Posted in December 2012

Are NFL Teams Covered Entities Under HIPAA?

Even NFL coaches know about HIPAA and are interpreting it to the news Media!  John Harbaugh, head coach of the Baltimore Ravens got pretty peeved  the week after the Ravens were fined $20,000 by the NFL for not listing Ed Reed on the injury report.  Their head coach John Harbaugh said that the team will cite every “hangnail” going forward, and questioned the validity of the weekly report.

“There’s no credence on the injury report now,” Harbaugh said. “It doesn’t mean anything. It has no value. The injury report has no value.”

Ed  Reed confessed he had been playing most of the season with a slightly torn labrum. The Ravens never listed him because  he  hadn’t missed any game or practice time with the injury.

“If a guy that goes out there and doesn’t miss a practice and doesn’t miss a game and doesn’t want to be on the injury report and we have to put him on the injury report, I want the league’s answer on that,” Harbaugh said. “I’m looking forward to hearing that.”

Harbaugh also questioned the wording of the league’s injury report policy which states, “All players with significant or noteworthy injuries must be listed on the report, even if the player takes all the reps in practice, and even if the team is certain that he will play in the upcoming game. This is especially true of key players and those players whose injuries have been covered extensively by the media.”

“I’ll go back to the significance thing. The way the thing is written, it says, ‘if a player has practiced fully or played fully and he has an injury and he is a significant player and it affects his play, then he should be on there.’ Well, I think player safety is important for all of the players. I’m going to say that every injury is significant,” Harbaugh said. “If that’s how they want to word it, I’m not going to go with the league saying that one player is more significant than another player. That’s absurd to me. They can get mad at me if they want for saying that, but they need to write that a little more clearly. We’ll just put every guy on there that has a hangnail and go from there.”

Harbaugh also voiced concerns about player’s privacy. “Aren’t there HIPAA rights here?,” Harbaugh asked. “If I’m a player and I’ve been out there playing and I don’t want that on the injury report and I’m told I have to put that on the injury report, we’ve got some players that resent that. So yeah, I got a problem with that in all honesty.”

Some quick research on my part produced this link to the NFL Injury Report where, for example you can see that Atlanta Falcon Zach Streif and Atlanta Falcon Sam Baker are both struggling with groin issues.   So I assume from all of this that NFL players are required by the terms of their contracts to disclose conditions that might impact their play.  Further perusal of the website led me to theorize  that one of the purposes of the injury report is to assist fantasy football participants and Vegas odds-makers.  I guess if you were betting on the Kentucky Derby you’d want to know if your horse had a groin injury.  Same difference, right?

And coach Harbaugh’s HIPAA reference gives me a jumping off point to clear up a frequently believed myth that anytime someone’s health information is disclosed someone or some entity has violated HIPAA. This is not the case.  HIPAA can only be violated  by individuals and entities within HIPAA’s purview.  These are called covered entities.  HIPAA violations can also be committed by business associates who have contracts with covered entities.  I initially was going to say that it would appear that The National Football League and teams are not a covered entities.  The players are contracted employees of their teams and HIPAA does not apply to employers.  So health records in your employment file aren’t protected under HIPAA, but may be protected by other confidentiality laws.  But then I realized that the teams  have physicians who treat the players.  Physicians are typically covered entities when they treat patients.  But then I went to this flowchart  I would argue that the main job of  NFL teams is playing football,  but accompanying that, they are obviously intimately involved with the health of a player and his ability to play. So it would appear that the teams furnish health care in the normal course of business.  So we say “yes” and move forward on the chart.


Then, the next part of the chart asks if  the person or business sends any covered transactions electronically.  I do not know what their practice is, however, if they do send electronic transactions, the chart indicates the team would be a covered entity.  If it does not send electronic transaction it would not be covered by HIPAA.  So, if all the health information is transmitted by paper only they could ostensibly scoot out from under HIPAA.    Also, it could be that players agree to disclosure of relevant injuries as part of their contracts.  Further, from the sound of this article, it sounds like players only have to report general types of injuries and that things like specific treatment they are undertaking would be covered by HIPAA.

So my conclusion is that team treating physicians are covered by HIPAA so only the most general type of disclosure is made, but specifics of treatment and other non-football related health issues are not disclosed due to HIPAA concerns.

Please comment if you think differently or have some insight to add.