HIPAA for Employers: What Businesses Are Responsible For Under HIPAA

Understanding HIPAA compliance for employer-sponsored health plans.

---

Published: 08.11.2026

In this guide:

• What Is HIPAA and Why It Matters for Employers
  • PII vs. PHI: What’s the Difference?
• Does HIPAA Apply to Employers?
• When HIPAA Applies to Benefits Administration Platforms
• What Employers Are Responsible for Under HIPAA
  • Protecting PHI
  • Conducting Risk Assessments
  • Managing Business Associate Agreements (BAAs)
  • Training Workforce Members
  • Handling Breach Notifications
• What Employers Are Not Responsible for Under HIPAA
• HR Do’s and Don’ts for HIPAA and PHI
• HIPAA Privacy vs. Security: What Employers Need to Know
• Proposed HIPAA Security Rule Changes
• How Brokers Help Employers Stay Compliant
• Need Help Navigating HIPAA Compliance?

What Is HIPAA and Why It Matters for Employers

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996. It establishes federal requirements to help safeguard protected health information (PHI) and ensure privacy and security.

PHI generally refers to individually identifiable health information held or transmitted by a covered entity or business associate, including information about a person’s health condition, health care, or payment for health care.

PII vs. PHI: What’s the Difference?
Personally Identifiable Information (PII) is a broad privacy term for information that can identify a person, such as:

• Name
• Address
• Phone number
• Email address
• Social Security number
• Employee ID

While PII is important to protect, it is not the primary HIPAA term.

Protected Health Information (PHI) is health information that identifies an individual, or could reasonably identify them, and relates to health care, payment for health care, or health care operations. To be PHI under HIPAA, the information must also be held or transmitted by a covered entity or business associate.

For employer-sponsored group health plans, PHI may include:

• Claims data
• Coverage and enrollment data
• Deductible or utilization information
• Dependent health-plan information
• Wellness program data, depending on how the program is structured

For employers, HIPAA compliance becomes critical when sponsoring a group health plan, such as:

• Medical plans
• Health reimbursement arrangements (HRAs)
• Flexible spending accounts (FSAs)

When a group health plan creates, receives, maintains, or transmits PHI—such as claims, eligibility, or plan administration data—HIPAA requirements may apply. Fully-insured plans with limited access to PHI may have more limited obligations.

Does HIPAA Apply to Employers?

HIPAA applies to covered entities and business associates. Whether it applies to an employer depends on the employer’s role and the type of health information involved.

Covered entities include health plans, health care clearinghouses, and certain providers. For employers, the key distinction is that an employer-sponsored group health plan may be a covered entity, while the employer acting in its role as an employer usually is not. In other words, HIPAA can apply to plan-related PHI, but it usually does not apply to employment records maintained by HR or the employer for workforce management purposes.

Examples of employment records that are usually not PHI include:

• Doctor’s notes kept in HR files
• FMLA certifications
• ADA accommodation paperwork
• Workers’ compensation records
• Attendance records tied to leave

These records may still be confidential and protected by other federal, state, or employment laws, even when HIPAA does not apply.

HIPAA generally applies to the group health plan itself. If a company sponsors a health plan, the plan is typically the HIPAA-covered entity, and the employer must keep plan-related PHI separate from employment records. HR and other employer representatives should not use health-plan PHI for hiring, termination, discipline, leave, promotion, or other employment decisions.

• Employers must separate their role as plan sponsor from their role as employer.
• Limited PHI may be shared for plan administration if HIPAA’s conditions are met.
• Health-plan PHI cannot be used for employment decisions.
• Other laws, such as the ADA, FMLA, workers’ compensation laws, and state privacy rules, may still apply to health information in employment records.

Business associates are vendors that handle PHI for a covered entity, such as Third-Party Administrators (TPAs), benefits platforms, or other service providers supporting plan administration.

When HIPAA Applies to Benefits Administration Platforms

Benefits administration platforms are important to review because they often sit directly in the flow of health-plan data. Even if an employer thinks of the platform as an HR tool, it may become a HIPAA-relevant vendor if it creates, receives, maintains, or transmits PHI on behalf of the group health plan.

A benefits administration platform may handle PHI if it stores or transmits health-plan information such as:

• Medical plan enrollment data
• Dependent information tied to coverage
• Claims-related information
• Wellness or health incentive data
• COBRA or benefit data that includes health-plan details

If the platform handles PHI for the health plan, the vendor is usually a business associate, and a Business Associate Agreement (BAA) is generally required.

What Employers Are Responsible for Under HIPAA

Employers that sponsor group health plans should understand the HIPAA obligations that apply to the plan and any plan sponsor responsibilities that arise when the employer receives PHI for plan administration. Key responsibilities include:

1. Protecting PHI

To satisfy the HIPAA Security Rule, the group health plan must have appropriate safeguards, policies, and procedures to protect the security of electronically transmitted and electronically stored PHI.

2. Conducting Risk Assessments

Regular risk analysis is required to identify vulnerabilities in how PHI is stored, used, and transmitted.

3. Managing Business Associate Agreements (BAAs)

Group health plans generally must have written Business Associate Agreements (BAAs) with vendors that create, receive, maintain, or transmit PHI on the plan’s behalf, including:

• TPAs, also known as Third-Party Administrators
• Technology vendors
• Benefits platforms

4. Training Workforce Members

Workforce members who handle PHI for the group health plan should be trained on the plan’s HIPAA policies, procedures, and compliance requirements.

Training should be role-based, documented, and updated when policies, systems, or job responsibilities change. Employers can use HHS HIPAA training materials and guidance as a starting point and may also evaluate third-party HIPAA training vendors for scalable workforce education, completion tracking, and audit-ready documentation.

5. Handling Breach Notifications

Covered entities and business associates must follow breach notification requirements if unsecured PHI is exposed, including required notifications and corrective actions.

What Employers Are Not Responsible for Under HIPAA

HIPAA does not apply to employment records, workers’ compensation data, or general personnel records maintained by an employer in its role as an employer.

• Employment records, such as sick notes in HR files
• Workers’ compensation data
• General personnel records

These records may still be subject to other employment or state privacy laws, but they are generally not considered PHI and governed by HIPAA.

HR Do’s and Don’ts for HIPAA and PHI

These best practices can help HR teams reduce privacy and security risks when handling benefits-related information and group health plan PHI. The key is to keep plan-related PHI separate from general employment records and limit access to only those who need it for plan administration.

Do:

• Keep health plan data separate from employment files.
• Limit access to benefits data and group health plan PHI to authorized personnel only.
• Use role-based permissions, strong passwords, and multi-factor authentication where appropriate.
• Train HR staff on the difference between PHI, PII, and employment information.
• Maintain secure storage, transmission, and disposal practices for sensitive information.
• Report suspected privacy or security incidents immediately through the appropriate internal process.
• Confirm vendor contracts include a Business Associate Agreement (BAA) when PHI is involved.

Don’t:

• Use health-plan PHI for hiring, firing, promotion, discipline, attendance, or other employment decisions.
• Share employee health information with managers unless required and permitted by law.
• Assume all medical or health-related information in HR files is HIPAA-covered.
• Allow unrestricted access to benefits administration systems or health-plan data.
• Send PHI through unsecured email, personal devices, or unapproved systems.

HIPAA Privacy vs. Security: What Employers Need to Know

HIPAA compliance includes two core components: the Privacy Rule and the Security Rule. While they work together, they serve different purposes.

Quick Comparison

 

HIPAA Privacy Rule	HIPAA Security Rule
Applies to all PHI (e.g., oral, written, electronic)	Applies only to electronic PHI (ePHI) such as computers, networks, email, software, electronic transmissions, etc.
Governs how information is used and shared and by whom	Governs how data is protected electronically
Focuses on individual rights, access, and permitted uses/disclosures	Focuses on data security safeguards
Sets rules for disclosure and minimum necessary use	Requires technical, physical, and administrative controls
Example: Who can access plan-related PHI	Example: Encrypting benefits platform systems

 

Proposed HIPAA Security Rule Changes

HIPAA compliance is evolving, and employers should be prepared for continued regulatory attention in 2026. While not every proposed change is final, the proposal signals continued regulatory emphasis on documentation, cybersecurity, risk management, vendor oversight, and the protection of electronic PHI.

The proposed changes are outlined in the Federal Register’s HIPAA Security Rule proposed rule.

Key Points and Proposed Changes

On January 6, 2025, HHS published a Notice of Proposed Rulemaking to make changes to the Security Rule under HIPAA.

The proposed HIPAA Security Rule updates would make compliance more specific and documentation-heavy for covered entities and business associates. If finalized, regulated entities would likely need to show more detailed proof of how ePHI is identified, protected, monitored, and reviewed.

Below is a non-exhaustive outline of newly explicit requirements under the Security Rule that should be considered by HIPAA-regulated entities.

• Written documentation of all security policies, procedures, plans, and analyses.
• Written security risk analysis that must be reviewed and updated at least once every 12 months and should include the identification and risk assessment of all reasonably anticipated threats and potential vulnerabilities.
• Plan document must require the plan sponsor to:
  • Comply with administrative, physical, and technical safeguards;
  • Ensure that any agent that receives ePHI agrees to comply with the same; and
  • Notify plans within 24 hours upon activation of contingency plans.
• Technology asset inventory and network map (an illustration/description of the movement of ePHI through the entity’s electronic information systems).
• Risk management plan addressing risks identified during analysis.
• Procedures for incident response and disaster recovery for restoration of certain systems and data within 72 hours of a loss that must be tested and revised at least annually.
• Annual Security Rule compliance audit.
• Annual security awareness training for workforce members with access to or managing ePHI.
• Updates to business associate agreements, including requirements for business associates to:
  • Provide notification within 24 hours of activating contingency plans; and
  • Provide annual written analyses and certifications of compliance with required technical safeguards, conducted by a subject matter expert.
• Encryption of all ePHI, both at rest and in transit (limited exceptions apply).
• Use of anti-malware protection.
• Use of multi-factor authentication (limited exceptions apply).
• Vulnerability scanning every six months and penetration testing annually.
• Implementation of network segmentation.
• Separate technical controls for backup and recovery of ePHI.

Proposed HIPAA Security Rule Timeline

• December 27, 2024: HHS/OCR issued the proposed rule to update the HIPAA Security Rule and strengthen cybersecurity protections for electronic PHI.
• January 6, 2025: The proposed rule was published in the Federal Register.
• March 7, 2025: The public comment period closed.
• May 2026: HHS/OCR’s regulatory agenda currently lists this as the target date for final action, though regulatory agenda dates are estimates and may change.
• After finalization: The final rule, if issued, would specify the effective date and any compliance timeline.

How Brokers Help Employers Stay Compliant

HIPAA compliance can be complex for employers, especially when group health plans, vendors, employee data, and cybersecurity expectations are involved. Brokers can help employers understand where HIPAA may apply, what responsibilities belong to the health plan, and how to keep plan-related PHI separate from employment records.

Brokers also help employers identify potential compliance gaps, such as missing business associate agreements, outdated policies, limited training, or unclear PHI procedures. By connecting employers with compliance resources, carrier guidance, technology partners, or legal and administrative support, brokers can help reduce risk and simplify compliance.

As regulations and enforcement priorities evolve, brokers can provide timely reminders and ongoing education to help employers stay proactive and protect sensitive health information.

Need Help Navigating HIPAA Compliance?

HIPAA compliance can be difficult to navigate alone, especially as rules, cybersecurity risks, and vendor responsibilities continue to evolve.

📧 Connect with our team of experts for practical guidance, compliance resources, and employer-ready tools and webinars that help reduce risk and support stronger benefits administration.


This article is for general educational purposes only and should not be considered legal advice. Employers should consult legal counsel or qualified compliance advisors about their specific HIPAA obligations.