Author's Commentary on "The Company That Cared Too Much"

Most companies in the United States spend a great deal of time and energy collecting data on their employees; whether it is demographic data about workers' ages or work histories, or health data about injuries and illness that workers may experience on the job. Since the Occupational Safety and Health Act was implemented in 1970, the Department of Labor has required companies to keep track of certain work-related health problems that employees experience, in addition to certain treatments, and whether or not time off from work was required as a result of injuries. However, only rather recently have companies utilized these data to implement prevention strategies and health care programs. This case study is intended to generate discussion about how a company handled a very sensitive issue about confidentiality of health information.

Brock Plastics has been described as a company that is well known for its great benefits and bonuses. In addition, the company provides an on-site fitness club and health unit that is staffed with professionals to assist employees with their diet, stress and personal health issues. Brock Plastics has gone above and beyond what is required in the United States by the Occupational Safety and Health Act. However, this company has followed a common trend in corporate America where companies have begun to see the positive impact in profits by treating their employees as valuable commodities. Companies that have happy and healthy employees are more likely to have highly productive employees.

Occupational health professionals are trained to keep all health information about an employee confidential. Only in circumstances where a health issue is related to a workplace exposure is an occupational health professional permitted to share health information with the employee's manager. For example, if Lynda missed work due to back problems related to her job, occupational health professionals would be allowed to share that information with Lynda's manager in order to improve Lynda's work environment. However, if Lynda missed work due to back problems unrelated to her job, the occupational health professionals would not be allowed to share that information with anyone within the company without Lynda's permission.

According to these rules, did Mary violate confidentiality by sending health promotion information to Lynda through intra-office mail? Technically, no, because Mary did not explicitly share with others the information that Lynda's mother was severely depressed. However, the message contained the implied message that Lynda has a problem with depression. When Mary sent the information without permission, she risked breaching confidentiality. If co-workers opened the letter or saw the information on Lynda's desk, they may have suspected that Lynda was having problems with depression. Therefore, Mary and her staff changed their practice of targeted mailings, ensuring that they obtained permission to mail information before doing so.

The second significant issue in this case is the use of computerized health data in order to plan needed prevention programs by the company. Should Brock Plastics be responsible for sharing information with its employees about how their personal data are being used and stored? Should employees be informed that their personal health information is being used to plan programs? The company's intentions are good. Regardless of the fact that they want to care for the health of their employees in order to safeguard the bottom line, the end result is still the same. The employees are well cared for. However, Brock Plastics has not been forthright with its employees regarding the use of the data. If the company asked employees to provide permission for the use of personal data, they probably would find that some employees would not allow it to be used.

In the past five years, Congress has debated the issue of whether people should be informed about how their health information is utilized and stored by hospitals, insurance companies and corporations. In April 2001, the Department of Health and Human Services promulgated the Privacy Rule. Most health plans and health care providers that are covered by the rule must comply with the new requirements by April 2003. This measure will provide employees with more control over their health information by setting boundaries around the use and release of health records. In addition, it will establish appropriate safeguards that health care providers and others must observe to protect the privacy of health information. Lastly, it holds violators accountable, with civil and criminal penalties that can be imposed if they violate patients' privacy rights. For employees, it means that they will be able to make informed choices about how their personal health information is being used.

It is a positive move for companies like Brock Plastics to invest in the emotional and physical well being of their employees. However, companies must respect employees' rights with regard to their personal health information. Brock Plastics did the right thing by asking its employees if they wanted to have health information sent to them through intra-office mail. However, they still need to implement the process of informed consent for the use of their employees' health data.