Health Information Compliance Alert

Read the situation below and decide how you would handle it before you compare it to our expert's advice.

Question: Workers' compensation disclosures are not listed as being exempt from the accounting requirement. I'm confused because our primary relationship with workers' comp is as a payor, which would cause the disclosure to fall under treatment, payment and health care operations.

Could you please clarify if and when workers' comp disclosures need to be accounted for?

Answer: There are potentially two different answers to this question, explains Kristen Rosati, an attorney with Coppersmith Gordon Schermer Owens & Nelson in Phoenix. "If you're paying workers' comp claims--if that's all you do--you're not even a HIPAA covered entity, because workers' comp insurance programs are excluded from the definition of a health plan," she says, adding that workers' comp insurance companies are not HIPAA health plans.

However, if you're a provider and you're disclosing health information under workers' comp without patient authorization - as certain situations allow - then you do need to track that data if the patient ever asks for it. "But if you get the patient's authorization to disclose the information, then you do not need to include it or track it for accounting, because the disclosures that are made pursuant to somebody's authorization don't need to be accounted for," Rosati advises.

Also, make sure that you're aware of how your state's laws may affect workers' comp issues like this, advises Barry Herrin, an attorney with Smith Moore in Atlanta.

Herrin says that if an employee makes a claim for benefits in Georgia, then they've waived their constitutional right to privacy. "Georgia has a state constitutional right to privacy; it's the strongest anywhere in the country that I know of."

If you file a claim for benefits in the Peach State, you waive your right to privacy with regard to all of your medical records, not just those related to the claim, explains Herrin. "So in that case it's a consensual release. You've authorized the treating professional to release that information to the employer, and you don't have to account for consensual releases in the accounting [under HIPAA]."

Herrin says there may be a state that stipulates, "All the records have to be released pursuant to a subpoena issued by the state board of worker's compensation." If that's the case, then it's a nonconsensual release and that would have to be documented.