HIPAA and Workers' Compensation: When Health Privacy Meets Workplace Injury

Does HIPAA Apply to Workers' Compensation?

Yes. HIPAA applies to any health information handled by a covered entity, including health plans that pay workers' compensation benefits. When an insurer processes a claim, it becomes a HIPAA covered entity and must protect the employee's medical records. However, the law's privacy rules are limited by the workers' comp statute, which requires certain information for claim adjudication.

Key HIPAA Privacy Rules in Workers' Comp

HIPAA's Privacy Rule allows disclosure of protected health information (PHI) for treatment, payment, or health care operations without patient authorization. In a workers' compensation context, insurers must disclose PHI to the employer, state workers' comp board, and other parties involved in the claim. The rule also permits the insurer to share PHI with the employer if the employer is a health plan or if the claim is considered part of the employer's health benefits program.

Limits and Exceptions

HIPAA does not override state workers' compensation laws that mandate certain data, such as diagnosis codes, injury details, and treatment dates. Conversely, the workers' comp statute cannot compel disclosure of PHI beyond what is necessary for adjudication. If an employee refuses to provide medical records, the insurer can still request them under the state law, but must comply with HIPAA's safeguards regarding the handling and storage of that data.

Employer Responsibilities

Employers must treat PHI obtained from the insurer as confidential. They can access information only to the extent required by the workers' compensation board or to coordinate benefits. Any broader use, such as for internal investigations unrelated to the claim, would violate HIPAA unless the employee gives explicit consent.

Practical Steps for Compliance

• Ensure the insurer's privacy policy reflects HIPAA requirements and the state workers' comp statute.
• Use secure electronic health record (EHR) systems that support audit trails for PHI access.
• Train HR and payroll staff on HIPAA limits and the specific data that may be shared for claim processing.
• Implement a process for employees to request access to their PHI and to file complaints if they suspect misuse.

Conclusion

HIPAA does apply to workers' compensation claims, but its reach is circumscribed by state law requirements. Employers and insurers must balance the need for information to adjudicate claims with the privacy protections afforded to employees. Properly aligning privacy policies with legal obligations ensures both compliance and trust in the workers' compensation system.