Employers need to be aware of several key considerations regarding the Health Insurance Portability and Accountability Act (HIPAA) when dealing with health information in the workplace. While employers themselves are not typically considered covered entities under HIPAA, since they are not a public agency and have a grant of authority to administer health care benefits through an employer benefit plan, they do have responsibilities related to employee health information and individual authorization that may be tied to employment records.
Many employers offer wellness programs that collect health information from employees, such as biometric data, to provide incentives, rewards, or other benefit activities. These programs must comply with HIPAA’s wellness program rules to ensure that employees’ health information is protected and that participation in an employer benefit plan is voluntary.
Employers should provide clear and comprehensive privacy policies and notices to employees explaining how their health information will be used, disclosed, and protected and if a public agency may have the information shared. These policies should outline the purposes for collecting health information and describe individuals’ rights related to their health information.
Information that should be protected includes legal services, electronic transactions, if an employee makes an administrative request, legal advice, and covered health care providers. Because benefits are usually covered by employers, they may have access to information if an employee makes an administrative request like taking leave, or if they need help finding covered health care providers or connecting with specific health care professionals. Guidance on how to navigate difficult subjects can be found by consulting with HHS.