Does the 1996 HIPAA Act Cover Workers' Compensation Claims?

HIPAA and Workers' Compensation: The Core Relationship

HIPAA's Privacy Rule protects health information from disclosure without patient consent. Workers' compensation, however, is a state‑based workers' injury insurance program. The two regimes overlap only when a workers' injury is treated by a health provider covered under HIPAA. In those instances, the provider must obtain the injured employee's authorization before sharing medical records with the insurer or the employer, unless a specific HIPAA exception applies.

When HIPAA Applies to Workers' Injury Treatment

Under HIPAA, a covered entity—hospital, clinic, or doctor—must treat the employee's medical records as protected health information (PHI). If the injured worker seeks care through a non‑covered entity, such as a private physician not affiliated with a hospital, that physician is not subject to HIPAA. The same rule applies to the workers' compensation insurer if it is a health plan; if it is a traditional insurer, HIPAA does not apply to its records.

Authorization Requirements and Exceptions

To release PHI to a workers' compensation insurer, the employee must sign a written authorization. The insurer can request the information only to the extent necessary for claim adjudication. HIPAA also permits a covered entity to disclose PHI without authorization when it is required by law—workers' compensation statutes are not federal law, so this exception does not automatically apply. However, some states grant insurers a "workers' compensation exception" that allows disclosure of PHI for claim purposes. When such a state exception exists, the insurer may obtain the necessary records without the employee's explicit consent, but the covered entity must still document the request and the exception's applicability.

Limits on Information Shared

Even when disclosure is permitted, the scope is limited to the minimum necessary. For example, a doctor may provide a summary of injuries and treatment, excluding unrelated medical history. The insurer may also request only the portions of the chart directly related to the injury. If the employee objects, the provider must honor the objection unless an overriding state law requires disclosure.

Compliance Checklist for Employers and Providers

Employers should:

• Verify whether their workers' comp insurer is a covered entity.
• Ensure that any PHI shared complies with HIPAA's minimum‑necessary rule.
• Obtain written consent from employees when required.

Providers should:

• Confirm the insurer's status under HIPAA.
• Document any disclosures and the legal basis for them.
• Train staff on the distinction between HIPAA and state workers' compensation laws.

Conclusion

HIPAA does not blanket workers' compensation claims, but it governs the handling of medical records when a covered entity treats an injured employee. Employers and insurers must navigate both HIPAA and state workers' compensation statutes to ensure lawful disclosure of PHI while protecting employee privacy.