What Is HIPAA?
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that establishes national standards for the protection of individually identifiable health information. While HIPAA is commonly associated with healthcare providers and insurers, it also has significant implications for HR professionals who manage employer-sponsored group health plans.
For HR professionals studying for the SHRM-CP or SHRM-SCP exam, HIPAA questions typically focus on the Privacy Rule, the distinction between covered entities and employers, and the practical limitations on how HR can use and disclose employee health information.
HIPAA applies to covered entities, which include health plans, healthcare providers who transmit information electronically, and healthcare clearinghouses. An employer-sponsored group health plan is a covered entity, meaning it must comply with HIPAA's Privacy Rule and Security Rule.
HIPAA and Employer-Sponsored Health Plans
A critical distinction for HR professionals is that HIPAA regulates the employer's group health plan, not the employer itself. This means:
- The employer, acting in its capacity as plan sponsor, can access protected health information (PHI) only if the plan documents are amended to permit it and the employer certifies it will safeguard the information.
- PHI obtained through the health plan cannot be used for employment decisions such as hiring, firing, promotions, or discipline.
- Only designated employees who perform plan administration functions ("workforce members") should have access to PHI, and only for plan administration purposes.
An important exam point: if an HR professional learns about an employee's medical condition through a source other than the group health plan (such as a supervisor's report, an ADA accommodation request, or a workers' compensation claim), HIPAA does not apply to that information. However, other laws such as the ADA may still impose confidentiality requirements.
The HIPAA Privacy Rule in Practice
The Privacy Rule establishes standards for when and how PHI can be used and disclosed. Key provisions include:
- Minimum necessary standard: When using or disclosing PHI, the group health plan must make reasonable efforts to limit the information to the minimum necessary to accomplish the intended purpose.
- Individual rights: Plan participants have the right to access their PHI, request corrections, receive an accounting of disclosures, and request restrictions on certain uses.
- Notice of Privacy Practices: The group health plan must provide a notice describing how it may use and disclose PHI, and the individual's rights under the Privacy Rule.
- Business associate agreements: The plan must have written agreements with any business associates (such as third-party administrators, consultants, or IT vendors) that access PHI on behalf of the plan.
Violations of the HIPAA Privacy Rule can result in significant civil and criminal penalties. Civil penalties range from $100 to $50,000 per violation, with annual caps depending on the level of culpability. Criminal penalties can include fines up to $250,000 and imprisonment for up to 10 years for the most serious offenses.
Common HIPAA Misconceptions in HR
Several common misconceptions about HIPAA are worth addressing, as they may appear on the SHRM exam:
- "HIPAA prohibits employers from asking employees about their health." This is false. HIPAA regulates the group health plan, not the employer's general employment practices. The ADA limits medical inquiries, but HIPAA does not.
- "Managers cannot ask about an employee's absence." Managers can ask about the nature of an absence and whether accommodation is needed. HIPAA does not prevent these conversations.
- "All employee health information is protected by HIPAA." HIPAA protects only PHI that flows through a covered entity (such as the group health plan). Medical information obtained through other channels may be protected by other laws but not by HIPAA.
- "HIPAA applies to all employers." HIPAA applies to covered entities. An employer that does not sponsor a group health plan is generally not subject to HIPAA.
Understanding these nuances is essential for answering SHRM exam questions correctly and advising managers appropriately in practice.
Start Practicing Today
HIPAA is an important compliance topic on the SHRM exam, which features 134 questions over 4 hours at Prometric or OnVUE. Know the distinction between the employer and the group health plan, the minimum necessary standard, and common misconceptions.
SHRMpractice.com offers targeted practice questions on HIPAA and other benefits compliance topics. Start with a diagnostic assessment to gauge your readiness, then sign up for full access to our study resources.