NOW LIVE! Today's the day you meet your new best friend. You don’t have to leave Wolfy behind... In 'Pets & Sidekicks' your companions level up with you!

Reply to thread

Message: <blockquote data-quote="MGibster" data-source="post: 8326330" data-attributes="member: 4534">You are 100% correct regarding the seriousness of the breach in privacy here but you're a little confused over applicable laws here. We have a byzantine series of laws here regarding accommodations, protected information, and other issues revolving around privacy and medical information so I can hardly blame anyone for being confused.  HIPAA isn't applicable here as the <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/index.html" target="_blank">privacy rule</a> applies to health care plans and providers but it doesn't apply to employers. The business associates you're thinking of in connection with the privacy rule are those who work with health care providers in billing, legal, as contractors, etc., etc. even if they don't work directly with patient care.However, failure to maintain confidentiality of an employee's medical information is a violation of the American with Disabilities Act (even if the information disclosed has nothing to do with a disability).  And again, you are absolutely correct regarding the seriousness of this breach of confidentiality.  In fact, any information we might have of an employee's medical status is not part of their personnel file and is kept secure in another location.  If I were to deliberately disclose the protected health information of an employee I would likely find myself out of a job the next day.  If someone in my marketing department disclosed the health status of an employee on social media without their express permission, I would recommend immediate termination.  And I do not typically go straight to recommending termination. You can disclose PHI for a few legitimate reasons. <ol> <li data-xf-list-type="ol">You can disclose PHI to managers/supervisors/others when necessary to provide reasonable accommodations to the employee.  Best practice is to provide the bare minimum information necessary to make the accommodations.</li> <li data-xf-list-type="ol">You can disclose PHI to authorized state/federal authorities conducting a workplace investigation. </li> <li data-xf-list-type="ol">You can disclose PHI to authorized individuals in the case of workman's compensation claims or other insurance. </li> <li data-xf-list-type="ol">You can disclose PHI to first responders or safety personnel if the employee needs emergency treatment. </li> </ol>I know that's all really boring stuff and not something we'd typically talk about here.  But I did want people to understand exactly what they did wrong by disclosing someone's PHI like that.Edit:  And I see that my post is completely pointless as you guys already sorted it out.</blockquote>

Verification