Healthcare worker therapy records: questions about privacy and access

Name the record before asking who can see it

HHS distinguishes employment records from records held by a covered provider or health plan. HIPAA generally does not govern employment records simply because they contain health information. When a healthcare employee is also a patient, the provider’s patient record is a different category from the employer’s personnel record.

Write down the document you mean: a visit note, a billing record, a time-off form, an occupational health document, or an appointment reminder. Then ask which office holds it, what access rules apply, and where to direct questions. Working in a healthcare organization does not make every record question the same.

Sources: HHS: Employers and Health Information in the Workplace

Ask the treating organization about its actual access process

If you are considering care within the organization where you work, ask its privacy office how employee-patient records are handled. Useful questions include whether special privacy processes exist, how a concern about inappropriate access can be raised, and what the organization can explain about authorized access. Do not assume a particular access restriction is available.

If you choose an outside practice, ask the same practical questions about its record system and information sharing. Location outside your employer does not answer every billing, communication, or disclosure question. Keep a note of the office that answered and the policy it directed you to, without copying confidential workplace information into your personal notes.

Sources: HHS: Employers and Health Information in the Workplace

Keep a workplace document request specific

HHS explains that an employer can ask for certain health information, while a covered provider generally needs authorization for a direct disclosure to the employer unless another legal permission or requirement applies. Ask the workplace office what document it needs and ask your provider how it handles that request.

Before authorizing a transfer, review the recipient, purpose, and information requested with the relevant office. If a form is unclear, ask for an explanation. Questions about a credentialing, occupational health, or employment dispute need the responsible organization’s process and, when necessary, qualified advice; this checklist cannot determine an individual disclosure obligation.

Sources: HHS: Employers and Health Information in the Workplace

Choose where appointment messages should go

Ask the practice which communication channels it supports and how to request a reasonable alternative contact method or location. HHS describes patient requests for alternative communications and the use of safeguards in provider email. Confirm the practice’s process rather than assuming one message changes every reminder, statement, or portal setting.

Make a small communication inventory: phone, email, mailing address, portal login, and any person with account access. Identify the entry you want changed and ask how to verify the change. For copies of your own clinical information, use the provider’s patient records process. Keep clinical records out of work storage unless there is a specific, understood reason to place them there.

Sources: HHS: Provider email and alternative patient communications; HHS: Access to your health information

Common questions