Me again. Should have added that you can get around the PIPA issues by asking employees to indicate their allergies without disclosing their identities. PHI, in other words, is protected only when it can be traced to an identifiable individual. If that’s not possible, asking about allergies for EAP purposes would probably be OK under PIPA as long as you:
- Ask only for the info you need to make decisions on EAP coverage
- You tell employees why you’re collecting the info and how you intend to use it
Good luck and I hope that helps.