Does HIPAA apply to employers?

HIPAA sets national standards for safeguarding patients' health information, primarily targeting healthcare organizations. However, employers often wonder about HIPAA's impact on their operations. Although HIPAA generally doesn't apply to employers directly, certain situations may require compliance with its privacy and security rules. 

Does HIPAA apply to employers?

The Health Insurance Portability and Accountability Act (HIPAA) typically does not directly apply to employers unless they are considered a covered entity or a business associate. Covered entities include healthcare providers, health plans, and healthcare clearinghouses. Business associates are companies that provide services to covered entities involving protected health information (PHI). Thus, employers outside these categories are not directly subject to HIPAA regulations.

What health information can employers request from employees?

Employers may request health information from employees under specific circumstances, including but not limited to:

• Sick leave: Employers may ask for a doctor's note to verify an employee's absence due to illness. This helps employers ensure the legitimacy of the leave and manage workforce availability.
• Workers' compensation: In the event of a workplace injury, employers require health information for claims processing, case management, and determining appropriate accommodations for the employee.
• Wellness programs: Employers often encourage employees to participate in voluntary wellness programs. These programs may involve sharing health information to assess individual needs and offer personalized recommendations.
• Health insurance: When administering employee health plans, employers may need access to health information to determine eligibility and coordinate benefits.

When does HIPAA apply to employers?

An employer may fall under HIPAA regulations in certain situations, such as:

• Operating a self-insured health plan: Employers who manage their own health plans take on the role of a covered entity and must comply with HIPAA privacy and security rules.
• Providing an on-site medical clinic: Employers offering on-site clinics for employees are subject to HIPAA privacy and security rules, as these clinics may handle PHI as part of their services.

What privacy laws affect employers?

In addition to HIPAA, employers need to be aware of other federal and state laws that govern the handling, disclosure, and storage of employee health information. While not as extensive as HIPAA, these laws still play a critical role in shaping how employers manage health-related data in the workplace. 

The following are some privacy laws that employers should be familiar with:

• Americans with Disabilities Act (ADA): The ADA regulates the confidentiality of employee medical information and prohibits discrimination based on disability. Employers must store medical records separately from general personnel files and limit access to those with a legitimate need.
• Family and Medical Leave Act (FMLA): The FMLA requires employers to maintain the confidentiality of employees' health information related to family and medical leave. Employers must store these records securely and separately from general personnel files.
• State privacy laws: State-specific regulations may govern health information privacy, so employers must be aware of the laws in their jurisdictions.

Protecting employee health information in the workplace

To ensure the privacy and security of employee health information, employers should:

• Implement a clear privacy policy: Develop a comprehensive policy outlining how the company handles health information and train employees on these guidelines.
• Limit access to health information: Restrict access to employee health records to those who need it for specific job-related purposes, such as human resources personnel, managers, or supervisors dealing with accommodations.
• Secure storage of records: Store health records securely, both physically and electronically, to prevent unauthorized access. Implement access controls, encryption, and regular audits to ensure data security.
• Use secure email when transmitting private employee information: Use secure, HIPAA compliant email whenever sending employee data, particularly if health information is included in the communication. 

Employees' rights and responsibilities

Understanding and actively participating in the protection of one's health information is crucial for employees. As an employee, be aware of your rights and responsibilities related to health information privacy in the workplace. Taking a proactive approach to safeguarding your personal data can help create a more secure environment and foster better communication between you and your employer.

• Know your rights: Understand your privacy rights under HIPAA, ADA, FMLA, and other relevant laws. Familiarize yourself with your employer's privacy policies and procedures to ensure you know how your health information is handled.
• Communicate with your healthcare provider: Make sure your healthcare provider knows not to share your health information with your employer without your authorization, except when required by law. Stay informed about your rights and any limitations on the disclosure of your health information.
• Be proactive: If you have concerns about health information privacy, discuss them with your employer or human resources department. Open communication can help address potential issues and create a more secure environment for health information.

Resources for employers and best practices

Employers seeking guidance on ensuring compliance and best practices can turn to several resources:

• U.S. Department of Health & Human Services (HHS): The HHS website offers a wealth of information on HIPAA, including FAQs, fact sheets, and guidance documents.
• State agencies: Check with your state's health department or attorney general's office for guidance on state-specific privacy laws.
• Professional associations: Industry-specific associations often provide resources and best practices for handling health information privacy.
• Legal counsel: Consult with an attorney experienced in healthcare privacy laws to ensure compliance with federal, state, and local regulations.

Related: Who HIPAA does not apply to and why