Do HIPAA Laws Apply to Workers' Compensation Claims?

What Is HIPAA and Why It Matters for Workers' Compensation

HIPAA, enacted in 1996, sets national standards for protecting the privacy and security of health information. It applies to covered entities—health plans, health care providers, and health care clearinghouses—and to business associates that handle protected health information (PHI). In workers' compensation, both the injured employee's medical records and the claims data often fall under HIPAA's purview, especially when a health care provider or insurer processes the information.

When HIPAA Enters the Workers' Compensation Landscape

Workers' compensation claims involve a mix of parties: the employee, the employer, the insurance carrier, and medical providers. HIPAA applies to:

• Health care providers who treat the injured worker.
• Insurance companies that administer workers' comp benefits.
• Any business associate that receives PHI for claim processing.

Employers, however, are not considered covered entities under HIPAA unless they operate a health plan that meets the statutory definition. Consequently, employers cannot claim HIPAA protection for employee medical records; they must rely on other privacy laws such as the Family and Medical Leave Act (FMLA) or state‑level statutes.

Scope of Protected Health Information in a Claim

HIPAA defines PHI as any individually identifiable health information, including:

• Diagnosis, treatment, and payment details.
• Health status and medical history.
• Any record that links a person to their health care.

In workers' comp, this means that medical notes, test results, and billing records are PHI and must be handled in compliance with HIPAA's Privacy Rule.

Key HIPAA Rights for Injured Workers

Workers who file a claim have the following rights under HIPAA:

• Access to their PHI: they can obtain copies of their medical records and claim documents.
• Correction of errors: they can request amendments to inaccurate information.
• Restriction of disclosures: they can limit who may see specific information (e.g., restrict access to certain medical details from the employer).

These rights coexist with workers' compensation statutes that often require certain disclosures to the employer or insurer for claim adjudication.

Practical Limits and Conflicts

Workers' comp laws can sometimes override HIPAA restrictions. For example:

• Employers may request medical records to verify injury eligibility.
• Insurance carriers may need PHI to determine coverage and benefits.

In such cases, HIPAA permits the release of PHI if it is necessary for treatment, payment, or health care operations, or if the employee gives written authorization.

How Employers and Insurers Protect PHI

Both parties must implement safeguards:

• Encryption of electronic PHI.
• Access controls and audit logs.
• Business associate agreements (BAAs) between insurers and health care providers.

Failure to comply can result in civil penalties up to $50,000 per violation and criminal charges for intentional violations.

Common Misconceptions

1. All medical records are automatically private from employers. Not true—HIPAA does not shield records from the employer unless the employer operates a covered health plan.

2. Workers' compensation is exempt from HIPAA. The law applies to all health care transactions involved in the claim.

3. Workers can refuse all disclosures. While workers can restrict certain details, they must still provide essential information for claim processing.

Table: HIPAA vs. Workers' Compensation Privacy Requirements

What To Do If You Suspect a HIPAA Violation

Workers who believe their PHI has been mishandled can file a complaint with the U.S. Department of Health & Human Services (HHS) Office for Civil Rights. The process includes:

• Submitting a written complaint.
• Providing evidence of the alleged breach.
• Waiting for HHS to investigate and issue a determination.

Bottom Line

HIPAA does apply to workers' compensation when health care providers and insurers handle medical information. Employees retain significant privacy rights, but those rights can be limited by the need to process claims. Employers must navigate both HIPAA and state workers' comp laws to ensure compliant handling of PHI.