The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that required the creation of national standards to protect sensitive patient health information from being disclosed without the patient’s consent or knowledge. The HIPAA Enforcement Rule and Breach Rule establishes regulations on how HHS may determine liability. This is all done in an effort to keep up with advancing technologies while meeting the demand of patient privacy. In regard to workers’ compensation, this means obtaining and securing medical information within HIPAA’s rules and guidelines.
How are HIPAA and Workers’ Compensation Connected
HIPAA’s Privacy Rule allows compensation insurers, third-party administrators, as well as some employers to obtain pertinent medical information in order to manage the workers’ compensation claim(s). Disclosure of medical information varies for each state and there are some instances where a medical release/authorization is not a requirement.
The Privacy Rule for Workers’ Compensation is designed to provide the minimal necessary information needed in order to manage a claim. Workers’ compensation carriers, as well as administrators, will typically send authorization release forms to the injured employee(s) upon the receipt and set up of a workers’ compensation claim to ensure that are in full compliance with HIPAA’s state laws. The following are some guidelines regarding health care providers’ continuing obligation to provide medical records to the Board:
- Pursuant to an order of a Workers’ Compensation Law Judge (WCLJ): This exemption can be found in the Privacy Rule at 45 CFR §164.512. If a WCLJ directs the taking of medical testimony or depositions, health care providers are not restricted by HIPAA and under New York State Law must comply with the WCLJ’s direction.
- In compliance with Workers’ Compensation Law with reasonable assurances from the requesting party that the claimant has been notified. This exemption can be found in the Privacy Rule at 45 CFR §164.512 (e) and (l). WCL §13-a(4)(a) and 12 NYCRR §325-1.3 require health care providers to regularly file medical reports of treatment with the Board and the carrier or employer. Additionally, WCL §13-(g) requires hospitals to provide all related medical records within 20 days of receiving a request. The Claim for Compensation (C-3) and the Notice of Indexing (EC-64) have been modified to include a HIPAA Notice on the reverse side. This Notice informs claimants that their health care providers are required to regularly file medical reports. Filing a C-4 with accompanying description is a “lawful process” in compliance with Workers’ Compensation Law and health care providers may continue to file this information with the Board and the carrier or employer in compliance with the WCL. As with Item 1 above, the WCL requires the filing of medical reports.
- For the health care provider’s own payment operations. This exemption can be found in the Privacy Rule at 45 CFR §164.502(a)(1)(ii) and §164.501 definition of “payment.” WCL §13-f requires that medical records be provided to the Board and the carrier or employer before they will be required to pay for any medical services.
Navigating the complicated process of submitting a workers’ comp claim and standing up for your rights as an injured worker are not something you should face on your own. The expert team of attorneys of Erwin, McCane & Daly are well versed in every aspect of workers’ compensation and ready to take on your case. Contact us today so we can get started!
