If you’re in HR at a small business, you probably handle sensitive employee health information on a regular basis. From insurance enrollment forms to FMLA certifications, these documents contain personal medical details, and it’s your responsibility to keep them protected.
But here’s the challenge: not all health data is treated the same under the law, and the rules can be confusing. Some of the information you manage may fall under the Health Insurance Portability and Accountability Act (HIPPA), while other documents are covered by laws like the Americans with Disabilities Act (ADA), Genetic Information Nondiscrimination Act (GINA), or state privacy regulations.
At Health & Benefits Partners, we’ve spent over 20 years helping small businesses manage employee benefits. One of the most common areas we see small HR teams struggle with is understanding how health insurance data intersects with privacy laws, and how to prevent accidental breaches of that information.
Let’s break down what you need to know.
What Counts as Sensitive Employee Health Data?
If you’re handling any of the following, you’re managing sensitive personal information:
- Test results or vaccination records
- Workers’ compensation paperwork
- Health insurance enrollment or claims documents
- Medical documentation for FMLA or ADA accommodations
- Information shared during open enrollment or benefit meetings
Some of this may qualify as Protected Health Information (PHI) under HIPAA, especially if it comes from an insurance carrier or through your group health plan. Other types may fall outside of HIPAA, but they’re still protected under federal and state privacy laws.
Bottom line: If it includes private health details, treat it as confidential, no matter which law applies.
HIPAA Isn’t the Whole Story
Many small business HR reps are surprised to learn that HIPAA doesn’t automatically apply to all health-related information.
Here’s when it does apply:
- Your business sponsors a group health plan
- You’re accessing data from a health insurance carrier, TPA, or broker
- The data qualifies as PHI (e.g., claims, EOBs, enrollment forms)
But if an employee submits a doctor’s note or ADA accommodation request directly, that information may not fall under HIPAA. Still, it’s protected under other laws like the ADA and must be handled with the same level of care.
This is where things get tricky: even when HIPAA doesn’t apply, you still have legal and ethical obligations. A breach (whether accidental or malicious) can damage employee trust, lead to legal issues, or trigger penalties.
How to Prevent Breaches of Medical Information
You don’t need a massive IT budget to protect employee health data. Many breaches happen because of simple mistakes, not hackers.
Here are six smart practices to help you stay protected:
- Use Secure Systems
- Limit Access to What’s Necessary
- Strengthen Passwords and Use MFA
- Collect Data Securely
- Only Keep What You Need
- Have a Plan for Mistakes
Why Cybersecurity Protection Matters (Even At a Small Company)
Even if your business is small, you still have the responsibility of handling your employees’ personal information. If health data is leaked, it can lead to identity theft, discrimination claims, loss of trust, or it could land your company in legal trouble.
Your employees are trusting you with some of their most personal information. Handling it properly isn’t just about compliance. It’s a key part of the value you offer as their HR representative.
At Health & Benefits Partners, we go beyond plan design. We work closely with HR teams to ensure you have the tools, support, and guidance to manage employee health benefits—and the data that comes with them—safely and securely.
We’re here to help eliminate frustration, reduce risk, and support you in delivering better benefits with confidence. Reach out today to learn how we can help protect your employees and your business.
