Woman reading about HIPAA

The summer fun continues this week with Chapter 2 of the Family and Medical Leave Act (FMLA) Summer School. This week, we dive into how the FMLA and the Health Insurance Portability and Accountability Act (HIPAA) interact. Again, this question came directly from our FMLA Deep Dive Webinar. So, sit back with that refreshing summertime lemonade, and enjoy!

Today’s lesson: HIPAA!

Question: What happens if a health care provider (“HCP”) refuses to fill out the FMLA certification paperwork based on HIPAA?

Answer: First, let’s look at a bit of background about HIPAA.

HIPAA – The Basics

HIPAA was enacted in 1996 to set national standards for the protection of certain health information. The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes these standards for individuals’ privacy rights and to address the use of certain health information by “covered entities” – those subject to the Privacy Rules. According to the federal Department of Health and Human Services (“HHS”), a “major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and wellbeing.”

As mentioned above, the Privacy Rule standards apply only to specified covered entities. According to the law, that includes health plans, health care clearinghouses, and any health care provider who transmits health information in electronic form, in connection with specified transactions for which the HHS has established standards.

HIPAA and the FMLA

Now, how does HIPAA impact the FMLA certification process? To determine whether an employee qualifies for FMLA leave, an employer can require sufficient medical information to support the FMLA request. However, an HCP may be restricted by HIPAA from divulging the protected health information of their patients to third parties, such as an employer. So, what is an employer to do?

First, remember that it is always an employee’s responsibility to submit a complete and sufficient certification form in order to prove FMLA eligibility. Therefore, an employee can personally deliver the completed FMLA certification form to the employer. If an employee is unable or unwilling to return the completed FMLA certification themselves, many providers will often allow release of protected health information upon receipt of a HIPAA-compliant authorization form. Such form, signed by the employee, will authorize their HCP to send the completed form directly to the employer.

In some cases, an employer may find that the FMLA certification form is incomplete or provides insufficient information to determine whether the employee qualifies for FMLA leave. In such cases, the FMLA requires the employer to give the employee written notice of the deficiencies and allow the employee seven days to submit the missing information. During this incomplete or clarification process, the HCP may again rely on the HIPAA compliant form to provide the protected health information being requested by the employer or administrator. The individual who reaches out to the HCP must be a healthcare practitioner, an HR professional, a leave administrator, or a management official – under no circumstances may such individual be the employee’s direct supervisor.

Follow-Up Question: But what if the employee refuses to sign an authorization?

Don’t forget – the employee still has the option to personally return the certification requested to provide proof of FMLA eligibility. However, if the employee refuses to personally deliver the completed FMLA certification form to the employer AND refuses to sign a HIPAA-compliant authorization form, then there is not much an employer can do, other than deny the request. Courts across the country have consistently held that an employee’s inability to comply with the notice and/or certification process for FMLA leave precludes entitlement to FMLA protections. Thus, if the employee refuses to provide sufficient information to determine their eligibility for FMLA, then the employer is not obligated to grant the FMLA request.

Don’t worry – the summer has just started! There will be more great lessons on tricky FMLA topics and leave management. Until then, top off the lemonade, reapply your sunscreen, and stay tuned for our next chapter!

What ReedGroup is Doing

ReedGroup continuously tracks and analyzes current and pending leave and accommodation legislation to determine potential impacts to our customers. In addition, ReedGroup monitors guidance from agencies such as the Department of Labor and Equal Employment Opportunity Commission and incorporates that guidance into our administration when appropriate.

If you’re looking for assistance managing leave of absence or accommodations or to ensure compliance across your organization, ReedGroup has solutions for you. Review our offerings here.


Information provided on this blog is intended for general educational use. It is not intended to provide legal advice. ReedGroup does not provide legal services. Consult an attorney for legal advice on this or any other topic. 

Previous FMLA Summer School – Chapter 3: Benefits
Next FMLA Summer School is in Session! Chapter 1: 12 Weeks!