I am manager of a small unit of a self-insured company with 150 employees. Our HR director recently called me to inquire about an employee who I terminated for poor performance. The HR director asked me if the former employee was "a drug addict" and said he asked because he had had to approve large payments for medication for the employee under our health plan. I told the HR director his question was inappropriate, and that it was illegal to give me such information about a fellow employee. Now the problem: I'm HIV positive and haven't used the company insurance plan for fear something like this would happen to me. I've been paying for my own insurance privately, which I no longer can afford. I want to use the company health plan. But how do I protect myself? By the way, I'm a resident of New York City.

You did the right thing by not disclosing any information. However, you should use the company health plan. HIPAA protects your right to privacy. Information regarding your health status can only be used for purposes of administering the health plan.