I get calls occasionally from folks who insist on telling me how their HIPAA rights have been violated. By the way, its HIPAA with two “a’s” not two “p’s.” HIPAA stands for the Health Insurance Portability and Accountability Act. It was passed by Congress in 1996. It has thereafter caused pain and suffering for millions of business people and amateur lawyers, not to mention real lawyers, ever since.
The calls that I get go like this. “My boss told me that I need to tell him why I called out sick yesterday. I told him that’s HIPAA, so I didn’t tell him why I was out. Now he says I’m insubordinate.”
Yes, that is correct: you are insubordinate. HIPAA is not a safe harbor that commands that medical information never be disclosed by anyone to anyone without a release.
If I see you at the doctor’s office and then I run into your boss and tell him that I saw you at the doctor’s office yesterday, I have not violated your HIPAA rights. I am probably not a good friend, and what I have done is at minimum impolite and socially unacceptable. But I haven’t violated the HIPAA.
So here’s a primer on what HIPAA allows and does not even address. The so-called HIPAA “privacy rule,” according to the U.S. Department of Health and Human Services, “protects individuals’ medical records and other personal health information and applies to health plans, health care clearinghouses, and [certain] health care providers who transmit health information in electronic form.” That’s it.
But still you will often hear people who have never read the law and its regulations promoting their ideas and theories about how HIPAA applies and prohibits folks from discussing health matters.
A big issue that has been coming up this year, of course, involves COVID. For those folks who still are going into a workplace, it becomes quite unsettling when word gets around that somebody may have tested positive for COVID.
When the whole COVID pandemic started, I gave the opinion that I believed it was going to be vitally important for all interested parties to be transparent about the disease and transmission in order to ensure faith and confidence in the system that would ultimately be put in motion to keep us safe.
But then I started hearing from folks that I represent who would tell me about “rumors” they heard that this person or that person at work had tested positive, or that a family member related to that co-worker had tested positive.
They would even whisper when they were telling me about it, as if speaking in a regular tone might subject them to penalties from the HIPAA police.
There is nothing in the law that prohibits co-workers from talking about positive COVID tests, except in the case of healthcare workers who gain the information through the performance of their jobs.
But for most other folks who do not work in a healthcare job, sharing knowledge about COVID is an important way to track the virus and make sure that we are all making safe choices.
HIPAA was passed by Congress to ensure that health care providers and systems not disclose private health information of an individual without that individual’s consent. You don’t want your medical history being sold to an insurance company or a bank.
But if you want to ask how a co-worker is feeling, or make a decision about whether you should get a COVID test based on what has occurred at work, HIPAA is not meant to stop you.