The applicability of the HIPAA privacy rule to DOT medical examination records.
In trucking litigation, it is common during the course of claims handling, pre-suit discovery, or written discovery following a motor vehicle accident for a claimant to request all medical examination reports and medical examiner’s certificates in the driver or motor carrier’s possession or contained in the driver qualification file. It is also common practice for a motor carrier, claims professional, or their counsel to produce all the documents contained in the driver qualification file, inclusive of any medical examination reports and medical examiner’s certificates. But if there is a Department of Transportation (DOT) Medical Examination Report contained in the driver qualification file, is the motor carrier, claims professional, or their counsel violating the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule by disclosing protected health information?
Medical Examination Records Pursuant to FMCSA Regulations
Through the Federal Motor Carrier Safety Administration (FMCSA), the DOT has set forth the physical qualifications for persons to be permitted to operate a commercial vehicle. Generally, barring certain variances and exceptions, a person is physically qualified to drive a commercial motor vehicle if the criteria set forth in 49 CFR § 391.41 are met. The regulation requires, in part, that the driver:
In order to ensure that a person meets the physical qualifications for driving a commercial vehicle, drivers are required (unless otherwise exempted) to undergo a medical examination every two years. Only a medical examiner who is listed with the National Registry of Certified Medical Examiners may perform a medical examination for these purposes.
Medical examiners are not only limited to physicians or medical doctors, but also may include practitioners of chiropractic medicine. Medical professionals on the National Registry will have completed a training course and passed a test pertaining to FMCSA physical qualification standards for drivers. The guidelines and instructions for the performance of a medical examination by a medical examiner are set forth in 49 CFR § 391.43, with the results of the examination recorded in a Medical Examination Report (commonly referred to as a “long form”).
The Medical Examination Report contains, in part, a health history and the results of certain tests and examinations performed on the driver. If the medical examiner finds that the driver, upon examination, is physically qualified to operate a commercial vehicle pursuant to the guidelines of 49 CFR § 391.43, the examiner furnishes the driver with a Medical Examiner’s Certificate (commonly called a “medical card”). Once the driver has been issued a certificate, the driver should maintain a copy in his possession, provide a copy to the motor carrier, and register a copy with the appropriate state agency (e.g., Department of Motor Vehicles, Department of Transportation, etc.).
As a part of its driver qualification file, a motor carrier must maintain a copy of the Medical Examiner’s Certificate, but it is not required to maintain a copy of the Medical Examination Report. In fact, while the motor carrier is not prohibited from obtaining a copy of the Medical Examination Report, the motor carrier is not entitled to receive a copy of the report, nor can it attempt to require the driver to produce a copy of the long form. In order to obtain the Medical Examination Report, an employer must get a release form signed by the driver.
No instruction is given by the FMCSA to medical examiners in 49 CFR § 391.43 regarding the sharing of medical information; they are referred to HIPAA regulations for guidance. In its memo “Are the DOT medical examinations covered by HIPAA?” the FMCSA has advised only that the information that can or must be turned over to the employer is a legal question subject to HIPAA and medical examiners should obtain a legal opinion to resolve any doubts.
HIPAA Privacy Rule and Disclosure of Protected Health Information
HIPAA permits the disclosure of medical records by a covered entity under certain conditions. A covered entity is defined as one of the following: (1) health care providers (e.g., doctor, dentist, psychologist); (2) health plans (e.g., health insurance company, Medicare, Medicaid); and (3) health care clearinghouses. Pursuant to 45 CFR § 160.103, the protected health information that the HIPAA Privacy Rule is intended to protect is “all individually identifiable health information.” Individually identifiable health information is any information that relates or pertains to (1) an individual’s past, present, or future physical or mental health or condition; (2) the provision of health care to an individual; (3) the past, present, or future payment for the provision of health care to the individual; and (4) information that identifies an individual or for which there is a reasonable basis to believe it can be used to identify an individual.
Under 45 CFR §164.512(e), which guides a covered entity’s permitted disclosures of protected health information in judicial and administrative procedures, a covered entity may produce protected health information (1) in response to a court order or (2) without a court order, in subpoena, discovery request, or other lawful process, if (a) the seeking party provides assurances to the covered entity that the individual who is the subject of the protected health information has been given notice of the request and has no objection or the objections have been resolved or (b) the seeking party gives assurances to the covered entity that it has made reasonable efforts to secure a qualified protective order from the court. Additionally, the individual who is the subject of the protected health information may provide a written authorization for the release of the protected health information.
Discovery Pertaining to DOT-Required Medical Examinations
Under the definitions of the Privacy Rule set forth in 45 CFR § 160.103, a Medical Examination Report is considered protected health information because it contains individually identifiable health information. Specifically, information contained in the long form relates to the driver’s health history and the results of certain tests and examinations performed on the driver. It is information that identifies the driver or for which there is a reasonable basis to believe that it can be used to identify the driver. In contrast, the Medical Examiner’s Certificate contains no such protected health information and only identifies the driver as one permitted to operate a commercial vehicle because he is in compliance with FMCSA regulations governing the driver’s physical qualifications.
Because the Medical Examination Report is protected health information, it should not be produced by either the motor carrier or its counsel—regardless of whether it is contained within the employer’s driver qualification file—without either an authorization for release from the driver or a HIPAA protective order entered by the court in the course of litigation. By contrast, the Medical Examiner’s Certificate is not protected health information and is immediately discoverable upon request, regardless of a release authorization or HIPAA order.
Jeremy W. Richter is an associate with CLM Member Firm Webster, Henry, Lyons, Bradwell, Cohan & Black PC. He can be reached at (205) 380-3480, jrichter@websterhenry.com
CLM’s Transportation Committee provides education, training, and solutions on significant current commercial and personal transportation issues facing insurance carriers, corporations, and other entities and individuals.
