Disability Discussions: Hipaa Law's Scope

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. It affects a wide range of healthcare issues, including insurance access, administrative costs, fraud, and the protection of private health information. HIPAA's Privacy Rule restricts the disclosure of protected health information by healthcare providers without patient consent, including to employers. The two primary disability nondiscrimination laws are the Americans with Disabilities Act (ADA) and the Rehabilitation Act of 1973, which protect the confidentiality of certain medical information. This raises the question of whether discussing a disability falls under HIPAA law, and how this interacts with ADA and other regulations.

HIPAA and the Social Security Disability Programs

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law that governs health information privacy and security. It affects a wide range of healthcare issues, including the Social Security Disability Programs. The primary goal of HIPAA is to improve access to health insurance, reduce administrative costs, curb fraud and abuse, and protect the privacy of health information.

Covered entities under HIPAA include all health plans, health care clearinghouses, and healthcare providers who conduct certain financial and administrative transactions electronically. These entities have specific obligations under the HIPAA Privacy Rule, such as notifying individuals of their privacy practices, obtaining consent before using or disclosing PHI for purposes other than treatment, and providing individuals with a notice of their rights. Additionally, covered entities must release information only as permitted by the Privacy Rule, often requiring an authorization form filled out by the individual.

To qualify for disability benefits through SSDI, individuals must meet the SSA's definition of disability and have sufficient work history. The SSA has a rigorous signature process for its authorization forms, ensuring the verification of the claimant's identity and providing a clear understanding of the disability claims process. This process complies with the requirements of the HIPAA Privacy Rule, which mandates that valid authorization forms include a signature.

HIPAA and the Americans with Disabilities Act (ADA)

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. It was created to modernize the flow of healthcare information, protect personally identifiable information (PII) from fraud and theft, and address limitations on healthcare insurance coverage. The entities that must abide by HIPAA are known as "covered entities," which include health plans, health insurance companies, most healthcare providers, and government programs like Medicare and Medicaid.

The Americans with Disabilities Act (ADA) is a federal disability nondiscrimination law that protects the confidentiality of certain medical information. The ADA's employment nondiscrimination standards apply to employers of 15 or more employees, employment agencies, labor organizations, and joint labor-management committees. The ADA's confidentiality restrictions apply to all disability-related medical information obtained by employers through employment-related examinations or inquiries, including medical exams for new hires or after an absence due to illness or injury.

HIPAA and the ADA both aim to protect individuals' privacy and prevent discrimination, but they have distinct purposes and apply to different entities. HIPAA primarily focuses on protecting the privacy and security of health information, while the ADA specifically addresses disability-related discrimination and confidentiality.

HIPAA's covered entities include health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with specific transactions. Employers are generally not considered covered entities under HIPAA's privacy regulations, but they may still have obligations when performing administrative functions for their health plans.

In the context of employment, the interaction between HIPAA and the ADA becomes relevant. While HIPAA's privacy rules generally do not apply to employers' actions, they do govern the disclosures made by healthcare providers. An employer cannot obtain an employee's health information directly from the healthcare provider without the employee's authorization, as required by HIPAA. However, once the employer receives the information, they are not bound by HIPAA's privacy rules for that specific information.

On the other hand, the ADA imposes confidentiality obligations on employers regarding employee and applicant medical information. Employers must treat such information as confidential, including medical information from voluntary health programs or any disclosures made by employees. The ADA's confidentiality restrictions also apply when employers transmit health information to a covered entity, such as a group health plan.

HIPAA and Consent to Obtain Medical Information for ADA Purposes

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. HIPAA's major intent is to provide better access to health insurance, reduce administrative costs, limit fraud and abuse, and protect the privacy of health information. The Privacy Rule, as revised in 2013, regulates most health care providers, health care clearinghouses, and health plans, and their formal business associates.

The Americans with Disabilities Act (ADA) is a federal disability non-discrimination law that protects the confidentiality of certain medical information. The ADA requires employers to maintain the confidentiality of employee medical information obtained from a medical inquiry or examination, including medical information from voluntary health or wellness programs.

If an employer needs to contact a healthcare provider directly for information, they must confirm that the employee has signed a HIPAA authorization form or a document that evidences express consent for the healthcare provider to disclose the individual's private medical information. This could be an "authorization to release medical information" document. The employer-drafted authorization must be HIPAA-compliant and include the following:

• The purpose for the request, for example, to support a request for reasonable accommodation under the ADA
• The party to whom express consent is given to receive the information
• Authorization for verbal/electronic/fax communication about the employee's medical history and care
• The date or event on which the authorization will expire
• A statement regarding the employee's right to revoke consent at any time

The ADA does not prohibit employer representatives from directly contacting healthcare providers when medical information is needed in support of a request for accommodation, as long as the request is job-related and consistent with business necessity. However, healthcare providers cannot share patients' protected health information with employers without first having formal authorization to do so.

HIPAA gives individuals the right to access their medical and other health records from their health care providers and health plans, upon request. This right is also extended to a personal representative of the individual.

HIPAA's Privacy Rule

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that governs health information privacy and security. The major intent of HIPAA is to provide better access to health insurance, reduce administrative costs, limit fraud and abuse, and protect the privacy of health information. The Department of Health and Human Services (HHS) adopted uniform standards for the privacy of individually identifiable health information, known as the Privacy Rule.

The Privacy Rule, as revised in 2013, regulates most health care providers, health care clearinghouses, and health plans, and their formal business associates. The Privacy Rule standards address the use and disclosure of individuals' health information, called “protected health information" by organizations subject to the rule, known as "covered entities". These covered entities include health plans, health care clearinghouses, and healthcare providers that conduct electronic transactions. Additionally, business associates are required to comply with the HIPAA Security Rule and the HIPAA Breach Notification Rule.

The Privacy Rule gives individuals the right to control how their health information is used and disclosed, request copies of their information, and request corrections when errors or omissions exist. All patients and plan members must be given a HIPAA Notice of Privacy Practices, which explains what Protected Health Information may be disclosed, to whom, and why. It also explains an individual's right to access, amend, or transfer their Protected Health Information.

In the context of disabilities, federal laws barring discrimination on the basis of disability, such as the Americans with Disabilities Act (ADA) and the Rehabilitation Act of 1973, protect the confidentiality of certain medical information. These laws intersect with the HIPAA Privacy Rule, as they cover entities that receive federal financial assistance. For example, an employer-sponsored group health plan may be subject to ADA confidentiality restrictions and the Privacy Rule.

HIPAA and Employment

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that governs health information privacy and security. It applies to "covered entities", which include health plans, healthcare clearinghouses, and healthcare providers that electronically transmit certain health information.

While HIPAA does not apply to employee health information maintained by an employer, it is important to note that employers are still subject to other legal obligations to protect the confidentiality of employee health information. For example, the Americans with Disabilities Act (ADA) requires employers to maintain disability-related medical information separately from personnel files and only disclose it in limited situations. Similarly, the Genetic Information Nondiscrimination Act (GINA) mandates that employers treat genetic information as confidential medical records.

HIPAA applies to employers in certain circumstances, such as when they provide onsite clinics as an employee health benefit or act as an intermediary between employees and healthcare providers. The Privacy Rule, a component of HIPAA, regulates how a health plan or covered healthcare provider shares protected health information with an employer. It is important to distinguish that the Privacy Rule does not protect employment records, even if they contain health-related information. However, it does safeguard medical and health plan records if the individual is a patient or member of the health plan.

In the context of discussing a disability, the ADA and the Rehabilitation Act of 1973 are the primary disability nondiscrimination laws. These laws protect the confidentiality of certain medical information related to disabilities. While employers are not considered covered entities under the privacy regulation, they may still be subject to restrictions if they receive federal financial assistance.

Frequently asked questions