In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a comprehensive health reform act which, for the first time, creates a national standard which gives individuals more control over their personal health information. Among other things, HIPAA regulations facilitate the electronic transmission of patient health, administrative and financial data. HIPAA also was enacted to enable individuals to find out how their medical information may be used. Furthermore, HIPAA establishes security standards designed to protect against the indiscriminate disclosure of an individual’s personal health information.
The basic principle of HIPAA is fairly straightforward: organizations that possess personal information related to an individual’s health care (or payment for health care) cannot disclose it, except in the following limited circumstances: (1) to the individual, pursuant to a signed, dated general consent form, in order to carry out treatment, payment or health care operations; (2) if not for treatment, payment or health care operations, then pursuant to a signed, dated and narrowly crafted authorization; or (3) to the government for purposes of public health, abuse/neglect investigation, fraud prevention, etc.
Without a doubt, one of the most important aspects of HIPAA is the protection of personal health information (PHI). PHI is defined as any information, in any form, created or received by a provider, health plan, insurer or employer, that relates to past, present or future health care or payments. Any such information, which can be personally identified by a person’s name, social security number, employee number or other identifier, is considered PHI and falls under the domain of HIPAA.
Generally, HIPAA regulations apply only to “covered entities”. These include group health plans, health care providers and health care clearinghouses. Specifically not covered under HIPAA regulations are employers. However, this does not mean that an employer should simply disregard HIPAA as there are many instances were an employer will fall within the regulations. For example, an employer, as plan sponsor of a group health plan, must take measures to ensure that the group health plan complies with HIPAA. An employer must also agree to comply with the rules if it helps administer a health plan and ensure that its health plans comply with the rules.
There are also many situations when an employer may receive PHI from a covered entity. Such disclosures are regulated by HIPAA. An employer may receive PHI from a covered entity only for any purpose consistent with an individual’s signed written authorization or to advocate for an employee who has a benefit dispute or other claim with a health plan. Additionally, an employer may receive PHI in order to enroll an employee in a health plan, or to amend or terminate such enrollment in a plan. An employer may also receive and use PHI to perform health plan administrative functions, but only pursuant to the restrictions in the HIPAA compliance plan governing the covered entity.
On the other hand, there are situations where the employer may request PHI from an employee outside of the domain of HIPAA. Nothing in the HIPAA regulations prohibits employers from conditioning employment on an individual signing the appropriate consent or authorization so that an employer may seek certain PHI. This may include drug test results, fitness-to-work assessments or other tests permitted by state or federal laws. Furthermore, employers may have to request PHI to carry out their obligations under the Family and Medical Leave Act (FMLA) or the Americans with Disabilities Act (ADA). For example, return-to-work exams, fitness for duty assessments, or FMLA leave reviews which contain PHI. These employment functions are not HIPAA-covered activities.
The Health and Insurance Portability Act places many restrictions on the disclosure and use of an individual’s health and medical information. Such restrictions are meant to further the Act’s goal of keeping “private information private”. But the restrictions were not created to entirely eliminate the disclosure of PHI. There remain various situations were such health and medical information can be disclosed and many of these situations fall within the employer/employee relationship.
