With the recent spread of coronavirus (2019-nCoV), it is an important time to examine what information employers may share under HIPAA’s Privacy Rule during an outbreak of infectious disease or other emergency situation.
First, note that HIPAA applies only to “covered entities” and “business associates.” Specifically, the HIPAA Privacy Rule applies only to disclosures made by employees, volunteers, and other members of a covered entity’s or business associate’s workforce. Generally, covered entities are health plans, health care clearinghouses, and certain health care providers, while business associates perform specific services for covered entities that provide access to personal health information (“PHI”)—i.e., individually identifiable health information that is maintained or transmitted by a covered entity.
Secondly, note that HIPAA applies only to PHI. When a covered entity creates or receives “health information” that identifies a specific individual, it is PHI. Health information refers to information that relates to an individual’s medical condition, the provision of medical care for that individual, or the payment for that individual’s medical care. The term is broad enough to pick up health coverage option (e.g., HMO or indemnity) or category (e.g., single/family), enrollment, and premium payment information, as well as information relating to health condition and treatment.
To the extent an employer is not a covered entity, it is typically not subject to HIPAA’s privacy rule, but an employer may unintentionally fall under HIPAA if it sponsors a group health plan from which it receives PHI. That is why there is an important exception from the definition of PHI for individually identifiable health information in employment records held by a covered entity in its role as employer. Such information includes records needed for the employer to carry out its obligations under the FMLA, ADA, and similar laws, as well as files or records related to occupational injury, disability insurance eligibility, sick-leave requests, drug screenings, workplace medical surveillance, and fitness-for-duty tests of employees.
The ultimate result is that most employers will not fall under HIPAA. But be aware that there may be other state or federal rules that apply.
Fortunately, in an outbreak of an infectious disease such as coronavirus, HIPAA-covered employers will have the same freedom as HIPAA-excluded employers to share employee information with anyone as necessary to prevent or lessen a serious and imminent threat to the health and safety of a person or the public–consistent with applicable law. Thus, an employer may disclose an employee’s health information to anyone in a position to prevent or lessen the serious and imminent threat, including family, friends, co-workers, caregivers, and law enforcement, without an employee’s permission.
As to what determines the nature and severity of a threat to health and safety, HIPAA expressly defers to the professional judgment of health professionals.
If you have any questions about this or other HIPAA-related issues, please contact the author of this Alert, Tiffany Downs, tdowns@fordharrison.com, partner in our Atlanta office and head of our Employee Benefits practice group. Of course, you may also contact the FordHarrison attorney with whom you usually work.