my husband was recently randomly tested and it came back positive for marijuana. Not a fulltime smoker but every now and then if someone has it he may take a puff.

he attended counseling and went through the classes. He was re-tested by the couselor and came back clean.

he went back to work and 1 of the managers made a comment to him in front of other employee's "you sure know how to party don't you?"

then a few days later a 2nd manager told another manager why my husband was off work for 3 weeks.

a lot of employee's now know why my husband was not at work for those 3 weeks. He reported this to the HR manager who did absolutely nothing. HR swept it under the rug and disregarded my husband.

since returning back to work, my husband is ashamed at his foolishness and his character has now been slandered at work.

is there anything we can do?

Has he suffered measurable damages? Meaning, has he lost pay because of the 'slander'?

Unless it was your husband's company providing the service (as in does he work for a hospital?) this is not a HIPAA complaint. HIPAA covers what doctors and other service providers can do.

While bad policy, there is very little that prevents the company from posting your husband's suspension on the bulletin board. After all, its not slander or libel if its true.

Why was he "off" for 3 weeks? I understand the positive test and the counselling - was he suspended for a dirty test?

No damages were suffered. He was off for 3 weeks because that is how long the counseling and classes took to complete. He could not return until it came back clean.

Then you probably have no actionable grounds.

The question here is how the manager and others found out the results of the test. If they were told by the testing lab, there might be a HIPAA violation. But I doubt it.

Most likely, since the test was ordered by the company, the lab told someone at the company and they spread the word.

So the question becomes what confidentialty assurance was given as to the results. If none was given, then there is nothing he can do. No HIPAA violation, not even a privacy violation.

Depending on the type of business, type of job, I'm not sure it isn't in the company's best interest for the managers to know.

At any rate, I don't see a HIPAA violation.

Another case of someone breaking the law and not facing up to the consequences, one of which is having other people find out.

I am amazed that he had three weeks of counselling, during which time he could not work, based on occasional use.