Yes, an employer can violate HIPAA, but only in a narrow situation: when it acts as the sponsor of a group health plan and mishandles protected health information it received in that role. In its everyday role as your boss — collecting doctor’s notes, reviewing accommodation requests, or discussing your absences — an employer generally isn’t covered by HIPAA at all. The laws doing most of the work to protect your medical privacy at work are the Americans with Disabilities Act and the Genetic Information Nondiscrimination Act.
That distinction matters because filing the wrong kind of complaint with the wrong agency can cost you the case.
Why HIPAA Usually Doesn’t Reach Your Employer
HIPAA’s Privacy Rule regulates three kinds of organizations: health plans, healthcare clearinghouses, and healthcare providers that handle certain electronic transactions.1U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule These are called covered entities. Your employer, acting as an employer, is not one of them.
The rule also explicitly excludes employment records from the definition of protected health information.1U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule When a manager collects a doctor’s note to verify a sick day, processes a disability accommodation, or reviews a fitness-for-duty certification, that paperwork lives in your employment file. If a coworker glances at your doctor’s note on a supervisor’s desk, that is a workplace confidentiality problem. It is not a HIPAA violation.
People are surprised by this because HIPAA is the only health privacy law most of us have heard of. It was written to regulate the healthcare system, not to police workplace conversations about health.
When an Employer Is Actually Bound by HIPAA
The picture changes when your employer sponsors a group health plan. The plan itself is a covered entity, and when the employer performs plan administration functions — processing claims, managing enrollment, handling appeals — HIPAA’s Privacy Rule applies to any protected health information it touches in that role.2Health Information Privacy. HIPAA Privacy and Security and Workplace Wellness Programs This matters especially at self-insured employers that fund benefits directly, since they see far more detailed claims data than employers who simply buy an insurance policy.
Federal regulations require the employer to build a wall between its plan-administration role and its ordinary employment functions. Plan documents must:3eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
- Identify which employees or classes of employees are allowed to access plan-related health information.
- Limit those employees to using the information for plan administration only.
- Prohibit using protected health information for hiring, firing, promotions, or any other employment-related decision.
- Include an internal process for addressing violations.
The employer also has to certify to the group health plan that these protections are in place before it can receive any protected health information.3eCFR. 45 CFR 164.504 – Uses and Disclosures: Organizational Requirements
Here is what a violation on this side looks like. A benefits administrator sees an employee’s depression treatment in claims data and mentions it to that employee’s supervisor. The information was obtained for plan administration and used for an employment purpose. That is exactly what the rule forbids.2Health Information Privacy. HIPAA Privacy and Security and Workplace Wellness Programs
A Small-Plan Gap
One narrow exception. A self-administered employee welfare benefit plan with fewer than 50 participants does not qualify as a group health plan under HIPAA and is not a covered entity.2Health Information Privacy. HIPAA Privacy and Security and Workplace Wellness Programs Very small employers running bare-bones benefit arrangements can fall outside HIPAA entirely, even in the plan-sponsor role.
The Laws That Actually Protect Workplace Medical Privacy
Most of the situations people describe as HIPAA violations at work are actually governed by two other federal statutes. Both apply to employers with 15 or more employees.
The Americans with Disabilities Act
Under the ADA, any medical information an employer obtains — through an accommodation request, a post-offer medical exam, or an FMLA certification — must be collected on separate forms, stored in separate medical files, and treated as a confidential medical record.4Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination This is statutory, not aspirational.
Access is limited to a small group:
- Supervisors and managers, only regarding work restrictions or necessary accommodations.
- First aid and safety personnel, if the condition might require emergency treatment.
- Government officials investigating ADA compliance.
An employer that drops your medical documentation into your regular personnel file, leaves it accessible across HR, or discusses your condition with colleagues who have no need to know is likely violating the ADA’s confidentiality requirements.4Office of the Law Revision Counsel. 42 U.S. Code 12112 – Discrimination This is where most workplace medical privacy violations actually live.
The Genetic Information Nondiscrimination Act
GINA prohibits employers from requesting, requiring, or purchasing your genetic information, which includes family medical history.5U.S. Equal Employment Opportunity Commission. Fact Sheet: Genetic Information Nondiscrimination Act When an employer legitimately requests medical documentation for another purpose, it is supposed to tell both you and your provider not to include genetic information.
Like the ADA, GINA requires that genetic information be kept confidential and separate from the general personnel file, though it can share the same confidential medical file used for ADA records.6U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination
Substance Use Disorder Records
Federal regulations at 42 CFR Part 2 add an extra layer of protection for substance use disorder treatment records. A treatment program generally cannot disclose these records without your written consent, and the consent has to specify who receives the information, what will be shared, the purpose, and an expiration date.7eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records You can revoke consent at any time.
Even if an employer somehow obtains these records, they cannot be used against you in any legal, administrative, or employment proceeding without your consent or a court order.7eCFR. 42 CFR Part 2 – Confidentiality of Substance Use Disorder Patient Records
HIV and Other Stigmatized Conditions
The ADA gives particular protection to conditions that carry social stigma. If you disclose your HIV status to your employer, the employer must keep that information confidential, including from coworkers.8U.S. Equal Employment Opportunity Commission. Living with HIV Infection: Your Legal Rights in the Workplace Under the ADA Employers generally cannot even ask whether you are HIV-positive before making a job offer.
State Law Can Add More
HIPAA sets a federal floor, not a ceiling. Where a state law provides stronger privacy protections than HIPAA — for instance, a state rule against disclosing HIV status in situations where HIPAA would allow it — the state law controls and is not preempted.9HHS.gov. Preemption of State Law Several states have their own workplace privacy statutes covering categories like mental health records, reproductive health information, and genetic data. Your state may give you protections that reach further than federal law.
Where to File If Your Employer Mishandles Your Medical Information
The right agency depends on which law was actually violated. Filing with the wrong one can eat up a deadline you cannot get back.
HIPAA: Office for Civil Rights
If your employer’s group health plan improperly shared your protected health information — a benefits administrator revealing your claims data to your supervisor, for example — file with the Office for Civil Rights at the U.S. Department of Health and Human Services.10HHS.gov. Filing a Health Information Privacy Complaint You have 180 days from when you knew about the violation, though OCR can extend that if you show good cause for the delay.11HHS.gov. How to File a Civil Rights Complaint
ADA or GINA: EEOC
If your employer failed to keep your medical records separate from your personnel file, disclosed your condition without authorization, or retaliated against you for requesting an accommodation, file a charge of discrimination with the Equal Employment Opportunity Commission.6U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination
The baseline deadline is 180 calendar days from the violation. It extends to 300 days if a state or local agency in your area enforces a law prohibiting the same type of discrimination, which is common but not universal.12U.S. Equal Employment Opportunity Commission. Time Limits for Filing a Charge Don’t assume you have the longer window without confirming. Missing the deadline that applies to you generally ends the claim.
Retaliation Is Separately Prohibited
Both HIPAA and the employment discrimination laws prohibit retaliation for filing a complaint. Under HIPAA, an employer cannot punish you for reporting a privacy violation to OCR, and OCR asks you to notify it immediately if any retaliation occurs.13HHS.gov. How to File a Health Information Privacy or Security Complaint The ADA and GINA likewise bar employers from firing, demoting, or otherwise penalizing employees who file EEOC charges.
When to Bring in an Attorney
If a privacy breach caused concrete harm — a lost job, a missed promotion, workplace harassment after your condition was disclosed — an employment attorney can evaluate whether you have grounds for a lawsuit. You don’t need a lawyer to file with OCR or the EEOC, but one can help when the employer stonewalls or when damages are significant. Employment attorneys in this area typically charge between $100 and $800 per hour depending on location and experience, and some take strong cases on contingency.