edited to make the boxes right
http://www.legalworkplace.com/hipaa-misunderstandings-blog.aspx It is never a violation of HIPAA to ask for information. Assuming that HIPAA applies at all, it is the release of information that is covered by HIPAA. Whether you want information about a potential accommodation under the Americans with Disabilities Act, are looking for Family and Medical Leave Act paperwork to be completed, or just plain want the chronically absent employee to bring in a doctor's note justifying the absence, you are not violating HIPAA by making the request. Now, if the doctor provides you with the information without the employee's authorization, the doctor might be in violation, but your request is not.
http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/index.htmlYour health information cannot be used or shared without your written permission unless this law allows it. For example, without your authorization, your provider generally cannot:
Give your information to your employer
Use or share your information for marketing or advertising purposes
Share private notes about your health care
http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/employers.htmlRequests from your employer
The Privacy Rule does not prevent your supervisor, human resources worker or others from asking you for a doctor’s note or other information about your health if your employer needs the information to administer sick leave, workers’ compensation, wellness programs, or health insurance.
However, if your employer asks your health care provider directly for information about you, your provider cannot disclose the information in response without your authorization.
Covered health care providers must have your authorization to disclose this information to your employer, unless other laws require them to disclose it.
http://www.hhs.gov/ocr/privacy/hipaa/understanding/consumers/courtorders.htmlCourt Orders and Subpoenas
A covered health care provider or health plan may disclose protected health information required by a court order, including the order of an administrative tribunal. However, the provider or plan may only disclose the information specifically described in the order.
A subpoena issued by someone other than a judge, such as a court clerk or an attorney in a case, is different from a court order. A covered provider or plan may disclose information to a party issuing a subpoena only if the notification requirements of the Privacy Rule are met. Before the covered entity may respond to the subpoena, the Rule requires that it receive evidence that reasonable efforts were made to either:
notify the person who is the subject of the information about the request, so the person has a chance to object to the disclosure, or to
seek a qualified protective order for the information from the court.