Be Careful What You Write: Employment, Disability, and Healthcare Law Considerations for Doctor’s Notes

Introduction

In a perfect world, employees would start the interactive process of asking for employment accommodations, including extended leave or a remote work arrangement, for a health condition before the condition affected their work. However, often times employees do not disclose such issues to their employers until after a performance problem arises, and the employee believes their position is in jeopardy. In some of those instances, a healthcare providers’ certification stating that the employee has a health condition requiring accommodation can seem like a convenient excuse–especially when medical certifications can be easily forged or simply downloaded from a suspect website without ever having been examined by a healthcare provider. These issues are further complicated when the employer is a medical practice or other covered entity.

When facing these types of issues, employers and healthcare providers must keep in mind certain legal considerations, including 1) whether an employer can require a certification from a healthcare provider substantiating both the existence of a health condition and the need for accommodation; 2) the extent to which an employer can push back on suspect certifications without violating employees’ rights; 3) the consequences of providing a false certification to a patient, either purposefully or because the patient misrepresented their symptoms; and 4) patient privacy.

Employers–Considerations for Requiring a Medical Examination and Certification

The Americans with Disabilities Act (“ADA”) and the Missouri Human Rights Act (“MHRA”) prohibit employers from discriminating against individuals with disabilities.¹ Furthermore, in situations where an employee’s disability is also considered a “serious health condition” under the Family and Medical Leave Act (“FMLA”), an employer may be subject to the requirements of both FMLA and the ADA.

The prohibitions in the ADA and MHRA against discrimination apply to people with qualifying physical and mental impairments and/or people who have a record of such impairments. These laws also require employers to make reasonable accommodations for known limitations (disabilities) of otherwise qualified applicants and employees, unless doing so poses an undue hardship.² The ability of an employer to inquire about health conditions varies depending on the stage of the employment relationship. For pre-employment applicants, the ADA generally restricts medical inquiries and examinations by employers and generally does not allow employers to make inquiries likely to illicit information about potential disabilities during the hiring process. Once the applicant is hired, however, these laws allow employers to request medical information in certain circumstances.

The U.S. Equal Employment Opportunity Commission (“EEOC”) has stated that one specific circumstance in which employers may request medical information is when an employee requests an accommodation for a medical condition, which may occur as the first step in an “informal, interactive process between the individual and the employer.”³ In such a situation, under both the ADA and FMLA, the employer may request information sufficient to substantiate the limitation or serious health condition, but may not ask for information unrelated to the specific disability or serious health condition.⁴ In other words, under the ADA and/or MHRA, the employer’s inquiry must be limited to the impairment and the job at issue. It must be job-related and consistent with business necessity.⁵ Under the FMLA, the employer “requests” needed information through the Health Care Provider Certification form.

Documentation is sufficient if it substantiates that the individual has a disability and needs the accommodation requested. Specifically, sufficient medical documentation should describe the nature, severity, and duration of the impairment, the activity or activities that the impairment limits, the extent to which the impairment limits the employee’s ability to perform the activity or activities of the employee’s position, and should also substantiate why the requested reasonable accommodation is needed.⁶ If the documentation is not sufficient, the employer should explain to the employee why it is insufficient and give the employee time to get the needed information. Absent express written authorization from the employee, the employer should not contact the healthcare provider directly to obtain the additional information needed, and, for reasons more fully explained below, the healthcare provider should not provide such information unless the patient has specifically authorized him/her in writing to do so.⁷

Employers–Considerations for Suspect Certifications

Suspected Employee Falsification

Employers may contact a medical provider who has supposedly provided medical certification in order to authenticate that document under FMLA; however, the employer should first give the employee an opportunity to clarify or cure any deficiencies with the documentation.⁸ If the employee fails to satisfactorily cure the deficiencies, then the employer’s “authentication” must be limited to the most basic, factual inquiry. Specifically, the employer can give the health care provider a copy of the certification and request the health care provider to confirm that the document was, in fact, provided and signed by that office/professional for the date(s) in question. This employer contact should be made by someone who is not in a direct supervisory role of the employee in order to protect confidentiality and minimize the possibility of improper use of the information learned.

Suspected Healthcare Provider Falsification

A more difficult instance is when an employer receives a certification that it believes is not accurate or is suspect for some reason. Because healthcare providers often have to rely on what a patient tells them about their alleged symptoms, it can be difficult for an employer to know whether the provider knowingly falsified a medical certification or simply documented the subjective reports of an employee patient concerning the patient’s condition.

One simple way for an employer to check whether the certification was provided by a legitimate provider, as opposed to an online service that sells fake certifications, is to ensure the provider listed on the certification is licensed in the state where the examination was performed. Typically, states require that physicians are licensed in the state where the patient is located if they are performing medical examinations for treatment or diagnostic purposes. Whether a provider holds a license to practice in a particular state is usually readily available to the public through the state’s licensing body’s website (e.g. the Board of Healing Arts). If the physician is not licensed in this state, it could mean the certification was bought through a website or that the provider should not be examining patients in the state.

Applicability of Non-Medical Opinions

More often than false certifications, providers will sometimes include non-medical opinions in certifications. For example, a certification may explain an illness and state that “this employee should not be terminated” or, commonly in the era of COVID-19, “this employee must continue in work from home status.” The former statement is not a medical opinion regarding the employee’s health condition. The latter could be related to a possible accommodation of a medical condition but does not link the possible accommodation to any medical need. In short, both comments are intended to assist the employee patient in maintaining employment, which is not the provider’s role. An employer may consider but is not obligated to abide by such statements. Further, attempting to step outside the provider’s role by offering non-medical opinions, detracts from the provider’s credibility.

Healthcare Providers–Licensing Considerations

Providing False Certifications

Many conditions require healthcare providers to rely on the patient’s own report of their symptoms (e.g. migraines). Thus, it can be difficult for providers to ascertain the severity of the condition and whether the patient is being truthful in all instances. That said, it is important that physicians and other healthcare providers take care in ensuring that they are not misrepresenting a condition or committing fraud.

Under Missouri Revised Statute § 334.100, the Missouri Board of Healing Arts may revoke a physician’s license to practice medicine for “[m] isconduct, fraud, misrepresentation, dishonesty, unethical conduct or unprofessional conduct in the performance of the functions or duties.” This can include “[k]nowingly making, or causing to be made, or aiding, or abetting in the making of, a false statement in any … certificate or document executed in connection with the practice of the person’s profession[.]” Thus, if a physician were to knowingly certify to an employer that a patient had a certain condition, the physician could lose their license to practice medicine in Missouri. Furthermore, if the physician were licensed in more than one state, such actions would likely cause all the states of licensure to investigate the physician.

Patient Abandonment Considerations when Terminating the Relationship

In extreme cases, physicians may consider terminating the physician/patient relationship with a patient who they believe is not being honest with them or patients who ask them to misrepresent their condition to an employer. In such cases, if a physician does not properly terminate the relationship to ensure the patient has continuity of care, it could be considered patient abandonment and the physician could face discipline by the Missouri Board of Healing Arts.

Prior to taking such extreme action; however, physicians should: 1) counsel the patient and explain why the provider does not think he/she has a condition that would interfere with his/her job; 2) clearly document these interactions and the patient’s response; 3) send a warning letter explaining the health consequences of the patient’s continued non-compliance and explain that it could lead to termination of their relationship if not corrected immediately; and 4) if none of these options get through to the patient, the provider may terminate his/ her relationship with the patient but should first review the network agreement with the patient’s insurance to determine if there are any obligations to give the payor notice or if any prohibitions exist.

In addition to contractual obligations in terminating a physician/patient relationship, there are state law requirements physicians must adhere to in order to avoid patient abandonment. In Weiss v. Rojanasathit, the Missouri Supreme Court explained that:

The duty to attend the patient continues so long as required unless the physician-patient relationship is ended by 1) the mutual consent of the parties; 2) the physician’s withdrawal after reasonable notice; 3) the dismissal of the physician by the patient; or 4) the cessation of the necessity that gave rise to the relationship. Absent good cause to the contrary, where the doctor knows or should know that a condition exists that requires further medical attention to prevent injurious consequences, the doctor must render such attention or must see to it that some other competent person…does so until the termination of the physician-patient relationship.⁹

Generally speaking, reasonable notice when terminating a physician/patient relationship should be 1) provided in writing; 2) allow the patient sufficient notice to find a new physician (at least thirty days); and 3) documentation of the notice should be retained, keeping the return receipt and a copy of the letter in the patient’s file should be standard practice in such instances.

Health Care Providers–Privacy Considerations

Healthcare Providers Disclosures to Employers

The information a provider may release to an employer is governed by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy Rule and state confidentiality laws. Generally, this rule applies to disclosures made by a health care provider and not the questions an employer may ask. If an employer asks a health care provider directly for information about an employee/patient, the provider cannot give the employer the information without patient authorization unless other laws require them to release such information.¹⁰ Healthcare organizations have been sanctioned for improperly disclosing protected health information (“PHI”) to an employer without patient authorization. Thus, healthcare providers must be careful not to disclose PHI. That said, if a health care provider receives a picture or fax of a certification or note purporting to be from the provider, they can verify whether the provider did, in fact, provide such information.

Healthcare Providers as Employers

Because the Privacy Rule protects PHI and not employment records, it can be confusing when the employer is a healthcare provider. In those instances, the employer may have access to both employment records and PHI, and it is important to maintain these records separately to ensure that health records containing PHI are adequately protected. This issue may arise when fellow employees or supervisors look at other employees’ health records without authorization or a valid reason to do so.

For example, suppose a nurse at a hospital system presented a doctors’ note stating that the nurse had tested positive for COVID and, thus, needed to isolate for fourteen days. The nurse’s supervisor remembers that this nurse presented a similar note six months ago and is suspicious of its validity. It would not be permissible for the supervisor to look at the nurse’s medical record and check the results of the nurse’s lab work without the nurse’s express authorization to do so. If the supervisor took such actions, it could be considered an improper access of the employee’s medical record and would be impermissible under HIPAA. In a similar case, the Department of Health and Human Services Office of Civil Rights (“OCR”) imposed sanctions on a clinic when a supervisor accessed an employee’s medical record. OCR explained that, while the employee record was not protected by HIPAA, the medical record was protected, and the supervisor accessed PHI in the employee’s medical record and shared it impermissibly. Thus, OCR imposed sanctions and required the clinic to take corrective action and retrain its staff regarding these issues. ¹¹

The correct course of action in the example described above would be for an employee who was not the nurse’s direct supervisor to contact the physician and ask whether the note was authentic and from the time stated. Alternatively, the nurse could authorize the physician to give the supervisor or the human resources department such information.

Conclusion

While the internet makes life much more convenient, it can also make a false medical certification much easier to obtain. However, due to patient confidentiality requirements and employment laws prohibiting discrimination, employers and healthcare providers must use caution in their communications about employee/patients’ health. As such, having robust policies in place and following such policies when these issues arise is imperative for compliance.