HIPAA And Workers’ Compensation

Arkansas Insurance Department 1200 West Third Street Little Rock, AR 72201-1904 1-501-371-2600 1-800-282-9134 Mike Huckabee Mike Pickens Fax 1-501-371-2618 Governor Commissioner www.state.ar.us/insuranc BULLETIN NO. 4-2003 TO: ALL LICENSED PROPERTY AND CASUALTY CARRIERS, SURPLUS LINES INSURERS, SURPLUS LINES BROKERS, NATIONAL ASSOCIATION OF INSURANCE COMMISSIONERS, AND OTHER INTERESTED PARTIES FROM: ARKANSAS INSURANCE DEPARTMENT (“AID”) and ARKANSAS WORKERS’ COMPENSATION COMMISSION (“AWCC”) SUBJECT: HIPAA AND WORKERS’ COMPENSATION DATE: AUGUST 4, 2003 ____________________________________________________________________________________________________________ This Bulletin provides clarification on the applicability of the HIPAA Privacy Rule to disclosures of protected health information (PHI) required by workers' compensation system participants. The HIPAA Privacy Rule does not apply to workers' compensation insurers, workers' compensation administrative agencies or employers when disclosing health information as required by state law for workers' compensation system purposes. Nothing in the Rule prohibits this disclosure for purposes of processing and administering workers’ compensation claims. The Arkansas Workers' Compensation Act and Commission Rules require certain system participants disclose to the AWCC an injured worker's PHI necessary to process or adjudicate claims or to coordinate care under the workers' compensation system. Generally, this health information is submitted to carriers/TPAs by health care providers who treat the injured workers and who may otherwise be covered by the HIPAA Privacy Rule. The Privacy Rule recognizes the legitimate need for insurers and other entities involved in the workers' compensation system to have access to an injured worker's PHI as authorized by state or other law. 45 C.F.R. §§164.512(a) and 164.502(b). The new Privacy Rules should not change or hinder PHI disclosures to the AWCC or other system participants as required by the Arkansas Workers' Compensation Act or Commission rules. How the Privacy Rule Works. Generally, the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) do not apply to workers' compensation insurers, workers' compensation administrative agencies or employers, except to the extent that they may otherwise be "covered entities." 42 U.S.C. §300gg-91 (c)(1). System participants making PHI disclosures to the Arkansas Workers' Compensation Commission or other workers' compensation participants as required by the Arkansas Workers' Compensation Act and Commission rules are, therefore, exempt from the HIPAA Privacy Rules with regard to those disclosures. Disclosures without Authorization. The Privacy Rule permits covered entities to disclose PHI to workers' compensation insurers, State administrators, employers or other persons or entities involved in the workers' compensation system without the individual's authorization: • As authorized and to the extent necessary to comply with laws relating to workers' compensation or similar programs established by law that provide benefits for work-related injuries or illness without regard to fault. 45 C.F.R. §164.512(l). • To the extent disclosure is required by State or other law. The disclosure must comply with and be limited to what the law requires. 45 C.F.R. §164.512(a). • For purposes of obtaining payment for any health care provided to an injured or ill worker. 45 C.F.R. §164.502(a)(1)(ii). Disclosures with Authorization. The Privacy Rule permits covered entities to disclose other PHI (in addition to or different than PHI the entities are required by law or Commission rules to disclose) to workers' compensation insurers, State administrators, employers or other persons or entities involved in the workers' compensation system when the individual has provided authorization for the release of the information to that entity. The authorization must contain the elements and meet the requirements of 45 C.F.R. §164.508. 1 Only the Minimum Necessary Required. Generally, the Privacy Rule requires covered entities to reasonably limit the amount of PHI disclosed under 45 C.F.R. §164.512(l) to the minimum necessary to accomplish the purpose for which the information is disclosed. When disclosing PHI as required by Arkansas workers' compensation or other law, or pursuant to an individual's authorization, however, covered entities are not required to make a minimum necessary determination 45 C.F.R. §164.502(b). Privacy Rules Under the Arkansas Workers' Compensation Act. Though the Commission is not required to comply with the HIPAA privacy provisions, the Commission is committed to protecting each injured worker's medical privacy. It is the Commission’s policy to keep confidential an injured worker's claim file information, including information that could be used to identify an injured worker, whenever possible. Privacy Notice Requirements. HIPAA regulations require covered entities to publish a privacy notice informing patients of the covered entity's policies regarding the release of PHI. The Commission recommends system participants include in their privacy notice that Arkansas state law requires, and federal law allows, use and disclosure of PHI to the Commission, workers' compensation insurers, employers, or other entities involved in the administration of workers' compensation benefits without an individual's authorization. Business Associate Contracts. HIPAA requires covered entities to obtain Business Associate contracts with "business associates," as defined by 45 C.F.R. §160.103. The Commission and system participants, however, are not required to enter into business associate contracts for the disclosure of PHI required by the Arkansas Workers' Compensation Act and Commission administrative rules because HIPAA exempts such disclosures from the Privacy Rules. This Advisory is not intended as legal advice. If you have concerns or questions about HIPAA compliance, please call Jennifer Love at AWCC at (501) 682-3930. Mike Pickens Julie Benafield Bowman Arkansas Insurance Commissioner Chief Executive Officer Arkansas Workers’ Compensation Commission 2