HIPAA does not automatically cover every piece of health information held at work. HHS explains that employment records are outside the Privacy Rule, even when they contain health information. Medical or health-plan records can still be protected when the employee is also a patient or plan member.
This distinction matters to HR, benefits teams, healthcare providers and managers. It prevents two different mistakes: assuming HIPAA permits no workplace health questions, or assuming an employer’s access to one record permits access to every record about the same person. Other privacy, employment and confidentiality obligations may still apply.
Classify the record and the function
Start with the purpose for which the information is held. A sick-leave document in an employment file, a clinical record maintained for treatment and a health-plan claim are not interchangeable simply because they relate to the same employee. Identify who received the information, in what capacity and for what authorised purpose.
Build a short map for recurring workflows: sickness absence, benefits administration, occupational-health referrals, workplace adjustments and wellness activities. Record the source, recipient, system, access group and retention owner. Where a workflow crosses functions, identify the decision that permits the information to move.
A healthcare organisation should be particularly careful about dual roles. Giving someone HR duties does not automatically justify access to clinical records. The practical boundary needs to be reflected in permissions, procedures and staff decisions, not just described in a privacy policy.
Separate an employer request from a provider disclosure
An employer may ask an employee for health information for a workplace purpose. That does not make every request appropriate under all applicable laws, nor does it mean a covered provider may freely disclose the requested record. The questions of collection by the employer and disclosure by the provider require separate assessment.
HHS explains that direct disclosure by a provider to an employer generally requires the individual’s authorisation unless a relevant legal requirement or permission applies. Avoid a blanket instruction that every employer request must be granted, or that no information can ever be disclosed. Route unusual requests to the appropriate privacy and legal decision makers.
As a practical control, give managers a defined request route and a clear description of the information needed for their decision. If the decision concerns attendance or a workplace restriction, first establish whether the manager needs a diagnosis at all. Keep the resulting record within its authorised purpose and access group.
Keep health-plan administration distinct from employment decisions
A group health plan and its sponsoring employer have different roles. HHS guidance on workplace wellness describes conditions for plan-sponsor access to protected health information for plan administration, including separation from employment functions. Access to administer a benefit should not become a route to using individual health information in unrelated staffing decisions.
Identify which people perform plan-administration tasks and what information they require. Check the relevant plan arrangements before introducing a shared HR platform, analytics report or supplier integration. Confirm whether the proposed recipients act for the plan, the employer or another party.
Hypothetical example: a benefits analyst receives detailed claim information for an authorised plan-administration task. A line manager asks for a list of employees with expensive conditions to inform staffing. The analyst does not treat internal employment as sufficient authority. The request is escalated, and the permitted purpose and information boundary are checked before any disclosure occurs.
Review a wellness programme on its actual structure
A workplace wellness label does not determine HIPAA coverage. HHS distinguishes programmes offered through a group health plan from programmes offered directly by an employer outside the plan. The information flows and applicable obligations differ, and other laws may remain relevant even where HIPAA does not apply.
Before launching a survey or screening programme, establish who operates it, which organisation receives identifiable results and what is reported to the employer. Review the proposed data fields and the necessity of individual-level reporting. Explain the arrangement clearly to participants rather than relying on a broad claim that the programme is HIPAA compliant.
Review supplier changes and new reporting features with the same care. An apparently minor dashboard update may expose information to a wider audience. Keep the approved report specification, access decisions and change record so that the intended boundary can be checked against actual operation.
Translate the boundary into everyday access decisions
Use separate access groups where the functions require separation, and check that shared folders, email distribution lists and exports do not defeat that design. A single database may support several legitimate activities, but the permissions and operating process must preserve the relevant limits.
Hypothetical example: a hospital employee receives care from the hospital’s outpatient clinic. Her manager also supervises clinic staff. That reporting relationship does not establish a treatment or other authorised reason to inspect her clinical record. A review identifies overly broad access, corrects the permission and gives supervisors a route for legitimate employment questions that does not depend on browsing patient records.
Train people on these concrete decisions. The benefits team needs different examples from a clinical receptionist or line manager. Our HIPAA applicability guide can help establish roles, while the access-controls guide explains how to connect authorised duties with access evidence.
Investigate an issue without expanding the disclosure
When someone receives an unexpected health record, limit further circulation and notify the appropriate owner through the established process. Preserve enough information to understand what happened without attaching the full record to every escalation. Determine which function held the information and which obligations govern it.
Do not label every workplace confidentiality issue a HIPAA breach before that assessment. Equally, do not dismiss it because the recipient works for the same organisation. Scope the facts, recipients and permissions, then obtain the relevant privacy, security or employment advice.
Maintain a small set of decision records: the workflow map, authorised access, approved disclosures or reporting arrangements, training and resolved exceptions. Use our HIPAA data-mapping guide for a more detailed information-flow review. Where several functions share systems, a scoped HIPAA assessment can help identify the boundaries that need attention.
Reference basis
- HHS, Employers and Health Information in the Workplace.
- HHS, HIPAA Privacy and Security and Workplace Wellness Programs.
- HHS, Summary of the HIPAA Privacy Rule: protected information and permitted uses and disclosures.
Questions and answers
Does HIPAA cover every employee health record?
No. Employment records are outside the HIPAA Privacy Rule even when health-related. Medical and health-plan records may be protected separately. Identify the role and purpose of the record, and consider other applicable privacy and employment obligations.
Can an employer ask an employee for a doctor's note?
HIPAA generally governs a covered provider's disclosure rather than every question an employer asks. An employer may have a legitimate workplace reason for requesting information, but other laws and the circumstances of the request still need consideration.
Can a manager access an employee's patient record at the same hospital?
Employment or supervisory status alone does not authorise access to a patient record. Access needs a permitted purpose and appropriate authorisation under the organisation's clinical and privacy arrangements.
Are all workplace wellness programmes subject to HIPAA?
No. HHS distinguishes wellness programmes offered through a group health plan from those offered directly by an employer outside the plan. Establish the actual arrangement and information flow rather than deciding from the programme name.
What is a useful first review for an HR team?
Choose one recurring health-information workflow and map its source, purpose, recipients, system and access owner. Check where it crosses employment, clinical or health-plan functions, and resolve unclear permissions before expanding the process.
Clarify the boundary before broadening access
Bring a workplace health-information workflow and the decision it supports. Discuss a focused information-flow review to identify responsibilities, access boundaries and the questions requiring specialist advice.