HRAR-1.06 - Employee Medical Files

 City Policy

The City of Portland works to ensure the confidentiality and security of its medical records and the privacy of employees. It is the policy of the City of Portland to treat all medical information about employees as confidential in accordance with all applicable laws and regulations.

All City employees are obligated and responsible for protecting the confidentiality of medical records, medical conditions and the privacy of employees. No employee shall disclose medical records or private health information to another employee or individual, except as specified under these Administrative Rules. Failure to comply with these rules shall be subject to discipline, up to and including discharge from employment.

Types of Medical Records

The City of Portland maintains the following medical records concerning its employees:

1. Medical Records relating to an employee’s ability to perform employment for the City, or the health of a spouse, domestic partner, or dependent. (Hereinafter referred to as Employment Medical Records).
2. Medical Records relating to an employee’s litigation against the City, OSHA Compliance, Short-Term, and Long-Term Disability. (Hereinafter referred to as Tort Medical Records).
3. Medical Records relating to an employee’s Workers’ Compensation or disability claim with the City. (Hereinafter referred to as Workers’ Compensation Medical Records).
4. Medical Records relating to a firefighter or police officer’s disability claim under the Fire and Police Disability and Retirement Plan. (Hereinafter referred to as FPDR Medical Records).
5. Medical information relating to an employee’s participation in a City Sponsored Benefit Plan. (Hereinafter referred to as Employee Benefit Medical Records).
6. Medical records related to a city employee's exposure to hazardous conditions such as chemicals, toxic substances, bloodborne pathogens, biological agents, bacteria, virus, fungus, radiation, noise, dust, heat, cold, vibration, repetitive motion, or other dangerous work-related conditions.

Employment Medical Records Files and Storage

Employment Medical Records shall be filed and stored as follows:

1. All medical information and related information that describes the health, medical history, or condition of an employee or an employee’s family member must be handled as confidential medical information.
2. Such information must be stored in a secure file physically separate from the personnel file.
3. Medical records (except Hazard Exposure Records) should be forwarded to the Bureau of Human Resources at the time they are generated. Medical records must be transmitted to the Bureau of Human resources in a manner that ensures confidentiality is maintained. Reference copies should be maintained by the employee's bureau in a secure file physically separate from other personnel files. All reference copies should be forwarded to the Bureau of Human Resources when an employee separates from City service. If there is pending legal action, the file will be retained by the bureau until such time as transfer is authorized by the City Attorney’s Office.
4. Hazard Exposure Records should be maintained in a secure file physically separate from other personnel files and handled as confidential medical information.

Each Bureau must have a written procedure specifying the individuals or class of individuals who may have access to employee medical files and the job- related reason for such access.

Access to Employee Medical Records

The Bureau director or designee, the Division of Risk Management, and the City Attorney’s Office may share information contained in Employee Medical Files with others as follows:

1. To assist supervisors and managers responsible for making decisions with respect to temporary or permanent accommodations due to medical condition(s);
2. Inform first aid and safety workers about a known condition that may require emergency treatment and about specific procedures that are needed if the workplace must be evacuated;
3. Grant access to government officials checking for ADA compliance reviews;
4. Grant access to the Bureau Director or designee, the City’s Division of Risk Management and Office of the City Attorney, as the situation requires.

Except for the above-mentioned reasons, medical information about employees should not be disclosed to anyone without a City of Portland Authorization for Use or Disclosure of Health Information Form or alternative form approved by the City Attorneys’ Office signed by the employee.

Employee Access to Employment Medical Records

Medical Records that are maintained by the City are not part of the employee’s personnel records.

What to Include in Employee Medical Record File

• Post-offer Pre-Employment Physical
• ADA Accommodation Requests and supporting medical documentation.
• Fitness for duty exam
• Medical information related to sick, FMLA/OFLA or catastrophic leave management or medical layoff.
• Information from an employee’s health care providers regarding the employee’s medical condition, physical restrictions, or need for workplace modification.
• Employee requests for leave that identify the employee’s illness or injury
• “Emergency” forms that list the employee’s medical condition(s), health care provider(s), and/or prescription medications; and
• Release/Readiness to Return to Work after Disability
• Information regarding the medical condition of an employee’s family member

NOTE: Any authorized workplace accommodation should be documented in an employee’s personnel file but should not reference any medical information.

Employee Medical Records and the Health Insurance Portability and Accountability Act (HIPAA)

Federal Regulations explicitly exclude employment records held by the City of Portland in its role as an employer from the HIPAA medical record requirements*.

Records that are exempt from the HIPAA requirements at the City of Portland include Worker’s Compensation health records, FMLA/OFLA health information, ADA Accommodation Requests and supporting documentation, occupational injury, disability insurance eligibility, sick-leave requests, drug screenings, workplace medical surveillance, fitness-for-duty tests, injured worker return to work, medical layoff, & Catastrophic Leave.

*67 Fed. Reg. 53181, 53192 (August 14, 2002)

Tort Medical Files

The City investigates, gathers, and retains medical records of employees who are involved in OSHA investigations, have applied for Short-Term, and Long-Term Disability, or have initiated a tort claim against the City.

1. OSHA Matters: 29 CFR 1910.1020 requires that these records be available to employees, their designated representatives and to OSHA investigators. These records are shared with the City Attorney if an OSHA matter is or is anticipated to be litigated.
2. Short-Term and Long-Term Disability Matters: These records are shared with the City Attorney if a disability matter is or is anticipated to be litigated. They may also be provided to the employee or employee’s representative with proper authorization as required by law.
3. Tort Matters: These records are shared with the City Attorney if a tort matter is anticipated to be litigated. They may also be provided to the employee or employee’s representative with proper authorization as required by law.

Employee Benefit Files

Employee Health or Benefit information acquired by the City of Portland’s Benefit Office for the purpose of Benefit Administration is covered by Federal HIPAA standards. See HIPAA Policy & Procedures for confidentiality and record release requirements. Such files are not part of the employee medical record but a separate and legally distinct Employee Benefit File. Information included in the Employee Benefit File:

• Initial Enrollment Information
• Annual Enrollment Information
• Cobra Notice
• Change in Family Status
• Copy of Marriage License
• Beneficiary Designation
• Domestic Partner Affidavit for Health
• Benefits

Workers’ Compensation Medical Records

FPDR investigates, gathers and retains employee medical records that are relevant to claims filed with FPDR for service-connected, occupational or nonservice connected disability.

• ORS 192.496(1) & 192.502(2) require the confidentiality of these records.

All requests for FPDR Medical Records from internal entities must be submitted directly to FPDR. Outside entities, other than those entitled to the documents by law, must have a singed authorization from the employee who is the subject of such request.

Handling Medical Records Request

Records may not be released without authorization except as required by law. An employee must sign the City of Portland Authorization For Use or Disclosure of Health Information Form. An alternative disclosure release form may be used for disclosure of employee records if that form has been approved by the City Attorney’s Office.

The City of Portland Authorization For Use or Disclosure of Health Information Form or alternative disclosure release form signed by the employee shall be placed in the employee’s appropriate file when medical records from a file are released.

It is a violation of this policy to release information from employee medical records or to discuss or disseminate such information to individuals who have no legitimate business need to know, who do not have proper authorization, are who are not entitled to the medical records by law.

Medical Records Request

All record requests shall be forwarded to Human Resources for appropriate action and response. Employees receiving any subpoena or other request to appear, respond, answer questions, or provide information to an administrative agency or department, or other legal authority, must immediately notify and deliver the subpoena, document, or request to the City Attorney’s Office. This is to protect the employee and the City and to ensure employee privacy and compliance with the law and this Administrative Rule.

Employee Drug & Alcohol Testing Results

The City of Portland retains all Drug & Alcohol testing information required by 49 CFR Part 40 in a secure file within the Labor Relations Unit of the Bureau of Human Resources and such information shall not be disclosed unless required by law or authorized by the employee.

The City of Portland is not required to obtain employee authorization to disclose drug and alcohol testing information required by 49 CFR Part 40 and other Department of Transportation agency drug and alcohol testing rules. (Also see HIPAA citation CFR 164.512).

Electronic Communication and Employee Health Information

Discussions regarding specific health issues of City employees shall be confidential and shall not be conducted over e-mail, except when deemed necessary by Risk Management and/or the City Attorney’s Office for the City to effectively manage and administer claims and benefits, and when the communications are otherwise protected from disclosure. General information regarding employee absence due to a health issue is permissible via email to manage leave or benefit coverage.

Medical Record Retention

1. At the time an employee transfers to another bureau, their medical file (except Hazard Exposure Records) shall be forwarded in full to their new bureau.
2. At the time an employee separates from service, the medical file (except Hazard Exposure Records) shall be forwarded to Employee Records in Human Resources for incorporation into the employee’s permanent medical record.
3. Employee medical files are retained in accordance with state and federal record retention requirements. Once the applicable retention period has expired, the files will be disposed of in a confidential and secure manner.
4. Hazard Exposure Records are to be maintained for the entire retention period by the safety office of the bureau that employed the employee at the time the exposure occurred.