Missoula, Montana-based Rocky Mountain Eye Center is fighting a ruling that terminating an employee for improper access to its electronic health record is an unfair labor practice under the National Labor Relations Act.
Employee Britta Brown had accessed the EHR to obtain the contact information of 17 coworkers and provided the information of 12 of them to a union representative as part of a union organizing campaign. Rocky Mountain terminated her on the grounds that she committed a HIPAA violation and violated the practice's confidentiality agreement.
The administrative law judge (ALJ) found, among other things, that while Rocky Mountain had kept personnel files in a separate software system, it comingled patient and employee contact information in its Centricity EHR even if the employees were not patients by having employees input their contact information into the EHR as part of EHR training. The judge also found that Rocky Mountain condoned the use of the EHR as an employee directory.
This is yet another example of how EHRs are creating new legal issues and can have unintended legal effects.
"It was generally known that coworkers and supervisors accessed the Centricity system to get employee contact information," the judge wrote. "Employees accessed each other's contact information for work-related purposes, primarily involving last-minute schedule changes. If there was an after-work gathering or an event such as a baby shower, employees would find each other's contact information in Centricity. During the relevant time period, employees' contact information was not stored anywhere at the Missoula facility other than in Centricity."
Rocky Mountain is challenging the ALJ's ruling. In its Exceptions document filed with the National Labor Relations Board July 10, the physician practice claims, among other things, that the EHR is a only a patient database, and that Brown accessed the records of patients who happened to be employees without authorization and impermissibly turned them over to a third party. It also claims that there was no testimony from Brown that she witnessed or was told that it is acceptable to look up patient-employee contact numbers in the EHR, and no evidence that Rocky Mountain condoned such access.
The ALJ's decision notes that Rocky Mountain no longer has new employees enter their contact information into the EHR and handles scheduling changes through the Human Resources Department. Rocky Mountain's Exceptions document does not address this issue.
To learn more:
- here are the documents in the case