In the wake of the National Labor Relations Board’s (NLRB) decision in Whole Foods Market, Inc., 363 NLRB No. 87 (Dec. 24, 2015), hospitals and healthcare providers will need to revisit their employee recording policies. This NLRB decision found that an employer may not adopt a work rule that prohibits employees from recording company meetings or conversations with coworkers without a valid legal or business justification. The NLRB reasoned that work rules banning recording tend to chill or restrain workers from engaging in or memorializing concerted, protected activity under federal law. Thus, policies that prohibit recording in the workplace would be considered a per se violation by the NLRB unless crafted thoughtfully and in a way that meets the NLRB’s business justification exception—a concept that is as of yet undefined but likely includes conflicts with other laws, including state laws that impose restrictions on recording (e.g., dual consent states) and other federal laws.
One such application of the business justification exception may come into play in the healthcare setting, where protected health information (PHI) of patients is at issue and protected by federal law. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies to healthcare providers and facilities that maintain PHI and is designed to safeguard and restrict unauthorized use and disclosure of PHI. If a healthcare employee were to record a conversation or event that contained PHI and later shared that information with a third party, a privacy violation under HIPAA might have occurred, jeopardizing the institution by making it vulnerable to civil and criminal penalties and potentially breaching its own HIPAA protocols.
So how can hospitals and healthcare providers not fun afoul of the NLRB’s recent ruling and still comply with HIPAA? A narrowly-tailored policy prohibiting employee recording of events or conversations that contain, or potentially contain, PHI is warranted. It may even be useful to designate certain areas of a healthcare facility as no-recording zones where patient privacy is of utmost importance. Surely the NLRB does not intend to have healthcare employers shirk their HIPAA obligations or place patient privacy at risk. Indeed, in Whole Foods Market, Inc., the NLRB acknowledged that some restrictions on recording may be valid depending on the business in which the employer is engaged. . The NLRB’s position preserves and is consistent with its 2011 decision in Flagstaff Medical Center, Inc., holding that patient privacy restrictions may justify a recording ban in hospitals.
HIPAA compliance is an inherent healthcare obligation that must be considered and addressed when revising recording policies of healthcare providers. While the NLRB’s new prohibition on anti-recording policies suggests wholesale revisions be made, healthcare providers may not have to go so far as to allow all recording in the workplace. Providers should instead work on crafting a policy that meets both HIPAA and NLRB objectives, carving out an exception to preserve the confidentiality of PHI.
