Does HIPAA apply to employers?
When HIPAA applies to employers and when it doesn't — doctor's notes, HR records, the company health plan, and what your doctor can tell your employer.
Does HIPAA apply to employers? at a glance
Usually no. HIPAA doesn't apply to an employer acting as an employer, so an employer may ask for a doctor's note, vaccination status or fitness-for-duty information — HIPAA doesn't stop the question, though other laws such as the ADA, FMLA and state laws limit what employers may ask and how they store it. HIPAA does apply to the employer's group health plan, and it stops your doctor from giving your employer your health information without your written authorization, except in narrow cases.
| Employer as employer | Not a HIPAA covered entity; employment records are excluded from PHI |
|---|---|
| Employer's group health plan | Usually a covered entity — see employer group health plans |
| Your doctor | Needs your authorization to share your information with your employer, with narrow exceptions |
| Other laws that apply | ADA, FMLA, GINA, OSHA rules and state laws |
HIPAA applies to health plans, health care clearinghouses, health care providers that conduct standard electronic transactions, and their business associates. An employer is none of these just because it employs people. The definition of protected health information also expressly excludes employment records held by a covered entity in its role as employer (45 CFR 160.103) — so even a hospital’s HR file on its own nurse is not PHI.
What HIPAA does and doesn’t control
| Situation | HIPAA? |
|---|---|
| Your manager asks for a doctor’s note for sick leave | No — HIPAA doesn’t regulate the request; other laws may |
| HR keeps your note in your personnel file | No — employment records are not PHI |
| Your employer asks your doctor directly | Yes — your doctor needs your authorization, with narrow exceptions |
| Your employer’s self-insured health plan handles your claims | Yes — the plan is a covered entity |
| A wellness program offered through the group health plan | Yes, for that plan’s information |
| A wellness program the employer runs directly, outside the plan | Generally no |
HHS notes that HIPAA doesn’t prevent an employer from asking for health information it needs for sick leave, workers’ compensation, wellness programs or health insurance. Laws such as the ADA, FMLA and GINA, plus state laws, decide what employers may ask and how they must protect the answers.
For the health plan side — what HR may see as plan sponsor — see HIPAA for employer group health plans.
Next steps
- HIPAA for employer group health plans →Scenario
- Covered entity →Requirement
- PHI and ePHI →Requirement
- HIPAA authorization →Requirement
Frequently asked questions
Can my employer ask about my medical condition?
HIPAA doesn't prohibit the question, because it doesn't regulate employers in their role as employers. Laws such as the ADA and state laws limit what employers can ask and require them to keep medical information confidential.
Can my employer call my doctor?
They can call, but your doctor generally may not disclose your information to your employer without your written HIPAA authorization.
Is my sick note protected by HIPAA once HR has it?
No. Health information in employment records held by an employer in its role as employer is not PHI. Other confidentiality laws may still apply.