Usually, your employer does not automatically receive individual details showing that you went to rehab just because treatment was billed to an employer-sponsored health plan. HIPAA restricts how group health plans and insurers share protected health information with an employer acting as plan sponsor.
However, the answer depends on how the employer’s health plan is structured and what role the employer has in administering it. Employers may receive limited information for plan administration in some circumstances, but HIPAA requires safeguards and generally prohibits using protected health information received for plan administration to make employment decisions.
What can an employer-sponsored health plan share with the employer?
HHS explains that a group health plan may provide a plan sponsor with certain summary health information and, under specific conditions, protected health information needed for plan-administration functions. The plan documents must restrict how that information is used and disclosed.
Those rules do not give supervisors or managers unrestricted access to individual claims simply because the company pays part of the premium.
Can my employer see the diagnosis code on a rehab claim?
Not automatically. Individual claim details are protected health information when held by a HIPAA-covered health plan. Access by the employer depends on the plan structure, the plan sponsor’s administration role, HIPAA safeguards, and applicable Part 2 protections when substance use disorder records are involved.
What if my employer is self-insured?
A self-funded employer plan may give the employer more responsibility for plan administration than a fully insured arrangement, but HIPAA still restricts use of protected health information. The employer must separate plan-administration functions from employment decisions and follow the plan-document restrictions required by HIPAA.
Does 42 CFR Part 2 add extra protection?
It can. Records from qualifying substance use disorder programs may be protected by 42 CFR Part 2 in addition to HIPAA. Part 2 restricts disclosure of identifying SUD treatment information except when the rule permits it.
Could my employer still learn that I am in rehab another way?
Yes. You may need to request leave, short-term disability, or an accommodation. In that process, the employer or leave administrator may receive limited medical information needed to evaluate the request. That is separate from access to your health-insurance claims.
For a broader overview, see Trinity’s guide to workplace privacy protections when going to rehab.
Can my employer use health-plan information against me?
HIPAA requires plan documents to prohibit a plan sponsor from using protected health information obtained for plan administration for employment-related actions or decisions. Separate employment laws, including the ADA and FMLA, may also provide protections depending on the facts.
What should I do if I am worried about privacy?
Ask the insurer or health-plan administrator for the plan’s privacy notice and find out whether the plan is fully insured or self-funded. For leave or disability paperwork, use the employer’s designated HR or benefits process and provide only the information required.
Frequently asked questions
Can my boss call the insurance company and ask if I went to rehab?
A health plan cannot simply disclose protected health information to a supervisor because the supervisor asks for it. HIPAA permits disclosures only as allowed by the Privacy Rule.
Does an employer paying the premium give it access to my claims?
No. Paying premiums does not by itself create unrestricted access to individual protected health information.
Can HR know I am on medical leave without knowing my diagnosis?
Yes. In many situations HR can administer leave using limited medical certification without receiving the person’s full treatment record.
What if I think my plan shared information improperly?
You can contact the plan’s privacy officer and may file a complaint with HHS Office for Civil Rights when HIPAA applies.
Authoritative sources
- HHS: Summary of the HIPAA Privacy Rule
- HHS: Employers and Health Information in the Workplace
- HHS: Employer Access to Group Health Plan Information
This article provides general privacy information, not legal advice. Health-plan structure and employment circumstances can change how these rules apply.