HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that establishes national standards for the protection of sensitive patient health information. In the employment context, HIPAA's Privacy Rule restricts how employers can use and disclose employees' protected health information (PHI).

HIPAA applies to "covered entities" — health plans, healthcare clearinghouses, and healthcare providers — and their business associates. Employers who sponsor self-insured health plans are covered entities for purposes of the plan. Employers who offer fully insured plans have more limited HIPAA obligations.

Key employer HIPAA obligations include: maintaining the confidentiality of employee medical information, keeping medical records separate from personnel files, and limiting access to medical information to those with a legitimate need to know.