Is employee health information in HR files protected health information?

The short answer

Employee health information in an HR file is usually not PHI. HIPAA protects health information held by covered entities (health plans, health care clearinghouses and providers that conduct standard transactions electronically) and their business associates. The Privacy Rule's definition of protected health information also carves out employment records that a covered entity holds in its role as employer. A manufacturer, software company or logistics business keeping a doctor's note in a personnel file is not handling PHI.

Two qualifications matter. The group health plan an employer sponsors is itself a covered entity, so claims and enrollment data held by or for the plan can be PHI. And not PHI does not mean unprotected: other federal and state laws restrict how employers collect, store and share medical information. The definition sits in HIPAA's general definitions at 45 CFR 160.103. This page links no primary text for it, so read the current regulation with counsel rather than relying on a summary.

Where does employee health information sit, and which rules apply?

Healthcare employers are the tricky case. When a hospital treats one of its own nurses, the treatment record is PHI held by the hospital as a provider; the same nurse's leave certification in the HR file is an employment record. The two live in different systems for a reason, and HR generally needs the employee's authorization to use the clinical record for employment purposes.

Which other laws protect employee health information?

• Federal disability law. Medical information an employer obtains through exams or inquiries must be kept confidential and stored apart from the general personnel file, with narrow exceptions such as telling supervisors about necessary accommodations.
• Genetic information rules. Federal law restricts employers from requesting or using genetic information, including family medical history, and requires confidentiality for what they do hold.
• Family and medical leave rules. Medical certifications and related records are kept as confidential medical records in separate files.
• California privacy law. The California Consumer Privacy Act gives consumers, a group that now includes a covered business's California workforce, rights that include limiting the use of sensitive personal information, and health information falls in that category. California also has a medical-information confidentiality statute with provisions aimed at employers.
• Other states. Several states add their own medical-privacy or biometric rules for employers. Rules vary by state; check with employment counsel.

Why licenses exclude HR health information anyway

Whether or not a file is PHI, it has no place in an AI training license. AI labs and data buyers want records of how work gets done: tickets, approvals, project histories, decisions and outcomes. A personnel file's health content adds legal exposure and almost nothing to that picture. SourceX treats datasets made up mainly of PHI, with no HIPAA authorization or de-identification, as a red flag, and it settles exclusion and redaction rules with the company before any processing starts. For the separate question of training AI on PHI held by providers and plans, see HIPAA and AI training data.

The practical problem is that health details leak outside HR systems. A manager forwards a doctor's note by email, a chat thread discusses someone's surgery dates, a shared drive keeps old accommodation forms. A data map built for privacy compliance is the fastest way to find those pockets before an inventory is built.

The HR health-information sweep

Work through this list before the company completes its data inventory.

• List every system that stores employee health information: HRIS, leave management, benefits portal, wellness vendor, occupational health.
• Mark group health plan and third-party administrator data as PHI and out of scope.
• Search email, chat and shared drives for doctor's notes, leave certifications and accommodation forms, and agree an exclusion or redaction rule for each pocket.
• Check whether any part of the business is itself a covered entity or business associate, as clinics, labs, billing firms and health plans are.
• Confirm which state laws apply to the workforce, starting with California staff and the notice they received; a California employee privacy notice template shows what that notice should cover.
• Record each exclusion decision in the inventory so buyers can see what was left out and why.

Monitoring software can also capture health details on screen; the guide to keystroke and screen monitoring covers that separate problem.

Questions to ask your counsel

1. Is any part of our business a covered entity or business associate, and which systems hold PHI as a result?
2. Who can access group health plan information, and is it walled off from HR decisions?
3. Where do exam, leave and accommodation records live, and are they separate from personnel files?
4. Which state medical-privacy or employee-privacy laws apply to our workforce?
5. Which exclusion and redaction rules should apply before any records are licensed?

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

Next step

Partners who advise employers can test a company's fit with the company fit checker, then read how it works to see where exclusions are decided. When a company looks promising, register as a partner and make the introduction, or have the owner apply at sourcex.si/apply.