In an administrative appeal decision issued on January 11, 2011, the EEOC ruled that an employer providing medical records pursuant to a subpoena issued by a court of law, but without the employee’s written consent, violates the privacy provisions of the Americans with Disabilities Act (ADA), and directed that the employee be given the opportunity to establish entitlement for compensatory damages and attorney fees for the unlawful disclosure.

Although this was a ruling in a federal government discrimination claim, and not a court decision, employers would be prudent to consider how this ruling could impact its responses to discovery requests and court and administrative subpoenas.

This ruling came in the EEOC’s consideration of an appeal of an administrative claim of discrimination raised by a Postal Service employee for violations of the Rehabilitation Act of 1973 and the Age Discrimination Act. Among the issues presented by the appeal to the EEOC was whether the Postal Service had violated the Rehabilitation Act when it released the employee’s medical information in unrelated litigation between the employee and a third party in response to a lawfully obtained court subpoena. The subpoena requested production of the employee’s payroll and personnel records, including his medical records. The Postal Service complied with the subpoena and produced the medical records along with the other requested documents. Although the employee had not provided written authorization for the release of those records, neither his counsel in the claim against the third party nor the Postal Service objected to the production of the medical records.

When determining whether the production of medical records violated the privacy provisions of the Rehabilitation Act (which incorporates the provisions of Title I of the ADA) the Postal Service decided there was no violation because it was under legal compulsion to produce the records and therefore no written release was required. This ruling was appealed by the employee to the EEOC pursuant to the administrative procedures for the Postal Service.

In its decision, the EEOC determined the disclosure without the written release of the employee was a violation of the ADA, and held that a subpoena issued by a court clerk does not fall within the exceptions in the law: “A request for an employee’s medical records pursuant to a discovery request in a civil action would not fit into one of the exceptions to the ADA’s confidentiality requirement.” The EEOC also concluded that a discovery request pursuant to a subpoena does not fall within the exception under the Privacy Act for disclosures “pursuant to the order of a court of competent jurisdiction” because there was no court order, only a clerk-issued subpoena provided at the request of the third party’s attorney.

What This Means to You

This administrative decision by the EEOC signals how the agency will view disclosures made pursuant to a subpoena without written authorization of the involved employee. Employers who respond without the written authorization will be exposed to claims for compensatory damages and attorney fees, even when the disclosure was made in good faith that compliance was required by the subpoena. Given the number of statutes that protect medical records from disclosure (the ADA, the Rehabilitation Act, HIPAA, the Family and Medical Leave Act, and the Genetic Information Nondisclosure Act, to name a few), employers should establish internal procedures to ensure that medical records privacy law and regulations are not violated by the tender of protected documents pursuant to subpoenas or discovery requests during litigation or administrative proceedings. Such procedures should also ensure that inadvertent disclosure of medical records misfiled in personnel files rather than in the required limited access medical record files, does not occur.