The Oregon Court of Appeals recently issued an opinion in Trumper v. Women’s Healthcare Associates, LLC confirming that the privacy protections afforded by the Health Insurance Portability and Accountability Act (HIPAA) do not excuse or supersede compliance with employee medical documentation requirements, including Oregon’s vaccine mandate exemption.
Trumper v. Women's Healthcare Associates, LLC Case Background
The Oregon Health Authority adopted OAR 333-019-1010 in 2021 requiring healthcare personnel to be vaccinated against COVID‑19 or obtain a medical or religious exemption, with medical exemptions requiring provider certification of a specific diagnosis that limits vaccination. The rule also required healthcare employers to maintain vaccination and exemption records consistent with privacy laws.
Women’s Healthcare Associates (WHA) followed that rule and required documentation for requested exemptions. An employee at the time, Christina Trumper, notified WHA that she would seek a medical exemption and submitted both the state form and the employer’s form, but her provider wrote only “HIPAA protected info” instead of identifying a diagnosis or explaining why vaccination was medically contraindicated. WHA denied the exemption as incomplete, the employee did not cure the deficiency, and WHA terminated her employment.
Oregon Court of Appeals' Decision
Trumper sued for wrongful discharge in violation of public policy, later asserting that she was an insulin‑dependent diabetic and claiming she had a right under HIPAA and Oregon privacy statutes to withhold the medical basis for her exemption from her employer. The court held there was no wrongful discharge because she was not terminated for fulfilling a public duty or exercising a protected job‑related right, but for failing to comply with a valid vaccination rule and its documentation requirements, which she did not challenge.
Most importantly, the Court rejected Trumper’s argument that HIPAA and ORS 192.553 gave her a right to refuse disclosure to her employer. The Court explained that HIPAA restricts covered entities’ disclosures but expressly permits disclosure with the individual’s consent and does not prohibit an employee from sharing their diagnosis to comply with a vaccination mandate. The court also rejected Trumper’s late‑raised argument that, as a remote worker, she fell outside the definition of “healthcare setting,” noting that the rule allowed healthcare employers to adopt more restrictive vaccination requirements, including for employees working from home.
OAR 333-019-1010 has since been repealed, effective June 30, 2023. However, this opinion can be applied beyond this Oregon rule. The court reaffirmed that HIPAA permits disclosure with an employee’s consent, which means it similarly does not protect employees from having to comply with medical documentation requirements of other laws such as verification under Oregon sick time, the interactive process under the Americans with Disabilities Act to identify reasonable accommodations, and medical leave under the federal Family Medical Leave Act, Oregon Family Leave Act, and Oregon Paid Family Medical Leave Insurance.
Key Takeaways for Employers
- Employers should continue to exercise care to ensure that requests for medical records and similar information are justified by applicable law (for example, within scope permitted by an applicable leave law and/or limited to what is necessary to evaluate an employee’s request for accommodation), but can now be assured that, where necessary, HIPAA does not excuse the employee’s obligation to provide it.
- Employer should also continue to maintain medical records separately from personnel files, limit access to those with a need to know, and state in forms and notices how information will be used and protected, aligning with federal and state privacy obligations.
- Work with employment counsel before discipline or termination in the event it is because an employee has refused to provide medical documentation, to confirm compliance with evolving public health rules, and disability and religious accommodation obligations.
The legal issues impacting this topic are and will continue to be ever-changing (Employment Law in Motion!), and since publication of this blog post, new or additional information not referenced in this blog post may be available.
This article is provided for informational purposes only—it does not constitute legal advice and does not create an attorney-client relationship between the firm and the reader. Readers should consult legal counsel before taking action relating to the subject matter of this article.
