Employers are subject to HIPAA only when acting as a health plan sponsor, on behalf of the employer health plan. A plan sponsor/employer is subject to HIPAA’s rules and responsibilities, all of which are centered on protecting the privacy of participants in the health plan. Any protected health information (PHI) accessed in connection with administration of the health plan must remain confidential.
However, many employers find themselves uncertain about whether HIPAA applies in other common employer situations involving employee health information. Is medical information disclosed as part of a workers’ compensation claim subject to HIPAA? Can an employer share the contents of a doctor’s note with the employee’s supervisor if needed? Does HIPAA apply to medical information relevant to a FMLA request?
These scenarios may feel like a gray area, but the reality is that none of them are subject to HIPAA. The reason is simple: the employer is not acting as a health plan sponsor in any of these situations, nor did any of the health information come from the health plan. A plan sponsor is bound by HIPAA; an employer is not. And although the employer and plan sponsor are the same entity, HIPAA only applies to the employer acting in its role as plan sponsor. All employee health information should be kept confidential, but health information learned in the employer role (as opposed to that of plan sponsor) does not fall under HIPAA.
Maintain a Distinction
The best way to avoid gray area confusion is to keep health plan functions and employer functions as separate as possible. Any information gathered from the health plan should be kept out of employment decisions. For example, if an employee is in the running for a promotion, but you know from their health plan information that the employee is fighting cancer, you must disregard that health plan knowledge when making the decision.
At first glance, it may seem like a good idea to express concern when you know from health plan information that an employee or their dependent is struggling with their health. However, simple gestures like get-well wishes or sending flowers can easily backfire. If an employee hasn’t shared a health concern with you, it likely means that they want to keep their health concerns private. The best practice is to honor the employee’s privacy and act as if you’re not aware of the information.
