We're sorry, but OSHAcademy doesn't work properly without JavaScript enabled. Please turn on JavaScript or install a browser that supports Javascript.

625 HIPAA Privacy Training
Skip to main content

Employers and Health Information in the Workplace

The Privacy Rule regulates how health plans or providers share protected health information with employers, like managers or supervisors.

A doctor with a stethoscope around his collar working at a computer.
Providers must have your permission to disclose your PHI.

Employer Requests

The Privacy Rule doesn't stop supervisors, HR staff, or others from requesting a doctor's note or health details. Such information can be sought if needed for reasons like sick leave, workers' compensation, wellness initiatives, or health insurance.

If your employer directly requests information about you from your health care provider, the provider needs your authorization to share it. However, they can disclose this information without your consent if other laws mandate it.

For most employer actions, the Privacy Rule doesn't apply. Additionally, if you're employed by a health plan or a covered health care provider, the Rule doesn't govern your employment records.

Employment Records

The Privacy Rule doesn't cover employment records, even with health-related details. Moreover, it generally doesn't govern employer actions, including those by workplace managers.

For those employed by a health plan or a covered health care provider:

  • Your employment records are not covered by the Privacy Rule.
  • The Rule does protect your medical or health plan records if you are a patient of the provider or a member of the health plan.

Knowledge Check Choose the best answer for the question.

2-3. What must a health care provider get before releasing your information to an employer?