It All Starts with HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) serves as the basis for healthcare privacy and the dissemination of medical records in the United States. The law was enacted in 1996 to address the many issues medical providers were facing and to protect the privacy of all individuals. In essence, it serves as the baseline for standards enacted at the state level for all covered entities.
Understanding the Basics of HIPAA
To understand the law, it is important to understand when it applies and whom it protects. HIPAA applies to all “covered entities,” which are defined under 45 C.F.R. §160.103, as:
- Health care providers who transmit “protected health information;”
- Entities that process personal health information (healthcare clearinghouses);
- Health plans such as Group Health Plans; and
- Any business partner of a “covered entity.”
It is also important to note that the federal law applies to “protected health information,” otherwise known as PHI. This is information defined under 45 C.F.R. §164.501, which is individually identifiable health information maintained or transmitted in any form, whether electronically, on paper or orally.
Exceptions to HIPAA in Work Comp
Employees at healthcare providers are required to know and understand HIPAA and have a duty to protect a patient’s PHI. Training is required for these entities as part of their ability to do business. Problems arise when employees at these facilities do not understand the nuances of HIPAA and how a state workers’ compensation act allows members of the claims management team to obtain PHI without properly executed authorizations. One such exemption is found under 45 C.F.R. §164.512(l), which states, “A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.”
Effectively Using the “Work Comp” Exception
Although this exception to HIPAA allows for easier access to a patient’s PHI, there are important limitations and requirements one must first understand. Failure to understand these issues can result is frustration, delay, and sanction.
- The permissible release of PHI is limited to only medical records directly related to the work injury in question. It does not provide for the cart blanche release of “any and all medical records;”
- State workers’ compensation and other privacy laws often require the requesting party to notify the injured worker in writing they are making a request. Additional requirements sometimes require the requesting party also to disclose the medical records obtained from a provider to the injured party; and
- Failure to make the necessary request disclosures may result in a sanction against the requesting entity.
It is also important to note that medical providers releasing documents under this exception may charge the requestor reasonable copy and retrieval fees.
Conclusions
It is important for members of the claims management team to obtain medical records in a timely manner. Part of this can include the request of medical records related to a workers’ compensation claim under HIPAA without obtaining written authorization. Before making these requests, it is important for claim handlers to know the necessary rules and follow them to avoid problems down the road.
Contact: mstack@reduceyourworkerscomp.com.
Workers’ Comp Roundup Blog: https://blog.reduceyourworkerscomp.com/
©2018 Amaxx LLC. All rights reserved under International Copyright Law.
Do not use this information without independent verification. All state laws vary. You should consult with your insurance broker, attorney, or qualified professional.
