Legal Question in Civil Rights Law in Virginia

The chief issue here would seem to be whether the employer was a so-called "covered entity" under applicable federal Hipaa law (Health Portability and Accountability Act) of 1996,and, if so, whether it could legally perform the activity in the manner described.

The first question would appear to depend on whether the employer, (defined under Hipaa as a business associate) was sending the protected medical information via an electronic medium in order to obtain the insurance premium quote. If not, then the employer would apparently not qualify as a covered entity and the answer to the question would be, yes, the employer has such right.

However, even if it was determined that the employer was transmitting the protected information by electronic means and therefore was a covered entity under Hipaa, the activity described would appear to be permissible as exceptions under the treatment, payment, health care operations of the employer which allow for the transmission of such personal employee medical history/information and without the employee's permission for the purpose of obtaining a medical insurance premium quote for the company's workforce as a whole.