Skip to content
Benefits

Can Our Company Require a Third-Party EAP Vendor to Provide Us With Reports on Employees Undergoing Mandatory Drug Counseling?

EBIA Checkpoint News Staff  

· 5 minute read

EBIA Checkpoint News Staff  

· 5 minute read

QUESTION: Our company’s policy dictates that an employee whose drug test is positive must complete mandatory drug counseling under a referral to our employer-sponsored employee assistance program (EAP). The EAP is staffed by a third-party vendor. Can our company request and receive from the EAP vendor proof of satisfactory participation in and completion of the drug counseling program as a precondition to the employee’s ongoing employment?

ANSWER: Yes, your company can request the information. However, the EAP should not disclose it to the company until it receives an authorization from the employee that complies with the HIPAA privacy rule.

As background, EAPs providing medical care (including counseling) are health plans and “covered entities” under HIPAA and therefore must comply with the requirements of the HIPAA privacy rule. The HIPAA privacy rule prohibits disclosure of protected health information (PHI), even from an EAP to the employer that referred an employee for treatment, unless an exception exists or a HIPAA-compliant authorization has been obtained from the employee. HHS treats drug testing results held by a covered entity as PHI, and this scenario does not appear to fall within any of the HIPAA privacy rule’s exceptions that would permit disclosure.

Although (with proper plan amendments) PHI may be shared with an employer for plan administrative functions, the information may not be shared with the employer for employment functions (such as to confirm whether employees have received drug counseling). This means that the EAP is not permitted to disclose an employee’s participation information to the employer without an authorization from the employee allowing the disclosure. And although the employer cannot require the employee to sign the authorization in order to receive treatment, it can require the employee to provide an authorization as a condition of ongoing employment.

While HIPAA does not protect an employee’s employment records, it does protect an employee’s medical or health plan records. Even if an employer requires an employee to take medical tests, and even if the employer pays for the testing, the employee still must provide authorization before the provider can send the medical records to the employer. For more information, see EBIA’s HIPAA Portability, Privacy & Security manual at Sections VI.L (“Employee Assistance Programs (EAPs)”), XXII.C (“What Are ‘Health Plans’ and ‘Group Health Plans?’”), and XXIII.D (“Many Common Employer Functions Require Authorization”).

 

Take your tax and accounting research to the next level with Checkpoint Edge and CoCounsel. Get instant access to AI-assisted research, expert-approved answers, and cutting-edge tools like Advisory Maps and State Charts. Try it today and transform the way you work! Subscribe now and discover a smarter way to find answers.

More answers