I know it is bad for a non-medical HR person or supervisor to give out personal or medical information about an associate, but is it actually a violation of the HIPAA law in the US?

I know that HIPAA definitely prohibits medical personnel from revealing medical information to third parties.

  • Since this question is pretty heavily in legal territory, I'd recommend asking this over at Law instead. – David K Oct 30 '18 at 12:28

The Health Insurance Portability and Accountability Act (aka HIPAA) only applies to what Dept. of Human Health Services refers to as "covered entities", this means:

  • healthcare providers
  • healthcare clearinghouses
  • health plans

"healthcare providers" is quite broad and includes:

  • hospitals
  • physicians
  • nurses
  • chiropractors
  • dentists
  • optometrists
  • hospitals
  • schools
  • nonprofit organizations (that provide healthcare services)
  • government agencies (that provide healthcare services)

If an employer is engaged in running a health plan for employees they may be required to comply with HIPAA as what is called a "hybrid entity", which has some limitations as to the extent of the HIPAA restrictions but to all intents and purposes they are required to abide by the same rules.

Additionally any entity who is considered a "Business Associate" of a covered entity is also required to abide by HIPAA - and for purposes of this a business associate is an entity that "uses or creates protected health information on behalf of a covered entity while performing certain functions or activities" so for example an IT provider who maintained the databases for a healthcare provider would be covered under HIPAA as well.

So in your example an non-medical employer would not be violating HIPAA unless they were privvy to that health information as a result of operating a company health plan or similar.

Not the answer you're looking for? Browse other questions tagged or ask your own question.