Call Call
Menu Menu

EMD Blog

HIPAA Guidelines and Workers’ Compensation

Erwin, McCane & Daly | Thursday, February 08, 2018
The Health Insurance Portability Accountability Act (HIPAA) was put into effect to protect paper form medical records. This has since been updated to the HIPAA Enforcement Rule and Breach Rule in an effort to keep up with advancing technologies while meeting the demand of patient privacy. With regards to workers’ compensation, this means obtaining and securing medical information within HIPAA’s rules and guidelines. 

How are HIPAA and Workers’ Compensation Connected

HIPAA’s Privacy Rule allows compensation insurers, third-party administrators, as well as some employers to obtain pertinent medical information in order to manage the workers’ compensation claim(s). Disclosure of medical information varies for each state; there are some instances where a medical release/authorization is not a requirement. The Privacy Rule for Workers’ Compensation is designed to provide the minimal necessary information needed in order to manage a claim. 

Workers’ compensation carriers, as well as administrators, will typically send authorization release forms to the injured employee(s) upon the receipt and set up of a workers’ compensation claim to ensure that are in full compliance with HIPAA’s state laws. With the exception of submitting health information to the Workers’ Compensation Board and the carrier of employer in three situations:

1. Pursuant to an order of a Workers' Compensation Law Judge (WCLJ): This exemption can be found in the Privacy Rule at 45 CFR §164.512. If a WCLJ directs the taking of medical testimony or depositions, health care providers are not restricted by HIPAA and under New York State Law must comply with the WCLJ's direction.

2. In compliance with Workers' Compensation Law with reasonable assurances from the requesting party that the claimant has been notified. This exemption can be found in the Privacy Rule at 45 CFR §164.512 (e) and (l). WCL §13-a(4)(a) and 12 NYCRR §325-1.3 require health care providers to regularly file medical reports of treatment with the Board and the carrier or employer. Additionally, WCL §13-(g) requires hospitals to provide all related medical records within 20 days of receiving a request. The Claim for Compensation (C-3) and the Notice of Indexing (EC-64) have been modified to include a HIPAA Notice on the reverse side. This Notice informs claimants that their health care providers are required to regularly file medical reports. Filing a C-4 with accompanying description is a "lawful process" in compliance with Workers' Compensation Law and health care providers may continue to file this information with the Board and the carrier or employer in compliance with the WCL. As with Item 1 above, the WCL requires the filing of medical reports;

3. For the health care provider's own payment operations. This exemption can be found in the Privacy Rule at 45 CFR §164.502(a)(1)(ii) and §164.501 definition of "payment." WCL §13-f requires that medical records be provided to the Board and the carrier or employer before they will be required to pay for any medical services. 




Workers’ comp and your rights as an injured worker are not something you should face on your own. You will need an expert team of attorneys at your side helping you navigate the process every step of the way. The attorneys of Erwin, McCane & Daly are well versed in every aspect of workers’ compensation and will put your mind at ease. Contact us today so we can get started!