An area where a lot of employers, workers compensation claim adjusters and even some lawyers get confused is the requirements of HIPAA – the Health Insurance Portability and Availability Act of 1996, which became fully functional in 2003. The law was written to protect the personal health information of individuals, and to keep the personal information as private as possible.
Like most federal regulations, it was written in code. Instead of saying the HIPAA law applies to doctors, hospitals, health care clinics, and other health service providers, the HIPAA law refers to “covered entities." An employer is not a “covered entity” unless the employer is also a provider of medical services, and then HIPAA does not apply to medical information in your employment records.(WCxKit)
The HIPAA law uses another two code phrase a lot – “personally-identifiable health information” (PHI), and “protected health information” (PHI) both meaning the same thing. [Yes, two phrases meaning the same thing, both using the same acronym – PHI]. By PHI the law is referring to:
1. Health care claim forms
2. Health claim attachments
3. Health care encounter information (like the doctor's or nurse's notes in the doctor's file)
4. Eligibility for a health plan
5. Enrollment in medical insurance – like Blue Cross or Aetna
6. Health plan premiums
7. Health care payments
8. Dis-enrollment from medical insurance
9. Health care claim status
10. Coordination of health care benefits
11. Medical referral authorizations and certifications
12. Last but not least – First Report of Injury
All the PHIs were referring to health insurance until the last one listed – the First Report of Injury which is the most often used workers' compensation form. Now this is where confusion about HIPAA arises for the employer. The First Report of Injury form you complete when the employee has a work comp claim is PHI when it is in the possession of the medical service provider. When it is in the employer's workers compensation file, it is not PHI and not subject to HIPAA. (It may be subject to state privacy laws – more on that later).
The same guidelines for the employer's handling of the First Report of Injury apply to the work comp adjuster's handling of the First Report of Injury. When the adjuster requests the medical records for an injured employee, the medical provider can provide all of the PHIs listed above and not be in violation of HIPAA. The HIPAA law specifically excludes workers compensation from its far reaching tentacles.
Workers compensation insurance companies, employers who are self-insured for workers compensation, third party administrators, medical case managers and workers compensation boards/industrial commissions are allowedby HIPAA to obtain all necessary medical information for the purpose of processing workers compensation claims. State laws governing the obtaining of medical information for work comp claim handling still apply. As the state laws on workers compensation can vary tremendously from state to state, the employer needs to know and understand the work comp laws and privacy laws of the states where they do business.
Often when the employee's attorney does not want the work comp adjuster to know about the employee's preexisting double laminectomy, or some other preexisting medical issue, the attorney will try to throw-up a smoke screen telling the adjuster t they cannot have the employee's pre-injury medical records due to HIPAA. This is totally incorrect. HIPPA specifically allows in Title 45 of the Code for Federal Regulations (CFR) for disclosure of the employee's pre-injury medical history:
1. If the disclosure is authorized and to the extent necessary to comply with laws relating to workers' compensation………(to) provide benefits for work related injuries or illness {this info is in the statute – 45 C.F.R. Paragraph 164.512 (1)}
2. If the disclosure is required by state law, the disclosure is limited to whatever the law requires {45 C.F.R. Paragraph 164.512(a)}
3. If the disclosure is for the purpose of obtaining payment for health care provided to the employee { 45 C.F.R. Paragraph 164.502(a)(1)(ii)}
In most states the notification to the medical provider that the information is being requested for the purpose of processing a workers compensation claim is all the authorization needed for the medical provider to send the information to the work comp adjuster. In the few states requiringthe adjuster to obtain a medical authorization before obtaining the medical information from the medical provider, it is the state law that requires the medical authorization, not HIPAA.
In the situation noted above where the employee's attorney is trying to block the adjuster from having the information about the employee's preexisting medical condition, HIPPA does not stand in the way. The adjuster in most states will still need the medical authorization for medical records prior to the date of the employee's injury, but the adjuster can petition the work comp board to require the employee to provide the medical authorization if it is not freely provided. (WCxKit)
The employer should understand that HIPAA does not hinder the processing of work comp claims. Some states have passed their own versions of medical privacy laws that are more restrictive than HIPAA. Also, some of the states have other privacy laws limiting the information you can disclose about an employee. If you have any question about what your state requires, please consult with an employment law attorney. If you have any questions about HIPAA and its relationship with workers' compensation, please contact us. Author Rebecca Shafer, JD, President of Amaxx Risks Solutions, Inc. is a national expert in the field of workers compensation. She is a writer, speaker and website publisher. Her expertise is working with employers to reduce workers compensation costs, and her clients include airlines, healthcare, printing/publishing, pharmaceuticals, retail, hospitality and manufacturing.
Contact: RShafer@ReduceYourWorkersComp.com or 860-553-6604.
