Last week, we looked at the apparent conflict between the OSHA Recordkeeping Rule , which requires employers to give employees, former employees and employee representatives access to illness and injury records and the federal Health Information Portability & Accountability Act (HIPAA), which bans employers from using or disclosing records containing personal health information about their employees without permission. We noted that an OSHA Interpretation Letter from last August suggests that HIPAA doesn't apply when a legitimate request for access is made under the Recordkeeping Rule and that employers should grant access to the records even if they contain private medical information about employees and employees didn't give consent to their release.

The fact that the OSHA Recordkeeping Rule supercedes HIPAA doesn't mean that privacy isn't a consideration for employers. On the contrary, there are privacy restrictions within the Recordkeeping Rule itself that employers must follow when logging and disclosing employee injury and illness records. Let's look at what those restrictions are.

Recording of 'Privacy Cases'

Normally, you must list the names of employees who suffer injuries and illnesses on the job. But under the Recordkeeping Rule, there are certain kinds of injuries and illnesses where instead of the employee's name, you list "privacy case". You also have discretion to leave out the employee's job title, date and even location where the injury took place if it would compromise the employee's identity.

Section 1904.29(b)(7) sets out six kinds of privacy cases:

• Injuries/illnesses to intimate body parts of the reproductive system;
• Sexual assaults;
• Mental illnesses;
• HIV infection, Hepatitis or Tuberculosis;
• Needlestick or sharp cut injuries; and
• Any other case in which the employee asks you not to enter his or her name in the Log.

Keeping of a Privacy Log

You must also keep all privacy case illness and injury records in a confidential privacy log that's separate from the OSHA 300 Log. Each case filed must have an identifying number and a corresponding employee name.

Conclusion

The privacy protections afforded by the Recordkeeping Rule are much narrower than those under HIPAA. The OSHA privacy protections apply only when certain kinds of injuries and illnesses are involved. And they don't limit use and disclosure of private medical information the way HIPAA does. In addition, although HIPAA and OSHA both afford individuals access to the medical information an employer maintains about them, HIPAA access rights are far broader than the access rights under the OSHA Recordkeeping Rule .

The Canadian Perspective

The above article deals with the technical provisions of a U.S. OSHA law and isn't of much interest to Canadians. Here's something that I think Canadian audiences will find more interesting:

4 Reasons Not to Fear C-45

On March 31, 2004, a new law called C-45 took effect in Canada. The law requires any person who controls or is in a position to control how work is done to take reasonable steps to protect the person doing the work and others. Failure to take reasonable steps can lead to criminal penalties including fines up to $100,000 and lifetime imprisonment.

C-45 is pretty scary stuff for safety directors and supervisors. But here are 4 reasons why it's not the beast it appears to be:

1. C-45 Covers Only the Worst Offenses

C-45 is Canada's answer to the Westray mining disaster. It's not designed to be used against every safety violation - only safety violations that show wanton and reckless disregard for life and safety - like the Westray officials did in allowing dangerous methane gases to build up in a mine and sending workers to work in those mines knowing how dangerous it was. Ordinary carelessness and innocent mistakes aren't crimes under C-45.

2. C-45 Targets Upper Management

Although the law is broadly written, the purpose of C-45 is to hold corporations and corporate officials accountable. True, the first and only prosecution under C-45 was against a supervisor in Ontario. But that case, which was recently dropped, was probably an aberration.

3. C-45 Doesn't Change the OHS Standards

C-45 is a criminal law, not an OHS regulation. It doesn't say anything about confined spaces, PPE, lockouts, etc. So you just have to keep following the same standards you always have.

4. You Can't Be Convicted If You Show Due Diligence

As noted above, C-45 covers only violations that are reckless and wanton. If you show due diligence to prevent accidents and follow the laws - just like you have in the past - a prosecutor can't convict you.

WHO WON?

Is Firing Retaliation for Air Quality Complaints?

What Happened: A manufacturing company made the decision to fire an engineer as part of a general force reduction. Five days later, before he had been told he was fired, the engineer called the company's ethics hotline to report concerns about air quality in the plant. He also claimed that his supervisor was taking kickbacks. 10 days later, the engineer's boss told him he was fired. The engineer claimed he'd been fired in retaliation for calling the hotline and demanded reinstatement.

Who Won?

Answer: The company. The court dismissed the case without a trial. The engineer didn't call the hotline until after the decision to fire him had been made. So the firing wasn't retaliatory.

Jermer v. Siemens Energy & Automation, Inc., 2005 U.S. App. LEXIS 1210 (6 th Cir), Jan. 25, 2005.

Story Tools:  Email This Post  Print This Post Top