Close Menu

HIPAA and Consent to Obtain Medical Information for ADA Purposes

ENews: Volume 15, Issue 1, First Quarter, 2017

From the desk of Tracie DeFreitas, M.S., Program Leader, Director of Training and Outreach

An employee submits a letter restricting him from lifting more than 20 pounds. The healthcare provider’s letter doesn’t indicate the reason for the lifting restriction, or the expected duration of the restriction. Does this employee have a disability? How long is he restricted in his ability to perform job duties?

An employee returned to work after a short leave of absence related to a gastrointestinal disorder. She requested approval to use unplanned intermittent leave when flare-ups occur. How frequently are flare-ups expected to occur? How much intermittent leave is she likely to need in a six month period?

An employee has a seizure disorder and asked his employer not to contact emergency services if he has a seizure at work that lasts a short period of time. Is this safe? What should the employer do while he’s having a seizure, and after? What is meant by “a short period of time”?

These workplace accommodation situations are common and illustrate that sometimes seemingly simple questions arise as part of the interactive process (IP). The answers to these kinds of questions can have a significant impact on the provision of accommodations and so obtaining appropriate medical information in a timely manner is important for an effective IP. Certainly, employers may ask employees to obtain additional, clarifying information from a healthcare provider, but sometimes it can be more efficient for an employer to contact an employee’s healthcare provider directly to obtain what is needed to proceed in the IP. For example, when an employer has a clarifying question about an employee’s restrictions or needs to know more about the anticipated frequency of the need for intermittent leave, it may be more efficient to call the healthcare provider. In some situations, a healthcare provider will be able to quickly answer a few direct questions to help an employer process a request for accommodation or facilitate return to work.

Provided an employer’s request for medical information is job-related and consistent with business necessity, the ADA does not prohibit employer representatives from directly contacting healthcare providers when medical information is needed in support of a request for accommodation. The catch – healthcare providers cannot share patients’ protected health information with employers who contact them directly without first having formal authorization to do so (DHHS, 2016). The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule restricts the disclosure of protected health information by healthcare providers to anyone without patient consent, including employers. The HIPAA Privacy Rule sets the national standard for protecting individuals’ medical records and other personal health information.

Other regulations, like the Family and Medical Leave Act (FMLA), may restrict who is permitted to contact an employee’s healthcare provider directly. Under the FMLA, direct authentication or clarification of the employee’s medical certification must be obtained by a healthcare provider, a human resource professional, a leave administrator, or a management official. A direct supervisor may not contact an employee’s healthcare provider for medical information (USDOL, 2016). State laws may also restrict employers from contacting healthcare providers directly.

When there is reason to contact a healthcare provider directly, employers should confirm that the employee for whom information is needed has either signed the HIPAA authorization form available through the healthcare provider, or signed a document, such as an “authorization to release medical information,” evidencing express consent for the healthcare provider to disclose the individual’s private medical information to a party named in the consent. Employer-drafted authorizations to release medical information should be HIPAA compliant. JAN does not provide legal advice or review releases for compliance. Consult an appropriate legal professional for guidance. However, the following elements might be included in an authorization to release medical information for ADA purposes:

  • Employee name for whom information is needed
  • Purpose for request to release medical information [e.g., to support a request for reasonable accommodation under ADA]
  • Party [e.g., person(s) and/or organization] to whom express consent is given to receive protected health information
  • Description of information to be released by healthcare provider and/or specific job-related medical questions relevant to the situation
  • Dates of healthcare service for which medical information may be released by the healthcare provider [e.g., from May 2016 through October 2016]
  • Authorization for verbal/electronic/fax communication about employee’s medical history and care
  • Date or event on which the authorization will expire
  • Statement regarding employee’s right to revoke consent at any time

Additional elements may be required to meet HIPAA compliance. For additional information regarding the HIPAA privacy rule and employment, see Employers and Health Information in the Workplace. For information about the ADA and requests for medical information, go to, A to Z of Disabilities and Accommodations, under the topic of Medical Exams and Inquiries.

doctor working