Confidentiality

The HIPAA Privacy Rule (45 CFR Parts 160 and 164) provides privacy protection for health information. Under the Privacy Rule, protected health information (PHI) is defined very broadly. PHI includes individually identifiable health information related to the past, present or future physical or mental health or condition, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

The Privacy Rule prohibits the disclosure of health information for employment-related decisions without the explicit authorization of the individual.  However, there are several instances when an employer may be able to obtain health information without individual authorization. Information related to pre- and post-employment drug testing is not considered protected health information (PHI) under the Privacy Rule.

The Privacy Rule does not apply to workers' compensation programs, so information obtained by Rutherford County Government as part of an On-the-Job Injury claim is not protected under the Privacy Rule.  In addition, Department of Transportation regulations, the Federal Aviation Administration, and the Federal Highway Administration rules, contain provisions that require doctors and others to disclose health information to employers. Such disclosures are permitted when required by law and become part of an employee's employment file, which is not subject to the Privacy Rule. However, any medical records obtained by Rutherford County Government shall remain confidential and shall not be considered to be public records.