Medicine, Law and Policy
To Release or Not to Release?
By Karolyn Stirewalt, J.D.
When is it all right for physicians who treat injured workers to release medical information without their consent?
This summary of the relationship between HIPAA and workers’ compensation laws should not be construed as legal advice.
When an employee is injured at work or acquires an occupational-related illness, he or she is generally entitled to workers’ compensation benefits under Minnesota Statute Chapter 176. Physicians who assess and treat workers’ compensation patients, however, may find themselves faced with a dilemma: When can they legally release medical information about the injured employee to other parties involved in a workers’ compensation claim without the injured employee’s consent?
The federal Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 in part to protect the security and confidentiality of individuals’ health information. Health information that is considered “protected” under the law is that which identifies an individual; relates to the past, present, or future health of an individual; and was created or received by a health care provider.1 Health plans, clearinghouses that process or facilitate the processing of health information, and health care providers who electronically transmit protected information are required to comply with the provisions in HIPAA.2
More often than not, HIPAA requires covered entities to obtain the consent of the patient before protected information may be used or disclosed. There are exceptions, however, and workers’ compensation is among them.3 Entities that must comply with HIPAA may use and disclose protected information without obtaining the patient’s consent for workers’ compensation claims, provided that the use and disclosure is consistent with, and limited to, the requirements under other federal and state laws pertaining to the release of medical records.4 Some of the federal laws that include provisions for workers’ compensation claims include the Black Lung Benefits Act, the Federal Employees’ Compensation Act, the Longshore and Harbor Workers’ Compensation Act, and the Energy Employees’ Occupational Illness Compensation Program Act.
Minnesota law generally requires that a patient (or the patient’s legally authorized representative) sign and date a consent form before a provider may release medical records. However, the law allows the records to be released without the patient’s consent when other laws specifically authorize it.5
The following list summarizes the Minnesota statutes and rules that authorize the release of medical data directly relating to workers’ compensation claims without an injured worker’s prior consent:6
- Providers receiving requests from the injured employee, the employer, the workers’ compensation insurer, or the Department of Labor and Industry (DLI) for written medical data that exists at the time of the request and relates directly to the workers’ compensation claim may provide the requested information to those entities without the injured employee’s consent.7
- Physicians who have examined, treated, or have special knowledge of an injury related to a workers’ compensation claim and who receive a request from the commissioner of Labor and Industry (or a representative of the commissioner) must report all facts and treatment relating to the nature and extent of the injury and disability to the DLI. No consent from the injured employee is needed to release the medical information.8
- Physicians receiving requests from the employee, the employer, the workers’ compensation insurer, or the commissioner of Labor and Industry (or an authorized representative of the commissioner) to file supplementary reports relating to the current nature and extent of the employee’s injury, disability, or treatment must comply with those requests; the injured employee’s consent to release this medical information is not needed.9
- Providers participating in planning an injured employee’s return to work are required to communicate medical information relating to the return to the employee, employer, insurer, rehabilitation providers, and commissioner of Labor and Industry.10 The injured employee’s consent is not required to release this supplementary medical information.
- Providers who are contacted by the injured employee, the employer, or the workers’ compensation insurer for a medical opinion about whether the employee is able to perform the physical requirements of a job are required to provide that opinion. Prior authorization for the disclosure of medical information about the injured employee is not required in such cases. (The provider must have the patient’s authorization before disclosing medical information to a vocational rehabilitation consultant. It is up to the rehabilitation consultant, however, to obtain the patient’s authorization and send it to the provider.)11
- Providers are also required to submit an itemized statement of charges on a billing form prescribed by the commissioner of Labor and Industry to the insurer. The provider must include copies of medical records or reports that substantiate the nature of the charge and its relationship to the work injury.12 The injured employee’s consent to release this medical information is not required.
It is important to remember that in these situations, medical data may only be disclosed to “parties” of the workers’ compensation claim including the injured employee, the DLI, the employer at the time of injury, and the workers’ compensation insurer. Any information provided must be limited to medical data that is directly related to the workers’ compensation claim. All requests and releases must be noted in the injured employee’s health record, and a written notice of the request and release of information must be sent to the injured employee or his or her attorney.13
In summary, both the HIPAA privacy law and the Minnesota statute governing the release of medical records generally require an injured employee to sign an authorization or consent form before their medical records may be released to a third party. Both laws have exceptions for workers’ compensation claims.
Physicians who treat workers who were either injured at work or acquired an occupational disease need to understand when it is appropriate to release related medical information and to whom they can release it. Physicians are encouraged to read the cited statutes and rules in order to gain a more thorough understanding of them.
More information about workers’ compensation laws in Minnesota is available at http://www.doli.state.mn.us/workcomp.html. Questions relating to specific workers’ compensation claims should be directed to an attorney who specializes in that area of law. MM
Karolyn Stirewalt is in-house legal counsel for the Minnesota Medical Association.
References
1. 45 CFR § 160.103 (2002) and 45 CFR 164.501(2002).
2. 45 CFR 164.104 (2002).
3. 45 CFR 164.512(l) (2002).
4. 45 CFR 164.512(l) (2002).
5. Minn. Stat. § 144.335 Subdivision 3(a).
6. A primer about HIPAA and Minnesota workers’ compensation. Available at: http://www.doli.state.mn.us/hipaa.html. Accessed August 13, 2007.
7. Minn. Stat. § 176.138 (a)
8. Minn. Stat. § 176.231, Subdivision 3. Note: information that must be provided on the commissioner’s form, including maximum medical improvement, is listed in the Minn. Rules part 5221-0410 Subparts 2-3.
9. Minn. Stat. § 176.231, Subdivisions 4-5
10. Minn. Rules Part 5221-0420 Subpart 1.
11. Minn. Rules Part 5221.0420.
12. Minn. Stat. § 176.135, Subdivision 7. Note that specific billing requirements are set forth in Minn. Rules, Part 5221.0700.
13. Minn. Stat. § 176.138(a)