The HIPAA privacy doesn't apply to employers, unless that employer is self-insured. There are a bunch of rules around that. But PHI as a concept doesn't need H

The HIPAA privacy doesn't apply to employers, unless that employer is self-insured. There are a bunch of rules around that. But PHI as a concept doesn't need HIPAA. In fact, it's probably good practice to isolate PHI, even if you don't need to be HIPAA-compliant. The PHI is only one join away anyway.