Division of Federal Employees' Compensation (DFEC)
Part 13
|
Paragraph and Subject |
Date |
RCHB Trans. No. |
|---|---|---|
|
Table of Contents |
02/15 |
15-01 |
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
|
|
8. Reporting Breaches of the Privacy Act and/or Personally Identifiable Information |
02/15 |
15-01 |
|
02/15 |
15-01 |
|
|
02/15 |
15-01 |
Back to Part 13 Table of Contents
1. Overview. As custodians of Federal Employees' Compensation Act (FECA) beneficiaries' personal information, the Government and its contract Field Nurses (FNs) and Vocational Rehabilitation Counselors (RCs) have a responsibility to protect this information. As every case file contains sensitive personal and medical information, release of those documents to unauthorized parties is inherently inappropriate, and may constitute a violation of law.
Back to Part 13 Table of Contents
2. Privacy Act. The Privacy Act (PA) is Federal legislation mandating that personal information about individuals collected by Federal agencies must be limited to that which is legally authorized and necessary; and maintained in a manner which precludes unwarranted intrusions upon individual privacy. See 5 U.S.C. 552a and 29 C.F.R. Part 71.
The PA imposes on government employees and contractors certain obligations and responsibilities concerning the maintenance, care and use of records. The PA, which assures private citizens the right to confidentiality of certain personal records/information, sets forth the government's responsibility to properly maintain and restrict access to these records.
Since the FECA workers' compensation case files constitute a PA system of records (i.e. the record is under the individual's own name), the Division of Federal Employees' Compensation (DFEC) follows the provisions and principles of the PA.
This includes the establishment of a "system of records." See paragraph 3 of this Part.
Back to Part 13 Table of Contents
3. System of Records. A system of records is "...a group of records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual..." as defined in the PA {5 U.S.C. § 552a(a)(5).}. An overview of the Office of Workers' Compensation Program's (OWCP) system of records is provided here; however, see http://www.dol.gov/sol/privacy/main.htm for further details.
Note - The information provided in this paragraph provides information related to FECA case files and is provided as a reference. FNs and RCs should not need this information in order to effectively work OWCP/DFEC cases; however, it is included in this Handbook as background information as it relates to release of information under the routine use provisions discussed in paragraph 4 of this Part.
a. DOL/GOVT–1: Office of Workers' Compensation Programs, Federal Employees' Compensation Act File.
This system of records may contain the following kinds of records: reports of injury by the employee and/or employing agency; forms authorizing medical care and treatment; other medical records and reports; bills and other payment records; compensation payment records; formal orders for or against the payment of benefits; information relating to vocational and/or medical rehabilitation plans and progress reports; and any other medical, employment, or personal information submitted or gathered in connection with the claim. This includes reports submitted by FNs and RCs.
b. DOL/ESA-43: Office of Workers' Compensation Programs, Federal Employees' Compensation Act and Longshore and Harbor Workers' Compensation Act Rehabilitation Files.
Historically, this system of records included information found in FECA (and Longshore) case files concerning the rehabilitation process. However, since DFEC case files are now fully imaged, all records pertaining to the rehabilitation process are included in the actual case file (as covered by DOL/GOVT-1) and not kept separately.
Back to Part 13 Table of Contents
4. Release of Information. If there is any doubt regarding whether a record may be disclosed, the FN or RC should contact the Staff Nurse or Vocational Rehabilitation Specialist for guidance.
a. Disclosure. The claimant has the right to a copy of his/her case file at any time, unless the file contains medical information which could be harmful if released. Disclosure of the case file to anyone else is generally prohibited without the express written consent of the claimant or authorized representative.
"No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless disclosure of the record would be...for a routine use as defined in subsection (a)(7)" {5 U.S.C. § 552a(b)(3)}.
b. Routine Use. There are a number of exceptions to this rule, however, called routine uses, which permit case file information to be used when necessary to carry out program responsibilities.
"The term "routine use" means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it was collected." {5 U.S.C. § 552a(7)}
This means that the OWCP can properly use information from the case file without first obtaining the claimant's permission. There are 12 universal routine uses, which can be accessed at http://www.dol.gov/sol/privacy/intro.htm
c. Disclosure to FNs and RCs. OWCP's authority to disclose certain relevant records to contract FNs or RCs without written consent is addressed under routine use #6:
"6. To disclose to contractors, employees of contractors, consultants, grantees, and volunteers who have been engaged to assist the agency in the performance of or working on a contract, service, grant, cooperative agreement or other activity or service for the Federal Government."
d. Routine Uses for FNs and RCs. A FN or RC may disclose information from this system of records, as a representative of the OWCP, to the following individuals and entities for the purposes noted when the purpose of the disclosure is both relevant and necessary and is compatible with the purpose for which the information was collected.
(1) Employing Agency. Records may be released to Employing Agency officials (i.e. the injury compensation specialist) for claims management purposes related to the agency's return to work (RTW) efforts.
However, records may not be released for other reasons. See paragraph 5 of this Part.
- This is authorized by routine use (b) under DOL/GOVT-1, which provides in part that, disclosure may be made "To federal agencies that employed the claimant at the time of the occurrence or recurrence of the injury or occupational illness in order to verify billing, to assist in administering the FECA, to answer questions about the status of the claim, to consider rehire, retention or other actions the agency may be required to take with regard to the claim or to permit the agency to evaluate its safety and health program."
(2) Physicians and other Health Care Providers. Records may be disclosed to an authorized medical provider to facilitate the injured worker's (IW's) medical treatment and recovery and promote the return to work (RTW) effort, e.g. a FN may provide a copy of the IW's position description to a physician or physical therapist who is evaluating whether the IW can return to duty.
- This is authorized by routine use (e) under DOL/GOVT-1, which provides that disclosure may be made "To physicians, pharmacies, and other health care providers for their use in treating the claimant, in conducting an examination or preparing an evaluation on behalf of OWCP and for other purposes relating to the medical management of the claim, including evaluation of and payment for charges for medical and related services and supplies.
(3) Other Contractors Providing Services to the Injured Worker. Records may be shared/released between the FN and RC in instances where both a FN and RC are assigned to the case simultaneously.
- This is authorized by routine use (k) under DOL/GOVT-1, which provides that disclosure may be made "To contractors providing services to the Department or any other Federal agency or any other individual or entity specified in any of these routine uses or in the Department's General Prefatory Statement who require the data to perform the services that they have contracted to perform, provided that those services are consistent with the routine use for which the information was disclosed to the contracting entity. Should such a disclosure be made to the contractor, the individual or entity making such disclosure shall insure that the contractor complies fully with all Privacy Act provisions, including those prohibiting unlawful disclosure of such information."
(4) Federal, State or Private Rehabilitation Agencies. This occurs only in the vocational rehabilitation effort (not during nurse intervention) when pursuing placement with a private employer. The records may be released to facilitate the RTW effort (e.g. job placement and accommodation) as part of an OWCP/DFEC approved vocational rehabilitation plan.
- This is authorized by routine use (d) under DOL/GOVT-1, which provides that disclosure may be made "To federal, state or private rehabilitation agencies and individuals to whom the claimant has been referred for evaluation of rehabilitation and possible reemployment."
(5) Other Federal Agencies and Private Employers. This occurs only in the vocational rehabilitation effort (not during nurse intervention) when pursuing placement with a private employer (or other government or private entity). Records may be released to facilitate the RTW effort (e.g. job accommodations) but should only be released in coordination with, and approval of, the IW since it is not always the IW's desire for a potential new employer to be made aware of a work-related disability or impairment.
- This is authorized by routine use (c) under DOL/GOVT-1, which provides that disclosure may be made "To other federal agencies, other government or private entities and to private-sector employers as part of rehabilitation and other return-to-work programs and services available through OWCP, where the entity is considering hiring the claimant or where otherwise necessary as part of that return-to-work effort."
e. Disclosure Methods. Telephonic or electronic disclosure of information is essential to permit efficient administration and adjudication of claims under the FECA. Therefore, disclosure of information may be made over the telephone or by electronic means, but only when the requestor provides appropriate identifying information. See paragraph 6 of this Part for guidelines on using email for case communication.
f. Subpoenas. A FN or RC who is subpoenaed to appear must respond to the subpoena, but should explain that their agreement with the OWCP subjects them to the provisions of the PA. As such, s/he cannot release any information relating to a PA system of records, such as OWCP case files (including nurse/rehabilitation files) without the express permission of the subject of the file (via a PA waiver signed by the claimant) or under the other exceptions provided by the PA.
In the event that a FN or RC receives a subpoena for records, s/he should immediately contact the responsible Staff Nurse or Vocational Rehabilitation Specialist.
Note - While FNs and RCs are contractors for OWCP/DFEC, the Department of Labor's Office of the Solicitor cannot provide legal advice to an FN or RC. See Part 1 of this Handbook, paragraph 2a(6).
g. Court Orders. Any questions regarding a court order should be referred to the Staff Nurse or Vocational Rehabilitation Specialist. S/he will consult with the Office of the Solicitor. This consultation is required before any FECA documents can be released.
h. Health Insurance Portability and Accountability Act (HIPAA). The HIPAA does not restrict disclosure of health care information necessary for the administration of a claim for workers' compensation benefits for a workers' compensation administrative agency such as the OWCP. The regulations provide, in regard to workers' compensation, that:
(l) Standard: Disclosures for workers' compensation. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illnesses without regard to fault.
The Department of Health and Human Services, in issuing this regulation, explained that:
Under this provision, a covered entity may disclose protected health information regarding an individual to a party responsible for payment of workers' compensation benefits to the individual, and to an agency responsible for administering and/or adjudicating the individual's claim for workers' compensation benefits. For purposes of this paragraph, workers' compensation benefits include benefits under programs such as the Black Lung Benefits Act, the Federal Employees' Compensation Act, the Longshore and Harbor Workers' Compensation Act, and the Energy Employees' Occupational Illness Compensation Program Act. (emphasis added) (65 FR 82542 (Dec. 28, 2000))
Back to Part 13 Table of Contents
5. Exceptions to Routine Use and Disclosure of Information. The FN and RC may not disclose case file information to the following requestors:
a. Employing Agency Nurses. Several employing agencies have initiated their own nurse intervention programs. While the concept of early nurse intervention is in keeping with current case management techniques, these agency programs must be coordinated with OWCP adjudicatory and case management activities. As such, certain criteria have been established pertaining to these programs. See Part 3, paragraph 6, of the Field Nurse Handbook for more information on Employing Agency nurses.
b. Legal Representatives.
(1) It is OWCP's policy that all requests for medical/other case file documentation from a legal representative be made in writing to the OWCP. The FN or RC should not release case documentation to a legal representative, but direct him/her to contact the responsible Claims Examiner.
(2) A FN or RC may discuss case related issues with the IW while a legal representative is present.
(3) A FN or RC should not discuss case issues with, or perform intervention services through direct communication with, a representative without the IW being present.
c. Agency Investigative Unit. DFEC may receive requests from individuals with the Office of the Inspector General (OIG) as they perform audits, evaluations, inspections and investigations. DFEC has established protocols to ensure all such requests are handled appropriately. A FN or RC should not respond directly to a request from the OIG, and instead should advise the OIG representative to contact the District Office.
Back to Part 13 Table of Contents
6. Transmitting Information to OWCP/DFEC. The amount and type of documentation collected, maintained and shared in the management of workers' compensation case files can create certain vulnerabilities in the integrity of the privacy of the records maintained by OWCP. As a result, specific procedures are in place to mitigate the risk of improper disclosure while transmitting documents and/or records containing Personally Identifiable Information (PII).
a. Reports and Bills. Reports and bills should be submitted through the OWCP Central Bill Processing System web portal.
b. Document Submission. Documents can be mailed to DFEC's Central Mailroom; however, the preferred method of document submission (other than reports/bills) is electronic submission via the Employees' Compensation Operations and Management Portal (ECOMP), available at https://www.ecomp.dol.gov/.
This secure website allows FNs and RCs to upload a scanned/electronic document (of up to 6 pages in length) directly into the case file after providing the IW's case number, last name, date of birth and date of injury. For more detailed information about this document submission feature, visit the ECOMP website and click "Help."
c. Email. See OWCP Bulletin 08-02, Case-specific Email Transactions, for complete guidance.
1) Transmission of documents and/or records containing PII is not permissible via unsecured email accounts (email outside of the DOL network). This includes, but is not limited to, email attachments that are not encrypted or password protected.
2) The Department defines Protected PII as information:
"whose disclosure could result in harm to the individual whose name or identity is linked to that information. Examples include, but are not limited to, social security number; credit card number; bank account number; residential address; residential or personal telephone; biometric identifier (image, fingerprint, iris, etc.); date of birth; place of birth; mother's maiden name; criminal records; medical records; and financial records. The conjunction of one data element with one or more additional elements, increases the level of sensitivity and/or propensity to cause harm in the event of compromise."
3) Communication with the OWCP Claims Examiner and/or Staff Nurse/Vocational Rehabilitation Specialist is allowed via email.
However, since email systems outside of the DOL network are not secure, no reference to the claimant's name or other Protected PII, as defined above, can be included in any part of the email message.
4) The only identifying information that can be in the email message is the OWCP claim number; however, the claim number should not be placed in the "subject" line of the email (only in the body of the email message).
To assist with confirmation that the claim number is correctly associated with the appropriate IW, the email message may contain the IW's initials in the email message.
Back to Part 13 Table of Contents
7. Security of Case Files. OWCP case files and related materials (including all hard copies, electronic copies, and scanned/imaged copies) are to be treated in a confidential manner. This data is protected under the PA and the FN and RC must ensure the security of the data throughout any transmission, processing, storage or disposal.
The FN and RC must not make use of shared, publicly-available internet access or computers (e.g. those found in public libraries, internet cafes, coffee shops, etc.) to access, transmit or otherwise use PII.
Any information provided to the FN or RC on a CD or other electronic media must be viewed only from the CD or electronic media, and must not be copied to an internal or external disk drive.
Upon closure of services, FNs and RCs no longer have any business justification for retaining case-specific personal information about the claimant and are required to document in their final/closure report the dispensation of all OWCP case file information, materials, medical records and/or emails that may exist in any form (hard copy and/or electronic). This includes documenting the means by which this action was performed: shredding, burning, or returned to OWCP via traceable route. Hardcopy documents, CDs, etc. containing PII must not be discarded in wastebaskets or recycle bins, but must be shredded or burned (or returned to OWCP via traceable route).
Back to Part 13 Table of Contents
8. Reporting Breaches of the Privacy Act and/or Personally Identifiable Information. OWCP has strict, time sensitive reporting requirements. In the event a FN or RC suspects there has been improper handling or release of PII (including, but not limited to, a stolen work laptop or the transmission of email to the wrong party), s/he is to:
a. Notify the OWCP Staff Nurse or Vocational Rehabilitation Specialist within one hour of the discovery of any suspected or actual disclosure or loss of PII. If this individual cannot be reached, the Claims Examiner should be contacted. If the Claims Examiner is also not available, the FN or RC should contact the general District Office contact line to report such a breach so that appropriate personnel can be notified.
b. Document the events leading up to and involving the suspected breach, being specific to time and dates.
c. Comply with any instructions from OWCP/DOL regarding any necessary follow up actions.
Back to Part 13 Table of Contents
9. Contractor Non-Disclosure Agreement. Each FN and RC is tasked with adhering to the PA and protecting PII. In order to ensure understanding and cooperation in this matter, the OWCP uses a Non-Disclosure Agreement that is to be signed by each FN and RC. This document is a detailed description of what is expected from a FN or RC in regards to fulfilling the terms of the PA legislation and protecting PII. It is his/her binding agreement to abide by the standards set forth by the Department of Labor. When in doubt, a FN or RC should seek clarification from OWCP (via the Staff Nurse or Vocational Rehabilitation Specialist) before responding to, or taking action on, an issue involving the PA or PII.
Back to Part 13 Table of Contents
10. Criminal Penalties. Failure to comply with any security requirements discussed in this Part could subject a FN or RC to criminal penalties.
Back to Part 13 Table of Contents