Are drug test results protected by HIPAA? Driver drug tests, doctor's notes, and a ride company's files

Is a driver’s drug test result protected by HIPAA?

No, not once it is in the employer’s file. HIPAA’s definition of protected health information, at 45 CFR 160.103, excludes health information “in employment records held by a covered entity in its role as employer.” A NEMT company that bills Medicaid electronically may be a covered entity for its rider records, as HIPAA for NEMT providers explains. Its driver files are still employment records, so the same exclusion applies. A company that is not a covered entity at all is outside HIPAA to begin with, because the rule binds only health plans, clearinghouses and providers that transmit health information electronically (45 CFR 160.102), plus their business associates.

HHS explained the line when it issued the Privacy Rule in 2000. Employers are not covered entities, it wrote, and covered entities “must comply with this regulation in their health care capacity, not in their capacity as employers.” Its example was a hospital personnel file with a nurse’s sick leave, which is not protected health information. Rider information is the opposite case. A manifest, a destination and a Medicaid ID stay protected, and HIPAA for NEMT drivers covers what drivers may say about them.

When does a clinic or lab need the driver’s written authorization?

When the clinic or lab is a HIPAA covered entity, it needs a valid authorization before it tells an employer anything. Under 45 CFR 164.508(a)(1) a covered entity may not disclose protected health information without one unless a rule permits it. A clinic that sends claims to a health plan electronically is a covered entity. A site that only collects specimens for employers and is paid by the employer may not be, and then HIPAA does not reach it. DOT rules and state law still do.

HIPAA lets the clinic make the test depend on the authorization. Section 164.508(b)(4)(iii) allows a covered entity to condition health care that exists only to create information for a third party on signing an authorization for that disclosure. HHS said in 2000 that an employer may require an employee to provide such an authorization as a condition of employment. A valid one names the information, who may release it, who may receive it, the purpose, an expiration date or event, and carries the driver’s signature and date (164.508(c)). Name your designated person on the form, not “the company.”

One exception looks relevant and is not. Section 164.512(b)(1)(v) lets a provider tell an employer about findings from workplace medical surveillance or a work-related injury or illness, when the employer needs them for OSHA-type recordkeeping and the worker gets written notice. It does not cover a pre-employment or random drug test.

What protects a driver’s test results instead?

Four sets of rules, and which one applies depends on the test and the state.

• DOT Part 40, for federally covered tests. Drivers who need a CDL, and drivers under an FTA-funded contract, are tested under DOT rules that run on Part 40’s procedures, and drug testing for NEMT drivers sorts out who is covered. Section 40.321 bars an employer or service agent from releasing individual results or medical information to a third party without the employee’s specific written consent. That consent must name a particular piece of information, a particular person and a particular time. Blanket releases, such as one covering all test results or every company the driver might apply to, are prohibited.
• The ADA, for medical details. The ADA applies to employers with 15 or more employees (29 CFR 1630.2(e)). Its regulation says a test for illegal drug use is not a medical examination (1630.16(c)(1)). The confidentiality paragraph for drug tests (1630.16(c)(3)) covers medical information that a test turns up, other than information about illegal drug use itself, and points to the ADA’s medical-record rules in 1630.14. A prescription that a medical review officer learns about is one example. Those rules put the information on separate forms in separate medical files, the setup that pre-employment physicals for NEMT drivers describes.
• GINA, for family history. The Genetic Information Nondiscrimination Act counts family medical history as genetic information. If a clinic form or a note includes it, the employer must keep it in separate confidential medical files (29 CFR 1635.3 and 1635.9).
• State drug testing laws. These are where most company tests get their confidentiality rule. Examples, not a full list:
  • Minnesota. Under Minnesota Statutes 181.954, a laboratory may disclose to the employer only whether drugs, cannabis, alcohol or their metabolites were present. Results are private and confidential and may not go to another employer or a third party without the employee’s written consent. The law covers any employer with one or more employees (181.950, subdivision 7).
  • Iowa. Iowa Code 730.5(13) makes communications an employer receives about drug or alcohol test results confidential. It lists when an employer may use or disclose them, including a labor arbitration, a workers’ compensation or unemployment proceeding, a federal agency that requires them, and a treatment evaluation. It applies to private employers with at least one full-time employee.

Both state laws allow narrow exceptions for legal proceedings and government agencies, and DOT’s 40.323 does the same for lawsuits and grievances. Check your own state’s testing statute, and read the driver drug and alcohol policy template so the written policy matches the rule that applies.

Who in the office may see a positive result?

Only the person who has to act on it. For a DOT test, the designated employer representative receives the results for the employer. 49 CFR 40.3 defines that person as an employee authorized to remove drivers from safety-sensitive duties and to make the decisions the testing process requires. Name one person and a backup. The employer must also keep the records in a location with controlled access (40.333(c)).

The rest of the office needs far less:

• Dispatchers and supervisors. The ADA regulation lets supervisors and managers be told about “necessary restrictions on the work or duties” and necessary accommodations (1630.14(c)(1)). A dispatcher needs to know only that a driver is off the schedule until a date. The reason stays in the locked file.
• First aid and safety staff. They may be told when a condition might require emergency treatment.
• Government officials. Investigators checking ADA compliance, and DOT agencies for DOT tests, can ask for the records.
• Other companies and other drivers. Neither has a right to a driver’s result. For a DOT test, a release to anyone Part 40 does not name needs the driver’s specific written consent under 40.321.

The ADA’s confidentiality rule leaves out information about illegal drug use itself, so a positive result is not covered by it. Do not rely on the ADA to keep it quiet. Rely on DOT Part 40 where it applies, your state’s testing law, and your own written policy limiting access to the designated person. How long to keep the records is covered in how long to keep driver and employee records.

What can a company ask for in a doctor’s note after a sick day?

A note or other explanation, if the company asks everyone for one. The EEOC’s 2000 guidance says an employer is entitled to know why an employee is requesting sick leave and may ask for a doctor’s note or other explanation, as long as its policy or practice applies to all employees, with and without disabilities. HIPAA is no obstacle, because it restricts the doctor’s side, not the employer’s request.

The doctor’s side is where authorization comes in. A clinic that is a covered entity cannot tell you about a visit without the driver’s written authorization, unless a rule permits it, so have the driver bring the note. Many states limit what an employer can require for sick leave, and two examples are in what to do when a driver calls out sick.

Whatever medical detail arrives is confidential. The EEOC says the ADA requires an employer to treat medical information from an inquiry, or that an employee volunteers, as a confidential medical record, and the regulation puts it on separate forms in separate medical files (1630.14(c)(1)). Only supervisors who must schedule around a restriction should hear about it. A note that gives the dates off and any work restrictions is enough to run a schedule. If a note includes a diagnosis, file it in the medical file and keep it out of schedules and chat.

Where HIPAA does reach what an employer holds

HIPAA reaches the company’s group health plan. A group health plan that has 50 or more participants, or that someone other than the employer administers, is a covered entity under 160.103. Its claims information is protected health information, and before the plan gives any of it to the employer, the plan documents must bar the employer from using it for “employment-related actions and decisions” (164.504(f)(2)(ii)(C)). Claims data a plan holds about a driver’s care is not something an employer may use in personnel decisions.

Credential dates and access in HealthRide

Fleet and credentials in HealthRide keeps the expiration dates for each driver’s licenses and certifications in one registry. It sends reminders ahead of the deadline and flags anything expired when a trip is being assigned. In the provider portal, what each person can open follows their role.