Drug testing in the workplace involves the process of screening employees or job applicants for the presence of illicit substances or alcohol. It can be done for various reasons, such as ensuring a safe work environment, complying with legal or regulatory requirements, or promoting productivity and reliability. When employers conduct drug tests, the results may be considered protected health information (PHI) if they involve a healthcare provider or are maintained as part of a health plan. It is here where the relationship between HIPAA and workplace drug testing comes into play.
HIPAA and workplace drug testing
According to Working Partners and SAPAA, “...employees who undergo a drug test generally must sign a release (usually at the time of the test) in order for their employer to receive the results. For more information about issues related to the release of health information, contact DHHS. This agency administers the Health Insurance Portability and Accountability Act (HIPAA), which dictates under what circumstances and to whom health information may be released.”
HIPAA's Privacy Rule sets clear guidelines for how employers must handle patient information related to workplace drug testing, ensuring employees' privacy is protected. Sections 164.502 and 164.530 require employers to treat drug test results as PHI. It means employers must maintain the confidentiality of these results and limit their use and disclosure. Specifically, Section 164.502 restricts the use and disclosure of PHI, allowing it only for necessary purposes unless the employee provides explicit authorization.
Section 164.530 goes further by requiring that employers implement administrative, technical, and physical safeguards to protect the privacy and security of health information. It includes training staff on privacy procedures and ensuring that all electronic exchanges of health information are secure. Employers must provide employees with a notice of privacy practices, clearly explaining how their health information may be used and shared. The notice also informs employees of their rights under HIPAA, such as the right to access their drug test information.
What types of drug tests are commonly used in the workplace?
- urinalysis
- blood test
- hair follicle test
- saliva test
- breathalyzer test
- sweat patch test
What should be included in a workplace drug and alcohol policy?
- A clear definition of substances tested for and prohibited in the workplace.
- Guidelines on when and how drug and alcohol testing will be conducted.
- Procedures for obtaining employee consent for testing.
- The process for handling and confidentially storing test results.
- Specific consequences and disciplinary actions for policy violations.
- Information on support services, like Employee Assistance Programs (EAPs), for those struggling with substance abuse.
- Details on how the policy adheres to relevant legal requirements, including the ADA and HIPAA.
- Protocols for accommodating employees undergoing substance abuse treatment.
- Clear communication of employee rights and responsibilities under the policy.
- Procedures for addressing prescription medication use and its impact on drug testing.
- A statement emphasizing the commitment to employee safety and health.
See also: Professional athletes' health information and HIPAA
Who has access to an employee’s drug test results?
Access to an employee's drug test results in the workplace is typically limited to specific personnel to ensure confidentiality. This usually includes members of the human resources department, medical review officers (MROs), and the employee's direct supervisors or managers if necessary. The MRO is responsible for reviewing and interpreting the results, especially in cases of positive tests. Any additional disclosures require the employee's consent except in situations mandated by law, such as legal investigations or workplace safety incidents.
See also: HIPAA Compliant Email: The Definitive Guide
How should employers obtain consent for drug testing?
Employers should obtain consent for drug testing by clearly informing employees about the testing process and its purpose. They must provide a consent form that the employee reads and signs before undergoing the test. This form should outline the types of tests to be conducted, the substances being tested for, and how the test results will be used and shared. Employers must ensure employees understand all aspects of the consent form, allowing them to ask questions and receive adequate explanations.
The Americans with Disabilities Act (ADA) and workplace drug testing
While the ADA does not prohibit drug testing, it requires employers to handle positive drug test results carefully, especially if the substance use is related to a documented disability like addiction or prescribed medication use. Employers must avoid discriminatory actions against individuals with a history of addiction who are not currently using illegal drugs or against those who use prescription medication under a doctor's guidance. Additionally, the ADA obliges employers to provide reasonable accommodations, such as allowing time off for rehabilitation or treatment, to employees with substance abuse disorders, ensuring their fair treatment in the workplace.
How can employers handle positive drug test results?
If the test is confirmed positive, the employer should follow their established drug policy, which may include counseling, referral to treatment programs, or disciplinary actions, depending on the company's policy and the nature of the job. Employers need to maintain confidentiality throughout this process, and they should also consider the legal implications if the employee has a history of addiction or is using prescribed medication.
See also: When can a healthcare provider share drug dependency information?
FAQs
What is the role of the HHS?
The U.S. Department of Health and Human Services oversees national health policies, provides human services, and enforces regulations like HIPAA to protect PHI.
When is drug testing information not considered PHI?
Drug testing information is not considered PHI when it is maintained solely as part of an employment record and not used in healthcare-related contexts.
Who is responsible for protecting drug testing results?
Employers who conduct drug testing and are covered entities under HIPAA are responsible for protecting the confidentiality and security of drug testing results.
Kirsten Peremore
