There is a group of employees who, during water cooler talk, think that it is OK to speculate on the health of the manager in my area. I believe that the discussions are inappropriate and in poor taste. It seems that if this manager does have a health issue, she does not want it known. I feel that if this chatter and speculation is going on in my area, it may be being discussed in other areas of the company. Are employees speculating/gossiping about the boss protected by HIPPA? Or is the manager, if damaged by these rumors, entitled to the same protection as an employee?

Thanks much.

Do you all work in the medical field?

Speculation is not covered under HIPAA. Only actual diagnoses, treatments, etc. Think of HIPAA as doctor/nurse/patient privilege.

Are the employees who are doing the talking/gossiping getting their talking points from files which they have access to, but not the authority to review, except in the course of performing their official duties? What is the company's written policy? Are you employed by a healthcare provider?

Quote:

---

Originally Posted by smearcase

Are the employees who are doing the talking/gossiping getting their talking points from files which they have access to, but not the authority to review, except in the course of performing their official duties? What is the company's written policy? Are you employed by a healthcare provider?

---

As far as I am aware, they are getting their talking points from their own observations. I don't believe that they have access to the HR files, which are under lock and key. I don't work for a healthcare company... it is an IT firm.

Summary of the HIPAA Privacy Rule

Who is Covered by the Privacy Rule
The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the “covered entities”). For help in determining whether you are covered, use CMS's decision tool.
Health Plans. Individual and group plans that provide or pay the cost of medical care are covered entities.⁴ Health plans include health, dental, vision, and prescription drug insurers, health maintenance organizations (“HMOs”), Medicare, Medicaid, Medicare+Choice and Medicare supplement insurers, and long-term care insurers (excluding nursing home fixed-indemnity policies). Health plans also include employer-sponsored group health plans, government and church-sponsored health plans, and multi-employer health plans. There are exceptions—a group health plan with less than 50 participants that is administered solely by the employer that established and maintains the plan is not a covered entity. Two types of government-funded programs are not health plans: (1) those whose principal purpose is not providing or paying the cost of health care, such as the food stamps program; and (2) those programs whose principal activity is directly providing health care, such as a community health center,⁵ or the making of grants to fund the direct provision of health care. Certain types of insurance entities are also not health plans, including entities providing only workers’ compensation, automobile insurance, and property and casualty insurance. If an insurance entity has separable lines of business, one of which is a health plan, the HIPAA regulations apply to the entity with respect to the health plan line of business.
Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule.⁶ Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all “providers of services” (e.g. institutional providers such as hospitals) and “providers of medical or health services” (e.g. non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.

Health Care Clearinghouses.Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e. standard format or data content), or vice versa.⁷ In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information.⁸ Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions.



According to the definitions above.....no HIPAA violation occurred

There is no HIPAA violation unless it is in a healthcare environment, institution, hospital, long term care facility and information is being divulged in the way of personal ID numbers and information regarding doctor/nurse/patient information.

This doesn't come close to a HIPAA violation. This is simply office gossip. It may not be appropriate and HR might want to be informed. But since no one is treating him or has access to his medical records, then HIPAA is not involved.