Workers' compensation and HIPAA: does HIPAA apply?
Why workers' compensation insurers and employers aren't covered by HIPAA, what treating providers may share with them, and how to limit and record those disclosures.
On this page
Workers' compensation and HIPAA: does HIPAA apply? at a glance
Workers' compensation coverage is not a HIPAA health plan. Insurers, administrators and employers are not subject to HIPAA merely because they handle these claims, though they may have other covered functions. HIPAA governs the treating doctors, dentists and hospitals that meet the covered-entity definition, and it expressly permits them to disclose information as authorized by, and to the extent necessary to comply with, workers' compensation laws, without the worker's authorization (45 CFR 164.512(l)). The minimum necessary standard applies to most of those disclosures, and they belong in the patient's accounting of disclosures.
| Workers' comp insurers and employers | Not subject to HIPAA merely because they handle these claims |
|---|---|
| Treating providers | HIPAA applies if the provider meets the covered-entity definition; workers' compensation law may authorize or require disclosures |
| Rule | 45 CFR 164.512(l) — disclosures for workers' compensation |
| Limit | Minimum necessary applies, except where law requires the disclosure |
| Record | Log each disclosure for the accounting of disclosures (164.528) |
HIPAA’s definition of a health plan excludes coverage that provides excepted benefits, and workers’ compensation is one of them (45 CFR 160.103; 42 U.S.C. 300gg-91(c)(1)). So workers’ compensation insurers, third-party administrators and employers are not subject to HIPAA merely because they handle these claims — though an organization may have other functions that make it a covered entity.
The doctors, dentists, hospitals and clinics that treat an injured worker are covered entities if they meet the definition — most do, because they bill electronically. The Privacy Rule lets them disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation laws and similar programs that provide benefits for work-related injuries or illness without regard to fault (45 CFR 164.512(l)). HHS guidance explains that providers may share information with insurers, administrators and employers on that basis, without the worker’s authorization.
What a treating provider does with a workers’ comp request
- Identify the basis. A workers’ compensation law, another legal requirement, payment for your treatment, or the worker’s authorization — the limits and the accounting depend on which. For a claim, check what your state’s law authorizes or requires you to send, and to whom; the details come from state workers’ compensation law, not from HIPAA.
- Send only what is needed. The minimum necessary standard applies, so share what relates to the claim. Do not send the whole record by default — only if the law requires it or the entire record is specifically justified as reasonably necessary for the purpose (45 CFR 164.514(d)(5)). It does not apply where the law requires a specific disclosure. When a state workers’ compensation official asks, you may reasonably rely on that request as the minimum necessary if the official says it is (45 CFR 164.514(d)(3)(iii)(A)).
- Use another basis for anything else. Information unrelated to the claim, or a request from the employer outside a claim, usually needs the worker’s authorization.
- Record it. Disclosures under the workers’ compensation provision (164.512(l)) are not among the exceptions to the accounting of disclosures, so log each one with the date, recipient, what you sent and why (45 CFR 164.528). Disclosures properly made for payment under 164.506 are generally excluded from the accounting.
The worker can always ask for their own records under the right of access.
What HIPAA does not decide
What the insurer or employer then does with the information is generally outside HIPAA, unless the recipient is itself acting as a covered entity; state workers’ compensation and privacy laws govern it. An employer’s group health plan is different: it is a HIPAA covered entity, and the employer as plan sponsor may not use plan PHI for employment-related actions without the employee’s authorization (45 CFR 164.504(f)) — see employer group health plans.
Next steps
- HIPAA for employer group health plans →Scenario
- HIPAA for small medical practices →Scenario
- Covered entity →Requirement
- Minimum necessary →Requirement
- HIPAA authorization →Requirement
Frequently asked questions
Does HIPAA apply to workers' comp claims?
Not to workers' comp insurers or employers merely because they handle the claim. It applies to your treating providers that are covered entities, and it lets them share information as workers' compensation law requires or authorizes.
Can my doctor send my records to the workers' comp insurer without my permission?
Yes, to the extent your state's workers' compensation law authorizes or requires it. HIPAA permits these disclosures without your authorization.
Can the employer see my whole medical record?
Not because of HIPAA's workers' compensation provision alone. The provider may share what the workers' compensation law authorizes and, unless the law requires a specific disclosure, only the minimum necessary for the claim. Unrelated information needs another basis, usually your authorization.
Is a return-to-work note for my employer covered by this?
Only when it is part of a workers' compensation claim and the law authorizes it. Outside a claim, a note the provider sends to your employer usually needs your authorization — or you can take the note to the employer yourself.