When your employer uses Gusto to manage health benefits, Gusto collects your health insurance choices, dependent information, and related health data as part of benefits administration.
Previous version had no excerpt; current version adds specific examples of health data types collected (insurance elections, dependent information, health plan data).
View full change record →Employees whose health benefits are managed through Gusto have their health insurance elections and potentially their dependents' information held by Gusto, which may or may not be subject to HIPAA protections depending on Gusto's contractual role.
Cross-platform context
See how other platforms handle Health Benefits Data Processing and similar clauses.
Compare across platforms →Health benefits data is among the most sensitive personal information, and depending on Gusto's role, it may trigger HIPAA obligations that provide stronger protections than general privacy law.
(1) REGULATORY FRAMEWORK: HIPAA (45 CFR Parts 160, 164) applies if Gusto qualifies as a Business Associate under 45 CFR §160.103 by handling Protected Health Information (PHI) on behalf of a covered employer health plan. CPRA classifies health information as 'sensitive personal information' (§1798.140(ae)(1)) requiring enhanced disclosure. ADA (42 U.S.C. §12112) and GINA (29 U.S.C. §1182) restrict use of health and genetic information in employment contexts. HHS OCR enforces HIPAA; EEOC enforces ADA/GINA. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.