I know it is bad for a non-medical HR person or supervisor to give out personal or medical information about an associate, but is it actually a violation of the HIPAA law in the US?

I know that HIPAA definitely prohibits medical personnel from revealing medical information to third parties.

closed as off-topic by gnat, Philip Kendall, Martin Tournoij, Jim G., David K Oct 30 '18 at 12:27

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – gnat, Philip Kendall, Martin Tournoij, Jim G., David K
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Since this question is pretty heavily in legal territory, I'd recommend asking this over at Law instead. – David K Oct 30 '18 at 12:28

The Health Insurance Portability and Accountability Act (aka HIPAA) only applies to what Dept. of Human Health Services refers to as "covered entities", this means:

  • healthcare providers
  • healthcare clearinghouses
  • health plans

"healthcare providers" is quite broad and includes:

  • hospitals
  • physicians
  • nurses
  • chiropractors
  • dentists
  • optometrists
  • hospitals
  • schools
  • nonprofit organizations (that provide healthcare services)
  • government agencies (that provide healthcare services)

If an employer is engaged in running a health plan for employees they may be required to comply with HIPAA as what is called a "hybrid entity", which has some limitations as to the extent of the HIPAA restrictions but to all intents and purposes they are required to abide by the same rules.

Additionally any entity who is considered a "Business Associate" of a covered entity is also required to abide by HIPAA - and for purposes of this a business associate is an entity that "uses or creates protected health information on behalf of a covered entity while performing certain functions or activities" so for example an IT provider who maintained the databases for a healthcare provider would be covered under HIPAA as well.

So in your example an non-medical employer would not be violating HIPAA unless they were privvy to that health information as a result of operating a company health plan or similar.

Not the answer you're looking for? Browse other questions tagged or ask your own question.