Recently, Google instructed its employees that sharing personal health data with third-party AI partners was necessary to access health benefits. After considerable pushback regarding medical privacy, the tech giant reversed this policy, making such information sharing optional. Nonetheless, medical privacy for workers is increasingly under threat across the country.
Even with more than 2.5 million workplace injuries and illnesses reported annually, and a growing volume of patient medical data due to technological advancements, injured workers often lack the privacy protections that some privileged groups, like inmates, can expect.
This troubling situation arises primarily from the current structure of workers’ compensation. Privacy protections embedded in state constitutions and statutes often don’t cover employees submitting workers’ compensation claims. Furthermore, federal medical privacy laws have been interpreted by courts to exclude such proceedings.
As a result, workers who are injured—many of whom may have severe disabilities—find themselves in a tough position where they must choose between seeking the compensation they deserve and protecting their medical privacy.
In contrast, most patients seeking medical care are afforded stronger privacy protections under the Federal Health Insurance Portability and Accountability Act. Physicians using electronic health records are required to safeguard personally identifiable health information, which includes relevant details like diagnoses and addresses.
This kind of information is generally only disclosed in a minimal way, primarily to facilitate patient treatment. The objective is to prevent harmful or stigmatizing exposure of medical details.
Indeed, the sharing of medical data can lead to stigma. For example, irrelevant details about mental health could be used to reject a workers’ compensation claim. There’s also the risk of prejudicial data reaching third parties, impacting future employment opportunities or insurance coverage. Miscommunication can also happen between employers and healthcare providers.
Moreover, many of these disclosures could lead to legal repercussions for employers, such as claims of employment discrimination.
To complicate matters, in numerous states, employees are barred from suing their employers for injuries, which amplifies concerns about medical privacy, especially when navigating the workers’ compensation process.
The historical context of this issue is quite complex, rooted in federalism, judicial interpretation, and state inaction.
States typically leverage their Tenth Amendment authority to safeguard citizen privacy while managing their own workers’ compensation frameworks. This has resulted in a false assumption that states will adequately protect injured workers’ privacy under federal laws.
This assumption has often been misinterpreted by the courts as a lack of federal privacy protections in the absence of state action, and unfortunately, states have largely failed to fill this privacy void.
Recent research indicates that states have not effectively shielded worker privacy in key areas, including disclosure scope, authorization protocols, and communications with treating physicians.
While it’s critical for states to manage workers’ compensation claims effectively, they must also adhere to medical privacy standards. There’s a notable distinction between efficient claims management and ignoring privacy protections altogether.
Potential solutions could come through the legal system or legislative action—perhaps in response to clarifications from the Department of Health and Human Services that workers’ compensation exemptions don’t eliminate medical privacy rights. Courts may begin to align with federal standards for protecting privacy.
Each state has the opportunity to enact laws reflecting these standards, though circumstances may vary. If states neglect to establish privacy protections, federal regulations may take precedence.
Alternatively, states might create their own guidelines grounded in best practices, such as limiting disclosure to specific injuries, establishing timelines for medical records disclosure, and requiring consent for such disclosures. States could also prohibit unsolicited communications or implement rules to ensure confidentiality.
Ultimately, injured workers deserve the same privacy rights as any other patients.
Ani B. Satz, Ph.D., J.D., is a law and public health professor and the director of the Project on Health Law, Policy, and Ethics at Emory University. Her work focuses on torts and health law, particularly regarding workers’ compensation and medical privacy issues.
