The HIPAA Privacy rule protects the privacy of information related to an individual’s health, treatment, or healthcare payment. The rule affects the viewing, handling, and storing of protected health information (PHI). The rule is applicable to covered entities. The rule allows disclosures for workers’ compensation purposes as outlined below:

“A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers’ compensation…”. 45 CFR § 164.512(l)

For a copy of the HIPAA Privacy rule, please visit the U.S. Dept. of Health and Human Resources - Administrative Simplification web site. The Privacy rule is effective on April 14, 2003 (April 14, 2004 for small health plans).

The Privacy rule specifically excludes workers’ compensation insurers from the definition of a covered entity. The rule also does not apply to the Workers’ Compensation Division or most employers. In order to provide workers’ compensation benefits to injured workers as required by law the division, insurers, and self-insured employers need access to health care records. ORS 656.252, 656.254, and 656.265 address reporting requirements for workers’ compensation claims. The August 14, 2002 Federal Register (Vol. 67, #157, pg. 53266-53273 clarifies that the HIPAA privacy rule does not preempt state workers’ compensation laws.

Additionally, the federal Department of Health and Human Services (DHHS) clarifies in the August 14, 2002 Federal Register (Vol. 67, No. 157, pg. 53198) that, "[HIPAA] Privacy Rule is not intended to disrupt existing workers' compensation systems as established by state law...the Rule is not intended to impede the flow of health information that is needed by employers, workers' compensation carriers, or State officials in order to process or adjudicate claims and/or coordinate care under the workers' compensation system."

Oregon Administrative Rules also address the issue of medical privacy and disclosure of relevant medical records for the purposes of workers’ compensation claims processing in OAR 436-010-0240.

For more information visit the US Department of Health & Human Services - Office for Civil Rights web site and view the publication Guidance Explaining Significant Aspects of the HIPAA Privacy Rule or phone 866-627-7748.

The Oregon Workers’ Compensation Division also publishes a HIPAA Privacy Rule Fact Sheet. For specific information on the application of HIPAA provisions for disclosures of psychotherapy notes for workers' compensation purposes, please go to Policy Issues.