Does HIPAA Apply to Drug Test Results?

The HIPAA Privacy Rule applies to covered entities, which are health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with a covered transaction (45 CFR 160.103). An employer acting in its role as an employer is not a covered entity. HHS states that in most cases the Privacy Rule does not apply to the actions of an employer (HHS, Employers and Health Information in the Workplace). The definition of protected health information also excludes employment records held by a covered entity in its role as employer (45 CFR 160.103).

A drug test result held by a covered health care provider can be protected health information. For non-DOT testing, HHS guidance states that, outside of workplace medical surveillance or work-related illness or injury evaluations that an employer needs to meet OSHA, MSHA, or similar state law requirements, a covered provider may not disclose drug test results to an employer without the individual's authorization unless another provision of the rule permits it. The same guidance states that nothing in the rule prohibits an employer from conditioning employment on an individual providing an authorization (HHS HIPAA FAQ 301). A valid authorization contains the core elements and statements listed in 45 CFR 164.508(c).

For DOT testing, the Privacy Rule permits a covered entity to use or disclose protected health information to the extent the disclosure is required by law and limited to the relevant requirements of that law (45 CFR 164.512(a)). Required by law includes statutes or regulations that require the production of information (45 CFR 164.103). The DOT HIPAA statement says employers and service agents do not need a written employee authorization for disclosures that 49 CFR Part 40 or DOT agency rules require, such as a Medical Review Officer reporting verified results to the employer (DOT ODAPC HIPAA Statement).

Part 40 has its own confidentiality rule. Employers and service agents may not release individual test results or medical information about an employee to third parties without the employee's specific written consent, and blanket releases are prohibited (49 CFR 40.321). Exceptions include releases to DOT agency representatives and, for post-accident tests, to the National Transportation Safety Board during an accident investigation (49 CFR 40.331). An employer may not require an employee to sign a consent, release, waiver of liability, or indemnification agreement for any part of the DOT testing process (49 CFR 40.27).