HIPAA RESTRICTIONS AND MEDICAL RECORDS
WORKERS' COMPENSATION GUIDELINES
On April 14, 2003 the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 went into effect. The Privacy Rule changes the way that “protected health information” may be used and disclosed by covered entities.
Under HIPAA’s Privacy Rule, the Workers' Compensation Board, workers' compensation carriers and employers are not covered entities and therefore may continue to use medical information concerning claimants in their customary manner.
If you are a “covered entity,” such as a health care provider, the Privacy Rule specifically exempts health information that is required as part of a lawful process, including a workers' compensation proceeding, from HIPAA restrictions concerning use and disclosure of protected health information. Therefore, health care providers may continue to provide the Board and carriers with reports of treatment (C-4s) and health care providers may continue to testify at hearings and depositions.
Important: This guideline reflects the Board's understanding of HIPAA and its application to New York's workers' compensation process. However, HIPAA and the Privacy Rule are federal legislation. Therefore, the New York State Workers' Compensation Board has no authority over the method and manner in which the new legislation and regulations will be implemented. For a binding interpretation of the law, you must contact the regulating federal agency, the Office of Civil Rights.
The following are some guidelines regarding health care providers' continuing obligation to provide medical records to the Board:
- No Authorization Required: The Privacy Rule permits health care providers to submit health information, without an authorization, to the Board and the carrier or employer in three situations:
- Pursuant to an order of a Workers' Compensation Law Judge (WCLJ). This exemption can be found in the Privacy Rule at 45 CFR §164.512. Thus, if a WCLJ directs the taking of medical testimony or depositions, health care providers are not restricted by HIPAA and under New York State Law must comply with the WCLJ's direction.
Failure to comply with an order of a WCLJ is a violation of New York State Law and has severe penalties.
- In compliance with Workers' Compensation Law with reasonable
assurances from the requesting party that the claimant has been notified. This exemption can
be found in the Privacy Rule at 45 CFR §164.512 (e) and (l). WCL §13-a(4)(a) and 12 NYCRR §325-1.3
require health care providers to regularly file medical reports of treatment with the Board and the
carrier or employer. Furthermore, WCL §13-(g) requires hospitals to provide all related medical
records within twenty days of receiving a request. The Claim for Compensation (C-3) and the Notice
of Indexing (EC-64) have been modified to include a HIPAA Notice on the reverse side. This Notice
informs claimants that their health care providers are required to regularly file medical reports.
Thus, filing a C-4 with accompanying narrative is a "lawful process" in compliance with Workers'
Compensation Law and health care providers may continue to file this information with the Board and
the carrier or employer in compliance with the WCL. As with Item 1 above, the WCL requires the
filing of medical reports;
- For the health care provider's own payment operations.
This exemption can be found in the Privacy Rule at 45 CFR §164.502(a)(1)(ii) and §164.501 definition
of "payment." WCL §13-f requires that medical records be provided to the Board and the carrier or
employer before they will be required to pay for any medical services. Thus, a health care provider
must continue to provide the required medical information in order to be paid.
- Pursuant to a Subpoena by a HIPAA Compliant Authorization: New
York's Civil Practice Law and Rules (CPLR) at §3122(a) has created requirements for the subpoena of
medical records that are more stringent than HIPAA's rules. Under the Workers' Compensation Law at
§119, the Board is bound to follow the CPLR's rules for subpoenas. Accordingly, all subpoena's
requesting production of medical records must be a) accompanied by a HIPAA compliant authorization;
and b) must state in bold-face type on the face of the subpoena that the medical records may not be
produced unless accompanied by the proper authorization. For more information please review CPLR
§3122(a) and the Board's Administrative Subject Number 046-129 issued April 12, 2004 and available
on this web site under Board Releases.
- HIPAA Compliant Authorization: The Privacy Rule permits
health care providers to disclose health information to anyone for any purpose so long as the
disclosure is made pursuant to a validly executed authorization signed by the claimant. The
requirements for a HIPAA compliant authorization may be found in the Privacy Rule at 45 CFR
§164.508. In some instances a health care provider may wish to obtain an authorization from the
patient/claimant permitting disclosure of necessary and relevant medical information to the Board
and carrier or employer for the duration of the compensation proceedings. A template for a HIPAA
compliant authorization that may be used for workers' compensation proceedings is available on this
web site, Form HIPAA-1.
If you would like to authorize the Board to release information
The HIPAA authorization will permit your health care provider to supply health information to the
Board and the parties you designate. If you would like to authorize the Board to release information
concerning your compensation claim to someone who is not a party to the compensation proceeding,
such as your spouse, execute the §110-a authorization, using
Important: The Board does not accept written requests for claimant records which are accompanied by a standard HIPAA authorization (OCA Official Form Number 960). Any request for claimant records should be made using Board Form OC-110A, or a notarized original authorization which directs the Board to release only workers’ compensation records to a specific person, as required by WCL Section 110a(3).
In short, all parties must be aware that a health care provider's obligations under HIPAA does
not relieve the provider or the parties of their obligations under the Workers' Compensation Law
and accompanying regulations. Claims will not be established, awards to claimants will not be made,
and medical bills will not be paid without the submission of required medical information.
Independent Medical Examinations: Employers and carriers are permitted to
continue to have claimant's evaluated by independent medical examiners in order to obtain
information concerning a work-related injury. The independent medical examiner may continue to
share his/her opinion with the Board and the employer/carrier in the customary manner.