Disclosing information to employers

Q: A patient came to my office with a note from his employer, who wanted to know the patient's diagnosis. If I didn't provide the information, my patient informed me, he wouldn't be paid for his time out of the office. Do employers have the right to request such information?

A: Yes. Since employers aren't covered entities under HIPAA, they aren't subject to any of its confidentiality rules. On the other hand, you are a covered entity, and, therefore, can't release protected medical information except as defined by HIPAA. Generally, this means that the release must pertain to treatment, payment, or healthcare operations, or must be authorized by your patient, or must be required by law. In the case you describe, you may release medical information to your patient's employer, but only after your patient gives you his signed authorization.