The Fair and Accurate Credit Transactions (FACT) Act

On December 4, 2003, President Bush signed into law the Fair and Accurate Credit Transactions Act, the "FACT Act," providing some relief to employers using third parties to conduct workplace investigations. Under the FACT Act, an employer who uses a third party to conduct a workplace investigation need no longer follow the consent and disclosure requirements of the Fair Credit Reporting Act if the investigation involves suspected misconduct, a violation of law or regulations, or a violation of any pre-existing written policies of the employer. In effect, it means the employer does not have to give the employee notice and get his or her permission to conduct a misconduct investigation in the workplace.

Since April, 1999, the Federal Trade Commission, which oversees the implementation of the FCRA, had taken the position that the FCRA consent and disclosure requirements were triggered when a third party, such as a law firm or outside human resources consultant regularly assisting employers with investigations, undertakes a workplace sexual harassment investigation on behalf of an employer. For example, under the FTC's interpretation, an employer was required to obtain the consent of an employee under investigation for alleged harassment prior to the third party conducting the investigation. Under those circumstances, the employer also was required to disclose to the employee the nature and scope of the investigation. An equally troubling aspect of the FTC interpretation required the employer provide the employee being investigated with a copy of the resulting report at the "pre-adverse action" stage of the proceeding, with the names of sources removed from the report.

The FACT Act requires that, to be excluded from the disclosure requirement at the pre-adverse action stage, communication of the report resulting from the third party investigation must be limited to the employer or an agent of the employer. As a practical matter, the report should not be disclosed to the complaining party; doing so may bring it within the scope of an investigative "consumer report" otherwise triggering the disclosure requirements.

In the event "adverse action" is taken against the employee based on the results of the investigation, the FACT Act still requires the employer to provide the employee a summary of the report. "Adverse action" has been broadly defined as any employment decision that adversely affects an employee. Employers using outside consultants to conduct internal investigations must therefore remember to provide this summary whenever an adverse action is taken, even if a written warning results. However, the summary does not have to identify the individuals interviewed or other sources of information.

Special Consent Required for Medical Information

In a separate provision, the FACT Act requires employers requesting medical information about a "consumer" applicant or employee to obtain a specific written consent describing in "clear and conspicuous language" the use for which the information will be furnished. The medical-related information sought by the employer must be, in effect, job-related. For example, a consumer reporting agency would be prohibited from disclosing any medical-related information inadvertently disclosed while conducting a background investigation, unless the employer had a specific consent form from an applicant or employee.

In this regard, the legislation adds a further layer of privacy, by specifically reminding employers that medical information should not be disclosed, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by law. This does not necessarily mean that drug testing or medical examination results received about applicants are subject to FCRA.

Reports prepared by health care providers and laboratories are generally not considered consumer reports because such communications fall within the "transactions and experiences" exception, as, for example, a drug counselor reporting the results of a test done by a laboratory is not creating a "consumer report." In contrast, an entity that retains copies of drug tests and regularly sells this information to a third party for a fee is considered a "consumer reporting agency" preparing a "consumer report."

In any event, employers will need to be cognizant of the authorization requirements of the Health Insurance Portability and Accountability Act before obtaining a copy of such reports. HIPAA's rules require covered health care providers who prepare these reports to obtain specific authorization when an employer requests a copy of employee medical information.

Certain entities subject to the HIPAA privacy regulations may have further compliance obligations. For example, a hospital that is a covered health care provider under HIPAA may conduct a workplace investigation with respect to an employee that involves certain health information of some of the hospital's patients. Although the HIPAA privacy regulations may permit disclosures of this kind as part of the hospital's health care operations (a defined term under HIPAA) without the patient's authorization, the hospital should review the privacy regulations and applicable state law to determine their obligations in this regard.

In sum, the changes to the FCRA requirements and the additional medical information privacy provisions of the new FACT Act will require employers to take a close look at their policies and practices involving background checks, workplace investigations, and requests for employee medical information. An employer conducting background checks should revisit whether the forms used or supplied by the consumer reporting agency comply with FCRA requirements, specifically when seeking covered medical information. Requests for, or the use of, medical related information should be reviewed to determine whether a separate HIPAA authorization would be required. Finally, in the event of a workplace investigation involving the use of a third party, the employer must provide the employee a summary of the results if any adverse employment action is taken. Sound documentation remains a key to your compliance efforts under this law.

Please be advised that the information above is not intended to be a substitute for legal advice. If you have general questions about the FCRA requirements, FACT Act, or applicable state law requirements we encourage you to direct your questions to Sure-Hire or to your legal counsel.