HIPAA real life example

Patient suffers a shoulder injury while on the job-installing a glass windshield. Employees of this company are required by their employer to have a urinalysis everytime there is an injury or accident. Patient complies. Patient is on Prescription Adderall for Attention Deficit Disorder. Urinalysis comes back positive for Amphetamines. The Medical Office contracted to perform UA's and all Occ med for this Employer calls the patient to inform him. Patient states that he is on Adderall.

Medical Office asks why and demands that patient fax a copy of the RX label to their office; tells the pt to "hold" that they need to record the doctor asking the patient to fax the label. Patient asks if he can jsut provide the name & # to the pharmacy, but Med. Office rejects offer. Patient complies.

A little later, the patient received a phone call from his Employer.

The doctor called the employer and disclosed the results of the urinalysis along with the fact that the patient is on prescription Adderall. The employer asks the patient why he is on Adderall as in disbelief.

QUESTION: Was the doctor allowed to disclose the Adderall information?

HIPAA violation ? No

http://www.hhs.gov/hipaafaq/providers/smaller/301.html 

The public health provision permits covered health care providers to disclose an individual's protected health information to the individual's employer without authorization in very limited circumstances. First, the covered health care provider must provide the health care service to the individual at the request of the individual's employer or as a member of the employer's workforce.

Second, the health care service provided must relate to the medical surveillance of the workplace or an evaluation to determine whether the individual has a work-related illness or injury. Third, the employer must have a duty under the Occupational Safety and Health Administration (OSHA), the Mine Safety and Health Administration (MSHA), or the requirements of a similar State law, to keep records on or act on such information. For example, OSHA requires employers to monitor employees' exposures to certain substances and to take specific actions when an employee's exposure level exceeds a specified limit. A covered entity which tests an individual for such an exposure level at the request of the individual's employer may disclose that test result to the employer without authorization.

Generally, pre-placement physicals, drug tests, and fitness-for-duty examinations are not performed for such purposes. However, to the extent such an examination is conducted at the request of the employer for the purpose of such workplace medical surveillance or work-related illness or injury, and the employer needs the information to comply with the requirements of OSHA, MSHA, or similar State law, the protected health information the employer needs to meet such legal obligation may be discussed to the employer without authorization.