Employer access and HMO billing reviews

Overview

The NPC emphasized proportionality in internal audits. A fitness certificate may meet an employer’s purpose without disclosure of the full clinical record. Paying HMO premiums does not, by itself, justify access to employees’ health information; itemized charges can also reveal health details.

Practice implications

Parao Law practice guidance

For physicians

For a fitness inquiry, consider whether a focused certification meets the request. Do not routinely send the complete chart to HR or an auditor. Route requests for detailed clinical or billing information through an authorized review process.

For lawyers

Identify the applicable basis for processing sensitive information and limit access to what the purpose requires. For the billing review described, the NPC suggested employee consent or employee confirmation of the amount charged. Build defined access permissions into audit procedures; an unrestricted audit clause is insufficient.