HIPAA for the plan sponsor: employer records versus plan information.
HIPAA treats the employer and its group health plan differently. What the employer keeps in its own employment files sits outside the Privacy Rule, while what the plan holds does not. Here is where the line falls and what the plan documents have to say.
Where the line falls.
Employment Records Are Outside The Rule
HHS says employment records are not protected by the Privacy Rule, even when they contain health-related information. Other laws, such as disability, medical leave and state privacy rules, may still limit how an employer collects and shares that information. Keep these records separate from general personnel files and ask counsel what rules apply.
The Rule Governs The Plan
The Privacy Rule controls how a health plan shares protected health information with an employer. It generally does not regulate the employer’s own actions. This is why an employer that handles claims or enrollment data in its role as plan sponsor should keep that work separate from ordinary employment decisions. Counsel can explain what safeguards are expected for your situation.
Employers May Ask For Documentation
An employer may ask an employee for medical documentation, such as a doctor’s note, when it is needed for sick leave, workers’ compensation, a wellness program or health insurance. Requests should be limited to what is needed for the stated purpose, and the information should be kept confidential and stored apart from other files. Counsel can confirm how other laws apply to specific requests.
Fully Insured Plans Have Lighter Duties
A fully insured group plan that creates or receives only summary health information and enrollment or disenrollment information does not need a notice of privacy practices and is generally exempt from most administrative requirements. Even with lighter duties, employers should avoid asking carriers or administrators for individual health details, and should limit who handles any enrollment data. Counsel can confirm whether your plan fits this description.
Four steps for the plan sponsor.
Decide What The Plan Receives
Settle whether the plan gets only summary and enrollment information or also claims-level detail. The answer drives which duties apply. Make that decision on purpose and write it down, rather than letting it happen by default through vendor reports or email. Review it whenever the carrier, administrator or reporting changes, and keep counsel informed.
Amend The Plan Documents Before Sharing
If the plan will share protected health information with the sponsor for plan administration, the plan documents have to be amended to allow it first. Employers should work with counsel to review and amend the documents, and to confirm the sponsor’s own safeguards are in place before any protected information is received. Do not rely on a verbal promise from a vendor.
Cover Security Incidents In The Documents
HHS says the plan documents must require the sponsor to report any security incident it becomes aware of, and should set how often, in what detail and in what format. Employers should ask counsel to review the language and then set up an internal contact for reporting incidents. A clear procedure, written before anything happens, is far easier to follow than one invented during a stressful event.
Do Not Retaliate Or Ask For Waivers
Even a lightly regulated plan cannot intimidate or retaliate against individuals or require them to waive their privacy rights. Managers and HR staff should understand that complaints about privacy must be handled respectfully, and that employees cannot be asked to give up their rights as a condition of coverage or employment. Counsel can advise on policy language.
Three questions to answer for your plan.
What Does Our Plan Actually Receive
If it is more than summary health information and enrollment data, more of the Privacy Rule applies. Ask the carrier and any administrator to describe in writing exactly which reports and files reach the employer, and who sees them. Compare their answer with what actually arrives, and revisit it when the plan or vendor changes.
Do The Plan Documents Say What They Need To
Check for the sharing language and the incident reporting requirement. Ask counsel to read the documents against current requirements, note any gaps and schedule the fixes. Keep the most recent signed version where HR can find it, and review it again each plan year or when the arrangement changes.
Who At The Company Can See Claims Detail
Keep that group small and defined, and keep the plan’s information apart from the employment file. Write down the names or roles, limit system access to match and remind them of the confidentiality rules. If someone changes jobs or leaves, remove the access promptly and ask counsel how to handle any records they held.
Common Questions About HIPAA And The Plan Sponsor
Is health information in our HR files covered by HIPAA?
Employment records are not protected by the Privacy Rule, even if they contain health-related information. Other laws may still apply, and HHS points employers to the Department of Labor and the EEOC for workplace questions.
Can we ask an employee for a doctor’s note?
Yes. Employers may ask for medical documentation when it is needed for sick leave, workers’ compensation, wellness programs or health insurance. The Privacy Rule mainly governs what a provider may disclose.
Does our fully insured plan need a notice of privacy practices?
Not if it creates or receives only summary health information and enrollment or disenrollment information. If the plan receives more, ask us what applies.
Can the plan share protected information with us?
Only as the rules allow. For plan administration functions, the plan documents generally have to be amended first, and the information shared is limited to what is needed.
What do the plan documents say about security incidents?
HHS says they must require the plan sponsor to report any security incident of which it becomes aware, and the plan can specify the frequency, level of detail and format.
Is this legal advice?
No. For a question specific to your company, involve your counsel. We can help you work out what the plan receives and frame the question.
Where the Rules Come From.
The laws and rules named on this page link to the statute or regulation they come from. This is general information, not legal or tax advice, and rules change, so check the current text.
HIPAA Privacy Rule (45 CFR Part 164)
Federal privacy and security standards for protected health information held by health plans.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.