Are Employee Health Records Held by an Employer Protected by HIPAA?

Generally, not as employment records. HIPAA's definition of protected health information excludes employment records held by a covered entity in its role as employer, and in most cases the Privacy Rule does not apply to the actions of an employer. Patient-care and group health plan records about employees can remain PHI. Other federal or state laws may still protect health information in employment records, such as drug test results.

Definition. 45 CFR 160.103 excludes from PHI "employment records held by a covered entity in its role as employer." HHS guidance explains that the Privacy Rule does not protect employment records, even if the information in them is health related.

Employers are not covered entities as employers. HIPAA applies to health plans, health care clearinghouses, and certain health care providers. An employer generally is not a covered entity when acting as an employer, though it may sponsor a group health plan that is one. A hospital that employs staff is a covered entity for patient information but holds its personnel files as an employer.

Other roles. Medical records held by a covered provider in its patient-care role, and group health plan records, can remain PHI even when the patient or member is also an employee.

Getting the information. When an employer asks a health care provider for an employee's health information, HHS guidance explains that the provider generally needs the employee's authorization to disclose it, with limited exceptions. 164.512(b)(1)(v) covers specified workplace medical surveillance or work-related injury evaluations needed for compliance with occupational safety and health law, with written notice to the employee. 164.512(l) permits workers' compensation disclosures only as authorized by and to the extent necessary to comply with the relevant law.

Other laws. Other legal regimes, with their own scopes, may require confidentiality of employee medical information. EEOC rules under the Americans with Disabilities Act treat covered medical information as a separate confidential record (29 CFR 1630.14(b)(1), (c)(1)); the ADA's use of "covered entity" differs from HIPAA's. For DOT-regulated testing, 49 CFR 40.321 restricts release of test information to third parties without specific written consent, subject to Subpart P exceptions. The FAQ on whether HIPAA applies to drug test results covers that topic.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."