What Employers Need to Know about HIPAA Compliance during the Coronavirus Outbreak

In light of a potential or actual coronavirus pandemic, we at Brownstein have begun to receive inquiries from employers concerned about being subject to, and running afoul of, the Health Insurance Portability and Accountability Act ("HIPAA").

HIPAA applies to “covered entities,” defined as health care clearinghouses, certain health care providers, and health plans. Additionally, persons or entities performing activities on behalf of a covered entity that involve the use or disclosure of protected health information—referred to as “business associates”—must also comply with HIPAA. If an employer does not meet the definitions for a covered entity or business associate, it is not subject to HIPAA.

This means that businesses that do not operate in or service the health care industry may not be required to comply with HIPAA. One exception to this generalization is that an employer-sponsored group health plan with more than 50 participants is considered a covered entity. Per guidance issues by the United States Department of Health and Human Services, an employer-sponsored group health plan is considered a separate legal entity from the employer that sponsors the group health plan for purposes of HIPAA compliance. Thus, while HIPAA would not directly regulate the non-covered entity employer that sponsors a group health plan, HIPAA does control the conditions under which the group health plan may share protected health information with the employer. Among these conditions is receipt of a certification from the employer that the health information will be protected as prescribed by HIPAA and will not be used for employment-related actions.

As employers formulate their plan for managing the coronavirus emergency, it is important to undertake an analysis and determine whether they must comply with HIPAA—either directly, as a business associate, or as an employer-sponsored health plan. Because each employer and its relationships are unique, we recommend consulting with an attorney to help evaluate the extent to which your coronavirus response plan is subject to HIPAA.

Information is changing daily and some of the content included in this alert may have changed or been updated since publication.

Click here to read more Brownstein alerts on the legal issues the coronavirus threat raises for businesses.

This document is intended to provide you with general information regarding what employers need to know about HIPAA compliance surrounding coronavirus. The contents of this document are not intended to provide specific legal advice. If you have any questions about the contents of this document or if you need legal advice as to an issue, please contact the attorneys listed or your regular Brownstein Hyatt Farber Schreck, LLP attorney. This communication may be considered advertising in some jurisdictions.