WORKERS’ COMPENSATION GUIDELINES

On April 14, 2003, the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) of 1996 went into effect. The Privacy Rule affects the way "protected health information" may be used and disclosed by covered entities.

Under the Privacy Rule, the Workers' Compensation Board, workers' compensation insurers and employers are not considered covered entities and therefore, may continue to use medical information concerning claimants in their customary manner.

If you are a "covered entity," such as a health care provider, the Privacy Rule specifically exempts health information that is required as part of a lawful process, including workers' compensation proceedings, from HIPAA restrictions concerning use and disclosure of protected health information. Therefore, health care providers may continue to provide the Board and insurers with reports of treatment (CMS-1500 form) and testify at hearings and depositions.

Important: This guideline reflects the Board's understanding of HIPAA and its application to the New York workers' compensation system. However, HIPAA is federal legislation. Therefore, the New York State Workers' Compensation Board has no authority over the method and manner in which HIPAA and the Privacy Rule is implemented. For a binding interpretation of the law, you must contact the regulating federal agency, the U.S. Department of Health and Human Services' Office of Civil Rights.

The following are some guidelines regarding health care providers' continuing obligation to provide medical records to the Board:

• No Authorization Required: The Privacy Rule permits health care providers to submit health information, without an authorization, to the Board and the insurer or employer in three situations:
  1. Pursuant to an order of a Workers' Compensation Law Judge (WCLJ). This exemption can be found in the Privacy Rule at 45 CFR §164.512(e). Thus, if a WCLJ directs the taking of medical testimony or depositions, health care providers are not restricted by HIPAA and under New York State Law must comply with the WCLJ's direction.
     
     Failure to comply with an order of a WCLJ has severe penalties.
  2. In compliance with laws relating to workers' compensation, with reasonable assurances from the requesting party that the claimant has been notified. This exemption can be found in the Privacy Rule at 45 CFR §164.512(e) and (l). WCL §13-a(4)(a) and 12 NYCRR § 325-1.3 require health care providers to regularly file medical reports of treatment with the Board and the insurer or employer. Furthermore, WCL § 13(g) requires hospitals to provide all related medical records within 20 days of receiving a request. The Employee Claim (Form C-3 or Form EC-3) and the Notice of Indexing (Form EC-84) have been modified to include a HIPAA Notice on the reverse side. This Notice informs claimants that their health care providers are required to regularly file medical reports. Thus, filing a CMS-1500 form with an accompanying narrative is a "lawful process" in compliance with the Workers' Compensation Law, and health care providers may continue to file this information with the Board and the insurer or employer. As with Item 1 above, the Workers' Compensation Law requires the filing of medical reports.
  3. For the health care provider's own treatment, payment, or health care operations. This exemption can be found in the Privacy Rule at 45 CFR § 164.502(a)(1)(ii) and the definition of "payment" in 45 CFR § 164.501 WCL § 13-f requires that medical records be provided to the Board and the insurer or employer before they will be required to pay for any medical services. Thus, a health care provider must continue to provide the required medical information in order to be paid.
• Pursuant to a Subpoena Accompanied by a HIPAA Compliant Authorization: Workers' Compensation Law § 119 provides that subpoenas shall be regulated by the Civil Practice Law and Rules (CPLR). CPLR § 3122(a)(2) specifically requires that all subpoenas requesting production of medical records from a covered entity be a) accompanied by a HIPAA compliant authorization, and b) must state in bold-face type on the face of the subpoena that the medical records may not be produced unless accompanied by a written authorization, or the court has issued the subpoena or otherwise directed the production of the documents. For more information, please review CPLR § 3122(a) and the Board Subject Number 046-129 issued on April 12, 2004 and available on this website under Board Releases.
• HIPAA-Compliant Authorization: The Privacy Rule permits health care providers to disclose health information to anyone for any purpose, as long as the disclosure is made pursuant to a validly executed authorization signed by the claimant. The requirements for a HIPAA-compliant authorization may be found in the Privacy Rule at 45 CFR § 164.508. In some instances, a health care provider may wish to obtain an authorization from the patient/claimant permitting disclosure of necessary and relevant medical information to the Board and insurer or employer for the duration of the compensation proceedings. A HIPAA-compliant authorization that may be used for workers' compensation proceedings is available on this website, Claimant's Authorization to Disclose Health Information (Pursuant to HIPAA) (Form HIPAA-1).
  
  If you would like to authorize the Board to release information, the HIPAA authorization will permit your health care provider to supply health information to the Board and the parties you designate. If you would like to authorize the Board to release information concerning your compensation claim to someone who is not a party to the compensation proceeding, such as your spouse, execute Claimant’s Authorization to Disclose Workers' Compensation Records (Pursuant to Workers' Compensation Law Section 110-a) (Form OC-110A).
  
  Important: The Board does not accept written requests for claimant records that are accompanied by a standard HIPAA authorization (OCA Official Form Number 960). Any request for claimant records should be made using Form OC-110A, or a notarized original authorization that specifically directs the Board to release only workers' compensation records to a specific person, as set forth in WCL § 110-a(3).

In short, all parties must be aware that a health care provider’s obligation under HIPAA does not relieve the provider or the parties of their obligations under the Workers' Compensation Law and accompanying regulations. Claims will not be established, awards to claimants will not be made, and medical bills will not be paid without the submission of required medical information.

Independent Medical Examinations: Employers and insurers are permitted to continue to have claimants evaluated by independent medical examiners in order to obtain information concerning a work-related injury. The independent medical examiner may continue to share their opinion with the Board and the employer/insurer in the customary manner.