The 11th Circuit Court of Appeals has rejected the appeal of a former City of Daytona Beach Fire Inspector who argued that the City improperly used her “personal health information” to defend itself against her lawsuit for interference under the Family Medical Leave Act. In Bailey v. City of Daytona Beach Shores, the City of Daytona Beach fired its Fire Inspector, Christine Bailey, after it learned she made claims under the City’s self-funded health plan for reimbursement of the cost of prescription narcotics without informing the City of the use of such drugs, in violation of the City’s drug-free workplace policy while she was on FMLA leave. In response, Bailey sued the City for FMLA interference and retaliation. During the underlying lawsuit, she moved to strike the City’s use of her personal health information on grounds that it would violate the Health Insurance Portability and Accountable Act (“HIPAA”) by the disclosure of her HIPAA-protected personal health information.

Health plans, like the one sponsored by the City, are “covered entities” under HIPAA and the use of protected health information from those plans for employment purposes is prohibited. Apparently, the Department of Health and Human Services notified the City that using the personal health information from the City’s plan for employment-related decisions would violate Bailey’s rights under HIPAA. We regularly advise employers who sponsor health plans, particularly self-funded plans, that individually identifiable health information they obtain in connection with plan administration services they provide for those plans cannot be used in the course of making employment decisions, absent the individual’s authorization or some other exception.

Affirming the trial court’s rejection of Bailey’s motion to strike, the 11th Circuit determined that while HIPAA prohibits the use and disclosure of personal health information in employment-related decisions, it does not bar a defendant in litigation from using the plaintiff’s personal health information to defend against that lawsuit. Thus, at least in the 11th Circuit, “fruit of the poisonous tree” can be used by employers to defend their employment decisions made based on fruit from their HIPAA-covered plans. The court further rejected Bailey’s FMLA interference and retaliation claims on grounds that the City proved it would have taken the same action, i.e., firing her for violations of the City’s drug policy, if she had not taken FMLA leave.

The 11th Circuit’s ruling may appear to be a victory for defendants in litigation who seek to use plaintiffs’ HIPAA-protected personal health information to defend themselves from plaintiff allegations that involve such information. However, the Court seems to gloss over the distinction made in the HIPAA regulations between functioning as a covered entity-health plan and functioning as an employer. The employee was suing the employer in this case, not the plan, and the employer, functioning as an employer, simply should not have had access to this information. The effects of this decision may be problematic for employers that do not read this decision and HIPAA carefully. Specifically, some employers may be encouraged to tap into health plan claims records more freely, not for plan administration purposes, but for employment purposes, believing that information can be used to defend their employment decisions in subsequent litigation.

Of course, while there may not be a private right of action under HIPAA, using protected health information in that way could expose the health plans, and in effect the employers, to investigations by the Office for Civil Rights. The 11th Circuit focused on the use of personal health information in litigation only, but whether such information is used in litigation or not does not remedy any underlying HIPAA violation. HIPAA would bar an employer from reviewing a prescription claim submitted to its health plan for the purposes of making an employment decision, irrespective of any litigation involving the disclosure or use. It remains to be seen whether a claimant who successfully files a HIPAA charge with the Office of Civil Rights, would be able to obtain a different result by a court addressing that party’s personal health information in the litigation context, the Bailey case notwithstanding.