Help Wanted: When work, privacy collide

DEAR CARRIE: I work for a catering hall that requires us to wear name tags with our full name. We have brought up the potential risks of displaying our last names and were told that we must wear the tags anyway. Is this legal? -- Nervous Caterer

DEAR NERVOUS: I'm afraid you're out of luck, according to a local employment attorney.

"There is no per se law against employers' requiring catering hall employees to wear name tags with both their first and last names," said Ellen Storch, counsel at Kaufman Dolowich Voluck & Gonzo in Woodbury.

"In fact, in certain states there are laws requiring employees in particular industries to display their full names." 

DEAR CARRIE: My employer is offering a $75 monthly credit toward my 2012 health insurance premium, which will be going way up. I can get the credit if I submit to a biometric screening at work or a physical exam with my physician.

My concern is the form, which contains my personal health information and identity, including such things as my date of birth, age and Social Security number. My doctor has to complete and sign the form and submit it to a third party for me to get the credit. The form doesn't have a privacy statement, or guarantee, that the information will be stored in a safe place. I am particularly worried about it being stored on the Internet.

I cannot convince my employer what an invasion of privacy this potentially represents. I plan to have my regular annual physical exam, and would have my doctor confirm that I had it. But I do not want to share my health status. My employer's answer is to just not participate and give up the $75 credit, which I cannot really afford to do. Do I have any options for keeping the information private? -- Keep It Private

DEAR KEEP: Your question falls into the area of HIPAA, or the Health Insurance Portability and Accountability Act. And whether you can claim privacy breaches under that law depends on whether the information is sent by mail or electronically, said employment attorney Jeffrey Schlossberg, a partner at Ruskin Moscou Faltischek in Uniondale.

"To our knowledge, there is no requirement that states that a non-electronically transmitted form must have a privacy statement on it," Schlossberg said. "In other words, if the doctor completes and mails the form, there is no HIPAA issue."

But an electronic transmission is different.

"If, however, the information that the doctor is gathering is being transmitted electronically to the third party, then it is the doctor's responsibility as a covered entity to ensure that he or she is in compliance with security and privacy regulations," Schlossberg said.

"It is generally in the doctor's interest to inquire of the third party to determine if that third party will protect the personal health information being electronically transmitted."

So what should you do to allay your concerns if electronic transmission comes into play? Your options are limited when it comes your employer.

"If the information is being electronically transmitted, then the writer could try to impress upon the employer that it is using a vendor that is not in compliance with HIPAA regulations," he said. "However, if the employer is not interested in changing vendors, there is nothing legally compelling it to do so. Ultimately, it is, in fact, the writer's choice to abide by the procedures in place or forego the $75."

But you could file a complaint against those entities covered by HIPAA. They include health plans, health-care clearinghouses and any health-care provider that conducts certain transactions electronically, according to the federal Department of Health and Human Services website.

For more on employees' rights under HIPAA privacy rules, click here to go to www.hhs.gov/ocr/privacy.

Click here to file a complaint under HIPAA, at www.hhs.gov/ocr/privacy/hipaa/complaints/index.html.