The rule requires that group health plans cannot disclose protected health information about employees to employers except as it relates to providing and paying for health care. Employers will also be required to create firewalls between company officials who work on company health plans and those involved in personnel or employment related matters.