certain penalties and sanctions under the HIPAA Privacy Rule against hospitals in its March 2020 COVID-19 and HIPAA Bulletin. These waivers were issued in response to President Donald J. Trump’s declaration of a nationwide emergency concerning COVID-19, and the Secretary’s earlier declaration of a public health emergency on January 31, 2020. The Secretary’s guidance makes clear that the Privacy Rule is not suspended during this crisis and provides guidance about the ability of entities covered by the HIPAA regulations to share information, including with friends and family, public health officials, and emergency personnel. But, in the following areas, the Secretary has waived sanctions and penalties against covered hospitals that do not comply with the following provisions of the HIPAA Privacy Rule:
- the requirements to obtain a patient’s agreement to speak with family members or friends involved in the patient’s care. See 45 CFR 164.510(b).
- the requirement to honor a request to opt out of the facility directory. See 45 CFR 164.510(a).
- the requirement to distribute a notice of privacy practices. See 45 CFR 164.520.
- the patient’s right to request privacy restrictions. See 45 CFR 164.522(a).
- the patient’s right to request confidential communications. See 45 CFR 164.522(b).
The waiver became effective on March 15, 2020, and there is more information and access to resources in the Bulletin about where it applies and for how long.
Reminder About What Entities Are Covered Entities and Business Associates
As part of its guidance on HIPAA privacy and disclosures in emergency situations, the Bulletin reminds readers what entities are covered by these rules – covered entities and business associates. There can be some tricky questions here, but these are the basic rules from the Bulletin:
The HIPAA Privacy Rule applies to disclosures made by employees, volunteers, and other members of a covered entity’s or business associate’s workforce. Covered entities are health plans, health care clearinghouses, and those health care providers that conduct one or more covered health care transactions electronically, such as transmitting health care claims to a health plan. Business associates generally are persons or entities (other than members of the workforce of a covered entity) that perform functions or activities on behalf of, or provide certain services to, a covered entity that involve creating, receiving, maintaining, or transmitting protected health information. Business associates also include subcontractors that create, receive, maintain, or transmit protected health information on behalf of another business associate. The Privacy Rule does not apply to disclosures made by entities or other persons who are not covered entities or business associates (although such persons or entities are free to follow the standards on a voluntary basis if desired). There may be other state or federal rules that apply.
Employers are Not Covered Entities or Business Associates – But Still Have Privacy and Confidentiality Obligations
When conducting its business, an organization can be a HIPAA covered entity and/or a business associate. However, when that business is functioning as an employer, it is neither a HIPAA covered entity nor a business associate, although it may sponsor a covered health plan subject to the HIPAA privacy and security rules. As organizations face the coronavirus threat to their workforce and their business, many questions arise about the collection, processing, and disclosure of medical information from employees, their family members, and visitors to their facilities. These can be thorny questions and organizations should seek qualified counsel, but here are some general rules:
When may an ADA-covered employer take the body temperature of employees during the COVID-19 pandemic?…
Continue Reading HIPAA Privacy Rule Waiver, Other Medical Information Questions During the COVID-19 Pandemic
Coronavirus Raises Privacy Concerns for Healthcare Providers and their Workers
The outbreak of a new coronavirus that is believed to have began in central Chinese city of Wuhan and now appears to be spreading to the United States is driving concerns for organizations around preparedness regarding their operations, their customers, and their employees. Both the Center for Disease Control and Prevention (CDC) and the State…
Nursing Facility Settles Alleged GINA Violations with EEOC for $370K
As one nursing facility in New York has learned, asking employees or applicants about their family medical history can violate the Genetic Information Nondiscrimination Act (“GINA”) and draw the ire of the U.S Equal Employment Opportunity Commission (EEOC). Founders Pavilion, Inc., a former Corning, N.Y. nursing and rehabilitation center, will pay $370,000 to settle discrimination…
A Summary of the Final HIPAA Rule
As we continue to examine the final HIPAA privacy and security regulations, as amended by the HITECH Act and the Genetic Information Nondiscrimination Act, we pulled together a summary of some of the key points. We fully expect additional sub-regulatory guidance to be provided by OCR, such as frequently asked questions and sample business …
Maryland and Illinois Seek to Protect Employee Social Media Activity
Have you ever reviewed the Facebook or LinkedIn profile or other social media activity of an employee or applicant? How about requiring employees or applicants to provide access to social media activity as a condition of employment.
Continue Reading Maryland and Illinois Seek to Protect Employee Social Media Activity
Decision on Genetic Information Privacy Issued by Minnesota Supreme Court
The Minnesota Supreme Court issued a decision on November 16, 2011 holding that the state’s Genetic Privacy Act, Minn. Stat. Section 13.386 (2010) restricts the collection and use of blood samples taken from newborns pursuant to the state’s Newborn Screening Statutes, Minn. Stat. Section 144.125-128. The litigation, captioned Bearder et al v. State of…
Connecticut Woman Files First GINA Claim
ABC News has reported that a Fairfield, Connecticut woman, Pamela Fink, yesterday filed claims with the U.S. Equal Employment Opportunity Commission and the Connecticut Commission on Human Rights and Opportunities that her employer violated GINA when it terminated her employment on March 25, 2010. The federal Genetic Information Nondiscrimination Act (GINA) (pdf), which went into…
GINA Effective November 21, 2009, But EEOC Final Regulations Remain Under Review
The Genetic Information Nondiscrimination Act (GINA) [pdf], signed into law in May 2008, prohibits discrimination by health insurers and employers based on individuals’ genetic information. Genetic information includes the results of genetic tests to determine whether someone is at increased risk of acquiring a condition (such as some forms of breast cancer) in the future…