Does HIPAA apply to workers comp?

HIPAA regulations do apply to workers' compensation scenarios. While protected health information (PHI) can be shared without individual authorization for treatment, payment, or healthcare operations related to the injury or illness, entities involved must adhere to HIPAA's privacy and security provisions when handling PHI.

Understanding HIPAA and workers comp

According to the HHS, “the HIPAA privacy rule does not apply to entities that are either workers’ compensation insurers, workers’ compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. However, these entities need access to the health information of individuals who are injured on the job or who have a work-related illness to process or adjudicate claims, or to coordinate care under workers’ compensation systems.”

Read also: 

• What is the HIPAA privacy rule?
• What are HIPAA’s Privacy Rule provisions? 

Disclosures without individual authorization

The privacy rule allows covered entities to disclose protected health information (PHI) to workers' compensation insurers, state administrators, employers, and other entities involved in workers' compensation systems without the individual's authorization. These disclosures are permitted under the following circumstances:

• Compliance with workers' compensation laws: Covered entities can disclose PHI as authorized by and to the extent necessary to comply with laws relating to workers' compensation or similar programs established by law. This includes programs like the Black Lung Benefits Act, the Federal Employees' Compensation Act, the Longshore and Harbor Workers' Compensation Act, and the Energy Employees' Occupational Illness Compensation Program Act. (45 CFR 164.512)
• Disclosure required by state or other law: Covered entities can disclose PHI to the extent state or other laws require. However, such disclosures must comply with the law and be limited to what the law demands. (45 CFR 164.512)
• Obtaining payment for healthcare: Covered entities can disclose PHI to obtain payment for any healthcare provided to the injured or ill worker. This helps facilitate the reimbursement process and ensures appropriate compensation for healthcare services. (45 CFR 164.501)

Disclosures with individual authorization

In addition to the circumstances mentioned above, covered entities may disclose PHI to workers' compensation insurers and other entities involved in workers' compensation systems if the individual is authorized to release the information. This authorization must adhere to specific requirements outlined in the HIPAA privacy rule.

Read more: Sharing patient information with authorization 

Minimum necessary requirement

While covered entities are allowed to disclose PHI for workers' compensation purposes, they are required to reasonably limit the amount of information disclosed to the minimum necessary to accomplish the intended purpose. This requirement applies to both workers' compensation purposes and payment purposes.

See also: HIPAA Compliant Email: The Definitive Guide

FAQS

Does HIPAA apply to workers' compensation cases?

Yes, to some extent: HIPAA does apply to certain aspects of workers' compensation cases, particularly regarding the privacy and security of an individual's medical information.

Can employers access an employee's medical information under HIPAA for workers' compensation purposes?

Generally, under HIPAA, employers do not have unrestricted access to an employee's medical information. They are typically only provided with certain medical information related to a work-related injury or illness, and this information is subject to the privacy and security requirements outlined in HIPAA.

What should employers and healthcare providers know about HIPAA and workers' compensation?

To ensure compliance, employers and healthcare providers involved in workers' compensation cases should be well-versed in HIPAA regulations. This includes understanding when and how medical information can be shared, the necessity of obtaining appropriate authorizations, and the importance of safeguarding the privacy and security of medical records.