Hungry Hungry HIPAA: Could It Mean Potential Liability for Medical Providers?

(WorkersCompensation.com) - For more than 20 years, the Health Insurance Portability and Accountability Act (HIPAA) has been the law of the land. The voluminous act contains many provisions not relevant to the workers’ compensation industry. However, there are issues within the privacy law section of HIPAA that workers’ compensation medical providers and insurers should be aware of in order to ensure compliance. 

The general privacy rule as codified in the Code of Federal Regulations 45 CFR 164.508 states that absent a valid release executed by the patient, a “covered entity,” which generally means a health care provider or an insurer, cannot disclose or otherwise use “protected health information,” defined as “information identifiable to the patient.”  

At first blush, this particular provision may seem to be a problem in the workers’ compensation arena. An employer needs to be able to determine if an injury is work-related and doing so requires access to medical records. Similarly, a workers’ compensation insurance provider also needs to have this information. On the flip side, employees can sometimes be hesitant to sign a waiver, thinking it might provide their employer with an entire account if their medical history.            

So what should a health care provider that provides workers’ compensation evaluations do? 

Fortunately, HIPAA provides a carve-out for workers’ compensation matters. Under 45 CFR 164.512 (I), a “covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs...” Where problems tend to arise concerns what information is and is not “necessary to comply” with workers’ compensation laws. 

Generally, only information that relates to the specific injury should be disclosed. Also, HIPAA does not allow for a private right of action, meaning that aggrieved individuals cannot file a lawsuit for HIPAA violations in civil court. Instead, the harmed individual must file a complaint with the Health and Human Services Office for Civil Rights or the state attorney general. The result of such claims is usually compliance agreements or consent orders meaning that health care providers will usually not be hit with damage awards that could also include attorney’s fees.

The HIPAA workers’ compensation exemption combined with the lack of a private right of action would seem to greatly limit potential liability for workers’ compensation medical providers. Recently, though, clever plaintiff’s attorneys have managed to file private lawsuits for HIPAA violations under a negligence theory.

In Connecticut, for example, a physician’s office provided medical records under a subpoena that did not comply with HIPAA. The suit alleged that HIPAA creates a “standard of care” with which medical providers must comply, and the doctor’s office breached that standard of care by supplying the medical records in response to a non-compliant subpoena. The Connecticut Supreme Court upheld the legal theory, and the case is currently proceeding through the state court system. 

In a worker’s compensation setting, this heightened standard of care could potentially be used to allege that the health care provider disclosed more information than was reasonably necessary to comply with the law. An example could be a pre-existing condition that may or may not be relevant to the alleged workplace injury. Given the potential liability, it would be prudent for workers’ compensation health care providers and insurers to be sure that they are providing only medical information that is relevant to the claim.  

Although HIPAA provides safeguards for the workers’ compensation industry, there should still be a general awareness of the law in order to ensure full compliance. Particularly in jurisdictions with a more liberal court system, there could potentially be a finding of liability for a violation that could easily have been prevented with some knowledge as to HIPAA and its requirements.

Share This Article: