HIPAA Privacy in the Workplace
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is best known for its privacy and security provisions that protect individuals' health information. For HR professionals preparing for the SHRM exam, understanding how HIPAA applies in the employment context is essential, particularly regarding employer-sponsored health plans and the handling of employee medical information.
HIPAA's Key Provisions
HIPAA contains several titles, but the most relevant for HR professionals are:
- Title I (Health Insurance Reform): Provides protections for workers and their families by limiting exclusions for pre-existing conditions, prohibiting discrimination based on health status, and guaranteeing renewability and availability of health coverage.
- Title II (Administrative Simplification): Establishes national standards for electronic health care transactions and national identifiers for providers, health plans, and employers. This title includes the Privacy Rule and Security Rule.
The Privacy Rule
The HIPAA Privacy Rule establishes national standards for the protection of individually identifiable health information, known as Protected Health Information (PHI). PHI includes any information that relates to the individual's past, present, or future physical or mental health condition, the provision of health care to the individual, or the past, present, or future payment for health care, and that identifies the individual or could reasonably be used to identify the individual.
The Privacy Rule applies to "covered entities," which include health plans (including employer-sponsored group health plans), health care providers who transmit health information electronically, and health care clearinghouses.
HIPAA and Employer-Sponsored Health Plans
A critical distinction for HR professionals is that HIPAA's Privacy Rule applies to the group health plan as a covered entity, not to the employer as an employer. This means that the employer, in its capacity as plan sponsor, has specific obligations when it handles PHI on behalf of the plan. Key requirements include:
- The plan documents must be amended to describe the permitted uses and disclosures of PHI by the plan sponsor.
- The employer must establish adequate separation between the plan and the employer, identifying specific employees who may access PHI.
- The employer must certify to the plan that it will comply with the plan document restrictions.
- The employer must ensure that any agents or subcontractors agree to the same restrictions.
What HIPAA Does Not Cover in Employment
A common misconception is that HIPAA restricts all employer access to employee medical information. In fact, HIPAA does not apply to employment records held by the employer in its capacity as an employer, even if those records contain health information. For example, HIPAA does not govern medical information collected for FMLA leave requests, workers compensation claims, ADA accommodation requests, fitness-for-duty certifications, or drug testing results.
However, even though HIPAA may not apply to these records, other laws (such as the ADA, FMLA, and state privacy laws) may restrict how employers collect, use, and disclose employee medical information.
The Security Rule
The HIPAA Security Rule establishes standards for protecting electronic PHI (ePHI). The Security Rule requires covered entities and their business associates to implement administrative safeguards (security management processes, workforce training, contingency plans), physical safeguards (facility access controls, workstation security, device and media controls), and technical safeguards (access controls, audit controls, transmission security, integrity controls).
Business Associate Agreements
When a covered entity (such as a group health plan) shares PHI with a business associate (a person or entity that performs functions involving PHI on behalf of the covered entity), a business associate agreement (BAA) must be in place. The BAA must specify the permitted uses and disclosures of PHI, require the business associate to implement appropriate safeguards, require reporting of any security incidents or breaches, and ensure the return or destruction of PHI upon termination of the agreement.
Breach Notification Requirements
The HITECH Act of 2009 strengthened HIPAA's enforcement provisions and established breach notification requirements. In the event of a breach of unsecured PHI, covered entities must notify affected individuals without unreasonable delay (no later than 60 days after discovery), notify the Department of Health and Human Services, and for breaches affecting 500 or more individuals, notify prominent media outlets in the state or jurisdiction.
SHRM Exam Tips
For the SHRM exam, remember that HIPAA applies to the group health plan, not the employer as an employer. Understand the distinction between PHI held by the plan and medical information held in employment records. Know the basic requirements of the Privacy Rule, Security Rule, and breach notification rules. Also recognize that HIPAA works alongside (not instead of) other laws that protect employee medical information.