What Every U.S. Employer Should Know About Workplace Privacy

Through the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Congress called on the U.S. Department of Health and Human Services (HHS) to promulgate regulations that would help ensure the privacy and security of health information. The Standards for Privacy of Individually Identifiable Health Information (the Privacy Rule) and the Security Standards (the Security Rule) promulgated pursuant to HIPAA apply to 'covered entities' and limit the ability of such entities to use or disclose protected health information (PHI). The Privacy Rule defines a 'covered entity' as a health plan, health care clearinghouse, or health care provider who transmits health information in electronic form in connection with certain specified transactions. While the Privacy Rule and the Security Rule do not directly apply to employers, the requirements of these rules do apply to ERISA-covered 'group health plans' that are sponsored by many employers.