Pulmonology Coding Alert

Question: When an employer pays our office to perform pulmonary tests, can we disclose the exam/test results to the employer without obtaining an authorization from the patient?

Codify Subscriber

Answer: Although many healthcare providers assume that they don’t need patient authorization in this case, that is not correct. As with any other protected health information (PHI), you generally need the patient’s written, HIPAA-compliant authorization to disclose exam and test results to the employer.

There are a few very limited exceptions where you can forgo patient authorization. You may disclose PHI to an appropriate entity if necessary, to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. Also, HIPAA allows disclosures to employers if the exam was part of a medical surveillance of the workplace, and the employer needs the information to report work-related injuries as required by the Occupational Safety and Health Administration (OSHA), the Mine Safety and Health Administration (MSHA), or similar state laws.

Additionally, HIPAA allows you to disclose PHI as necessary to comply with workers’ compensation laws.

Best practice: If you conduct employment exams, make sure you obtain the patient’s written, HIPAA-compliant authorization before conducting the exam and/or disclosing exam/test results to the patient’s employer.