The Americans with Disabilities Act (ADA) governs employer access to and use of medical information. These restrictions are described in Disabilities and genetic information.
The Health Insurance Portability and Accountability Act (HIPAA) privacy rule and security rule protects the use and disclosure of protected health information (PHI) by covered entities and business associates, except as authorized by the individual or as permitted or required by the privacy rule. The rule imposes different requirements on healthcare providers, group health plans and employers. Therefore, depending on whether the organization is handling health information in its capacity as a group health plan as opposed to its role as an employer or even healthcare provider, the requirements may change. Initially, there are six key must-knows:
What is PHI?
Who’s a covered entity?
Who’s a business associate?
What’s “use or disclosure?”
How do I get authorization or identify a regulatory exception?
What use/disclosure is permitted by the HIPAA privacy rule?