HIPAA

Is asking if have COVID symptoms PHI?

  • 1.  Is asking if have COVID symptoms PHI?

    Posted 07-07-2020 12:01 PM
    How many believe that if the following question is asked of our employees, it is considered PHI?

    Do you have any of the COVID symptoms listed above? Mark "yes" if you do. If no, click "submit."

    ------------------------------
    Nicole Goodman
    University Compliance Manager/HIPAA Privacy Officer
    Western Washington University
    Bellingham,WA
    ------------------------------
    19th Annual CEI Virtual Conference


  • 2.  RE: Is asking if have COVID symptoms PHI?

    Posted 07-07-2020 12:25 PM
    Nichole,

    This is a question that comes up over and over again.

    Health related information collected by an employer in the employers role as an employer is employment information not PHI as defined by HIPAA even if that employer normally operates as a covered entity.  . 

    So unless the employer is collecting the information in the role of healthcare provider who engages in electronic insurance transactions, healthcare insurer, or healthcare insurance clearinghouse the information in question is HR information subject only to the State's HR privacy laws.  

    As a university your organization is likely to be a complex hybrid organization with some business units being HIPAA covered entities, some business units subject to the educational institution privacy requirements and others just subject to employment data regulation. 

    I hope this is helpful.

    -Alex- 
    Alexander I Slosman, MHA, CHC, CHPC



    19th Annual CEI Virtual Conference


  • 3.  RE: Is asking if have COVID symptoms PHI?

    Posted 07-07-2020 12:35 PM
    HHS website - Guidance:

    Employment Records

    The Privacy Rule does not protect your employment records, even if the information in those records is health-related. In most cases, the Privacy Rule does not apply to the actions of an employer.

    If you work for a health plan or a covered health care provider:

    • The Privacy Rule does not apply to your employment records. 
    • The Rule does protect your medical or health plan records if you are a patient of the provider or a member of the health plan.
    [Underline added by myself.]

    Does this mean that once the medical record has made it's way to the employee file, it is no longer covered by HIPAA? I guess so, C&C?

    ------------------------------
    David Rothery, CHC, AWI-CH
    Compliance & Privacy Officer
    Health & Human Services
    Marin County, CA


    These are my personal opinions and not those of the County of Marin
    ------------------------------

    19th Annual CEI Virtual Conference


  • 4.  RE: Is asking if have COVID symptoms PHI?

    Posted 07-07-2020 12:33 PM
    In order to be PHI, the information needs to be collected by a Covered Entity while it is acting as such.

    Typically, information collected by an employer in their role as an employer, even if the employer is a CE, isn't PHI.  The exception is in the context of Wellness programs which may be, depending on specific facts, be characterized as health insurers.

    So... unlikely but possible depending on who in the organization is doing the questionnaire, why and how.

    What?!  You thought there was going to be a crystal clear answer in HIPAA-dom? ;-)

    ------------------------------
    Scott Intner
    Chief Compliance Officer
    GW Medical Faculty Associates
    Washington,DC
    ------------------------------

    19th Annual CEI Virtual Conference