State of California HIPAA disclosure and our notice of privacy practices for protected health information.
45 CFR 164.512(l)
Background
The HIPAA Privacy Rule does not apply to entities that are either workers’ compensation insurers, workers’ compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. However, these entities need access to the health information of individuals who are injured on the job or who have a work-related illness to process or adjudicate claims, or to coordinate care under workers’ compensation systems. Generally, this health information is obtained from health care providers who treat these individuals and who may be covered by the Privacy Rule. The Privacy Rule recognizes the legitimate need of insurers and other entities involved in the workers’ compensation systems to have access to individuals’ health information as authorized by State or other law. Due to the significant variability among such laws, the Privacy Rule permits disclosures of health information for workers’ compensation purposes in several different ways.
How the Rule WorksDisclosures Without Individual Authorization. The Privacy Rule permits covered entities to disclose protected health information to workers’ compensation insurers, State administrators, employers, and other persons or entities involved in workers’ compensation systems, without the individual’s authorization:
Disclosures with Individual Authorization. In addition, covered entities may disclose protected health information to workers’ compensation insurers and others involved in workers’ compensation systems where the individual has provided his or her authorization for the release of the information to the entity. The authorization must contain the elements and otherwise meet the requirements specified at 45 CFR 164.508.
Minimum Necessary. Covered entities are required reasonably to limit the amount of protected health information disclosed under 45 CFR 164.512(l) to the minimum necessary to accomplish the workers’ compensation purpose. Under this requirement, protected health information may be shared for such purposes to the full extent authorized by State or other law. In addition, covered entities are required reasonably to limit the amount of protected health information disclosed for payment purposes to the minimum necessary.
Covered entities are permitted to disclose the amount and types of protected health information that are necessary to obtain payment for health care provided to an injured or ill worker. Where a covered entity routinely makes disclosures for workers’ compensation purposes under 45 CFR 164.512(l) or for payment purposes, the covered entity may develop standard protocols as part of its minimum necessary policies and procedures that address the type and amount of protected health information to be disclosed for such purposes.
Where protected health information is requested by a State workers’ compensation or other public official, covered entities are permitted to reasonably rely on the official’s representations that the information requested is the minimum necessary for the intended purpose. See 45 CFR 164.514(d)(3)(iii)(A). Covered entities are not required to make a minimum necessary determination when disclosing protected health information as required by State or other law, or pursuant to the individual’s authorization. See 45 CFR 164.502(b). The Department will actively monitor the effects of the Privacy Rule, and in particular, the minimum necessary standard, on the workers’ compensation systems and consider proposing modifications, where appropriate, to ensure that the Rule does not have any unintended negative effects that disturb these systems.
References:https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-workers-compensation/index.html
45 CFR 164.512(l)
45 CFR 164.512(a)
45 CFR 164.502(a)(1)(ii)
45 CFR 164.501.
45 CFR 164.508
45 CFR 164.512(l)
45 CFR 164.512(l)
45 CFR 164.514(d)(3)(iii)(A)
45 CFR 164.502(b)
45 CFR 164.512(l)
Background
The HIPAA Privacy Rule does not apply to entities that are either workers’ compensation insurers, workers’ compensation administrative agencies, or employers, except to the extent they may otherwise be covered entities. However, these entities need access to the health information of individuals who are injured on the job or who have a work-related illness to process or adjudicate claims, or to coordinate care under workers’ compensation systems. Generally, this health information is obtained from health care providers who treat these individuals and who may be covered by the Privacy Rule. The Privacy Rule recognizes the legitimate need of insurers and other entities involved in the workers’ compensation systems to have access to individuals’ health information as authorized by State or other law. Due to the significant variability among such laws, the Privacy Rule permits disclosures of health information for workers’ compensation purposes in several different ways.
Disclosures Without Individual Authorization. The Privacy Rule permits covered entities to disclose protected health information to workers’ compensation insurers, State administrators, employers, and other persons or entities involved in workers’ compensation systems, without the individual’s authorization:
Disclosures with Individual Authorization. In addition, covered entities may disclose protected health information to workers’ compensation insurers and others involved in workers’ compensation systems where the individual has provided his or her authorization for the release of the information to the entity. The authorization must contain the elements and otherwise meet the requirements specified at 45 CFR 164.508.
Minimum Necessary. Covered entities are required reasonably to limit the amount of protected health information disclosed under 45 CFR 164.512(l) to the minimum necessary to accomplish the workers’ compensation purpose. Under this requirement, protected health information may be shared for such purposes to the full extent authorized by State or other law. In addition, covered entities are required reasonably to limit the amount of protected health information disclosed for payment purposes to the minimum necessary.
Covered entities are permitted to disclose the amount and types of protected health information that are necessary to obtain payment for health care provided to an injured or ill worker. Where a covered entity routinely makes disclosures for workers’ compensation purposes under 45 CFR 164.512(l) or for payment purposes, the covered entity may develop standard protocols as part of its minimum necessary policies and procedures that address the type and amount of protected health information to be disclosed for such purposes.
Where protected health information is requested by a State workers’ compensation or other public official, covered entities are permitted to reasonably rely on the official’s representations that the information requested is the minimum necessary for the intended purpose. See 45 CFR 164.514(d)(3)(iii)(A). Covered entities are not required to make a minimum necessary determination when disclosing protected health information as required by State or other law, or pursuant to the individual’s authorization. See 45 CFR 164.502(b). The Department will actively monitor the effects of the Privacy Rule, and in particular, the minimum necessary standard, on the workers’ compensation systems and consider proposing modifications, where appropriate, to ensure that the Rule does not have any unintended negative effects that disturb these systems.
References:
https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-workers-compensation/index.html
45 CFR 164.512(l), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.512(a), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.502(a)(1)(ii), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.501., Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.508, Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.512(l), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.512(l), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.514(d)(3)(iii)(A), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
45 CFR 164.502(b), Disclosures for Workers’ Compensation Purposes, Guidance, Privacy, For Professionals, Health Insurance Portability and Accountability Act of 1996, Health Information Privacy, https://www.hhs.gov.
You may file a complaint if you feel your rights are violated
Need help with this? Call our San Jose office at (408) 988-8581 or email referrals@nmciclinic.com and we will respond promptly. Please do not send protected health information by email.