Looking for a Business Associate Agreement? Download our FREE starter BAA template.

Total HIPAA Logo

Who is Responsible for Employee Health Information?

Organizations are responsible for protecting their employees’ personal information. This is regulated under different laws, and by different state and federal agencies. Depending on the kinds of health benefits provided to employees, there are some different regulatory items HR needs to be aware of. 

HIPAA applies to employers when the organization has a self-funded or level-funded health plan. In all other cases health information confidentiality falls under the purview of Americans with Disabilities Act (ADA) and/or Family Medical Leave Act regulations.

In most cases, the responsibility for safeguarding health information confidentiality lies within the jurisdiction of the Americans with Disabilities Act (ADA) and the Family and Medical Leave Act (FMLA) regulations. These two laws play pivotal roles in ensuring that employees’ health-related data is handled with care and respect for their privacy. While HIPAA might not directly apply to most employers, understanding the implications of ADA and FMLA is crucial for maintaining a secure and respectful environment for employees, particularly when addressing absences or FMLA-related health matters.

Now, when does HIPAA become relevant for employers? HIPAA comes into play when an employer chooses to self-insure or go with a level-funded plan, which means they assume the financial risk of providing health benefits to their employees. In this scenario, HIPAA regulations become applicable, and the employer is designated as a Covered Entity, bound by strict privacy and security standards in the handling of employees’ protected health information (PHI) which the HR staff will be seeing as part of their work handling the health plan.

Key Takeaway:

For the vast majority of employers who rely on external insurance providers, it’s not the employer but rather the insurance companies that are the Covered Entities. These insurers must adhere to HIPAA rules when managing health information for the company they provide health insurance to.

If you have determined your company needs to be HIPAA compliant please book a demo to learn about HIPAA Prime. Total HIPAA specializes in making HIPAA compliance an easy and comprehensive way to become cyber secure. We look forward to meeting you!
Book a Clarity Call Today.

Further Reading for Employers:
HIPAA and ERISA: Everything You Need To Know

Sharing is caring!


Looking for a Business Associate Agreement?

Download our free template to get started on your path toward HIPAA compliance.

Download Now

Let's keep in touch

Stay up to date on the latest HIPAA news, plus receive tons of free tools and info.

Navigating HIPAA Compliance in 2023

Watch the recording of this webinar to learn more about how you can become and stay HIPAA compliant!


Related Posts

What is Access Control in terms of HIPAA?

What is Access Control in terms of HIPAA?

Access control, in terms of cybersecurity, refers to the practice of managing and regulating who can access specific resources, systems, or data within an organization's network or information...

Comparing HIPAA and NIST

Comparing HIPAA and NIST

In the ever-evolving landscape of data security and privacy, two key frameworks have emerged as significant players: HIPAA and NIST. Both emphasize the importance of safeguarding sensitive...

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)