We use what amounts to an outside lab at our system (run in our lab, but the results are not stored in our Medical Record system).  We get the results electronically sent to us from the lab . These are then merged with the employee incident report and store them in our employee health file system.    We also have our own server on our IS system.  This prevents access by anyone  other than EHS personnel.

 

 

 

 

If I may ask, your process would seem to eliminate confidentiality issues during the testing and reporting processes, but where do you maintain record of the results?  And how do you “lock” those records from unauthorized access?

 

Thanks.

 

 

That is one of the reasons we do not use the Clinical lab and do not put names on the lab slips.  (Our lab has an outreach process for providers requesting labs from outside our system and these do not get into the medical record system of our facility. We use this for our employee exposures.).

By assuring no one but EHS knows who is being tested, we hopefully have reduced the issue of someone in the lab seeing who the test is being run on.

Of course this also raises issues with our State public health.  Since  the lab reports all positive tests for HIV, Hep B and Hep C to public health;  Public Health does not like that they cannot identify the person that the positive result  is on. We have had multiple discussions on this issue and try to notify public health as soon as we have a reportable result that is confirmed positive.    

 

 

 

In my reading of it, the interpretive letter is not about the “separate from personnel records” part as much as it is about “confidential, not disclosed without written permission of employee.” I don’t think it was about HIV stigma in particular.

 

The question specifically put to them outlined the separate nature of the medical record as distinct from personnel records, the need for a secure log in, and the punishment associated with unauthorized viewing of a coworker’s record. Their response was that those protections only kick in AFTER you catch someone looking at the record – but by then they’ve seen it. So employees may not report if they know coworkers technically have the ability to see their labs. They insisted on a system that actually will not allow unauthorized people to see the record.

 

I have not seen any more recent interpretations.

 

Here’s how I see it: if I work in the lab and I am exposed, I can choose to report it or not report it. We know underreporting is a big problem. If I know that my coworkers in the lab are going to see my result come through their system and say “Hey, that’s Melanie! Oh, she had virology testing done. Wonder what that was about” then I may be less inclined to report, than if I know my results cannot be seen by them.

 

 

 

The section under medical records below only states that they must be kept confidential and separate from other personnel records.  I still have difficulty understanding how that means we have to code the HIV testing because it is only kept in systems that ARE confidential and separate from personnel records (HR has no access to this).  Since the CDC recommends HIV testing on everyone between 16 and 64 yo, it appears that the previous stigma attached to testing has been mitigated.  Does OSHA have any relevant interpretation that is more recent than 12 years ago?  What am I missing here?

 
Susan Fair, MPAS, PA-C

Yale New Haven Hospital

Occupational Health Plus

New Haven, CT

 

 

Look at the blood borne pathogen exposure regulation. I use the hospital etool…. It helps you find specifics faster.

 

https://www.osha.gov/SLTC/etools/hospital/index.html

 

BBP reg: https://www.osha.gov/SLTC/etools/hospital/hazards/bbp/bbp.html

 

• Employer should establish and maintain both medical and training records [29 CFR 1910.1030(h)(1) and 29 CFR 1910.1020].
  • If an exposure incident occurs, employer should add reports to the medical record to document the incident, including testing results following the incident, follow-up procedures, and the written opinion of the health care professional.
    • Medical Records must be preserved and maintained for each employee with an occupational exposure to bloodborne pathogens [29 CFR 1910.1030(h)(1)] and for at least the duration of employment plus 30 years. They must be kept confidential (not disclosed without written permission of employee, except by law) and separate from other personnel records and must also include:
      • The employee's name and social security number, hepatitis B vaccination status, including the dates of vaccination and medical records related to the employee's ability to receive vaccinations.

Hope you find this helpful…. Very quick resource once you click on the hazard that you want.

 

 

Kathy Dayvault, RN, BSN, MPH, COHN-S/CM

 

Independent OHN Consultant

 

 

 

 

 

Can anyone direct me where I can find the OSHA regulation pertaining to the Duty to ensure privacy of employees exposed to blood and body fluid.  I know some facility use psuedo names in order to protect their employees privacy when the test are done in their facility.  I want to do this, however our lab is not agreeable as they are not sure how to register the employee and keep everything straight.   The lab informed me that they checked the state regulations (we are in PA) and there is nothing that says we must give psuedo names.  Therefore , I am looking for any information that would assist my mission to provide privacy to our employees.  I thought there was an OSHA regulation if the test was done within the facility such as the rapid HIV suds test that we could not use their name.  Can anyone direct me on this?

Cathy Senior RN BSN CDE

Employee Health Director

Penn Highlands DuBois

100 Hospital Avenue

P.O. Box 447

DuBois Pa 15801

Phone 814-375-3392

Fax 814-372-2610

cesenior@phhealthcare.org

www.phhealthcare.org

 

This message originates from the Yale New Haven Health System. The information contained in this message may be privileged and confidential. If you are the intended recipient you must maintain this message in a secure and confidential manner. If you are not the intended recipient, please notify the sender immediately and destroy this message. Thank you.

The contents of this message may contain private, protected and/or privileged information. If you received this message in error, you should destroy the e-mail message and any attachments or copies, and you are prohibited from retaining, distributing, disclosing or using any information contained within. Please contact the sender and advise of the erroneous delivery by return e-mail or telephone. Thank you for your cooperation.

This message (including any attachments) is intended only for the use of the individual or entity to which it is addressed and may contain information that is non-public, proprietary, privileged, confidential, and exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by telephone and delete this message   ­­