HIPAA Regulations: General Provisions: Definitions: Workforce - § 160.103
As Contained in the HHS HIPAA Rules
|
HHS Regulations as Amended January 2013 |
Workforce means employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate
| HHS Description and Commentary From the January 2013 Amendments General Provisions: Definitions - Workforce |
[We] revise[d] the definition of “workforce member” in § 160.103 to make clear that the term includes the employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a business associate, is under the direct control of the business associate, because some provisions of the Act and the Privacy and Security Rules place obligations on the business associate with respect to workforce members.
| HHS Description From the Original Rulemaking General Provisions: Definitions - Workforce |
We proposed in the NPRM to define workforce to mean employees, volunteers, trainees, and other persons under the direct control of a covered entity, including persons providing labor on an unpaid basis.
The definition in the final rule reflects one revision established in the Transactions Rule, which replaces the term “including persons providing labor on an unpaid basis” with the term “whether or not they are paid by the covered entity.” In addition, we clarify that if the assigned work station of persons under contract is on the covered entity’s premises and such persons perform a substantial proportion of their activities at that location, the covered entity may choose to treat them either as business associates or as part of the workforce, as explained in the discussion of the definition of business associate. If there is no business associate contract, we assume the person is a member of the covered entity’s workforce. We note that independent contractors may or may not be workforce members. However, for compliance purposes we will assume that such personnel are members of the workforce if no business associate contract exists.
| HHS Response to Comments Received From the Original Rulemaking General Provisions: Definitions - Workforce |
Comment: Some commenters requested that we exclude “volunteers” from the definition of workforce. They stated that volunteers are important contributors within many covered entities, and in particular hospitals. They argued that it was unfair to ask that these people donate their time and at the same time subject them to the penalties placed upon the paid employees by these regulations, and that it would discourage people from volunteering in the health care setting.
Response: We disagree. We believe that differentiating those persons under the direct control of a covered entity who are paid from those who are not is irrelevant for the purposes of protecting the privacy of health information, and for a covered entity’s management of its workforce. In either case, the person is working for the covered entity. With regard to implications for the individual, persons in a covered entity’s workforce are not held personally liable for violating the standards or requirements of the final rule. Rather, the Secretary has the authority to impose civil monetary penalties and in some cases criminal penalties for such violations on only the covered entity.
Comment: One commenter asked that the rule clarify that employees administering a group health or other employee welfare benefit plan on their employers’ behalf are considered part of the covered entity’s workforce.
Response: As long as the employees have been identified by the group health plan in plan documents as performing functions related to the group health plan (consistent with the requirements of § 164.504(f)), those employees may have access to protected health information. However, they are not permitted to use or disclose protected health information for employment-related purposes or in connection with any other employee benefit plan or employee benefit of the plan sponsor.