This article concludes our four-part series on managing medical record requests in outpatient therapy clinics. In previous installments on the BCMS Blog, we explored requests from attorneys, disclosures supported by “satisfactory assurances,” and the key differences between court-ordered and attorney-issued subpoenas. Here, we turn our attention to Workers’ Compensation records requests.
When treating patients covered by Workers’ Compensation, we must remember that Workers’ Compensation is not considered a covered entity because it is not a provider, health plan, or healthcare clearinghouse. HIPAA has a special rule that allows healthcare providers to disclose PHI to workers’ compensation programs, subject to state law. While we will not address the full range of those administrative requirements in this article, we will focus on what providers should do when a request for medical records is received for a patient with Workers’ Compensation coverage. In such situations, providers often ask: What does the law require, and how can we remain compliant?
As with any discussion of records disclosure, we must begin with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule (45 CFR § 164.512). In general, HIPAA requires covered entities, such as healthcare providers, to obtain a patient’s written authorization before disclosing protected health information (PHI) unless the disclosure relates to treatment, payment, or healthcare operations (T-P-O), or falls within an exception. Workers’ compensation is considered an exception.
The Privacy Rule explicitly permits the disclosure of PHI “as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs established by law that provide benefits for work-related injuries or illnesses without regard to fault” (45 CFR § 164.512(l)). This provision allows providers to release relevant records without obtaining the patient’s authorization.
Even when an exception applies, providers generally must adhere to the Minimum Necessary Rule under HIPAA. The HIPAA Privacy Rule requires that only the PHI necessary to fulfill the specific purpose be disclosed, typically limited to records directly related to the work-related injury in question. Exception: Texas’s Medical Privacy law does mandate the minimum necessary when releasing records to the workers’ compensation commission and certain other entities.
While these exceptions often eliminate the need for patient authorization, many providers still choose to obtain a signed release from the patient as a matter of best practice. State laws governing Workers’ Compensation can vary significantly, and some jurisdictions may impose additional requirements, such as mandatory patient notification or a signed release, regardless of HIPAA. Because these rules vary by state, it is prudent for providers to proceed cautiously, understand their state’s Workers’ Compensation requirements, and secure authorization when in doubt.
By understanding the applicable exceptions and limitations, providers can confidently respond to Workers’ Compensation records requests while safeguarding patient privacy and maintaining full compliance.
Thank you for following this series. If you have questions about any of the topics covered or need assistance implementing these guidelines in your clinic, please reach out. We are here to help.
BCMS Compliance Program: Your Partner in Compliance
At BCMS, we empower outpatient therapy practices with our robust Compliance Program, which features tailored policies and procedures aligned with HIPAA Privacy laws and other federal regulations. Let us assist you with the complexities of record release requests and other HIPAA issues to ensure your practice remains compliant and secure. Contact us today to discover how we can assist you in your compliance journey.
About BCMS
BCMS is a trusted leader in healthcare compliance, delivering enrollment, credentialing, audit, and appeals services, as well as other regulatory solutions, for outpatient therapy providers. BCMS specializes in empowering healthcare providers through our comprehensive Compliance Program, which includes tailored policies and procedures and integrates Federal guidance with robust annual training. Stay informed with our latest insights at bcmscomp.com/blog.
Disclaimer: This blog is for informational purposes only and does not constitute legal advice. Consult an attorney for legal matters or a compliance professional for specific guidance.