HIPAA Laws and Employers: What Covered Entities Must Know

HIPAA Laws and Employers: What Covered Entities Must Know

HIPAA laws and employers intersect in specific, often overlooked ways. An employer is not automatically a HIPAA covered entity. Only health plans, health care clearinghouses, and certain health care providers that transmit health information electronically are bound by the rule. When an employer sponsors a self-insured health plan or acts as a plan administrator, it steps into the role of a covered entity and must follow the Privacy, Security, and Breach Notification Rules.

For employers who are not covered entities, HIPAA still matters whenever they receive protected health information. A human-resources team handling leave requests, accommodation forms, or disability documentation often touches PHI. Treating that data with safeguards—even absent a direct HIPAA obligation—reduces risk and aligns with common professional standards.

When Employers Fall Under HIPAA

The most common path is through group health plans. An employer that self-funds its plan must comply with HIPAA as a plan administrator. This includes the obligation to provide a Notice of Privacy Practices, obtain authorization for uses beyond treatment, payment, and health care operations, and limit disclosures to the minimum necessary. If the employer contracts with a third-party administrator, the plan and the administrator typically share responsibility through a business associate agreement.

Employers that operate clinics, employee assistance programs, or on-site health centers that transmit electronic transactions are also covered entities. In these settings, workforce health records are subject to the same rules as patient records in a hospital or private practice.

Employment Records Versus Protected Health Information

A key distinction separates employment records from PHI. FICA, payroll, I-9 forms, and performance reviews are employment records and sit outside HIPAA. But when a record contains health information—such as a doctor's note for FMLA leave, workers' compensation documentation, or a vaccination record—it may be PHI. The same file can hold both types of data, which makes handling it carefully essential.

Even if a record is employment data, other federal and state laws still apply. The Americans with Disabilities Act restricts how medical information is used in employment decisions, and the Genetic Information Nondiscrimination Act bars discrimination based on genetic data. Employers should map where PHI lives in their systems and apply controls that satisfy both HIPAA and these parallel statutes.

Permitted Uses and Disclosures in the Workplace

Under HIPAA, covered entities may disclose PHI for treatment, payment, and health care operations without individual authorization. In employment contexts, this means a plan can share claims information with an employer as the plan sponsor for purposes like premium billing or plan administration. Other disclosures require written permission from the individual or must fit a specific regulatory exception.

Common workplace scenarios that trigger authorization requirements include releasing medical records to a manager, sharing test results with a supervisor, or using an employee's health condition in a return-to-work decision. The minimum necessary standard applies: disclose only what is needed for the specific purpose.

Administrative Requirements for Employers

Employers acting as covered entities should designate a privacy official, provide workforce training, and maintain policies for record access, amendment, and accounting of disclosures. A notice of privacy practices must be distributed and posted where individuals can see it. Business associate agreements are required for any vendor that creates, receives, maintains, or transmits PHI on the employer's behalf.

Technical safeguards—such as access controls, audit logs, and encryption—help protect electronic PHI. Physical safeguards should limit who can enter areas where records are stored, and administrative safeguards should define role-based permissions so employees see only the data their job requires.

State Laws That Layer On Top of HIPAA

Many states impose stricter rules on employer handling of medical information. California's Confidentiality of Medical Information Act, for instance, applies broadly to any entity that receives medical data and carries its own consent and disclosure requirements. Texas, Washington, and New York each have their own frameworks that can be more protective than HIPAA. Employers with a multi-state workforce must compare federal baseline requirements against state mandates and apply the stricter standard.

Common Pitfalls and Practical Steps

Frequent missteps include treating all employee files as if they were HIPAA-protected, which can lead to over-redaction and operational friction, or assuming HIPAA does not apply at all and leaving PHI exposed. Employers should run a data mapping exercise to identify where PHI enters their systems, classify it, and set retention and disposal rules.

• Determine whether the employer is a covered entity or merely handles PHI incidentally.
• Draft a privacy policy that covers both HIPAA and parallel state law obligations.
• Train managers on the difference between job-related information and medical information.
• Use business associate agreements with any vendor handling workforce health data.
• Audit access logs periodically and respond promptly to access requests and complaints.

Because the exact obligations depend on the employer's plan structure and state jurisdiction, organizations should consult qualified legal counsel when designing their privacy and security programs.