Are employers subject to the Privacy Rules?
A. On the surface, no. In fact, HIPAA regulations expressly state that the type of records protected by the Privacy Rules do not include information which is contained in employment records maintained by an employer. Employers are not off the hook, however, because as sponsors and administrators of their group health plans, they are responsible to ensure that these plans comply with HIPAA. So, employers must be concerned about HIPAA compliance and take the necessary steps to bring their group health plans into conformity with the law.
