Hi, I will make this quick.
an employee has been required by the doctor to go from 5 day work weeks to 3 day work weeks because of health issues.
the employee emails her supervisor and explains some details of her condition and how she can manage her position working 3 days a week.
The supervisor forwards the email to his "girlfriend" that works at a completely different company and just puts in the forward "FYI".

Can this be ok to do?

Thanks
saaben

Definitely NO.

This supervisor should be disciplined severely. If this supervisor treats such info in this manner, I can only shudder at what else might have been told to others.

If this company places any value on its proprietary material and processes or has trade secrtes that it wishes to protect, it runs a great risk keeping this supervisor. Keeping this Supervisor also would be setting a bad example and establishing a precedent that could create a problem in the future when the company might have to try to either discipline an employee or seek legal protection for its trade secrets etc.

HIPAA aside, there is much more at stake.

What if i told you it was the president of a non profit organization.

Then you have a potential problem for the Board of Trustees and the D&O insurance carrier if this is reported by the affected employee. Unfortunately, I do not think that is suits any current employee to complain about the President of any org, the Board would never listen. So if you are not the affected employee (and who wants to keep their job) forget about it. Or make an anonymous report to the federal Dept Of Labor's division that enforces HIPAA compliance and civil rights violations.

Thanks so much for you reply, it helps me alot.
saaben

There has definitely been a violation of privacy and a lack of good sense here. But, I believe HIPAA rules only apply to health care information collected by or used by the health care plan. I don't believe the HIPAA regulations apply to information volunteered for disability or life insurance situations.

I agree. There is no HIPAA violation here.

HIPAA does not apply to absence management information. However, some state courts (notably New Jersey) have used HIPAA as the standard for common-law privacy issues. Certainly this practice should be avoided.

Also, just as a side note, the Federal Department of Labor does not enforce HIPAA privacy rights. The Department of Health and Human Services does.

The DOL would only have the ability to get involved if the HIPAA violation also constituted a failure to follow the terms of the plan document (i.e., the HIPAA amendment). Even then, I believe they would defer the investigation to HHS.