HIPAA Training for HR Teams Handling Employee Health Records

When Does HIPAA Apply to HR Teams?

HIPAA generally does not regulate an employer’s ordinary employment records or the employer acting in its role as an employer. An employee’s health-related information in a personnel file is not automatically protected health information (PHI) under HIPAA. The HHS guidance on employers and health information explains that the Privacy Rule does not protect employment records, even when they contain health-related details.

HIPAA can apply to HR work when staff handle information for a covered group health plan—for example, when carrying out authorized group health plan administration. The plan is generally a separate covered entity from the employer. If the employer’s plan sponsor receives PHI for plan administration, conditions include separating those duties from employment functions and not using the information for employment-related decisions. See HHS guidance on employers that sponsor group health plans.

Training should make clear which capacity an HR employee is acting in: employer, plan administrator, or—in some organizations—workforce member of a covered health care provider or health plan. Other laws and employer policies may protect health information even when HIPAA does not apply to the record.

Which Employee Health Records Are Protected by HIPAA?

HIPAA PHI is individually identifiable health information held or transmitted by a covered entity or its business associate. For HR teams, this can include identifiable health plan enrollment, claims, or case-management information received and maintained for plan administration. The HHS Summary of the HIPAA Privacy Rule explains what information the Privacy Rule protects and that employment records held by a covered entity in its role as employer are excluded.

By contrast, records such as an employee’s doctor’s note submitted for leave, a workplace injury report, or medical documentation used for an employment decision are generally employment records—not HIPAA-protected records simply because they contain health details. Handle them confidentially under applicable laws and workplace policies, and avoid assuming that “not HIPAA-protected” means unrestricted sharing is appropriate.

Teach staff to identify the source and purpose of a record before applying a rule: Was it received from or maintained for a covered health plan, or collected and used by the employer for an employment purpose? That distinction helps HR route, store, and disclose information correctly.

What Should HIPAA Training for HR Cover?

For HR personnel who handle PHI on behalf of a covered group health plan, training should connect the HIPAA Privacy Rule to the team’s actual plan-administration duties. Cover permitted uses and disclosures, authorization and escalation steps, confidentiality, documentation, and the boundary between plan administration and employment decisions.

Explain the minimum necessary standard: when it applies, limit access, use, and disclosure to what is reasonably needed for the permitted purpose. Teach role-based access controls so employees can access only the PHI appropriate to their duties, and show them how to recognize misdirected emails, inappropriate requests, lost devices, or access outside their role.

For electronic PHI, cover organization-approved systems, secure handling and transmission, password and account practices, workstation security, and how to report security incidents. The HHS Security Rule summary describes required safeguards and workforce training for regulated entities; training should also explain the employer’s specific policies, reporting contacts, and sanctions.

How Should HR Secure and Store Health Information?

Keep plan-administration PHI separate from ordinary personnel records and restrict it to staff who need it for authorized duties. Use role-based access controls, individual user accounts, secure approved storage, and access reviews. For electronic PHI, the HIPAA Security Rule requires covered entities and business associates to use reasonable and appropriate administrative, physical, and technical safeguards; the HHS Security Rule guidance outlines those obligations.

For paper files, use access-controlled storage and avoid leaving documents visible or unattended. For electronic files, follow approved procedures for secure transmission, device use, access changes, backups, and disposal. Do not send PHI through personal email or store it in unapproved drives or devices.

Where HR handles health information as an employer rather than for a covered plan, HIPAA may not govern the record. Still, apply the organization’s confidentiality rules and relevant legal requirements. For plan-administration information, maintain the separation between plan duties and employment functions required by the applicable plan arrangements.

Who Should Access Employee Health Records and When?

Access should be limited to people whose assigned duties require the information. HR staff handling a plan’s PHI should access it only for authorized plan-administration purposes, not to make hiring, promotion, discipline, or other employment decisions. The HHS guidance on workplace wellness programs describes the separation and safeguards required when a plan sponsor receives PHI for plan administration.

Use role-based access controls to define what each job function can view or change. Review permissions when someone changes roles or leaves, and follow procedures for logging and reviewing access where required by the organization’s HIPAA obligations. Train staff not to browse records out of curiosity or share information with managers or colleagues who do not have an authorized need.

When a request is unclear, pause and contact the privacy officer, plan administrator, or other designated lead before disclosing information. Do not assume that a manager’s request, an employee’s role, or a general business interest automatically authorizes access to plan PHI.

When Should HR Staff Receive HIPAA Training?

Covered entities must train workforce members on privacy policies and procedures as necessary and appropriate to their functions. They must train new workforce members within a reasonable period after they join and provide relevant training within a reasonable period after a material change to policies or procedures. The HHS audit protocol for 45 C.F.R. § 164.530(b) describes these training requirements.

HIPAA does not establish a universal annual training or certificate-renewal requirement for every HR employee. Covered entities must also provide security awareness and training as required by the Security Rule. Employers and plans may set more frequent refreshers through their own policies, contracts, or risk-management practices.

Make training specific to each employee’s duties, document completion as required, and provide additional instruction when responsibilities, systems, or procedures change. A course completion certificate documents training; it does not by itself establish that an employer or health plan is HIPAA-compliant.

How Should HR Report a Suspected Breach?

Report a suspected loss, misdirected message, unauthorized access, or disclosure immediately through the organization’s incident-reporting process. Notify the privacy or security officer and the appropriate plan contact; share only the facts needed to begin the response. Follow instructions to contain the incident, preserve relevant messages and records, and avoid deleting evidence or conducting an informal investigation that could interfere with the response.

The covered entity or business associate responsible for the information must assess the incident under the Breach Notification Rule. An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or a risk assessment demonstrates a low probability that the PHI was compromised. The HHS Breach Notification Rule guidance explains the assessment and notification requirements. Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery; HR staff should not independently promise or issue notices unless assigned that responsibility.

In practice, effective HR handling depends on knowing which records and duties fall under HIPAA, limiting access to authorized purposes, keeping plan information separate from employment functions, and promptly escalating suspected incidents under the organization’s procedures.

FAQs

Are employee personnel records protected by HIPAA?

Generally, no. HIPAA does not protect personnel records just because they contain health information. However, identifiable information held for a covered group health plan may be PHI, and other laws or employer policies may still require confidential handling of personnel records.

When do HR staff need HIPAA training?

HR staff who handle PHI as workforce members of a covered entity need training appropriate to their duties. Covered entities must train new workforce members within a reasonable period and provide relevant training after material policy changes. An employer may also require training for staff handling sensitive health records even when HIPAA does not directly apply to those records.

How should HR separate medical information from personnel files?

Store health-related documents in a separate, access-restricted file or approved system, and give access only to staff with an authorized need. Keep group health plan PHI separate from employment functions and follow the plan’s policies, applicable legal requirements, and the organization’s retention and security procedures.

What should HR do after a suspected disclosure of protected health information?

Report it promptly to the designated privacy or security officer and plan contact, follow instructions to limit further disclosure, and preserve relevant evidence. The responsible covered entity or business associate should assess whether the incident is a breach and determine any required notifications under the organization’s procedures.