HIPAA Compliance Guide for Functional Capacity Evaluation Companies

Functional capacity evaluation (FCE) companies handle sensitive information about a person’s health, physical abilities, and work-related limitations. Whether HIPAA applies depends on the company’s role and activities—not simply on the fact that it performs evaluations or receives health information.

This guide explains how to assess covered entity status, protect protected health information (PHI), document referrals and permissions, and share and secure FCE reports. HIPAA is only part of the picture: state law, professional rules, contracts, and workers’ compensation requirements may also apply.

When Does HIPAA Apply to Functional Capacity Evaluation Companies?

HIPAA applies to health plans, health care clearinghouses, and health care providers that conduct certain transactions electronically, such as standardized health care billing transactions. A company that provides FCEs is not automatically a covered entity just because it collects or handles health information. Assess whether it functions as a health care provider and conducts—or has conducted on its behalf—the covered electronic transactions. See HHS guidance on covered entities.

An FCE company may also be a business associate when it performs a function or service on behalf of a covered entity or business associate and the work involves PHI. The parties generally need a written business associate agreement (BAA) for that arrangement. A company may be a covered entity in one role and a business associate in another; determine the status by examining the actual activities and relationships. See HHS guidance on business associates.

A referral between health care providers for treatment does not, by itself, require a BAA. HHS explains that a covered provider may share PHI with another provider for treatment without one. A BAA may still be needed if a provider performs a separate service on behalf of a covered entity, such as an administrative or data-management function involving PHI. See HHS guidance on provider-to-provider treatment referrals.

If a company is neither a covered entity nor a business associate, HIPAA’s rules do not apply to it in that capacity. That does not mean the information is unrestricted: state privacy laws, professional obligations, contracts, and other applicable requirements may still govern it.

What Information in an FCE Is Protected Health Information?

PHI generally includes individually identifiable information about a person’s past, present, or future physical or mental health, health care, or payment for health care when it is held or transmitted by a covered entity or its business associate. It can be in electronic, paper, or oral form. See HHS’s Summary of the HIPAA Privacy Rule.

Depending on the information and context, an FCE record may contain PHI such as a person’s name paired with diagnoses, pain reports, test results, lifting or endurance measurements, observed performance, functional restrictions, or the fact that the person received an evaluation. An electronic FCE record that meets the definition of PHI is ePHI when maintained or transmitted electronically.

HIPAA’s application depends on the status of the organization holding or transmitting the information. For example, an employer’s employment records are generally not protected by HIPAA just because they contain health-related information. However, HIPAA may restrict a covered provider’s disclosure of health information to an employer. See HHS guidance on employers and health information.

How Should FCE Referrals and Informed Consent Be Documented?

Use a referral record that identifies who requested the evaluation, its purpose, and the specific functional or work-related questions the FCE should address. Where relevant, include job demands, applicable restrictions, the referral source’s contact information, and the records supplied for review. Clear questions help the evaluator select relevant tests and explain how findings relate to the requested purpose.

Explain the evaluation to the person being assessed before testing. As a sound practice, document what the evaluation involves, its purpose and limits, how results may be used, who is expected to receive the report, and any applicable consent or authorization. Professional guidelines describe informed consent as part of FCE practice; legal requirements may also vary by jurisdiction and referral context. See the APTA Orthopedics and Occupational Health Section FCE best-practices guideline.

Do not treat ordinary consent to an evaluation as interchangeable with a HIPAA authorization. Where HIPAA requires authorization for a disclosure, the authorization must meet specific requirements, including identifying the information, the person or entity allowed to disclose it, the recipient, the purpose in applicable cases, and an expiration date or event. It must also include required statements about revocation and other matters. See HHS guidance distinguishing consent from authorization.

Keep the referral, consent documentation, and any HIPAA authorization with the appropriate record. Confirm the authorization covers the intended recipient and the type of report before sending it, and follow any applicable state or contract requirements.

What Can an FCE Report Disclose and to Whom?

A report should go only to a recipient permitted to receive it. A covered provider may generally disclose PHI for treatment, payment, and health care operations as HIPAA allows. Other disclosures may require a valid HIPAA authorization unless a specific legal permission or requirement applies. HHS identifies disclosures to employers for employment decisions as an example that generally requires authorization. See HHS’s Summary of the HIPAA Privacy Rule.

Before disclosing information to an employer, confirm the authorization—or other applicable legal basis—covers the recipient and information. Do not assume that an employer’s referral alone permits the evaluator to send the full report to the employer. HIPAA’s minimum necessary standard generally requires covered entities to limit many uses and disclosures to what is reasonably needed for the purpose. However, that standard does not apply to disclosures made pursuant to an individual’s authorization or to disclosures to a health care provider for treatment. See HHS guidance on the minimum necessary standard.

Workers’ compensation rules may permit certain disclosures without authorization when the disclosure is authorized by, or necessary to comply with, applicable law. The details depend on the governing law and situation, so check the relevant state requirements rather than assuming every workers’ compensation referral permits unrestricted disclosure. HHS describes the applicable HIPAA provision in its guidance on disclosures to employers for workplace medical surveillance.

Employers generally are not HIPAA covered entities simply because they receive a report as an employer. HIPAA governs the covered provider’s disclosure; other laws or agreements may govern how the employer handles the information afterward. Different rules can apply when an employer acts in another capacity, such as administering a group health plan.

How Can Companies Secure and Deliver FCE Reports Electronically?

If the company is a covered entity or business associate, the HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for ePHI. These safeguards must protect the confidentiality, integrity, and availability of the information. See HHS’s Summary of the HIPAA Security Rule.

Set workforce access controls according to job responsibilities, verify a recipient’s identity and authority, and use secure systems and transmission methods appropriate to the organization’s risk analysis. HIPAA calls for access controls and transmission security; encryption is an addressable implementation specification, which means the organization must assess whether it is reasonable and appropriate and document its decision. See HHS’s summary of Security Rule safeguards.

Before using a cloud storage, email, or document-delivery provider, determine whether it creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate. If so, the provider may itself be a business associate, and a BAA may be required. See HHS guidance on HIPAA and cloud computing.

Operationally, confirm the recipient and address before delivery, avoid sending reports to unintended recipients, and establish a process for handling misdirected reports or suspected security incidents. These measures support careful handling but do not replace a required risk analysis, policies, or other HIPAA safeguards.

What Documentation Should an FCE Report Include?

HIPAA does not prescribe a universal FCE report template. The report should nevertheless answer the referral question clearly and distinguish observed findings from the evaluator’s interpretation. Consider including:

• The person’s identifying information, evaluation date, evaluator’s name and qualifications, and referral source.
• The evaluation purpose, referral questions, relevant history, and any job or activity demands considered.
• The methods and tests performed, including relevant measures, procedures, and any limitations that affected testing.
• Objective results, the person’s reported symptoms or responses, and relevant observations during testing.
• An interpretation of the findings, functional abilities and limitations, and how those findings address the referral questions.
• Any relevant restrictions, recommendations, or need for follow-up, clearly identified as conclusions within the evaluator’s professional scope.

These are practical documentation elements, not a claim that HIPAA requires a particular FCE format. FCE best-practice guidance addresses designing, administering, interpreting, and reporting evaluations. For a separate Medicare context, CMS describes documentation for physical performance testing as including the problem requiring the test, the specific test performed, and a separate measurement report. Those Medicare documentation rules do not establish a universal FCE template. See the FCE best-practices guideline and CMS guidance on physical performance testing documentation.

Do not confuse HIPAA’s documentation retention rules for required Security Rule records with medical-record retention. The HIPAA Privacy Rule does not set a general retention period for medical records. Other HIPAA documentation requirements have their own retention rules, and state law, payer requirements, contracts, or professional rules may require records to be kept for a different period. See HHS guidance on medical-record retention.

Which Professionals Are Qualified to Perform an FCE?

HIPAA does not establish a specific FCE credential or determine which professional may perform an evaluation. Licensing, scope of practice, payer rules, workers’ compensation requirements, and contracts may affect who is qualified in a particular jurisdiction or case.

As a professional benchmark, an APTA Orthopedics and Occupational Health Section best-practices guideline describes a functional capacity examiner as a physical therapist or occupational therapist licensed where the services are performed, with education, training, and competencies specific to FCE design, administration, and interpretation. This is a professional guideline, not a universal federal licensing rule. Check the relevant licensing board and local requirements before assigning an evaluator. See the FCE best-practices guideline.

In short, assess each company’s HIPAA role, document the referral and the person’s permissions, disclose reports only on a valid basis, and protect ePHI with safeguards appropriate to your role. Confirm applicable professional, state, payer, and workers’ compensation rules as well.

FAQs

Is an FCE company always a HIPAA covered entity?

No. An FCE company is a covered entity only if it meets HIPAA’s definition—for example, as a health care provider that conducts certain covered electronic transactions. It may instead be a business associate when it performs services involving PHI on behalf of a covered entity or business associate. Some companies may have both roles in different activities.

Does an employer receiving an FCE report have to comply with HIPAA?

Usually not when the employer receives the report in its capacity as an employer. HIPAA generally governs the covered provider’s disclosure, not the employer’s employment records. An employer may have other privacy duties, and different HIPAA rules can apply if it handles information in another role, such as administering a group health plan.

When is a business associate agreement needed for an FCE referral?

A BAA is generally needed when the FCE company performs a service or function involving PHI on behalf of a covered entity or business associate. A covered provider’s disclosure to another health care provider for treatment, including a treatment referral, does not by itself require a BAA. Determine the relationship from the actual work being performed, not just the fact that a referral occurred.

What information can an FCE company share with an employer or insurer?

The company should share information only when HIPAA permits or requires the disclosure, or when a valid authorization covers it. For an employer, do not assume the referral permits release of the full report. A specific legal rule may allow certain workers’ compensation or workplace-surveillance disclosures; check the applicable law. When the minimum necessary standard applies, limit the disclosure to what is reasonably needed for its purpose.