HR Tip: HIPAA and a work-related injury

HIPAA authorization is not required for workers' comp information used to determine benefits to an injured worker. According to the Department of Health & Human Services, the HIPAA Privacy Rule does not apply to entities that are workers' compensation insurers, workers' compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. However, these entities need access to the health information of individuals injured on the job or who have a work-related illness to process or adjudicate claims, or to coordinate care under workers' compensation systems. The Privacy Rule recognizes the legitimate need of insurers and other entities involved in the workers' compensation systems to have access to individuals' health information as authorized by State or other law. Due to the significant variability among such laws, the Privacy Rule permits disclosures of health information for workers' compensation in several ways.

Disclosures without Individual Authorization. The Privacy Rule permits covered entities to disclose protected health information to workers' compensation insurers, State administrators, employers, and other persons or entities involved in workers' compensation systems, without the individual's authorization as authorized by and to the extent necessary to comply with laws relating to workers' compensation or similar programs established by law that provide benefits for work-related injuries or illness without regard to fault.
Disclosures with Individual Authorization. Covered entities may disclose protected health information to workers' compensation insurers and others involved in workers' compensation systems where the individual has provided his or her authorization for the release of the information to the entity.
Minimum Necessary. Covered entities are required reasonably to limit the protected health information disclosed to the minimum necessary to accomplish the workers' compensation purpose. Under this requirement, protected health information may be shared for such purposes to the full extent authorized by State or other law. Covered entities are required reasonably to limit the protected health information disclosed for payment to the minimum necessary. Covered entities may disclose the amount and types of protected health information necessary to obtain payment for health care provided to an injured or ill worker.