Health Privacy and OSHA Whistleblower Complaints

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public 

Law 104-191, requires “covered entities” to protect the privacy of individuals’ 

health information.

Protected Health Information 

The HIPAA privacy regulation provides that 

individually identifiable information about a 

person’s physical or mental health or health 

care (in any written or oral form) — including 

computer records — is protected from 

unauthorized disclosure.

Keeping Health Information Private

The privacy regulation requires “covered 

entities” (which, for the purposes of this fact 

sheet, means health care providers who transmit 

any health information in electronic form in 

connection with carrying out health care-related 

financial or administrative activities) to establish 

policies and procedures addressing the use 

and disclosure of protected health information. 

“Disclosure” means revealing information 

to someone outside the entity holding the 

information. Thus, HIPAA does not ban an 

employee of a covered entity from revealing 

information to his or her supervisor or to another 

management official.

When Health Information Can 

Be Disclosed

Under normal circumstances, an individual 

must give written consent to disclose his or 

her health information. However, a covered 

entity’s employees or business associates 

may disclose protected health information to a 

public health authority (such as federal OSHA 

or a state agency operating under a federal 

OSHA-approved state plan, both of which 

are hereinafter referred to as “OSHA”) that is 

authorized to investigate a covered entity’s 

conduct, to an attorney retained to deal with a 

case involving such conduct, or to a health care 

accrediting organization. These disclosures are 

permitted as long as the employee believes in 

good faith that the conditions he is reporting 

are unlawful or endanger employees, among 

other things. Employees who are crime victims 

may also disclose protected health information 

to a law enforcement official if the information 

is about the suspected perpetrator and the 

information is limited to that listed in the privacy 

regulation at 45 CFR § 164.512(f)(2)(i). Also, an 

employee may report a serious and imminent 

threat to the health and safety of a person if 

the recipient of the report is reasonably able to 

prevent or diminish the threat. Such recipients 

include law enforcement officials, OSHA, and 

union officials.

Employees are protected from retaliation for 

making disclosures authorized by HIPAA in 

connection with an occupational safety or 

health complaint. They may file whistleblower 

complaints with OSHA under Section 11(c) of 

the Occupational Safety and Health Act (OSH 

Act). The whistleblower complaint must be filed 

within 30 days of the retaliation.

OSHA’s Role

OSHA is charged with regulating health and 

safety in the workplace, and is considered both 

a public health authority and a health oversight 

agency under HIPAA. The agency sometimes has 

to use and disclose protected health information 

to conduct investigations, litigate cases, and 

engage in other activities. Although OSHA is 

not a “covered entity” under HIPAA and is not 

bound by the use and disclosure requirements 

included in the privacy regulation, it complies 

with applicable laws and regulations protecting 

privacy, such as the Privacy Act, 5 U.S.C. § 552a.

How to File a Complaint

An employee can file a complaint with OSHA by 

visiting or calling his or her local OSHA office, 

sending a written complaint to the closest OSHA 

office, or filing a complaint online. No particular 

FactSheet
DWPP FS-3947 05/2018

This is one in a series of informational fact sheets highlighting OSHA programs, policies or 

standards. It does not impose any new compliance requirements. For a comprehensive list of 

compliance requirements of OSHA standards or regulations, refer to Title 29 of the Code of Federal 

Regulations. This information will be made available to sensory-impaired individuals upon request. 

The voice phone is (202) 693-1999; teletypewriter (TTY) number: (877) 889-5627.

form is required and complaints may be 

submitted in any language. Written complaints 

may be filed by fax, electronic communication, 

hand delivery during business hours, U.S. mail 

(confirmation services recommended), or other 

third-party commercial carrier. 

The date of the postmark, fax, electronic 

communication, telephone call, hand delivery, 

delivery to a third-party commercial carrier, or 

in-person filing at an OSHA office is considered 

the date filed. 

To file a complaint electronically, please visit 

www.osha.gov/whistleblower/WBComplaint.html. 

To contact an OSHA area office, please call 

1-800-321-OSHA (6742) to be connected to

the closest area office. Or visit our website at

www.osha.gov/html/RAmap.html and click on

your state to find your local OSHA office address

and contact information.

When OSHA receives a complaint, the agency 

will first review it to determine whether certain 

basic requirements are met, such as whether the 

complaint was filed on time. If so, the complaint 

will then be investigated according to the 

procedures required by 29 CFR Part 1977.

Results of the Investigation

If the evidence supports an employee’s 

complaint of retaliation, OSHA will issue an 

order requiring the employer to, as appropriate, 

pay lost wages, restore benefits, and other 

possible relief. The exact requirements will 

depend on the facts of the case. If the evidence 

does not support the employee’s complaint, 

OSHA will dismiss the complaint. 

To Get Further Information

For a copy of the OSH Act, 29 U.S.C. § 660, the 

regulations (29 CFR 1977), and other information, 

go to www.whistleblowers.gov.

OSHA’s Whistleblower Protection Programs 

enforces the whistleblower provisions of more 

than 20 federal whistleblower laws. To learn 

more about the whistleblower statutes which 

OSHA enforces, view our “Whistleblower 

Statutes Desk Aid” at www.whistleblowers.gov/

whistleblower_acts-desk_reference.pdf. 

Under the Occupational Safety and Health 

Act of 1970, employers are responsible for 

providing safe and healthful workplaces for 

their employees. OSHA’s role is to ensure these 

conditions for America’s working men and 

women by setting and enforcing standards, and 

providing training, education, and assistance. 

For more information, visit www.osha.gov.