Health Information Compliance Alert

Question: An employee who works at our company has shingles and has been in contact with some pregnant women in our office. Can we disclose his name to these women?

Ohio Subscriber

Answer: Shingles is a communicable disease, and there is a chance that the virus from a shingles patient may cause chickenpox in someone who has not had it before.

But as far as HIPAA is concerned, questions such as these are essentially functions of state law, responds Stephen Bernstein, an attorney with McDermott Will & Emery in Boston. The threat of a communicable disease among your workforce constitutes a state law safety concern and isn't really driven by HIPAA, he says.

"So HIV and all those kinds of categories of sensitive health information -- other than psychotherapy notes -- are totally driven by state law concerns," he explains. Therefore, you must consult state law before going ahead and disclosing the individual's protected health information to other employees without the individual's authorization.

One might be able to argue that protecting your staff's health can be considered part of your health  care operations, which would then allow you to  disclose the PHI without obtaining a signed authorization, says Bernstein. But he's quick to add that even if the regs did allow you to categorize staff safety as a health care operation, you'd still have to check whether your state or local law places stricter limitations on such disclosures than HIPAA.

And does it matter which disease you're talking about -- be it shingles, hepatitis or HIV? Again, go back to your state laws, since each state might have different protection requirements for different types of diseases, notes Bernstein.

While HIPAA was never intended to put anyone's health safety at risk, you'll still need to consult your state laws before announcing an employee's health information to any of your staff members.