The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes national standards for protecting individually identifiable health information (Protected Health Information, or PHI). The Privacy Rule governs who can access PHI and under what circumstances; the Security Rule requires administrative, physical, and technical safeguards for electronic PHI. In occupational health, HIPAA applies to covered entities (clinics, labs, MROs) handling worker medical records. Notably, employment records — including DOT drug test results reported to the employer — are generally not considered PHI under HIPAA. However, medical records at the occupational health clinic or MRO office are covered. Business Associate Agreements (BAAs) must be in place between covered entities and any third party that handles PHI.