Compliance Stuff

When an employee requests a reasonable accommodation for a health condition, it may be confusing for employers to parse out the various privacy protections embedded in the Health Insurance Portability and Accountability Act (HIPAA), the Americans with Disabilities Act (ADA), and  42 CFR Part 2 (Part 2),  a federal regulation restricting the disclosure of substance use disorder records. This article will explain the legal obligations under the three standards and how they intersect in this tricky area of compliance. Quick Hits The ADA, HIPAA, and the 42 CFR  Part 2 regulation  seek to protect patients’ private medical information with different requirements for healthcare providers and employers. When employers receive a request for a reasonable accommodation, they can request a doctor’s letter or limited medical records for which there is a business need for the information. Non-healthcare employers typically are not subject to HIPAA and Part 2 for their employment...

Healthline Media has agreed to pay $1.55 million to resolve allegations that it violated the California Consumer Privacy Act (CCPA) – which is the largest settlement to date under the state’s landmark privacy law. The California Attorney General alleged that the company’s health information website, Healthline.com , failed to allow consumers to opt out of targeted advertising and shared data – including information about potential medical conditions – with third parties without proper privacy protections. The settlement, which still needs to be approved by the court, also contains a unique provision: it prohibits Healthline from sharing information with third parties about article titles consumers view that may reveal a medical diagnosis . Here's a breakdown of the allegations and settlement terms, as well as a six-step compliance plan for businesses that operate in California or collect data from California residents. Background and Allegations Healthlin...