EEOC Informal Discussion Letter

An EEOC Office of Legal Counsel staff member wrote the following informal discussion letter in response to a Federal Register notice. This letter is intended to provide an informal discussion of the noted issue(s) and does not constitute an official opinion of the Commission.

ADA/Rehab Act & GINA: Confidentiality of Protected Medical and Genetic Information

October 29, 2018

TRANSMITTED VIA E-MAIL

Regulations Comment Desk
Strategy and Performance Division (MP)
Suite 4100
National Archives and Records Administration
8601 Adelphi Road
College Park, MD 20740-6001

Re: Request for Comments Regarding SORN NARA 45, Insider Threat Program Records

Dear Ms. Keravuori and Mr. Carmichael:

The U.S. Equal Employment Opportunity Commission (EEOC) submits this comment in response to the request for comments regarding the National Archives and Records Administration's (NARA's) proposed system of records, NARA 45, Insider Threat Program Records.[1]

As you know, the EEOC enforces the federal laws that prohibit employment discrimination on the basis of race, color, religion, sex, national origin, age, disability, or genetic information.[2]  The laws enforced by the EEOC also prohibit retaliation for filing a charge or complaint of employment discrimination, participating in an employment discrimination proceeding, or opposing such discrimination.[3]  Further, the EEOC coordinates and leads the federal government's efforts to eradicate employment discrimination.[4]

As indicated below in greater detail, we recommend that NARA review and revise the routine uses applicable to NARA 45 as necessary to avoid conflict with the Rehabilitation Act of 1973 and Title II of the Genetic Information Nondiscrimination Act of 2008.

Overview of NARA 45, Insider Threat Program Records

NARA 45 covers, among other individuals, NARA civilian employees and certain officials or employees of federal, state, tribal, territorial, and local law enforcement organizations affiliated or working with NARA.[5]  Records in the system include, among others, medical records, medical reports, substance abuse and mental health records of individuals undergoing law enforcement action or presenting an identifiable imminent threat, and equal employment opportunity complaints (which may include protected medical and/or genetic information).[6]  In addition to disclosures generally permitted under 5 U.S.C. § 552a(b) of the Privacy Act, records maintained in NARA 45 may be disclosed as a routine use pursuant to 5 U.S.C. § 552a(b)(3) in sixteen delineated situations.[7] 

Confidentiality Requirements of Section 501 of the Rehabilitation Act of 1973

The EEOC enforces Section 501 of the Rehabilitation Act of 1973, as amended (Rehabilitation Act), which prohibits federal agencies from discriminating against qualified applicants or employees on the basis of disability.[8]  The Rehabilitation Act restricts the circumstances under which federal agencies may obtain applicants' and employees' medical information, and requires that federal agencies that lawfully obtain such information collect and maintain the information on separate forms and in separate medical files and treat it as a "confidential medical record."[9] 

Disclosure of medical information governed by the Rehabilitation Act's confidentiality provisions is permitted only in limited circumstances.  Specifically, federal agencies may share medical information with supervisors and managers who need to know about an employee's work restrictions and necessary accommodations, with first aid and safety personnel if an employee's disability might require emergency treatment or assistance in the event of an emergency, and with government officials investigating Rehabilitation Act compliance.[10]  The  EEOC also has interpreted the Rehabilitation Act to allow federal agencies to disclose information for workers' compensation and insurance purposes.[11] 

Confidentiality Requirements of Title II of the Genetic Information Nondiscrimination Act of 2008

The EEOC also enforces Title II of the Genetic Information Nondiscrimination Act of 2008 (GINA), which prohibits employment discrimination based on genetic information.[12]  Protected genetic information under GINA includes, among other things, genetic test results and family medical history.[13]  GINA restricts the circumstances under which federal agencies may obtain applicants' and employees' genetic information, and, like the Rehabilitation Act with respect to covered medical information, requires that federal agencies that lawfully obtain genetic information keep it confidential and retain it in separate medical files.[14] 

Federal agencies may disclose genetic information in six limited circumstances[15]:

1. To the employee or family member about whom the information pertains upon receipt of the employee's or family member's written request;
2. To an occupational or other health researcher conducting research in compliance with certain federal regulations;
3. In response to a court order expressly authorizing disclosure of specified genetic information;
4. To government officials investigating compliance with Title II of GINA, if the information is relevant to the investigation;
5. For leave certification under the FMLA or state family and medical leave laws; or
6. To a public health agency only with regard to information about the manifestation of a disease or disorder that concerns a contagious disease that presents an imminent hazard of death or life-threatening illness.

Recommendation Regarding Routine Uses Applicable to NARA 45

We believe that a few of the routine uses applicable to NARA 45 would permit disclosure of protected medical and/or genetic information in system records in circumstances beyond what the Rehabilitation Act and GINA permit.  For example, Routine Use B in Appendix A permits disclosure of records to agencies to obtain relevant information regarding, among other things, agency hiring or retention decisions, contract awards, or issuance of a license or grant.[16]  Routine Use C in Appendix A permits disclosure of records to federal agencies upon request in connection with, among other things, employee hiring or retention, suitability investigations, job classification, contract awards, or issuance of a license or grant.[17] 

We recommend that NARA review and revise the routine uses applicable to NARA 45 as necessary to prevent any unintended legal conflicts.  For example, NARA could exempt medical and genetic records, reports, or information from disclosure, where possible, or redact protected medical and/or genetic information from records prior to disclosure.

Thank you for the opportunity to provide these comments in response to the proposed information system.  Should you have any questions, please feel free to contact me.

Sincerely,  

Lisa Schnall
Senior Attorney Advisor
Office of Legal Counsel
U.S. Equal Employment Opportunity Commission

FOOTNOTES:

[1] Privacy Act of 1974; System of Records, 83 Fed. Reg. 48,869 (Sept. 27, 2018).

[2] See Title VII of the Civil Rights Act of 1964, as amended, 42 U.S.C. § 2000e et seq.; the Age Discrimination in Employment Act of 1967, as amended, 29 U.S.C. § 621 et seq.; Section 501 of the Rehabilitation Act of 1973, as amended, 29 U.S.C. § 791; Titles I and V of the Americans with Disabilities Act of 1990, as amended, 42 U.S.C. § 12101 et seq.; the Equal Pay Act of 1963, 29 U.S.C. § 206(d); and Title II of the Genetic Information Nondiscrimination Act of 2008, 42 U.S.C. § 2000ff et seq.

[3] 42 U.S.C. § 2000e-3(a); 29 U.S.C. § 623(d); 29 U.S.C. § 791(g) (incorporating, among other provisions, the anti-retaliation provision of the ADA into the Rehabilitation Act); 29 U.S.C. § 215(a)(3); 42 U.S.C. § 2000ff-6(f).

[4] Exec. Order No. 12,067, 43 Fed. Reg. 28,967 (June 30, 1978).

[5] 83 Fed. Reg. at 48,870.

[6] Id. at 48,871.

[7] Id. at 48,872 (counting the routine uses in Appendix A individually). 

[8] 29 U.S.C. § 791 et seq.  See also 29 U.S.C. § 791(g) (applying the standards under Title I of the Americans with Disabilities Act of 1990 to the Rehabilitation Act). 

[9] 42 U.S.C. § 12112(d); 29 C.F.R. §§ 1630.13, 1630.14(b)(1), (c)(1), (d)(1). 

[10] 29 C.F.R. § 1630.14(b)(1), (c)(1), (d)(1). 

[11] 29 C.F.R. pt. 1630, App. § 1630.14(b).

[12] 42 U.S.C. § 2000ff et seq.; 29 C.F.R. pt. 1635.

[13] 42 U.S.C. § 2000ff(4); 29 C.F.R. § 1635.3(c).

[14] 42 U.S.C. § 2000ff-1(b); 42 U.S.C. § 2000ff-5.

[15] 42 U.S.C. § 2000ff-5; 29 C.F.R. § 1635.9.

[16] Privacy Act of 1974; Notice of Republication and Alteration of Systems of Records Notices (SORNs), 78 Fed. Reg. 77,256, 77,287 (Dec. 20, 2013).

[17] Id.