The Rapidly Fading Privacy of Employee Health Records

A visit to the doctor's office often involves taking off all your clothes, putting on a remarkably thin gown, and sitting in a chilly room trying to ignore the draft of cold air running up your backside. Needless to say, that's not something you want to do in the waiting room, which is why you are usually directed to a small private exam room where you are seen by just a doctor and perhaps a nurse. Because of the perceived privacy of the exam room, you are more likely to reveal to the doctor things that you wouldn't reveal to anyone else.

Increasingly, however, the doctor and nurse are not the only ones in the exam room with you. If you rely on a health insurance company to pay the doctor's bill, a claim representative is present in spirit, checking to make sure that the doctor's treatment is covered by your health insurance policy and is not unnecessary or experimental. If your employer pays your health insurance premiums, then your employer is there as well, quietly watching as the doctor pokes and prods and inquires about your recent onset of high blood pressure. All of sudden, that small exam room has gotten crowded.

Why are all those other people there? The chief culprit is the phenomenally high cost of medical care and the corresponding cost of health insurance. Before paying your medical bills, the insurance company understandably wants some information: What was the treatment for? Is the condition one that your policy covers? How long will the treatment go on? How much will the treatment cost? Are there less costly alternatives?

As much as they sometimes try to pretend otherwise, health insurance companies are for-profit businesses and their main objective, at the end of the day, is to take in more money in premiums that they pay out in claims. In order to accomplish that goal, an insurance company needs to minimize expenses, chiefly by avoiding "unnecessary" procedures, coverage for high-risk individuals, and fraudulent claims.

Patient information—the more, the better—is an insurance company's chief tool for screening potential subscribers and combating fraud. Does your medical history indicate that you have a preexisting condition (a common health insurance exclusion)? Are you seeking treatment for a condition that is not covered by (or excluded from) your policy? Do you have dietary habits or other addictions that may be contributing to your medical condition? Are you requesting reimbursement for an elective or cosmetic procedure? Is the proposed treatment experimental? All these inquiries are of interest to health insurance companies, because they help to determine whether the insurance company is responsible for paying for your treatment.

The information about your physical condition begins to be even more widely disseminated when your employer pays your health insurance premiums. Without question, the single biggest threat to the privacy of employee medical records is the fact that most employers pay some or all of the cost of medical care for their employees, either through the payment of premiums for health insurance or through a program of self-insurance. In either case, the company can require the insurance company to turn over the medical records it collects. In fact, many employers require newly hired employees to sign a blank waiver that allows the employer to collect medical records from any source. And when a company self-insures its employees, it has a powerful incentive to identify employees with potentially expensive medical conditions.

The grim reality is that what was once a way for employers to offer employees a higher level of effective compensation at a lower per-dollar cost (and offer greater peace of mind as well) has become a tremendous drain on the corporate bottom line. Since corporations are in business to maximize profits, it's not particularly surprising that most of them work aggressively to reduce one of their largest and most rapidly rising expenses.

Health Insurance as a Benefit of Employment

In theory, health insurance is a terrific idea: It allows the cost of providing medical services to be spread across a broad population, with the premiums of the healthy members of the group supporting the cost of providing care to those in need of medical attention. This helps to reduce the risk of potentially ruinous medical costs and makes it possible for more people to receive a higher level of medical care than they might be able to provide for themselves.

The concept of health insurance first appeared in the 1850s. In London, England, the Accidental Death Association was formed to provide sick or injured individuals with insurance against a loss of income; and in Hartford, Connecticut, the Franklin Assurance Company was founded to offer care insurance for a handful of different diseases. ^[2] In 1929, a group of school-teachers in Texas negotiated health coverage from the Baylor Hospital in Dallas as part of their compensation package. That program gave rise to what we know today as the Blue Cross plan, which was later joined by the physician-initiated Blue Shield plan.

From an employer's point of view, health insurance was an attractive idea. In the cash-strapped years immediately following World War II, it enabled employers to offer employees a form of compensation that was not subject to federal income taxes or Social Security contributions, which meant that the same amount of money went further. Health insurance proved so popular, in fact, that by the mid-1950s, 77 million people in the United States were covered (roughly half of the country's then 160 million residents). In the race to find and retain good employees, many companies began offering health insurance plans that offered 100 percent coverage with no deductibles. It was, without question, the high-water mark of the employer-provided health insurance system.

Unfortunately, what was once a marvelous idea has been steadily breaking down for years. The cost of insurance premiums is generally determined in one of two ways: community rating or experience rating. Broad-based insurance plans like Blue Cross and Blue Shield typically establish their premiums for a community by looking at the community's overall medical needs and costs, and then everyone in the community pays the same premium. By contrast, private insurance companies that offer health insurance coverage typically base their premiums on an actuarial assessment of the risk of the insured group. For instance, an asbestos removal company would probably pay higher health insurance premiums than a bookseller.

The development of experience rating as a method for calculating health insurance premiums in turn led to the concept of self-insurance. If a company has a large enough number of employees, it can do its own analysis of medical costs and set aside sufficient funds each year to cover its actual costs if doing so is lower than paying health insurance premiums (which, given the enormous popularity of self-insurance, must frequently be the case).

Government policy has also played an important role in the rise of self-insurance by corporations. Although health insurance is a tax-free benefit to employees, the premiums paid to insurance companies are taxed by state revenue agencies. The insurance company typically passes the cost of that tax on to the customer (i.e., employer); companies that self-insure don't have to pay the cost of the tax on premiums. In addition, under the terms of the 1974 Employee Retirement Income Security Act, companies that self-insure are not subject to state insurance regulations that mandate the provision of specific types of health care coverage.

As the level of self-insurance has grown, however, the size of the "community" for establishing premium levels has fallen, making it more difficult for insurers to set affordable premiums. In addition, the companies most likely to self-insure are those that face a lower level of risk with respect to medical costs. As more and more lower-risk groups opt out of the broader health insurance market, private insurers and the Blue Cross/Blue Shield system are left with a pool of higher-risk groups. Add in the perpetually skyrocketing cost of medical care in general and an aging population and it's not surprising that the cost of health insurance has increased so dramatically over the last few years. In fact, the cost of health care insurance rose an estimated 20 percent in 2002 alone, and it's expected to increase an average of another 15 percent in 2003.

The increased cost of health insurance has had a number of deleterious impacts: reduced coverage, outright elimination of coverage, and an increased willingness on the part of some employers to risk wrongful termination suits by culling out employees with expensive and/or long-term medical conditions or, more frighteningly, employees that might someday perhaps develop such long-term conditions. It is particularly unfortunate that these types of financial pressures have arisen at a time when technology is making it increasingly easy to identify individuals who may be prone to long-lasting and expensive medical conditions.

The Tyranny of the Fit: The Rise in Medical Discrimination

Under the terms of the American with Disabilities Act (ADA), the only time that a medical condition is supposed to be taken into account by your employer is if it in some way impairs your ability to perform your job (or the job for which you are applying). Even if your ability to do your job is affected by your medical condition, your employer is supposed to try to make reasonable accommodations to your condition before concluding that they need to hire someone else.

But as we've seen, your fitness for a particular job is only part of an employer's motivation for keeping tabs on your general medical condition and what you do during your private time. Another motivation, if not the primary motivation, is limiting the cost of providing you and your family with medical care, either through the payment of health insurance premiums or the bills themselves under a self-insurance plan. The analysis is fairly straightforward: Employees with long-term, typically expensive medical conditions raise an employer's costs. Thus, according to a variety of surveys conducted over the last five years, roughly 35 to 40 percent of employers use medical records or health information in one manner or another to make employment decisions.

The timing of those employment decisions can often be horrific. In 2002, the South Florida Sun-Sentinel carried a story about a woman named Susan Mabe, an accounts receivable manager for a southern Florida construction consulting firm, who had undergone surgery for cervical cancer. While she was lying in her hospital bed, attached to a morphine drip for post-operative pain, her supervisor called to give her the news that she had been fired. Mabe had never received any negative evaluations or reviews, so the only reason for her firing seemed to be the cost of treating her cancer. ^[3]

It's not only employees themselves that are at risk, but also employees with family members who have high medical bills. The Houston Chronicle has been following the case of Michael Ogg, a former pipefitter for Enpro Systems in Channelview, Texas, whose son Brendan was born three months premature, weighing just one and a half pounds. The infant spent four months in the hospital, a stay that ultimately cost nearly a half million dollars. When he was finally discharged, Brendan was diagnosed with chronic lung problems and has required repeated follow-up visits for his medical problems.

Less than a month after Brendan was sent home, Michael Ogg was laid off from his job. It would have cost him $823 per month to maintain his health insurance. Ogg told the Chronicle that he suspected the cost of his son's medical care was the reason for his layoff, particularly since he had just recently received a pay raise and was expecting another one at the time he was let go. His suspicions were confirmed when he ran into his former supervisor, who said that he had been ordered to get rid of Ogg because of the impact of his son's condition on the company's health insurance premiums. The supervisor, who provided an affidavit for the claim that Ogg filed with the Equal Employment Opportunity Commission, also said that two other pipefitters had been laid off to cover up the reason for Ogg's dismissal. Enpro Systems President John Painter categorically denied Ogg's allegations, saying that in the thirty years that the company had been in business, the rights of his employees had never been violated. ^[4]

A spokesman for the American Cancer Society, contacted by the Indianapolis Star regarding a similar story, said that the Society receives several calls each month regarding workers who have lost their jobs shortly after they or someone in their family has been diagnosed with cancer. ^[5]

Unfortunately, employees who lose their jobs due to their own illness or that of a family member often have little or no legal recourse. The Americans with Disabilities Act, for instance, only applies to businesses with fifteen or more employees. Similarly, the Family Medical Leave Act (FMLA), which guarantees up to twelve weeks of unpaid leave to deal with illness, only applies to businesses with fifty or more employees. If you're fired from a small business that is not covered by either law, it's not clear that you would have any recourse, unless you can demonstrate some other violation of federal or state law (such as discrimination based on a forbidden criteria like age, sex, race, etc.).

Treadmills for the Rat Race

One of the more positive approaches being adopted by employers in the fight against rising medical costs is a renewed emphasis on employee fitness. A significant percentage of the people in this country work in sedentary office jobs, a fact that contributes to the fact that nearly 60 percent of all Americans are overweight. While the correlations are not absolute, there is evidence that suggests that employees who are obese (i.e., who have a body mass index of twenty-five or higher) have higher rates of absenteeism and higher health costs. According to a report prepared by the former Surgeon General Dr. David Satcher, obesity cost the U.S. economy $117 billion in 2000 and resulted in 39 million missed workdays.

Given the connections between employee weight, general health, productivity, and health costs, employers have a double-vested interest in helping their employees find time to exercise. According to a National Worksite Health Promotion Survey conducted in 1999, roughly half of the companies with more than 750 employees offer a comprehensive employee health promotion program. ^[6] Coincidentally, a 2002 survey of more than 1,000 corporate managers revealed that the number one perk requested by job seekers is a health club membership. ^[7]

As beneficial as employer-sponsored fitness programs are for employee health, they are virtually certain to come with a privacy cost. The first level of detail is whether or not you've used the company exercise facility on a particular day. Collecting that type of data is as simple as having a sign-in sheet at the front door; some of the other technologies that were discussed earlier in the book, such as magstripe readers, infrared badges, or even radio frequency IDs, can help a company automatically log your visits to the gym. Another source of usage data is to offer an incentive program that ties reward levels to the number of visits you make to the gym. The Chrysler Group, for instance, hands out "well bucks" to employees who participate in the company's various fitness programs. The "well bucks" can be redeemed for assorted athletic equipment, giving the company additional information that can contribute to its profile of each employee's general fitness habits.

The information gathered by a company fitness program, of course, can go far beyond simply recording whether you've visited the gym. Many of the programs in place today include routine medical check-ups, which raise a host of medical privacy concerns. Other medically related company programs are less broadly invasive (programs specifically designed to control weight, stress, or help employees quit smoking) but they still have the potential to collect and distribute very private information.

Even the act of exercising itself can be a source of information. One of the hot trends in athletic equipment is the use of monitoring devices that can collect data and then transmit it to a personal computer or personal data assistant. This trend toward interactive athletic equipment is likely to accelerate as Bluetooth technology becomes more widely implemented. Imagine that you have a Bluetooth-equipped heart rate monitor. All you have to do after your morning run is walk into the room where your computer is located; your heart rate monitor automatically recognizes the computer and downloads its data directly to your fitness program. Another device, laced onto your shoe, transmits a step-by-step summary of your run, including detailed pacing information, elevation changes, and even temperature changes.

Some of the interactive devices already on the market are intended to work with websites that will track your progress and provide you with an ongoing fitness assessment and recommendations for workouts. The high-end FitSense FS-1 Pro Speedometer, for instance, can track a wide variety of information for runners and then transmit the information wirelessly to a separate NetLink component, which takes the data and feeds it into a personal computer. The training information is then uploaded to a Web page on the FitSense website.

It would be a relatively simple matter for an employer to offer a similar service to its employees. With an appropriately equipped gym, a company could help its employees establish fitness goals, monitor the overall health of its workforce, set up contests and competitions, and answer the burning questions of our time (for instance, "How much can the average network administrator bench press?"). ^[8]

There's no indication that companies are currently collecting information about exercise habits, but as health insurance costs continue to skyrocket, the temptation for businesses to do so will grow steadily stronger. Lifestyle discrimination (something not covered by the Americans with Disabilities Act or the Civil Rights Act of 1964) is already a problem for smokers and overweight workers, and the extent to which you exercise could easily become a factor in how much you are required to contribute to your health insurance coverage at work (or whether you qualify for it at all).

^[2]In time, so many insurance companies established their headquarters in Hartford that it became known as the "Insurance Capital of the World."

^[3]Nancy McVicar, "Salt in the Wound," South Florida Sun-Sentinel (October 5, 2002).

^[4]L.M. Sixel, "Sick infant caught in middle of discrimination dispute," Houston Chronicle (August 30, 2002).

^[5]Gregory Weaver, "Dad loses job—and insurance," Indianapolis Star (August 4, 2002).

^[6]Alexandra R. Moses, "From yoga to walks, employers are finding ways to encourage good health," Boston Globe (April 22, 2002).

^[7]L.M. Sixel, "Sweating in Fat City," Houston Chronicle (April 12, 2002).

^[8]Of course, any network administrator worth his salt is going to have the ability to pump up and massage the data.