January 2011 - National Labor Relations Board

10054 THE INVESTIGATIONPursuant to OM 99-35, Regional Offices should ensure that docketing lettersspecifically inform charged parties that the evidence and statements of position submittedby the parties will be used without qualification or condition. See also Federal Rules ofEvidence 801(d)(2)(C).10054.7 HIPAA’s Privacy Rule Disclosure Procedures for Medical InformationBefore attempting to secure medical information, Board agents should consultOM Memos 07-60 and 08-34, which contain a comprehensive treatment of issues relativeto the Health Insurance Portability and Accountability Act of 1996 (HIPAA).HIPAA and a set of implementing regulations promulgated by the Department ofHealth and Human Services, known as the Privacy Rule, establish a legal protocolgoverning the use and disclosure of individually identifiable health information from“covered entities”. Covered entities include most doctors and other health care providers,health plans and health care clearinghouses that transmit health informationelectronically. “Health care provider” is further defined to include a “provider of healthand mental services . . . and any other person who furnishes, bills, or is paid for healthcare.”HIPAA and the Privacy Rule prohibit covered entities from disclosingindividually identifiable health information unless the request complies with anapplicable exception. As set forth below, there are two exceptions that most typicallyarise in NLRB investigations:Valid written authorization for disclosure of protected health careinformation from the individual. See medical and psychotherapy notesauthorization patterns attached to OM Memo 08-34, which revise thosepatterns provided in OM Memo 07-60.Subpoenas which are subject to special requirements set forth in thePrivacy Rule under its law enforcement standard, which applies to theAgency. The subpoena must:o Be specific and limited in scopeo Seek only information that is relevant to a legitimate lawenforcement inquiry, ando Request protected health care information only because deidentifiedhealth information could not reasonably be usedDe-identified information is by definition not covered by HIPAA or the PrivacyRule restrictions because it is not protected health care information. Information is deidentifiedif:Revised 01/11