I have been asked to draft a document for human resources employees to sign that advises them of the confidentiality of medical and personnel records and contains a promise to not disclose that information. I suppose the consequence for breaking this promise might be a stern talking-to or perhaps a reprimand using sharp tones. This, of course, ignores the obvious fact that we probably should not hire anyone in an HR capacity who does not already understand privacy rules and HIPAA. Having made a cursory search for such an agreement, and being an essentially lazy person, I thought I would see if any of you had something in hand already before I actually had to apply myself in finding a close approximation and subsequently exercising judgment and logic in molding said instrument to my specific needs. Any help would be appreciated.

Our folks generally are politely reminded that distributing confidential information (as some PHI plainly is) can land them in the graybar hotel for up to six months under Gov't Code sec. 552.352. Moreover, if the information is used with intent to obtain a benefit or harm or defraud another, why, that's misuse of official information, a rather unseemly third degree felony. So, it may be useful to folks going to work for your HR department that the form simply notes that significant criminal penalties may attach to the disclosure of health care information without appropriate employee or legal authorization.

Thanks for the info, Scott. I may not use as many syllables, but it is a good idea to remind employees of the gravity of their duties.