Ob-Gyn Coding Alert

Answer: Employers can ask what they want, but labs can’t give them lab test results, COVID-19 or otherwise, without patient permission.

The Health Insurance Portability and Accountability Act (HIPAA) has engendered so much confusion about who it applies to and when someone can share protected health information (PHI).

Key: HIPAA applies only to Covered Entities (CEs) and their Business Associates (BAs). A CE is a healthcare provider, plan, or clearinghouse that transmits PHI. An employer is not typically a CE, although employers are bound by certain restrictions involving disclosures to the employer-sponsored health plan.

BA: According to the department of Health and Human Services (HHS), “A ‘business associate’ is a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity.

The HIPAA law does not apply to whether an employer can expect an employee to provide health information. But it does mean that a CE or BA, like a lab or physician, can’t provide PHI at an employer’s request.