

Self-insured employers should be aware of their responsibilities under HIPAA (and if not, please seek counsel). The employer is fully self-insured and either does or does not have access to protected health information. There are several ways to operate self-insured plans, such as using a third party to manage the benefits so that the employer is completely hands-off. When it comes to the insured part of the company, these employers are covered entities under HIPAA because they are basically considered insurance providers. HIPAA May Apply to Some Self-Insured Health Plans It could also be a violation for the doctor under other laws. Employers should also inform the doctors not to provide this information.

Recommendation: Your health information is protected with your health care provider (and your insurance company), and unless you signed a form authorizing your provider to release that information, it is illegal unless there is an emergency situation - which would be incredibly unusual with COVID-19 and your employer.


Your employer asking for it is not necessarily a HIPAA violation, but it is a violation of other laws and the company should not ask. Answer: Yes … if the doctor gave them the information.My employer called my doctor and asked if I was vaccinated or had COVID. Recommendation: Employers should read this guidance from the Equal Employment Opportunity Commission titled “What You Should Know About COVID-19 and the ADA, the Rehabilitation Act, and Other EEO Laws,” along with this guidance from the Department of Health and Human Services, titled “If my employer requires proof of my COVID-19 vaccination status, does that violate my rights under HIPAA?”.Answer: Yes, it can ask, but if you are not vaccinated, the company cannot ask you why not, because that might violate other federal laws.Is my employer allowed to ask for my COVID-19 vaccination card? Employers need to store these copies securely and retain them for the minimum time necessary. If employers insist on copying it anyway, black out everything on there that is irrelevant, such as DOB, medical record number, etc. Sure, have someone on HR look at it, note that it was shown, and let that be all. Recommendation: Employers should not make a copy of these records.Answer: This is not a HIPAA violation, because HIPAA does not apply to your employer asking these questions.My employer wants a copy of my husband’s health record to prove he has COVID-19 in order to permit me to work at home. Here are some examples: I am required to be at work in person unless I or someone in my household has COVID-19. You should absolutely treat the information confidentially, but HIPAA does not generally apply. Most employers are usually none of these - or at least none of these as it pertains to their own employees. HIPAA applies to health care providers, insurers and health information clearinghouses and their business associates. HIPAA Does Not Cover the Health Data Employers Collect on Employees Related to COVID-19 HIPAA seems to be a simple law - health data is protected - although it’s not clear to most employees what that level of protection includes.
