HIPAA in the Workplace

HIPAA, the Health Insurance Portability and Accountability Act, is a federal law whose Privacy Rule controls how covered entities and their business associates use and share protected health information. Covered entities are health plans, health care clearinghouses and certain health care providers.

Most employers are not covered entities when they act as employers. HIPAA does not apply to the health information an employer keeps in its employment records, and that is the point many HR teams miss.

Who Does HIPAA Apply To?

HHS says the HIPAA Rules apply to covered entities and business associates, and that an entity that is neither does not have to comply. The definitions sit in 45 CFR 160.103. Health care providers count only if they transmit certain information electronically in standard transactions.

A business associate is a person or company that handles protected health information on behalf of a covered entity. The regulation lists claims processing, data analysis, billing and benefit management as examples. Healthcare employers that are covered entities have more duties, and our HIPAA onboarding checklist is written for them.

Are Employment Records Protected by HIPAA?

No. HHS says the Privacy Rule does not protect employment records, even when the information in them is health-related, and in most cases it does not apply to the actions of an employer. The regulation also excludes employment records held by a covered entity in its role as employer from the definition of protected health information.

Employers can ask for a doctor's note or other health information for sick leave, workers' compensation, wellness programs or health insurance, as the HHS guidance on employers and health information notes. HIPAA limits what a provider can disclose without authorization, not what an employer may ask. Other laws still apply: HHS notes that the ADA requires vaccination documentation to be kept confidential and separate from personnel files.

How Do Group Health Plans Change the Picture?

A group health plan is a covered entity, except for self-administered plans with fewer than 50 participants. HHS treats the plan as a separate legal entity from the employer and says neither employers nor other plan sponsors are covered entities. HIPAA therefore reaches the employer through the plan.

A plan may share protected health information with the employer as plan sponsor only for plan administration. The sponsor must amend the plan documents, promise not to use the information for employment-related actions, and keep staff who administer the plan separate from those who make employment decisions. Plans may also share enrollment status, and summary health information for purposes such as premium bids.

Wellness programs depend on how they are built. If a program is offered through the group health plan, the information collected is protected health information. If the employer runs it directly, HIPAA does not apply to the information, though other federal or state laws may.

What May HR Do With Employee Health Information?

HIPAA rarely stops HR from handling ordinary employee health information, but other laws and plan rules set limits.

• Ask for a doctor's note to support sick leave or a workers' compensation claim.
• Keep medical documents confidential and apart from personnel files.
• Never use health plan information to make hiring, discipline or firing decisions.
• Limit access to plan information to the staff who administer the plan.

When an employee hands you health information directly, it is generally an employment record rather than protected health information. Treat it as sensitive anyway and share it only with people who need it to act on it.

What Are Common HIPAA Myths in the Workplace?

Four myths cause most of the confusion, and HHS guidance corrects each one.

If a manager shares an employee's diagnosis, the issue is more likely the ADA's confidentiality rules or company policy than HIPAA. Either way, HR should treat it as a serious breach of trust and review it with counsel.

How Can HR Cloud Help With HIPAA in the Workplace?

HR Cloud's HRIS page describes unifying profiles, documents and permissions, with secure document storage, role-based access control and audit tracking. HR teams can use role-based access to limit who sees sensitive employee documents.

The page describes HR records and documents, not a health plan or benefits administration, and HR Cloud does not give legal advice on HIPAA. HR still has to decide which records are sensitive, set access rules and confirm with its plan administrator whether any vendor handles plan information.

Discover how our HR solutions streamline onboarding, boost employee engagement, and simplify HR management

Book Your Free Demo

Frequently Asked Questions

Q: Does HIPAA apply to my company?

A: Only if it is a covered entity or business associate. Sponsoring a group health plan does not make the employer a covered entity, but the plan itself usually is one.

Q: Is a doctor's note protected by HIPAA once HR has it?

A: Generally no. HHS says employment records are not protected by the Privacy Rule, but the ADA requires employers to keep medical information confidential.

Q: Can HR see employees' health plan claims?

A: Not freely. The plan may give the employer protected health information only for plan administration, and the employer may not use it for employment-related actions.

Q: Does a self-funded plan fall under HIPAA?

A: Yes. The regulation's definition of group health plan includes insured and self-insured plans, though HHS says requirements are limited when a plan is fully insured.

Q: Does an employer need HIPAA training for its staff?

A: An employer that is not a covered entity or business associate has no HIPAA duty of its own as an employer. Staff who administer a group health plan should ask the plan's administrator what the plan requires.

Q: Who enforces HIPAA?

A: The HHS Office for Civil Rights enforces the Privacy and Security Rules. Those rules apply to covered entities and business associates.