AskaManager is an awesome blog, this is one of today's discussions that I found interesting. The comments are fascinating as well.

by ALISON GREEN on AUGUST 30, 2021

A reader writes:

I took a job a few months ago doing benefits for a new company and recently have started to feel uneasy about one of my job duties. For now this particular duty has been delegated to my manager (who has experience in benefits but only started at this company a week before me), so I haven’t been doing it, but I’m worried about when the time comes for me to take it back on.

Every week, we receive a report from our health insurance company with the names of employees who had a claim processed that week, and the costs associated with their claims. The file itself doesn’t contain anything confidential, but it does have the medical codes associated with the employee’s claim. Our job is to find the most expensive claims (generally anything above $3,000) and look up the medical codes and figure out what treatment the employee had and why (which sometimes inevitably leads to that person’s medical diagnosis), and then send the names of those employees with their medical treatments and health information to our chief operating officer and VP of HR for approval. We also have to include a note as to whether we expect to see any future high-cost claims from that person.

When I first started, I didn’t really think anything of it, but after being there for a few months and seeing the not-illegal-but-less-than-ethical approach this company takes in other situations, it started to make my stomach churn. And the more I thought about it, the less sense it made to even be doing this file in the first place because 1) our health insurance company has already approved/denied these claims by the time we get the report and 2) we still have to pay the insurance company whether the COO approves this file or not. And while I can’t prove anything for certain, there’s been at least one person whose name has appeared on the file several times and was let go not long after.

I definitely don’t plan on sticking around long-term so I don’t want to make a huge deal out of this, but at the same time I don’t feel right sending this information around like that. If it I had a serious disease or embarrassing medical issue, I wouldn’t want anyone to know about it, let alone the COO and VP of HR at my work.

When the time comes for me to start doing this task again, I’ve thought about just sending the information without including anyone’s name, but I am doubtful that they will allow this since one of the few times I did it, the COO asked for the names of people specifically.

Is this illegal, and if it’s not, how much can I push back on it?

Whaaaat.

This is so messed up that I can barely see straight. It’s unethical and disgusting of your company to be investigating people’s medical conditions — and to the point that they’ve formalized a process for doing it, as if it’s just some mundane business practice — and possibly pushing someone out because of his medical treatment (!).

I took this straight to employment lawyer Donna Ballman, author of the excellent book Stand Up For Yourself Without Getting Fired, who said:

Wow! I thought I’d heard them all but this really takes the cake. What possible legal use could the COO and VP of HR have for this information? Because I can imagine lots of illegal things they could do with it. Disability discrimination, genetic information discrimination, and FMLA violations jump immediately to mind. The company’s potential liability for this practice is mind-boggling. I don’t know what state this happened in, but in Florida (where Donna practices) if the employee objects to or refuses to participate in an illegal practice, they are protected under the Florida Whistleblower Act. Other states have similar laws, but not all do. So you might be protected under a state whistleblower law. Otherwise, we need to look at federal legal protections.

Here are some possible legal violations by this employer:

Americans With Disabilities Act: Decisions about employment can’t be motivated by concerns about the impact of the employee’s disability or the disability of a person associated with the employee on the employer’s health insurance plan. Employers also can’t discriminate against employees because they discover an employee or an employee’s family member has a disability. Retaliation against employees who object to disability discrimination is illegal. EEOC enforces this.

Pregnancy Discrimination: Similar to age discrimination, employers can’t discriminate because they discover an employee is pregnant. Retaliation against employees who object to pregnancy discrimination is illegal. EEOC also enforces this.

HIPAA: Employer sponsored health plans are “covered entities” under HIPAA and the use of protected health information from those plans for employment purposes is prohibited without employee authorization. HIPAA requires that employers who gain access to employee medical information due to providing health insurance limit the people who can access this information to those who need the information for plan administration purposes. Under no circumstances can the company make any decisions about employment based on the employee’s health or the health of any of the employee’s family members. Both the insurance company and the employer could have exposure for this, and I really question why the insurance company would give the employer these codes at all. The Office of Civil Rights handles enforcement of HIPAA violations. Retaliation against whistleblowers who file a HIPAA complaint with OCR or who cooperate with a HIPAA investigation is illegal.

If this were a Florida case, I’d suggest that you put in writing that you object to and refuse to participate in this practice, state what laws you believe it violates, and then you are probably protected under the Florida Whistleblower Act. If your state doesn’t have a law like this, then you may have to file a complaint with the Office of Civil Rights or EEOC to gain legal protection. The problem with an EEOC complaint is you simply don’t know how the information is being used. But it certainly seems like it can only be used for illegal purposes under the circumstances. If you have a good relationship with your boss, you might point to the potential liability issues here and tell them that you think it’s a bad practice. You might want to run this past an employment lawyer in your state to get some legal advice on this before you take any action to make sure you are protected against retaliation before you act.

Letter-writer, you shocked even Donna Ballman, who I am pretty sure has seen everything. Please take her advice!