Understanding Hipaa: Employer Rights And Responsibilities

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects sensitive patient information within the healthcare industry. It applies to employers in certain circumstances, such as when they are handling protected health information or acting as intermediaries between employees, healthcare providers, and health plans. While HIPAA does not restrict patients from voluntarily sharing their health information, it prohibits covered entities, including healthcare providers and health plans, from disclosing protected information without patient consent. Understanding HIPAA compliance is crucial for employers to safeguard privacy and avoid violations.

Does HIPAA apply to employers in medical teaching institutions?

HIPAA, or the Health Insurance Portability and Accountability Act of 1996, is a federal law that protects sensitive patient information within the healthcare industry. It applies to employers in certain circumstances.

HIPAA can apply to employers in medical teaching institutions depending on the nature of the medical services provided by the institution. If medical services are only available to employees and students, the institution is not a HIPAA covered entity because the provision of medical services to employees is not portable and the provision of medical services to students is covered by FERPA.

If medical services are available to the public, the institution is a hybrid entity required to comply with HIPAA for the medical services provided to members of the public. However, HIPAA does not apply to non-portable medical services provided to employees or for FERPA-covered medical services provided to students.

Does HIPAA apply to self-insured health plans?

HIPAA compliance for self-insured health plans is a complicated area of HIPAA legislation. Self-insured health plans, or self-administered health group plans, are subject to the Administrative Simplification Rule of the Health Insurance Portability and Accountability Act (HIPAA). This rule imposes requirements on "Covered Entities" to comply with national standards for the privacy of individually identifiable health information and the security of electronic Protected Health Information (PHI) at transit and rest.

HIPAA treats the health plan itself as a separate entity that must follow its rules. However, the employers who sponsor the plans are responsible for ensuring their health plans comply with HIPAA. Sponsors of insured plans with limited access to PHI will have fewer compliance obligations, as the insurer will assume most responsibilities. In contrast, sponsors of self-insured plans will have more compliance obligations.

Exemptions from HIPAA compliance for self-insured companies are rare. Only if a group health plan is self-insured, self-administered, and the employer has fewer than fifty employees is the company exempt from HIPAA compliance, provided that medical expense reimbursement flexible spending account plans (medical FSAs) and health reimbursement account plans (HRAs) are also administered by the employer and not a third-party administrator.

Partial compliance applies when neither the sponsor of a group health plan nor its insurance agent accesses or transmits PHI electronically. These "hands-off" group health plans occur in specific circumstances, and most self-insured group health plans will be subject to HIPAA compliance.

To comply with HIPAA, self-insured group health plans must appoint a Privacy and Security Officer, analyse uses and disclosures of PHI, develop HIPAA-compliant privacy and security policies, and create a breach notification policy. Employee training is also essential to ensure compliance.

Can employers ask about medical conditions?

In the US, the Americans with Disabilities Act (ADA) prohibits employers from asking questions that could force employees to disclose disabilities. However, there are certain situations in which an employer can ask about an employee's medical condition.

Firstly, if an employee has already disclosed that they have a medical condition and is seeking a job accommodation under the ADA, or is requesting medical leave, employers are allowed to ask for documentation to verify the existence or severity of the health issue.

Secondly, if an employer suspects that an employee is suffering from a condition that might impact their ability to perform their job or make them a safety risk, they can ask for medical documentation. For example, if an employee has been avoiding climbing ladders, an employer may be able to justify asking for a medical exam.

Thirdly, once a person is hired, an employer can ask medical questions or require an exam if they need documentation to support an employee's request for accommodation.

It's important to note that HIPAA (the Health Insurance Portability and Accountability Act of 1996) does not prevent an employer from asking about an employee's medical condition, as employers are not considered "covered entities" under HIPAA. However, if an employer asks a covered entity (such as a healthcare provider) to disclose information about an employee's medical condition, HIPAA only permits this under certain circumstances or with the consent of the employee.

In general, employers should avoid asking questions that may require employees to reveal sensitive information when it is not necessary to help them perform their job.

Does HIPAA apply to workers' compensation cases?

HIPAA, or the Health Insurance Portability and Accountability Act, is a federal law that protects sensitive patient information within the healthcare industry. It applies to "covered entities," including healthcare providers, health plans, and healthcare clearinghouses, and their business associates who handle PHI (protected health information) on their behalf.

While HIPAA generally does not apply to employers, there are certain circumstances in which it may apply. For example, if an employer administers a self-insured health plan or acts as an intermediary between employees, healthcare providers, and health plans, they are subject to "partial compliance." In these cases, the employer must certify that PHI will be safeguarded as prescribed by the HIPAA Privacy Rule and not used for employment-related actions.

Now, let's address the specific question of whether HIPAA applies to workers' compensation cases. The short answer is no. HIPAA specifically exempts workers' compensation from its regulations, allowing for the necessary exchange of medical information between employers, insurers, and healthcare providers in these situations.

The HIPAA Privacy Rule permits covered entities to disclose PHI without individual authorization to workers' compensation insurers, state administrators, employers, and other entities involved in workers' compensation systems. This disclosure is allowed in the following instances:

• When required by workers' compensation laws or similar programs that provide benefits for work-related injuries.
• When disclosure is required by state or other laws.
• To obtain payment for the healthcare of the injured or ill worker.

However, it is important to note that employers and healthcare providers must make reasonable efforts to limit the sharing of medical information to what is essential for the workers' compensation case, adhering to HIPAA's "minimum necessary" requirement.

What is the HIPAA Privacy Rule?

The HIPAA Privacy Rule is a federal standard that safeguards the privacy of personal health information. It gives patients control over their health information and other identifying information by limiting the use and disclosure of such information by "covered entities" and "business associates" without authorization.

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established national standards for the security and privacy of protected health information (PHI). The HIPAA Privacy Rule and the HIPAA Security Rule were issued to ensure that PHI remains protected and secure while enabling the flow of health information.

The HIPAA Privacy Rule protects "individually identifiable health information", which includes information relating to an individual's past, present, or future physical or mental health condition, the provision of health care to the individual, or the payment for the provision of health care to the individual. The rule also gives patients the right to obtain copies of their health records and to request corrections.

Covered entities under the HIPAA Privacy Rule include all health plans, healthcare clearinghouses, and healthcare providers, along with their business associates. These covered entities are subject to compliance and may face penalties for non-compliance.

The HIPAA Privacy Rule is one of the most complicated pieces of legislation affecting the healthcare and health insurance industries. Its objective is to standardize how individually identifiable personal information is protected across various use cases, and its language is "non-specific", leading to multiple interpretations.

To ensure compliance with the HIPAA Privacy Rule, covered entities and business associates must formulate and enforce privacy policies and procedures in line with the rule. They must also appoint a privacy official to oversee the development and implementation of these policies and conduct regular training sessions for their workforce.

Frequently asked questions